@rogatio/cli 1.9.0 → 2.0.0

package/dist/node/index.js

@@ -14,6 +14,1160 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// packages/schema/dist/node/index.js
+import { Ajv2020 } from "ajv/dist/2020.js";
+function hasControl(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+function formatSha256(hex) {
+  return `sha256:${hex}`;
+}
+function isSha256Digest(value) {
+  return /^sha256:[0-9a-f]{64}$/.test(value);
+}
+function isForbiddenHeader(name, direction) {
+  const normalized = name.toLowerCase();
+  const forbidden = direction === "request" ? FORBIDDEN_REQUEST_HEADERS : FORBIDDEN_RESPONSE_HEADERS;
+  return forbidden.includes(normalized) || direction === "request" && FORBIDDEN_REQUEST_PREFIXES.some(
+    (prefix) => normalized.startsWith(prefix)
+  );
+}
+function normalizeSiteOrigin(value) {
+  if (typeof value !== "string" || value.length === 0 || value.trim() !== value)
+    return null;
+  if (value.includes("?") || value.includes("#")) return null;
+  const match = /^(https?):\/\/([^/?#\\\s]+)(\/)?$/i.exec(value);
+  if (!match || match[2].includes("@")) return null;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (url.origin === "null" || url.hostname.length === 0) return null;
+  if (url.username.length > 0 || url.password.length > 0) return null;
+  if (url.hostname.includes("*")) return null;
+  if (url.hostname.endsWith(".")) return null;
+  if (url.pathname !== "/") return null;
+  return url.origin;
+}
+function isSiteOrigin(value) {
+  return typeof value === "string" && normalizeSiteOrigin(value) !== null;
+}
+function compileUrlRegex(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > LIMITS.maxUrlRegexLength)
+    return null;
+  try {
+    return new RegExp(value);
+  } catch {
+    return null;
+  }
+}
+function ajvIssues(errors) {
+  return (errors ?? []).map((error) => ({
+    instancePath: error.instancePath,
+    keyword: error.keyword,
+    message: error.message ?? "validation failed",
+    params: error.params
+  }));
+}
+function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
+  if (value === null || typeof value !== "object") {
+    return { valid: true, value };
+  }
+  if (ancestors.has(value)) return { valid: false };
+  ancestors.add(value);
+  try {
+    if (Object.getOwnPropertySymbols(value).length > 0) {
+      return { valid: false };
+    }
+    if (Array.isArray(value)) {
+      const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+      if (lengthDescriptor === void 0 || !("value" in lengthDescriptor) || !Number.isSafeInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > LIMITS.maxRulesPerProject) {
+        return { valid: false };
+      }
+      const length = lengthDescriptor.value;
+      for (const propertyName of Object.getOwnPropertyNames(value)) {
+        if (propertyName === "length") continue;
+        const index = Number(propertyName);
+        if (!Number.isInteger(index) || index < 0 || index >= length || String(index) !== propertyName) {
+          return { valid: false };
+        }
+      }
+      const snapshot2 = new Array(length);
+      for (let index = 0; index < length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(
+          value,
+          String(index)
+        );
+        if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
+          return { valid: false };
+        }
+        const child = snapshotOwnData(descriptor.value, ancestors);
+        if (!child.valid) return child;
+        snapshot2[index] = child.value;
+      }
+      return { valid: true, value: snapshot2 };
+    }
+    const snapshot = /* @__PURE__ */ Object.create(null);
+    for (const key of Object.getOwnPropertyNames(value)) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
+        return { valid: false };
+      }
+      const child = snapshotOwnData(descriptor.value, ancestors);
+      if (!child.valid) return child;
+      Object.defineProperty(snapshot, key, {
+        configurable: true,
+        enumerable: true,
+        value: child.value,
+        writable: true
+      });
+    }
+    return { valid: true, value: snapshot };
+  } catch {
+    return { valid: false };
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function semanticIssues(project) {
+  const issues = [];
+  const ids = /* @__PURE__ */ new Map();
+  let ruleCount = 0;
+  for (let groupIndex = 0; groupIndex < project.groups.length; groupIndex += 1) {
+    const group = project.groups[groupIndex];
+    const groupPath = `/groups/${groupIndex}`;
+    const existingGroup = ids.get(group.id);
+    if (existingGroup) {
+      issues.push({
+        instancePath: `${groupPath}/id`,
+        keyword: "uniqueId",
+        message: `must be unique; already used at ${existingGroup}`,
+        params: { previousPath: existingGroup }
+      });
+    } else {
+      ids.set(group.id, `${groupPath}/id`);
+    }
+    for (let ruleIndex = 0; ruleIndex < group.rules.length; ruleIndex += 1) {
+      let hasLoneSurrogate22 = function(value) {
+        for (let i = 0; i < value.length; i += 1) {
+          const code = value.charCodeAt(i);
+          if (code >= 55296 && code <= 56319) {
+            if (i + 1 >= value.length) return true;
+            const next = value.charCodeAt(i + 1);
+            if (next < 56320 || next > 57343) return true;
+          } else if (code >= 56320 && code <= 57343) {
+            if (i === 0) return true;
+            const prev = value.charCodeAt(i - 1);
+            if (prev < 55296 || prev > 56319) return true;
+          }
+        }
+        return false;
+      };
+      var hasLoneSurrogate3 = hasLoneSurrogate22;
+      const rule = group.rules[ruleIndex];
+      ruleCount += 1;
+      const rulePath = `${groupPath}/rules/${ruleIndex}`;
+      const existingRule = ids.get(rule.id);
+      if (existingRule) {
+        issues.push({
+          instancePath: `${rulePath}/id`,
+          keyword: "uniqueId",
+          message: `must be unique; already used at ${existingRule}`,
+          params: { previousPath: existingRule }
+        });
+      } else {
+        ids.set(rule.id, `${rulePath}/id`);
+      }
+      if (rule.type !== void 0 && rule.type !== "redirect" && rule.type !== "query" && rule.type !== "header" && rule.type !== "mock" && rule.type !== "response-body" && rule.type !== "request-body") {
+        issues.push({
+          instancePath: `${rulePath}/type`,
+          keyword: "enum",
+          message: 'must be "redirect", "query", "header", "mock", "response-body", or "request-body"',
+          params: {
+            allowedValues: [
+              "redirect",
+              "query",
+              "header",
+              "mock",
+              "response-body",
+              "request-body"
+            ]
+          }
+        });
+      }
+      if (rule.type === "redirect") {
+        const destination = rule.redirect !== void 0 ? rule.redirect.destination : void 0;
+        if (rule.redirect === void 0 || typeof destination !== "string") {
+          issues.push({
+            instancePath: `${rulePath}/redirect/destination`,
+            keyword: "required",
+            message: "Redirect rules require a destination string.",
+            params: {}
+          });
+        } else {
+          for (const issue of validateRedirectDestination(
+            destination,
+            rule.urlRegex
+          )) {
+            issues.push({
+              instancePath: `${rulePath}/redirect/destination`,
+              keyword: issue.code,
+              message: issue.message,
+              params: {}
+            });
+          }
+        }
+      }
+      const effectiveOrigins = /* @__PURE__ */ new Set();
+      for (let originIndex = 0; originIndex < group.origins.length; originIndex += 1) {
+        const origin = normalizeSiteOrigin(group.origins[originIndex]);
+        if (origin !== null) effectiveOrigins.add(origin);
+      }
+      for (let originIndex = 0; originIndex < rule.origins.length; originIndex += 1) {
+        const origin = normalizeSiteOrigin(rule.origins[originIndex]);
+        if (origin !== null) effectiveOrigins.add(origin);
+      }
+      if (effectiveOrigins.size === 0) {
+        issues.push({
+          instancePath: `${rulePath}/origins`,
+          keyword: "effectiveOrigin",
+          message: "must combine with group origins to contain at least one origin",
+          params: {}
+        });
+      }
+      const action = rule.action;
+      if (action && "type" in action && action.type === "query") {
+        const seenNames = /* @__PURE__ */ new Set();
+        for (let p = 0; p < action.params.length; p += 1) {
+          const param = action.params[p];
+          if (!param) continue;
+          const paramName = param.name;
+          if (seenNames.has(paramName)) {
+            issues.push({
+              instancePath: `${rulePath}/action/params/${p}/name`,
+              keyword: "uniqueQueryParamName",
+              message: `query param name must be unique; duplicate "${paramName}"`,
+              params: { name: paramName }
+            });
+          } else {
+            seenNames.add(paramName);
+          }
+        }
+      }
+      if (rule.type === "header" && rule.headerName !== void 0) {
+        const direction = rule.headerDirection ?? "request";
+        if (isForbiddenHeader(rule.headerName, direction)) {
+          issues.push({
+            instancePath: `${rulePath}/headerName`,
+            keyword: "forbiddenHeader",
+            message: `Header "${rule.headerName}" is forbidden for ${direction} headers.`,
+            params: {
+              headerName: rule.headerName,
+              headerDirection: direction
+            }
+          });
+        }
+      }
+      if (rule.type === "response-body") {
+        const action2 = rule.responseBody;
+        const actionPath = `${rulePath}/responseBody`;
+        if (!action2 || !Array.isArray(action2.replacements) || action2.replacements.length === 0) {
+          issues.push({
+            instancePath: `${actionPath}/replacements`,
+            keyword: "response-body-replacements",
+            message: "A response-body rule must define at least one replacement.",
+            params: {}
+          });
+        } else {
+          for (let index = 0; index < action2.replacements.length; index += 1) {
+            const replacement = action2.replacements[index];
+            if (compileUrlRegex(replacement.pattern) === null) {
+              issues.push({
+                instancePath: `${actionPath}/replacements/${index}/pattern`,
+                keyword: "response-body-pattern",
+                message: "Response-body replacement patterns must be valid regular expressions.",
+                params: {}
+              });
+            }
+          }
+        }
+      }
+      if (rule.type === "request-body") {
+        const action2 = rule.requestBody;
+        const actionPath = `${rulePath}/requestBody`;
+        if (!action2) {
+          issues.push({
+            instancePath: actionPath,
+            keyword: "request-body-action",
+            message: "A request-body rule must define a requestBody action.",
+            params: {}
+          });
+        } else {
+          const mode = action2.mode;
+          if (mode !== "replace" && mode !== "regex") {
+            issues.push({
+              instancePath: `${actionPath}/mode`,
+              keyword: "request-body-mode",
+              message: 'requestBody.mode must be "replace" or "regex"',
+              params: { mode }
+            });
+          }
+          if (action2.mode === "replace") {
+            if (typeof action2.body !== "string") {
+              issues.push({
+                instancePath: `${actionPath}/body`,
+                keyword: "request-body-replace-body",
+                message: "Replace mode requires a body string.",
+                params: {}
+              });
+            } else if (action2.body.length > LIMITS.maxRequestBodyBytes) {
+              issues.push({
+                instancePath: `${actionPath}/body`,
+                keyword: "request-body-replace-body",
+                message: `Replace body exceeds the maximum size of ${LIMITS.maxRequestBodyBytes} bytes.`,
+                params: { limit: LIMITS.maxRequestBodyBytes }
+              });
+            } else if (hasLoneSurrogate22(action2.body)) {
+              issues.push({
+                instancePath: `${actionPath}/body`,
+                keyword: "request-body-lone-surrogate",
+                message: "Replace body must not contain lone UTF-16 surrogates.",
+                params: {}
+              });
+            }
+          }
+          if (action2.mode === "regex") {
+            if (typeof action2.pattern !== "string" || action2.pattern.length === 0) {
+              issues.push({
+                instancePath: `${actionPath}/pattern`,
+                keyword: "request-body-pattern",
+                message: "Regex mode requires a non-empty pattern string.",
+                params: {}
+              });
+            } else if (action2.pattern.length > LIMITS.maxRequestBodyPatternLength) {
+              issues.push({
+                instancePath: `${actionPath}/pattern`,
+                keyword: "request-body-pattern",
+                message: `Regex pattern exceeds the maximum length of ${LIMITS.maxRequestBodyPatternLength} characters.`,
+                params: { limit: LIMITS.maxRequestBodyPatternLength }
+              });
+            } else if (compileUrlRegex(action2.pattern) === null) {
+              issues.push({
+                instancePath: `${actionPath}/pattern`,
+                keyword: "request-body-pattern",
+                message: "Regex pattern must be a valid regular expression.",
+                params: {}
+              });
+            }
+            if (typeof action2.replacement !== "string" || action2.replacement.length > LIMITS.maxRequestBodyReplacementLength) {
+              issues.push({
+                instancePath: `${actionPath}/replacement`,
+                keyword: "request-body-replacement",
+                message: `Regex replacement exceeds the maximum length of ${LIMITS.maxRequestBodyReplacementLength} characters.`,
+                params: { limit: LIMITS.maxRequestBodyReplacementLength }
+              });
+            } else if (hasLoneSurrogate22(action2.pattern)) {
+              issues.push({
+                instancePath: `${actionPath}/pattern`,
+                keyword: "request-body-lone-surrogate",
+                message: "Regex pattern must not contain lone UTF-16 surrogates.",
+                params: {}
+              });
+            } else if (hasLoneSurrogate22(action2.replacement)) {
+              issues.push({
+                instancePath: `${actionPath}/replacement`,
+                keyword: "request-body-lone-surrogate",
+                message: "Regex replacement must not contain lone UTF-16 surrogates.",
+                params: {}
+              });
+            }
+          }
+        }
+        if (rule.method !== "POST" && rule.method !== "PUT" && rule.method !== "PATCH") {
+          issues.push({
+            instancePath: `${rulePath}/method`,
+            keyword: "request-body-method",
+            message: 'Request-body rules require method "POST", "PUT", or "PATCH".',
+            params: { method: rule.method }
+          });
+        }
+        const resourceTypes = rule.resourceTypes;
+        if (!Array.isArray(resourceTypes) || resourceTypes.length !== 1 || resourceTypes[0] !== "xmlhttprequest") {
+          issues.push({
+            instancePath: `${rulePath}/resourceTypes`,
+            keyword: "request-body-resource-types",
+            message: 'Request-body rules require exactly one resource type: "xmlhttprequest".',
+            params: { resourceTypes }
+          });
+        }
+      }
+      if (rule.type === "mock") {
+        const mock = rule.mock;
+        const mockPath = `${rulePath}/mock`;
+        const bodySet = mock?.body !== void 0;
+        const fileSet = mock?.file !== void 0;
+        if (bodySet === fileSet) {
+          issues.push({
+            instancePath: mockPath,
+            keyword: "mock-body-source",
+            message: "A mock rule must set exactly one of body or file.",
+            params: {}
+          });
+        }
+        if (mock?.headers !== void 0) {
+          for (let h = 0; h < mock.headers.length; h += 1) {
+            const header = mock.headers[h];
+            if (header === void 0) continue;
+            if (hasControl(header.name) || header.name.includes(":")) {
+              issues.push({
+                instancePath: `${mockPath}/headers/${h}/name`,
+                keyword: "mock-header-name",
+                message: "Mock header names must not contain control characters or ':'.",
+                params: {}
+              });
+            }
+          }
+        }
+        if (mock?.file !== void 0 && hasControl(mock.file)) {
+          issues.push({
+            instancePath: `${mockPath}/file`,
+            keyword: "mock-file-path",
+            message: "Mock file paths must not contain control characters.",
+            params: {}
+          });
+        }
+      }
+    }
+  }
+  if (project.requestBodyPolicy !== void 0) {
+    const policy = project.requestBodyPolicy;
+    if (typeof policy.localOrigins !== "undefined") {
+      if (!Array.isArray(policy.localOrigins)) {
+        issues.push({
+          instancePath: "/requestBodyPolicy/localOrigins",
+          keyword: "request-body-policy-local-origins",
+          message: "localOrigins must be an array.",
+          params: {}
+        });
+      } else {
+        const seen = /* @__PURE__ */ new Set();
+        for (let i = 0; i < policy.localOrigins.length; i += 1) {
+          const origin = policy.localOrigins[i];
+          if (typeof origin !== "string") {
+            issues.push({
+              instancePath: `/requestBodyPolicy/localOrigins/${i}`,
+              keyword: "request-body-policy-local-origin",
+              message: "Each local origin must be a string.",
+              params: {}
+            });
+            continue;
+          }
+          const normalized = normalizeSiteOrigin(origin);
+          if (normalized === null) {
+            issues.push({
+              instancePath: `/requestBodyPolicy/localOrigins/${i}`,
+              keyword: "request-body-policy-local-origin",
+              message: "Each local origin must be a valid exact HTTP(S) origin with no credentials, path, query, fragment, wildcard, backslash, invalid port, or trailing-dot hostname.",
+              params: { origin }
+            });
+          } else if (seen.has(normalized)) {
+            issues.push({
+              instancePath: `/requestBodyPolicy/localOrigins/${i}`,
+              keyword: "request-body-policy-local-origin",
+              message: "Local origins must be unique.",
+              params: { origin: normalized }
+            });
+          } else {
+            seen.add(normalized);
+          }
+        }
+        if (policy.localOrigins.length > LIMITS.maxLocalOrigins) {
+          issues.push({
+            instancePath: "/requestBodyPolicy/localOrigins",
+            keyword: "request-body-policy-local-origins",
+            message: `localOrigins must contain at most ${LIMITS.maxLocalOrigins} entries.`,
+            params: { limit: LIMITS.maxLocalOrigins }
+          });
+        }
+      }
+    }
+  }
+  if (ruleCount > LIMITS.maxRulesPerProject) {
+    issues.push({
+      instancePath: "/groups",
+      keyword: "maxRulesPerProject",
+      message: `must contain at most ${LIMITS.maxRulesPerProject} rules in total`,
+      params: { limit: LIMITS.maxRulesPerProject, actual: ruleCount }
+    });
+  }
+  return issues;
+}
+function skipBalancedGroup(source, start) {
+  let depth = 0;
+  let index = start;
+  const length = source.length;
+  while (index < length) {
+    const char = source[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")") {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+    index += 1;
+  }
+  return length;
+}
+function countCapturingGroups(urlRegex) {
+  let count = 0;
+  let index = 0;
+  const length = urlRegex.length;
+  while (index < length) {
+    const char = urlRegex[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === "(") {
+      if (urlRegex[index + 1] === "?") {
+        index = skipBalancedGroup(urlRegex, index);
+        continue;
+      }
+      count += 1;
+    }
+    index += 1;
+  }
+  return count;
+}
+function validateRedirectDestination(destination, urlRegex) {
+  const issues = [];
+  if (typeof destination !== "string" || destination.length === 0) {
+    issues.push({
+      code: "schema.required",
+      message: "Redirect destination must be a non-empty string."
+    });
+    return issues;
+  }
+  if (destination.length > LIMITS.maxRedirectDestinationLength) {
+    issues.push({
+      code: "schema.out-of-range",
+      message: `Redirect destination must be at most ${LIMITS.maxRedirectDestinationLength} characters.`
+    });
+    return issues;
+  }
+  let url;
+  try {
+    url = new URL(destination);
+  } catch {
+    issues.push({
+      code: "schema.invalid-format",
+      message: "Redirect destination must be an absolute URL."
+    });
+    return issues;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    issues.push({
+      code: "schema.invalid-value",
+      message: "Redirect destination must use the http or https scheme."
+    });
+    return issues;
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    issues.push({
+      code: "schema.invalid-value",
+      message: "Redirect destination must not contain credentials."
+    });
+    return issues;
+  }
+  if (url.hostname.length === 0 || url.hostname.includes("*")) {
+    issues.push({
+      code: "schema.invalid-format",
+      message: "Redirect destination must have a valid host."
+    });
+    return issues;
+  }
+  const groups = countCapturingGroups(urlRegex);
+  const backreference = /\\([1-9])/g;
+  let match = backreference.exec(destination);
+  while (match !== null) {
+    const referenced = Number(match[1]);
+    if (referenced > groups) {
+      issues.push({
+        code: "schema.invalid-value",
+        message: `Redirect destination references capture group ${referenced} but the URL pattern defines ${groups}.`
+      });
+    }
+    match = backreference.exec(destination);
+  }
+  return issues;
+}
+function validateProjectDetailed(value) {
+  const snapshot = snapshotOwnData(value);
+  if (!snapshot.valid) {
+    return {
+      valid: false,
+      errors: [
+        {
+          instancePath: "",
+          keyword: "ownProperties",
+          message: "must contain only own array entries",
+          params: {}
+        }
+      ]
+    };
+  }
+  if (!projectValidator(snapshot.value)) {
+    return { valid: false, errors: ajvIssues(projectValidator.errors) };
+  }
+  const errors = semanticIssues(snapshot.value);
+  return errors.length > 0 ? { valid: false, errors } : { valid: true, data: value };
+}
+var FORBIDDEN_REQUEST_HEADERS, FORBIDDEN_RESPONSE_HEADERS, FORBIDDEN_REQUEST_PREFIXES, LIMITS, PROJECT_VERSION, RESOURCE_TYPES, HTTP_METHODS, label, id, projectSchemaDefinition, projectSchema, ajv, compiledProjectValidator, ownArrayEntriesError, guardedProjectValidator, projectValidator;
+var init_node = __esm({
+  "packages/schema/dist/node/index.js"() {
+    "use strict";
+    FORBIDDEN_REQUEST_HEADERS = Object.freeze([
+      "accept-charset",
+      "accept-encoding",
+      "access-control-request-headers",
+      "access-control-request-method",
+      "connection",
+      "content-length",
+      "cookie",
+      "cookie2",
+      "date",
+      "dnt",
+      "expect",
+      "host",
+      "keep-alive",
+      "origin",
+      "proxy-authenticate",
+      "proxy-authorization",
+      "te",
+      "trailer",
+      "transfer-encoding",
+      "upgrade",
+      "via"
+    ]);
+    FORBIDDEN_RESPONSE_HEADERS = Object.freeze([
+      "connection",
+      "content-encoding",
+      "content-length",
+      "date",
+      "keep-alive",
+      "proxy-authenticate",
+      "proxy-authorization",
+      "set-cookie",
+      "set-cookie2",
+      "te",
+      "trailer",
+      "transfer-encoding",
+      "upgrade",
+      "via"
+    ]);
+    FORBIDDEN_REQUEST_PREFIXES = Object.freeze(["proxy-", "sec-"]);
+    LIMITS = Object.freeze({
+      maxGroups: 64,
+      maxRulesPerGroup: 256,
+      maxRulesPerProject: 4096,
+      maxOriginsPerScope: 32,
+      maxIdLength: 64,
+      maxLabelLength: 100,
+      maxDescriptionLength: 1e3,
+      maxUrlRegexLength: 2048,
+      maxResourceTypesPerRule: 16,
+      minPriority: 1,
+      maxPriority: 1e3,
+      maxRedirectDestinationLength: 2048,
+      maxCaptureGroups: 9,
+      maxQueryParamsPerRule: 64,
+      maxQueryNameLength: 256,
+      maxQueryValueLength: 2048,
+      maxHeaderNameLength: 256,
+      maxHeaderValueLength: 4096,
+      minMockStatus: 200,
+      maxMockStatus: 599,
+      maxMockHeadersPerRule: 32,
+      maxMockHeaderNameLength: 256,
+      maxMockHeaderValueLength: 4096,
+      maxMockInlineBodyLength: 65536,
+      maxMockDelayMs: 3e4,
+      maxMockFilePathLength: 2048,
+      maxResponseBodyReplacements: 64,
+      maxResponseBodyPatternLength: 2048,
+      maxResponseBodyReplacementLength: 4096,
+      maxRequestBodyBytes: 4 * 1024 * 1024,
+      maxRequestBodyPatternLength: 2048,
+      maxRequestBodyReplacementLength: 4096,
+      maxRequestBodyOperations: 32,
+      maxLocalOrigins: 32
+    });
+    PROJECT_VERSION = 1;
+    RESOURCE_TYPES = Object.freeze([
+      "main_frame",
+      "sub_frame",
+      "stylesheet",
+      "script",
+      "image",
+      "font",
+      "object",
+      "media",
+      "xmlhttprequest",
+      "ping",
+      "csp_report",
+      "websocket",
+      "webtransport",
+      "webbundle",
+      "other"
+    ]);
+    HTTP_METHODS = Object.freeze([
+      "GET",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE",
+      "HEAD",
+      "OPTIONS",
+      "CONNECT",
+      "TRACE"
+    ]);
+    label = {
+      type: "string",
+      minLength: 1,
+      maxLength: LIMITS.maxLabelLength,
+      pattern: "\\S"
+    };
+    id = {
+      type: "string",
+      minLength: 1,
+      maxLength: LIMITS.maxIdLength,
+      pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+    };
+    projectSchemaDefinition = {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      $id: "https://rogatio.dev/schema/project-v1.json",
+      type: "object",
+      additionalProperties: false,
+      required: ["version", "name", "groups"],
+      properties: {
+        version: { type: "integer", const: PROJECT_VERSION },
+        name: label,
+        description: {
+          type: "string",
+          maxLength: LIMITS.maxDescriptionLength
+        },
+        groups: {
+          type: "array",
+          maxItems: LIMITS.maxGroups,
+          items: { $ref: "#/$defs/group" }
+        },
+        requestBodyPolicy: { $ref: "#/$defs/requestBodyPolicyConfig" }
+      },
+      $defs: {
+        group: {
+          type: "object",
+          additionalProperties: false,
+          required: ["id", "name", "origins", "rules"],
+          properties: {
+            id,
+            name: label,
+            origins: {
+              type: "array",
+              maxItems: LIMITS.maxOriginsPerScope,
+              uniqueItems: true,
+              items: { type: "string", format: "rogatio-origin" }
+            },
+            rules: {
+              type: "array",
+              maxItems: LIMITS.maxRulesPerGroup,
+              items: { $ref: "#/$defs/rule" }
+            }
+          }
+        },
+        rule: {
+          type: "object",
+          additionalProperties: false,
+          required: [
+            "id",
+            "name",
+            "urlRegex",
+            "origins",
+            "resourceTypes",
+            "priority"
+          ],
+          properties: {
+            id,
+            name: label,
+            urlRegex: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxUrlRegexLength,
+              format: "rogatio-url-regex"
+            },
+            origins: {
+              type: "array",
+              maxItems: LIMITS.maxOriginsPerScope,
+              uniqueItems: true,
+              items: { type: "string", format: "rogatio-origin" }
+            },
+            resourceTypes: {
+              type: "array",
+              minItems: 1,
+              maxItems: LIMITS.maxResourceTypesPerRule,
+              uniqueItems: true,
+              items: { type: "string", enum: [...RESOURCE_TYPES] }
+            },
+            priority: {
+              type: "integer",
+              minimum: LIMITS.minPriority,
+              maximum: LIMITS.maxPriority
+            },
+            method: { type: "string", enum: [...HTTP_METHODS] },
+            type: {
+              type: "string",
+              enum: [
+                "redirect",
+                "query",
+                "header",
+                "mock",
+                "response-body",
+                "request-body"
+              ]
+            },
+            redirect: {
+              type: "object",
+              additionalProperties: false,
+              required: ["destination"],
+              properties: {
+                destination: { type: "string" }
+              }
+            },
+            action: { $ref: "#/$defs/queryAction" },
+            headerDirection: { type: "string", enum: ["request", "response"] },
+            headerOperation: { type: "string", enum: ["set", "append", "remove"] },
+            headerName: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxHeaderNameLength
+            },
+            headerValue: {
+              type: "string",
+              maxLength: LIMITS.maxHeaderValueLength
+            },
+            mock: { $ref: "#/$defs/mockAction" },
+            responseBody: { $ref: "#/$defs/responseBodyAction" },
+            requestBody: { $ref: "#/$defs/requestBodyAction" }
+          },
+          allOf: [
+            {
+              if: {
+                required: ["type"],
+                properties: { type: { const: "redirect" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["redirect"]
+              }
+            },
+            {
+              if: {
+                required: ["type"],
+                properties: { type: { const: "query" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["action"]
+              }
+            },
+            {
+              if: {
+                required: ["type"],
+                properties: { type: { const: "header" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["headerDirection", "headerOperation", "headerName"]
+              }
+            },
+            {
+              if: {
+                required: ["type"],
+                properties: { type: { const: "mock" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["mock"]
+              }
+            },
+            {
+              if: {
+                required: ["type"],
+                properties: { type: { const: "response-body" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["responseBody"]
+              }
+            },
+            {
+              if: {
+                required: ["headerOperation"],
+                properties: { headerOperation: { const: "set" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["headerValue"]
+              }
+            },
+            {
+              if: {
+                required: ["headerOperation"],
+                properties: { headerOperation: { const: "append" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["headerValue"]
+              }
+            },
+            {
+              if: {
+                required: ["type"],
+                properties: { type: { const: "response-body" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["responseBody"]
+              }
+            },
+            {
+              if: {
+                required: ["type"],
+                properties: { type: { const: "request-body" } }
+              },
+              // biome-ignore lint/suspicious/noThenProperty: AJV conditional schema keyword
+              then: {
+                required: ["requestBody", "method", "resourceTypes"]
+              }
+            }
+          ]
+        },
+        queryParam: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "value"],
+          properties: {
+            name: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxQueryNameLength
+            },
+            value: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxQueryValueLength
+            }
+          }
+        },
+        queryAction: {
+          type: "object",
+          additionalProperties: false,
+          required: ["type", "params"],
+          properties: {
+            type: { const: "query" },
+            params: {
+              type: "array",
+              minItems: 1,
+              maxItems: LIMITS.maxQueryParamsPerRule,
+              items: { $ref: "#/$defs/queryParam" }
+            }
+          }
+        },
+        mockHeader: {
+          type: "object",
+          additionalProperties: false,
+          required: ["name", "value"],
+          properties: {
+            name: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxMockHeaderNameLength
+            },
+            value: {
+              type: "string",
+              maxLength: LIMITS.maxMockHeaderValueLength
+            }
+          }
+        },
+        mockAction: {
+          type: "object",
+          additionalProperties: false,
+          required: ["status"],
+          properties: {
+            status: {
+              type: "integer",
+              minimum: LIMITS.minMockStatus,
+              maximum: LIMITS.maxMockStatus
+            },
+            headers: {
+              type: "array",
+              maxItems: LIMITS.maxMockHeadersPerRule,
+              items: { $ref: "#/$defs/mockHeader" }
+            },
+            delayMs: {
+              type: "integer",
+              minimum: 0,
+              maximum: LIMITS.maxMockDelayMs
+            },
+            body: {
+              type: "string",
+              maxLength: LIMITS.maxMockInlineBodyLength
+            },
+            file: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxMockFilePathLength
+            }
+          }
+        },
+        responseBodyReplacement: {
+          type: "object",
+          additionalProperties: false,
+          required: ["pattern", "replacement"],
+          properties: {
+            pattern: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxResponseBodyPatternLength,
+              format: "rogatio-url-regex"
+            },
+            replacement: {
+              type: "string",
+              maxLength: LIMITS.maxResponseBodyReplacementLength
+            }
+          }
+        },
+        responseBodyAction: {
+          type: "object",
+          additionalProperties: false,
+          required: ["replacements"],
+          properties: {
+            replacements: {
+              type: "array",
+              minItems: 1,
+              maxItems: LIMITS.maxResponseBodyReplacements,
+              items: { $ref: "#/$defs/responseBodyReplacement" }
+            }
+          }
+        },
+        requestBodyReplaceAction: {
+          type: "object",
+          additionalProperties: false,
+          required: ["mode", "body"],
+          properties: {
+            mode: { const: "replace" },
+            body: {
+              type: "string",
+              maxLength: LIMITS.maxRequestBodyBytes
+            }
+          }
+        },
+        requestBodyRegexAction: {
+          type: "object",
+          additionalProperties: false,
+          required: ["mode", "pattern", "replacement"],
+          properties: {
+            mode: { const: "regex" },
+            pattern: {
+              type: "string",
+              minLength: 1,
+              maxLength: LIMITS.maxRequestBodyPatternLength,
+              format: "rogatio-url-regex"
+            },
+            replacement: {
+              type: "string",
+              maxLength: LIMITS.maxRequestBodyReplacementLength
+            }
+          }
+        },
+        requestBodyAction: {
+          oneOf: [
+            { $ref: "#/$defs/requestBodyReplaceAction" },
+            { $ref: "#/$defs/requestBodyRegexAction" }
+          ]
+        },
+        requestBodyPolicyConfig: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            localOrigins: {
+              type: "array",
+              maxItems: LIMITS.maxLocalOrigins,
+              uniqueItems: true,
+              items: { type: "string", format: "rogatio-origin" }
+            }
+          }
+        }
+      }
+    };
+    projectSchema = projectSchemaDefinition;
+    ajv = new Ajv2020({
+      allErrors: true,
+      coerceTypes: false,
+      removeAdditional: false,
+      useDefaults: false,
+      ownProperties: true,
+      // The redirect `then` clause requires `redirect` via `if/then` while the
+      // property is declared on the enclosing rule, which strictRequired forbids.
+      strictRequired: false
+    });
+    ajv.addFormat("rogatio-origin", {
+      type: "string",
+      validate: isSiteOrigin
+    });
+    ajv.addFormat("rogatio-url-regex", {
+      type: "string",
+      validate: (value) => compileUrlRegex(value) !== null
+    });
+    compiledProjectValidator = ajv.compile(projectSchema);
+    ownArrayEntriesError = {
+      instancePath: "",
+      keyword: "ownProperties",
+      message: "must contain only own array entries",
+      params: {},
+      schemaPath: ""
+    };
+    guardedProjectValidator = Object.assign(
+      (value) => {
+        const snapshot = snapshotOwnData(value);
+        if (!snapshot.valid) {
+          guardedProjectValidator.errors = [ownArrayEntriesError];
+          return false;
+        }
+        const valid = compiledProjectValidator(snapshot.value);
+        guardedProjectValidator.errors = compiledProjectValidator.errors ?? null;
+        return valid;
+      },
+      {
+        errors: null,
+        schema: compiledProjectValidator.schema,
+        schemaEnv: compiledProjectValidator.schemaEnv
+      }
+    );
+    projectValidator = guardedProjectValidator;
+  }
+});
+
 // packages/runtime/dist/node/index.js
 var node_exports = {};
 __export(node_exports, {
@@ -88,42 +1242,22 @@ __export(node_exports, {
   verifyMarker: () => verifyMarker
 });
 import { isIP } from "node:net";
-import { HTTP_METHODS as HTTP_METHODS2 } from "@rogatio/schema";
-import { hasControl } from "@rogatio/schema";
 import { isIP as isIP2 } from "node:net";
-import { hasControl as hasControl2, normalizeSiteOrigin } from "@rogatio/schema";
 import { constants } from "node:fs";
 import { realpath } from "node:fs/promises";
 import { isAbsolute, relative } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
 import { createServer as createServer2 } from "node:http";
 import { createHash, randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import { isSha256Digest } from "@rogatio/schema";
-import { normalizeSiteOrigin as normalizeSiteOrigin2 } from "@rogatio/schema";
 import { randomBytes as randomBytes22 } from "node:crypto";
 import { readFile as readFile3, realpath as realpath2, stat } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3, sep } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve4, sep } from "node:path";
 import { lookup as dnsLookup } from "node:dns/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { createHash as createHash2 } from "node:crypto";
-import {
-  compileUrlRegex as compileUrlRegex2,
-  HTTP_METHODS as HTTP_METHODS22,
-  hasControl as hasControl3,
-  LIMITS,
-  normalizeSiteOrigin as normalizeSiteOrigin3,
-  RESOURCE_TYPES as RESOURCE_TYPES2
-} from "@rogatio/schema";
 import { createHash as createHash3 } from "node:crypto";
-import { formatSha256 } from "@rogatio/schema";
 import { Worker } from "node:worker_threads";
-import { LIMITS as LIMITS2 } from "@rogatio/schema";
-import { LIMITS as LIMITS3 } from "@rogatio/schema";
-import {
-  compileUrlRegex as compileUrlRegex22,
-  normalizeSiteOrigin as normalizeSiteOrigin4
-} from "@rogatio/schema";
 import {
   createPrivateKey,
   createSign,
@@ -132,7 +1266,7 @@ import {
 } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { mkdir as mkdir2, readFile as readFile22, rename as rename2, rm, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname2, isAbsolute as isAbsolute3, join as join2, relative as relative3 } from "node:path";
+import { basename as basename3, dirname as dirname3, isAbsolute as isAbsolute3, join as join2, relative as relative3 } from "node:path";
 import { generateKeyPairSync as generateKeyPairSync2 } from "node:crypto";
 function parseIPv4(value) {
   const parts = value.split(".");
@@ -284,7 +1418,7 @@ function normalizeLogicalPath(value) {
   }
   return parts.join("/");
 }
-function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
+function snapshotOwnData3(value, ancestors = /* @__PURE__ */ new WeakSet()) {
   if (value === null || typeof value !== "object") {
     return { valid: true, value };
   }
@@ -316,7 +1450,7 @@ function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
         if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
           return { valid: false };
         }
-        const child = snapshotOwnData(descriptor.value, ancestors);
+        const child = snapshotOwnData3(descriptor.value, ancestors);
         if (!child.valid) return child;
         snapshot2[index] = child.value;
       }
@@ -330,7 +1464,7 @@ function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
       if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
         return { valid: false };
       }
-      const child = snapshotOwnData(descriptor.value, ancestors);
+      const child = snapshotOwnData3(descriptor.value, ancestors);
       if (!child.valid) return child;
       Object.defineProperty(snapshot, key, {
         configurable: true,
@@ -381,11 +1515,11 @@ function validHostname(hostname) {
   if (unbracketed.includes("%") || unbracketed.endsWith(".")) return false;
   if (isIP2(unbracketed) !== 0) return true;
   if (unbracketed.length === 0 || unbracketed.length > 253) return false;
-  return unbracketed.split(".").every((label) => ID_PATTERN.test(label));
+  return unbracketed.split(".").every((label2) => ID_PATTERN.test(label2));
 }
 function canonicalizeOutboundTarget(value) {
   if (typeof value !== "string" || value.length === 0) return null;
-  if (value.trim() !== value || hasControl2(value)) return null;
+  if (value.trim() !== value || hasControl(value)) return null;
   if (value.includes("\\") || value.includes("#")) return null;
   if (!hasValidPercentEncoding(value)) return null;
   if (/%(?:2f|2F|5c|5C)/.test(value)) return null;
@@ -422,13 +1556,13 @@ function isOriginAllowed(target, origins) {
   return origin !== null && origins.includes(origin);
 }
 function validMethod(value) {
-  return typeof value === "string" && HTTP_METHODS2.includes(value);
+  return typeof value === "string" && HTTP_METHODS.includes(value);
 }
 function validId(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(value);
 }
 function exactDescriptor(value) {
-  const snapshot = snapshotOwnData(value);
+  const snapshot = snapshotOwnData3(value);
   if (!snapshot.valid || snapshot.value === null || typeof snapshot.value !== "object" || Array.isArray(snapshot.value))
     return null;
   const record = snapshot.value;
@@ -755,7 +1889,7 @@ function generatePacScript(origins, endpoint, options) {
   }
   const valid = [];
   for (const origin of origins) {
-    const normalized = normalizeSiteOrigin2(origin);
+    const normalized = normalizeSiteOrigin(origin);
     if (normalized !== null) valid.push(normalized);
   }
   const unique = Array.from(new Set(valid)).sort();
@@ -927,7 +2061,7 @@ async function readMockFile(root, logicalPath) {
   if (normalized === null) return failure("runtime.file-denied");
   try {
     const canonicalRoot = await realpath2(root);
-    const candidate = resolve3(canonicalRoot, ...normalized.split("/"));
+    const candidate = resolve4(canonicalRoot, ...normalized.split("/"));
     const actualPath = await realpath2(candidate);
     if (!withinRoot2(canonicalRoot, actualPath))
       return failure("runtime.file-denied");
@@ -1839,14 +2973,14 @@ function validId2(value) {
   return typeof value === "string" && ID_PATTERN2.test(value);
 }
 function validMethod2(value) {
-  return typeof value === "string" && HTTP_METHODS22.includes(value);
+  return typeof value === "string" && HTTP_METHODS.includes(value);
 }
 function normalizeMockHeader(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     return null;
   if (!exactKeys(value, ["name", "value"])) return null;
   const record = value;
-  if (typeof record.name !== "string" || record.name.length === 0 || record.name.length > LIMITS.maxMockHeaderNameLength || hasControl3(record.name) || record.name.includes(":"))
+  if (typeof record.name !== "string" || record.name.length === 0 || record.name.length > LIMITS.maxMockHeaderNameLength || hasControl(record.name) || record.name.includes(":"))
     return null;
   if (typeof record.value !== "string" || record.value.length > LIMITS.maxMockHeaderValueLength)
     return null;
@@ -1894,7 +3028,7 @@ function normalizeMockConfig(value, matcherById) {
   if (bodySet === fileSet) return null;
   if (bodySet && body.length > LIMITS.maxMockInlineBodyLength) return null;
   if (fileSet) {
-    if (file.length === 0 || file.length > LIMITS.maxMockFilePathLength || hasControl3(file))
+    if (file.length === 0 || file.length > LIMITS.maxMockFilePathLength || hasControl(file))
       return null;
   }
   return Object.freeze({
@@ -1907,7 +3041,7 @@ function normalizeMockConfig(value, matcherById) {
   });
 }
 function validResourceType(value) {
-  return typeof value === "string" && RESOURCE_TYPES2.includes(value);
+  return typeof value === "string" && RESOURCE_TYPES.includes(value);
 }
 function freezeMatcher(operation) {
   const matcher = Object.freeze({
@@ -1959,14 +3093,14 @@ function normalizeMatcher(value) {
     return null;
   }
   const regex = regexValue;
-  if (typeof regex.source !== "string" || regex.source.length > LIMITS.maxUrlRegexLength || regex.flags !== "" || compileUrlRegex2(regex.source) === null) {
+  if (typeof regex.source !== "string" || regex.source.length > LIMITS.maxUrlRegexLength || regex.flags !== "" || compileUrlRegex(regex.source) === null) {
     return null;
   }
   if (!Array.isArray(matcher.origins) || matcher.origins.length === 0 || matcher.origins.length > LIMITS.maxOriginsPerScope)
     return null;
   const origins = [];
   for (const value2 of matcher.origins) {
-    const normalized = normalizeSiteOrigin3(value2);
+    const normalized = normalizeSiteOrigin(value2);
     if (normalized === null || origins.includes(normalized)) return null;
     origins.push(normalized);
   }
@@ -1978,7 +3112,7 @@ function normalizeMatcher(value) {
     resourceTypes.push(value2);
   }
   resourceTypes.sort(
-    (left, right) => RESOURCE_TYPES2.indexOf(left) - RESOURCE_TYPES2.indexOf(right)
+    (left, right) => RESOURCE_TYPES.indexOf(left) - RESOURCE_TYPES.indexOf(right)
   );
   if (typeof matcher.priority !== "number" || !Number.isSafeInteger(matcher.priority) || matcher.priority < LIMITS.minPriority || matcher.priority > LIMITS.maxPriority)
     return null;
@@ -2052,7 +3186,7 @@ function makeGrant(value, matcherById) {
   });
 }
 function normalizeRuntimePreset(value) {
-  const snapshot = snapshotOwnData(value);
+  const snapshot = snapshotOwnData3(value);
   if (!snapshot.valid || snapshot.value === null || typeof snapshot.value !== "object" || Array.isArray(snapshot.value)) {
     return failure("runtime.invalid-preset");
   }
@@ -2540,10 +3674,10 @@ async function rewriteRequestBody(input, action) {
     if (action.pattern.length === 0) {
       return failure("runtime.request-body-regex-missing-pattern");
     }
-    if (action.pattern.length > LIMITS2.maxRequestBodyPatternLength) {
+    if (action.pattern.length > LIMITS.maxRequestBodyPatternLength) {
       return failure("runtime.request-body-regex-pattern-too-large");
     }
-    if (action.replacement.length > LIMITS2.maxRequestBodyReplacementLength) {
+    if (action.replacement.length > LIMITS.maxRequestBodyReplacementLength) {
       return failure("runtime.request-body-regex-replacement-too-large");
     }
     if (hasLoneSurrogate2(action.replacement)) {
@@ -2588,7 +3722,7 @@ async function rewriteResponseBody(input, replacements) {
     return failure("runtime.size-limit");
   if (input.contentEncoding !== void 0 && input.contentEncoding !== "identity")
     return failure("runtime.size-limit");
-  if (input.body.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes || replacements.length === 0 || replacements.length > LIMITS3.maxResponseBodyReplacements)
+  if (input.body.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes || replacements.length === 0 || replacements.length > LIMITS.maxResponseBodyReplacements)
     return failure("runtime.size-limit");
   let text;
   try {
@@ -2598,7 +3732,7 @@ async function rewriteResponseBody(input, replacements) {
   }
   try {
     for (const entry of replacements) {
-      if (entry.pattern.length === 0 || entry.pattern.length > LIMITS3.maxResponseBodyPatternLength || entry.replacement.length > LIMITS3.maxResponseBodyReplacementLength)
+      if (entry.pattern.length === 0 || entry.pattern.length > LIMITS.maxResponseBodyPatternLength || entry.replacement.length > LIMITS.maxResponseBodyReplacementLength)
         return failure("runtime.size-limit");
       const regex = new RegExp(entry.pattern, "gu");
       text = text.replace(regex, entry.replacement);
@@ -2643,10 +3777,10 @@ async function fetchAndRewriteAuthorizedResponse(operation, replacements, option
   };
 }
 function originOf(value) {
-  const direct = normalizeSiteOrigin4(value);
+  const direct = normalizeSiteOrigin(value);
   if (direct !== null) return direct;
   try {
-    return normalizeSiteOrigin4(new URL(value).origin);
+    return normalizeSiteOrigin(new URL(value).origin);
   } catch {
     return null;
   }
@@ -2658,11 +3792,11 @@ function projectHasRule(project, groupId, ruleId) {
   return group.rules.some((rule) => rule.id === ruleId);
 }
 function revalidateAuthority(project, operations, request) {
-  const projectSnap = snapshotOwnData(project);
+  const projectSnap = snapshotOwnData3(project);
   if (!projectSnap.valid) return { allowed: false, reason: "project-invalid" };
-  const opsSnap = snapshotOwnData(operations);
+  const opsSnap = snapshotOwnData3(operations);
   if (!opsSnap.valid) return { allowed: false, reason: "project-invalid" };
-  const reqSnap = snapshotOwnData(request);
+  const reqSnap = snapshotOwnData3(request);
   if (!reqSnap.valid) return { allowed: false, reason: "project-invalid" };
   const operation = operations.find(
     (candidate) => candidate.groupId === request.groupId && candidate.ruleId === request.ruleId && "matcher" in candidate
@@ -2678,7 +3812,7 @@ function revalidateAuthority(project, operations, request) {
     return { allowed: false, reason: "project-inconsistent" };
   }
   const matcher = operation.matcher;
-  const regex = compileUrlRegex22(matcher.urlRegex.source);
+  const regex = compileUrlRegex(matcher.urlRegex.source);
   if (regex === null || !regex.test(request.url)) {
     return { allowed: false, reason: "url-mismatch" };
   }
@@ -2858,7 +3992,7 @@ function isWellFormedManifest(value) {
   return typeof m.name === "string" && typeof m.path === "string" && m.type === "stdio" && Array.isArray(m.allowed_origins) && m.allowed_origins.every((o) => typeof o === "string");
 }
 async function writeFileAtomic(path, data) {
-  const dir = dirname2(path);
+  const dir = dirname3(path);
   await mkdir2(dir, { recursive: true });
   const tmp = join2(dir, `.${basename3(path)}.${process.pid}.tmp`);
   await writeFile2(tmp, data, "utf8");
@@ -3025,9 +4159,19 @@ function createRequestBodyTrustController(options = {}) {
   return { install, uninstall, trust, untrust, status };
 }
 var MAX_ARRAY_LENGTH, MAX_OBJECT_PROPERTIES, ID_PATTERN, RUNTIME_LIMITS, RUNTIME_PROTOCOL, PROTOCOL, ENVELOPE_MAX_BYTES, MAX_PAC_ORIGINS, MAX_CONCURRENT_TRANSFORMS, REVALIDATION_INTERVAL_MS, FORBIDDEN_BODY_KEYS, MOCK_BODY_KEY, MOCK_BODY_ALLOWED_TYPES, ENVELOPE_MESSAGE_TYPES, EnvelopeError, TOKEN_BYTES, TOKEN_LENGTH, registeredProvider, currentSession, NATIVE_FRAME_MAX_BYTES, NATIVE_POLICY_MAX_BYTES, NATIVE_POLICY_MAX_FRAMES, NATIVE_POLICY_STAGE_TIMEOUT_MS, NativeFrameType, defaultResolver, defaultTransport, ID_PATTERN2, PRIVATE_RANGES, SUPPORTED_MIME_TYPES, SUPPORTED_MIME_PREFIXES, FORBIDDEN_HEADERS, FORBIDDEN_CONTENT_ENCODINGS, RESERVED_MARKER_PREFIX, MARKER_SEPARATOR, pendingAuths, cachedContext, TRUST_LIMITS, TrustError, ORIGIN_RE, DEFAULT_CAPABILITIES;
-var init_node = __esm({
+var init_node2 = __esm({
   "packages/runtime/dist/node/index.js"() {
     "use strict";
+    init_node();
+    init_node();
+    init_node();
+    init_node();
+    init_node();
+    init_node();
+    init_node();
+    init_node();
+    init_node();
+    init_node();
     MAX_ARRAY_LENGTH = 4096;
     MAX_OBJECT_PROPERTIES = 256;
     ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -3227,12 +4371,11 @@ var init_node = __esm({
 
 // packages/cli/src/index.ts
 import { realpathSync } from "node:fs";
-import { basename as basename4, dirname as dirname4, resolve as resolve7 } from "node:path";
+import { basename as basename4, dirname as dirname5, resolve as resolve8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/cli/src/commands/edit.ts
-import { resolve as resolve2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { resolve as resolve3 } from "node:path";
 
 // packages/cli/src/server/http.ts
 import { randomInt } from "node:crypto";
@@ -3253,11 +4396,11 @@ function createServer(handler, options = {}) {
   let port = null;
   let started = false;
   async function listenOn(candidatePort) {
-    await new Promise((resolve8, reject) => {
+    await new Promise((resolve9, reject) => {
       server.once("error", reject);
       server.listen(candidatePort, "127.0.0.1", () => {
         server.off("error", reject);
-        resolve8();
+        resolve9();
       });
     });
   }
@@ -3312,8 +4455,8 @@ function createServer(handler, options = {}) {
     },
     async stop() {
       if (!started) return;
-      await new Promise((resolve8) => {
-        server.close(() => resolve8());
+      await new Promise((resolve9) => {
+        server.close(() => resolve9());
       });
       started = false;
     }
@@ -3324,10 +4467,360 @@ function createServer(handler, options = {}) {
 import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
-import { compileProject } from "@rogatio/compiler";
+
+// packages/compiler/dist/node/index.js
+init_node();
+init_node();
+var ISSUE_CODES = {
+  required: "schema.required",
+  additionalProperties: "schema.unknown-property",
+  type: "schema.invalid-type",
+  format: "schema.invalid-format",
+  const: "schema.invalid-value",
+  enum: "schema.invalid-value",
+  pattern: "schema.invalid-value",
+  minLength: "schema.out-of-range",
+  maxLength: "schema.out-of-range",
+  minItems: "schema.out-of-range",
+  maxItems: "schema.out-of-range",
+  minimum: "schema.out-of-range",
+  maximum: "schema.out-of-range",
+  uniqueItems: "schema.out-of-range",
+  ownProperties: "schema.invalid-structure",
+  uniqueId: "schema.duplicate-id",
+  effectiveOrigin: "schema.no-effective-origin",
+  maxRulesPerProject: "schema.rule-limit"
+};
+var SAFE_PARAM_KEYS = /* @__PURE__ */ new Set([
+  "additionalProperty",
+  "actual",
+  "allowedValue",
+  "allowedValues",
+  "format",
+  "i",
+  "j",
+  "limit",
+  "missingProperty",
+  "previousPath",
+  "type",
+  "headerName",
+  "headerOperation",
+  "headerDirection"
+]);
+var MESSAGES = {
+  "schema.required": "Required project data is missing.",
+  "schema.unknown-property": "The project contains an unknown property.",
+  "schema.invalid-type": "The project contains a value with an invalid type.",
+  "schema.invalid-format": "The project contains a value with an invalid format.",
+  "schema.invalid-value": "The project contains an invalid value.",
+  "schema.out-of-range": "The project contains a value outside its allowed bounds.",
+  "schema.invalid-structure": "The project contains invalid structure.",
+  "schema.duplicate-id": "Project and rule IDs must be unique.",
+  "schema.no-effective-origin": "Each rule must have at least one effective origin.",
+  "schema.rule-limit": "The project contains too many rules.",
+  "compiler.invariant": "The compiler could not normalize validated project data.",
+  "compiler.forbidden-header": "The header name is forbidden for this direction.",
+  "compiler.header-value-required": "Header value is required for set and append operations.",
+  "compiler.header-value-unexpected": "Header value must not be provided for remove operation.",
+  "compiler.invalid-header-direction": "Invalid header direction.",
+  "compiler.invalid-header-operation": "Invalid header operation."
+};
+function copySafeParams(params) {
+  const safe = {};
+  for (const key of Object.keys(params)) {
+    if (!SAFE_PARAM_KEYS.has(key)) continue;
+    const value = params[key];
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value === null) {
+      safe[key] = value;
+      continue;
+    }
+    if (Array.isArray(value)) {
+      const values = [];
+      for (let index = 0; index < value.length; index += 1) {
+        const item = value[index];
+        if (typeof item === "string" || typeof item === "number" || typeof item === "boolean" || item === null) {
+          values.push(item);
+        }
+      }
+      safe[key] = values;
+    }
+  }
+  return safe;
+}
+function compareCodeUnits(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+function compareDiagnostics(left, right) {
+  const leftParams = stableParams(left.params);
+  const rightParams = stableParams(right.params);
+  return compareCodeUnits(left.path, right.path) || compareCodeUnits(left.code, right.code) || compareCodeUnits(left.message, right.message) || compareCodeUnits(leftParams, rightParams);
+}
+function stableParams(params) {
+  const keys = Object.keys(params).sort(compareCodeUnits);
+  return keys.map((key) => `${JSON.stringify(key)}:${JSON.stringify(params[key])}`).join(",");
+}
+function mapValidationIssues(issues) {
+  return issues.map((issue) => {
+    const code = Object.hasOwn(ISSUE_CODES, issue.keyword) ? ISSUE_CODES[issue.keyword] : "schema.invalid-value";
+    return {
+      code,
+      severity: "error",
+      path: issue.instancePath,
+      message: MESSAGES[code],
+      params: copySafeParams(issue.params)
+    };
+  }).sort(compareDiagnostics);
+}
+function invariantDiagnostic(path = "") {
+  return {
+    code: "compiler.invariant",
+    severity: "error",
+    path,
+    message: MESSAGES["compiler.invariant"],
+    params: {}
+  };
+}
+function compareCodeUnits2(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+function snapshotOwnData2(value, ancestors = /* @__PURE__ */ new WeakSet()) {
+  if (value === null || typeof value !== "object") {
+    return { valid: true, value };
+  }
+  if (ancestors.has(value)) return { valid: false };
+  ancestors.add(value);
+  try {
+    if (Object.getOwnPropertySymbols(value).length > 0) {
+      return { valid: false };
+    }
+    if (Array.isArray(value)) {
+      const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+      if (lengthDescriptor === void 0 || !("value" in lengthDescriptor) || !Number.isSafeInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > LIMITS.maxRulesPerProject) {
+        return { valid: false };
+      }
+      const length = lengthDescriptor.value;
+      for (const propertyName of Object.getOwnPropertyNames(value)) {
+        if (propertyName === "length") continue;
+        const index = Number(propertyName);
+        if (!Number.isInteger(index) || index < 0 || index >= length || String(index) !== propertyName) {
+          return { valid: false };
+        }
+      }
+      const snapshot2 = new Array(length);
+      for (let index = 0; index < length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(
+          value,
+          String(index)
+        );
+        if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
+          return { valid: false };
+        }
+        const child = snapshotOwnData2(descriptor.value, ancestors);
+        if (!child.valid) return child;
+        snapshot2[index] = child.value;
+      }
+      return { valid: true, value: snapshot2 };
+    }
+    const snapshot = /* @__PURE__ */ Object.create(null);
+    for (const key of Object.getOwnPropertyNames(value)) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
+        return { valid: false };
+      }
+      const child = snapshotOwnData2(descriptor.value, ancestors);
+      if (!child.valid) return child;
+      Object.defineProperty(snapshot, key, {
+        configurable: true,
+        enumerable: true,
+        value: child.value,
+        writable: true
+      });
+    }
+    return { valid: true, value: snapshot };
+  } catch {
+    return { valid: false };
+  } finally {
+    ancestors.delete(value);
+  }
+}
+var CompilerInvariantError = class extends Error {
+  constructor(path) {
+    super("invalid normalized origin");
+    this.path = path;
+    this.name = "CompilerInvariantError";
+  }
+  path;
+};
+function normalizeOrigins(group, rule, groupIndex, ruleIndex) {
+  const origins = /* @__PURE__ */ new Set();
+  const sourceArrays = [group.origins, rule.origins];
+  for (let sourceIndex = 0; sourceIndex < sourceArrays.length; sourceIndex += 1) {
+    const source = sourceArrays[sourceIndex];
+    for (let originIndex = 0; originIndex < source.length; originIndex += 1) {
+      const normalized = normalizeSiteOrigin(source[originIndex]);
+      if (normalized === null) {
+        const path = sourceIndex === 0 ? `/groups/${groupIndex}/origins/${originIndex}` : `/groups/${groupIndex}/rules/${ruleIndex}/origins/${originIndex}`;
+        throw new CompilerInvariantError(path);
+      }
+      origins.add(normalized);
+    }
+  }
+  const normalizedOrigins = [];
+  for (const origin of origins) normalizedOrigins.push(origin);
+  normalizedOrigins.sort(compareCodeUnits2);
+  return normalizedOrigins;
+}
+function canonicalResourceTypes(resourceTypes) {
+  const ordered = [];
+  for (let canonicalIndex = 0; canonicalIndex < RESOURCE_TYPES.length; canonicalIndex += 1) {
+    const canonical = RESOURCE_TYPES[canonicalIndex];
+    for (let sourceIndex = 0; sourceIndex < resourceTypes.length; sourceIndex += 1) {
+      if (resourceTypes[sourceIndex] === canonical) ordered.push(canonical);
+    }
+  }
+  return ordered;
+}
+function compileMatcher(group, rule, groupIndex, ruleIndex) {
+  const matcher = {
+    urlRegex: { source: rule.urlRegex, flags: "" },
+    origins: normalizeOrigins(group, rule, groupIndex, ruleIndex),
+    resourceTypes: canonicalResourceTypes(rule.resourceTypes),
+    priority: rule.priority
+  };
+  if (rule.method !== void 0) matcher.method = rule.method;
+  return matcher;
+}
+function compileOperations(project) {
+  const operations = [];
+  for (let groupIndex = 0; groupIndex < project.groups.length; groupIndex += 1) {
+    const group = project.groups[groupIndex];
+    for (let ruleIndex = 0; ruleIndex < group.rules.length; ruleIndex += 1) {
+      const rule = group.rules[ruleIndex];
+      const matcher = compileMatcher(group, rule, groupIndex, ruleIndex);
+      if (rule.type === "redirect") {
+        const operation = {
+          kind: "redirect",
+          groupId: group.id,
+          ruleId: rule.id,
+          matcher,
+          redirect: { destination: rule.redirect?.destination ?? "" }
+        };
+        operations.push(operation);
+      } else if (rule.type === "query" && rule.action && "type" in rule.action && rule.action.type === "query") {
+        const action = rule.action;
+        const operation = {
+          kind: "query",
+          groupId: group.id,
+          ruleId: rule.id,
+          matcher,
+          action
+        };
+        operations.push(operation);
+      } else if (rule.type === "header") {
+        const operation = {
+          kind: "header",
+          groupId: group.id,
+          ruleId: rule.id,
+          matcher,
+          header: {
+            direction: rule.headerDirection ?? "request",
+            operation: rule.headerOperation ?? "set",
+            name: rule.headerName ?? "",
+            ...rule.headerValue !== void 0 ? { value: rule.headerValue } : {}
+          }
+        };
+        operations.push(operation);
+      } else if (rule.type === "mock") {
+        const operation = {
+          kind: "mock",
+          groupId: group.id,
+          ruleId: rule.id,
+          matcher,
+          mock: rule.mock ?? { status: 200, body: "" }
+        };
+        operations.push(operation);
+      } else if (rule.type === "response-body") {
+        const operation = {
+          kind: "response-body",
+          groupId: group.id,
+          ruleId: rule.id,
+          matcher,
+          responseBody: rule.responseBody ?? { replacements: [] }
+        };
+        operations.push(operation);
+      } else if (rule.type === "request-body") {
+        const operation = {
+          kind: "request-body",
+          groupId: group.id,
+          ruleId: rule.id,
+          matcher,
+          requestBody: rule.requestBody ?? { mode: "replace", body: "" }
+        };
+        operations.push(operation);
+      } else {
+        const operation = {
+          kind: "matcher",
+          groupId: group.id,
+          ruleId: rule.id,
+          matcher
+        };
+        operations.push(operation);
+      }
+    }
+  }
+  return operations;
+}
+function compileProject(value) {
+  const snapshot = snapshotOwnData2(value);
+  if (!snapshot.valid) {
+    return {
+      ok: false,
+      operations: [],
+      diagnostics: mapValidationIssues([
+        {
+          instancePath: "",
+          keyword: "ownProperties",
+          message: "must contain only own data properties",
+          params: {}
+        }
+      ])
+    };
+  }
+  let validation;
+  try {
+    validation = validateProjectDetailed(snapshot.value);
+  } catch {
+    return { ok: false, operations: [], diagnostics: [invariantDiagnostic()] };
+  }
+  if (!validation.valid) {
+    return {
+      ok: false,
+      operations: [],
+      diagnostics: mapValidationIssues(validation.errors)
+    };
+  }
+  try {
+    return {
+      ok: true,
+      operations: compileOperations(validation.data),
+      diagnostics: []
+    };
+  } catch (error) {
+    const path = error instanceof CompilerInvariantError ? error.path : "";
+    return {
+      ok: false,
+      operations: [],
+      diagnostics: [invariantDiagnostic(path)]
+    };
+  }
+}
 
 // packages/dry-run/dist/node/index.js
-import { compileUrlRegex, HTTP_METHODS, RESOURCE_TYPES } from "@rogatio/schema";
+init_node();
 function parseTestUrl(input) {
   if (typeof input !== "string" || input.length === 0) {
     return { ok: false };
@@ -3633,7 +5126,7 @@ function dryRunProject(operations, cases, options) {
 }
 
 // packages/cli/src/server/routes.ts
-import { validateProjectDetailed } from "@rogatio/schema";
+init_node();
 
 // packages/cli/src/utils/mock-preview.ts
 import { basename } from "node:path";
@@ -3678,7 +5171,7 @@ var RequestBodyError = class extends Error {
   code = "request-body-too-large";
 };
 function getRequestBody(req) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let body = "";
     let bytes = 0;
     let settled = false;
@@ -3708,7 +5201,7 @@ function getRequestBody(req) {
     req.on("end", () => {
       if (!settled) {
         settled = true;
-        resolve8(body);
+        resolve9(body);
       }
     });
     req.on("error", (error) => {
@@ -4052,6 +5545,21 @@ function createRoutes(context) {
   };
 }
 
+// packages/cli/src/utils/asset-paths.ts
+import { dirname, resolve as resolve2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function isDistBuild(here = dirname(fileURLToPath(import.meta.url))) {
+  return here.includes("/dist/") || here.includes("\\dist\\");
+}
+function editorAssetPaths(here = dirname(fileURLToPath(import.meta.url))) {
+  const editorRoot = isDistBuild(here) ? resolve2(here, "..", "editor") : resolve2(here, "..", "..", "..", "editor", "dist", "browser");
+  return {
+    bundle: resolve2(editorRoot, "index.js"),
+    css: resolve2(editorRoot, "index.css"),
+    fonts: resolve2(editorRoot, "fonts")
+  };
+}
+
 // packages/cli/src/utils/browser.ts
 import { spawn } from "node:child_process";
 var BrowserLaunchError = class extends Error {
@@ -4088,7 +5596,7 @@ async function launchBrowser(url) {
         `Unsupported platform: ${platform}`
       );
   }
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn(command, args, {
       detached: true,
       stdio: "ignore"
@@ -4096,13 +5604,13 @@ async function launchBrowser(url) {
     child.unref();
     child.on("error", (err) => {
       if (err.code === "ENOENT") {
-        resolve8(false);
+        resolve9(false);
       } else {
-        resolve8(false);
+        resolve9(false);
       }
     });
     child.on("close", (code) => {
-      resolve8(code === 0);
+      resolve9(code === 0);
     });
   });
 }
@@ -4110,7 +5618,7 @@ async function launchBrowser(url) {
 // packages/cli/src/utils/file.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdir, readFile as readFile2, rename, writeFile } from "node:fs/promises";
-import { basename as basename2, dirname, join } from "node:path";
+import { basename as basename2, dirname as dirname2, join } from "node:path";
 var ProjectFileError = class extends Error {
   code;
   path;
@@ -4160,10 +5668,10 @@ async function readProject(path) {
   }
 }
 async function writeProject(path, data) {
-  const tempName = `.${basename2(dirname(path))}.${randomBytes2(8).toString("hex")}.tmp`;
-  const tempPath = join(dirname(path), tempName);
+  const tempName = `.${basename2(dirname2(path))}.${randomBytes2(8).toString("hex")}.tmp`;
+  const tempPath = join(dirname2(path), tempName);
   try {
-    await mkdir(dirname(path), { recursive: true });
+    await mkdir(dirname2(path), { recursive: true });
     await writeFile(tempPath, JSON.stringify(data, null, 2), "utf-8");
     await rename(tempPath, path);
   } catch (e) {
@@ -4224,9 +5732,9 @@ Options:
   }
   let filePath;
   if (positionalArgs[0]) {
-    filePath = resolve2(positionalArgs[0]);
+    filePath = resolve3(positionalArgs[0]);
   } else {
-    filePath = resolve2(process.cwd(), ".rogatio.json");
+    filePath = resolve3(process.cwd(), ".rogatio.json");
   }
   try {
     const stat3 = await import("node:fs/promises").then(
@@ -4295,17 +5803,11 @@ Options:
   }
   const serverUrl = `http://127.0.0.1:${server.port}`;
   const editorUrl = `${serverUrl}/editor.html`;
-  let editorBundlePath;
-  try {
-    editorBundlePath = fileURLToPath(import.meta.resolve("@rogatio/editor"));
-  } catch (e) {
-    console.error(`Error: cannot resolve @rogatio/editor bundle: ${e}`);
-    await server.stop();
-    return { exitCode: Promise.resolve(2), shutdown: () => {
-    } };
-  }
-  const editorCssPath = editorBundlePath.replace(/index\.js$/u, "index.css");
-  const editorFontsPath = resolve2(editorBundlePath, "..", "fonts");
+  const {
+    bundle: editorBundlePath,
+    css: editorCssPath,
+    fonts: editorFontsPath
+  } = editorAssetPaths();
   context.editorHtml = generateEditorHtml(serverUrl, csrfToken, filePath);
   context.editorBundlePath = editorBundlePath;
   context.editorCssPath = editorCssPath;
@@ -4322,11 +5824,11 @@ Options:
     console.log(`Editor available at: ${editorUrl}`);
     console.log("Open this URL in your browser to edit the project.");
   }
-  const exitCodePromise = new Promise((resolve8) => {
+  const exitCodePromise = new Promise((resolve9) => {
     const checkShutdown = setInterval(() => {
       if (shutdownCalled) {
         clearInterval(checkShutdown);
-        resolve8(0);
+        resolve9(0);
       }
     }, 100);
     const handleSignal = () => {
@@ -4334,8 +5836,8 @@ Options:
     };
     process.on("SIGINT", handleSignal);
     process.on("SIGTERM", handleSignal);
-    const originalResolve = resolve8;
-    resolve8 = (code) => {
+    const originalResolve = resolve9;
+    resolve9 = (code) => {
       clearInterval(checkShutdown);
       process.off("SIGINT", handleSignal);
       process.off("SIGTERM", handleSignal);
@@ -4460,18 +5962,17 @@ function generateEditorHtml(apiBase, csrfToken, filePath) {
 }
 
 // packages/cli/src/commands/runtime.ts
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join3, relative as relative4, resolve as resolve5, sep as sep2 } from "node:path";
+init_node2();
 init_node();
-import { dirname as dirname3, isAbsolute as isAbsolute4, join as join3, relative as relative4, resolve as resolve4, sep as sep2 } from "node:path";
-import { compileProject as compileProject2 } from "@rogatio/compiler";
-import { validateProjectDetailed as validateProjectDetailed2 } from "@rogatio/schema";
 function showRuntimeHelp() {
   console.log(`Usage: rogatio runtime <command> [options]
 
 Native messaging runtime control for response-body and request-body rules.
 
 Native runtime commands:
-  start     Start the runtime (explicit, no auto-start)
-  stop      Stop the runtime (idempotent)
+  activate  Activate the runtime (explicit, no auto-activation)
+  deactivate Deactivate the runtime (idempotent)
   status    Show the current runtime and trust state
 
 Request-body trust commands:
@@ -4482,10 +5983,10 @@ Request-body trust commands:
   uninstall Uninstall the native-messaging host manifest (idempotent)
 
 Native host command:
-  runtime-host [path]  Run the consolidated native-messaging runtime host,
-                       reading pairing/authorization/mock envelopes from stdin
-                       and writing responses to stdout. This process is what the
-                       browser launches via the native-messaging manifest.
+  host [path]  Run the consolidated native-messaging runtime host, reading
+               pairing/authorization/mock envelopes from stdin and writing
+               responses to stdout. This process is what the browser launches
+               via the native-messaging manifest.
 
 Options:
   --extension-id    Extension ID for native messaging manifest (required for install)
@@ -4506,7 +6007,7 @@ function toMatcherOperations2(operations) {
 }
 function resolveMockFile(root, filePath) {
   if (filePath.includes("\0")) return null;
-  const absolute = isAbsolute4(filePath) ? filePath : resolve4(root, filePath);
+  const absolute = isAbsolute4(filePath) ? filePath : resolve5(root, filePath);
   const rel = relative4(root, absolute);
   if (rel.startsWith("..") || isAbsolute4(rel)) return null;
   const logical = rel.split(sep2).join("/");
@@ -4545,16 +6046,16 @@ async function nativeRuntimeCommand(args) {
     preset: await loadControlPreset()
   });
   switch (subcommand) {
-    case "start": {
+    case "activate": {
       const result = await controller.start();
       if (result.state === "running") {
-        console.log("runtime started");
+        console.log("runtime activated");
         return 0;
       }
-      console.error(`runtime start failed: ${result.state}`);
+      console.error(`runtime activate failed: ${result.state}`);
       return 1;
     }
-    case "stop": {
+    case "deactivate": {
       const result = await controller.stop();
       console.log(`runtime ${result.state}`);
       return 0;
@@ -4663,7 +6164,7 @@ async function runtimeStatusCommand(_args) {
   return 0;
 }
 async function loadControlPreset() {
-  const { normalizeRuntimePreset: normalizeRuntimePreset2 } = await Promise.resolve().then(() => (init_node(), node_exports));
+  const { normalizeRuntimePreset: normalizeRuntimePreset2 } = await Promise.resolve().then(() => (init_node2(), node_exports));
   const result = normalizeRuntimePreset2({
     version: 1,
     limits: RUNTIME_LIMITS,
@@ -4681,7 +6182,7 @@ async function runtimeHostCommand(args) {
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--root" && index + 1 < args.length) {
-      root = resolve4(args[++index]);
+      root = resolve5(args[++index]);
     } else if (arg === "--root") {
       argumentError = "--root requires a value";
     } else if (arg === "--mock-port" && index + 1 < args.length) {
@@ -4715,7 +6216,7 @@ async function runtimeHostCommand(args) {
       filePath = "<stdin>";
       projectData = JSON.parse(chunks.join(""));
     } else {
-      filePath = inputPath ? resolve4(inputPath) : resolve4(process.cwd(), ".rogatio.json");
+      filePath = inputPath ? resolve5(inputPath) : resolve5(process.cwd(), ".rogatio.json");
       projectData = await readProject(filePath);
     }
   } catch (error) {
@@ -4723,7 +6224,7 @@ async function runtimeHostCommand(args) {
     console.error(`Error: ${message}`);
     return 2;
   }
-  const schemaResult = validateProjectDetailed2(projectData);
+  const schemaResult = validateProjectDetailed(projectData);
   if (!schemaResult.valid) {
     for (const issue of schemaResult.errors) {
       console.error(
@@ -4732,7 +6233,7 @@ async function runtimeHostCommand(args) {
     }
     return 1;
   }
-  const compileResult = compileProject2(schemaResult.data);
+  const compileResult = compileProject(schemaResult.data);
   if (!compileResult.ok) {
     for (const diagnostic of compileResult.diagnostics) {
       console.error(
@@ -4741,7 +6242,7 @@ async function runtimeHostCommand(args) {
     }
     return 1;
   }
-  const rootDir = root ?? (inputPath === "-" ? process.cwd() : dirname3(filePath));
+  const rootDir = root ?? (inputPath === "-" ? process.cwd() : dirname4(filePath));
   const mocksResult = buildMockConfigs(compileResult.operations, rootDir);
   if (!mocksResult.ok) {
     console.error(`Error: ${mocksResult.message}`);
@@ -4775,10 +6276,11 @@ async function runtimeCommand(args, _options = {}) {
   if (first === "install" || first === "trust" || first === "untrust" || first === "uninstall")
     return trustRuntimeCommand(args);
   if (first === "status") return runtimeStatusCommand(args);
-  if (first === "start" || first === "stop") return nativeRuntimeCommand(args);
-  if (first === "runtime-host") return runtimeHostCommand(args.slice(1));
+  if (first === "activate" || first === "deactivate")
+    return nativeRuntimeCommand(args);
+  if (first === "host") return runtimeHostCommand(args.slice(1));
   console.error(
-    `Error: 'rogatio runtime' no longer starts an HTTP mock server. Use 'rogatio runtime-host [path]' to run the native-messaging host, or one of: start, stop, status, install, trust, untrust, uninstall.`
+    `Error: 'rogatio runtime' no longer starts an HTTP mock server. Use 'rogatio runtime host [path]' to run the native-messaging host, or one of: activate, deactivate, status, install, trust, untrust, uninstall.`
   );
   showRuntimeHelp();
   return 2;
@@ -4790,9 +6292,8 @@ async function runRuntimeHostEntry() {
 
 // packages/cli/src/commands/test.ts
 import { readFile as readFile4 } from "node:fs/promises";
-import { resolve as resolve5 } from "node:path";
-import { compileProject as compileProject3 } from "@rogatio/compiler";
-import { validateProjectDetailed as validateProjectDetailed3 } from "@rogatio/schema";
+import { resolve as resolve6 } from "node:path";
+init_node();
 function usageError(message) {
   return `Error: ${message}
 `;
@@ -4865,7 +6366,7 @@ function resultOptions(maxCases, operations) {
   return options;
 }
 function diagnosticsFromSchema(projectData) {
-  const result = validateProjectDetailed3(projectData);
+  const result = validateProjectDetailed(projectData);
   if (result.valid) return [];
   return result.errors.map((error) => ({
     code: `schema.${error.keyword}`,
@@ -4914,7 +6415,7 @@ function testCommandNeedsStdin(args) {
   return !hasUrlSource && positionalUrls.length === 0;
 }
 async function testCommandImpl(args, stdinInput, captureOutput) {
-  let filePath = resolve5(process.cwd(), ".rogatio.json");
+  let filePath = resolve6(process.cwd(), ".rogatio.json");
   let jsonMode = false;
   let maxCases;
   const urlCases = [];
@@ -4973,7 +6474,7 @@ async function testCommandImpl(args, stdinInput, captureOutput) {
     }
     filePath = "<stdin>";
   } else if (inputPath) {
-    filePath = resolve5(inputPath);
+    filePath = resolve6(inputPath);
   }
   for (const url of positionalUrls) urlCases.push({ url });
   if (urlsFile) {
@@ -5025,7 +6526,7 @@ async function testCommandImpl(args, stdinInput, captureOutput) {
     console.error(output.trim());
     return 2;
   }
-  const schemaResult = validateProjectDetailed3(projectData);
+  const schemaResult = validateProjectDetailed(projectData);
   let diagnostics = diagnosticsFromSchema(projectData);
   if (!schemaResult.valid) {
     const output = jsonMode ? jsonOutput({ diagnostics }) : diagnostics.map(
@@ -5037,7 +6538,7 @@ async function testCommandImpl(args, stdinInput, captureOutput) {
     else console.error(output.trim());
     return 1;
   }
-  const compileResult = compileProject3(schemaResult.data);
+  const compileResult = compileProject(schemaResult.data);
   diagnostics = diagnosticsFromCompiler(compileResult);
   if (!compileResult.ok) {
     const output = jsonMode ? jsonOutput({ diagnostics }) : diagnostics.map(
@@ -5115,9 +6616,8 @@ async function testCommand(args, stdinInput, captureOutput = false) {
 }
 
 // packages/cli/src/commands/verify.ts
-import { resolve as resolve6 } from "node:path";
-import { compileProject as compileProject4 } from "@rogatio/compiler";
-import { validateProjectDetailed as validateProjectDetailed4 } from "@rogatio/schema";
+import { resolve as resolve7 } from "node:path";
+init_node();
 async function verifyCommandImpl(args, stdinInput, captureOutput) {
   let filePath;
   let jsonOutput2 = false;
@@ -5143,9 +6643,9 @@ async function verifyCommandImpl(args, stdinInput, captureOutput) {
     }
     filePath = "<stdin>";
   } else if (inputPath) {
-    filePath = resolve6(inputPath);
+    filePath = resolve7(inputPath);
   } else {
-    filePath = resolve6(process.cwd(), ".rogatio.json");
+    filePath = resolve7(process.cwd(), ".rogatio.json");
   }
   let projectData;
   try {
@@ -5163,7 +6663,7 @@ async function verifyCommandImpl(args, stdinInput, captureOutput) {
     console.error(output2.trim());
     return 2;
   }
-  const schemaResult = validateProjectDetailed4(projectData);
+  const schemaResult = validateProjectDetailed(projectData);
   const diagnostics = [];
   if (!schemaResult.valid) {
     for (const error of schemaResult.errors) {
@@ -5176,7 +6676,7 @@ async function verifyCommandImpl(args, stdinInput, captureOutput) {
       });
     }
   } else {
-    const compileResult = compileProject4(schemaResult.data);
+    const compileResult = compileProject(schemaResult.data);
     if (!compileResult.ok) {
       for (const diag of compileResult.diagnostics) {
         diagnostics.push({
@@ -5213,11 +6713,10 @@ async function verifyCommand(args, stdinInput, captureOutput = false) {
 }
 
 // packages/cli/src/index.ts
-var __dirname = dirname4(fileURLToPath2(import.meta.url));
-var isDist = __dirname.includes("/dist/") || __dirname.includes("\\dist\\");
-var packageJsonPath = resolve7(
+var __dirname = dirname5(fileURLToPath2(import.meta.url));
+var packageJsonPath = resolve8(
   __dirname,
-  isDist ? "../../package.json" : "../package.json"
+  isDistBuild(__dirname) ? "../../package.json" : "../package.json"
 );
 var packageJson = JSON.parse(
   await import("node:fs/promises").then(
@@ -5309,8 +6808,8 @@ Commands:
   edit [path]     Launch browser editor for .rogatio.json
   test [path] [url...]  Run offline dry-run tests against .rogatio.json
   verify [path]   Validate .rogatio.json file
-  runtime <start|stop|status|install|trust|untrust|uninstall>  Native messaging runtime and request-body trust control
-  runtime-host [path]  Run the consolidated native-messaging runtime host
+  runtime <activate|deactivate|status|install|trust|untrust|uninstall>  Native messaging runtime activation and request-body trust control
+  runtime host [path]  Run the consolidated native-messaging runtime host
 
 Global Options:
   --help, -h      Show help
@@ -5354,16 +6853,17 @@ Exit codes:
 }
 function showRuntimeHelp2() {
   console.log(`Usage: rogatio runtime <command> [options]
-       rogatio runtime-host [path]
+       rogatio runtime host [path]
 
 Native messaging runtime control for response-body and request-body rules. The
 runtime no longer serves an HTTP mock server; mock delivery happens in the
 consolidated native-messaging host (spec REQ-001..REQ-005).
 
 Native runtime commands:
-  start     Start the runtime (explicit, no auto-start)
-  stop      Stop the runtime (idempotent)
-  status    Show the current runtime and trust state
+  activate   Activate the runtime (explicit, no auto-activation)
+  deactivate Deactivate the runtime (idempotent)
+  host [path]  Run the consolidated native-messaging runtime host
+  status     Show the current runtime and trust state
 
 Request-body trust commands:
   install   Install the native-messaging host manifest (requires --extension-id)
@@ -5372,17 +6872,17 @@ Request-body trust commands:
   uninstall Uninstall the native-messaging host manifest (idempotent)
 
 Native host command:
-  runtime-host [path]  Run the consolidated native-messaging runtime host. The
-                      browser launches this process via the native-messaging
-                      manifest; it reads pairing/authorization/mock envelopes from
-                      stdin and writes responses to stdout.
+  host [path]  Run the consolidated native-messaging runtime host. The browser
+               launches this process via the native-messaging manifest; it reads
+               pairing/authorization/mock envelopes from stdin and writes
+               responses to stdout.
 
 Options:
   --root <dir>    Root for confined file mocks (default: project directory)
   --extension-id  Extension ID for native messaging manifest (required for install)
   --help, -h      Show this help
 
-The native runtime activates unconditionally once started; the device-local CA /
+The native runtime activates unconditionally once activated; the device-local CA /
 PAC routing capability only affects request-body interception, not the host
 control plane.
 
@@ -5423,7 +6923,7 @@ Exit codes:
   1  Validation/compile/test errors
   2  Usage error (invalid arguments, missing input)`);
 }
-if (process.argv[1] !== void 0 && realpathSync.native(fileURLToPath2(import.meta.url)) === realpathSync.native(resolve7(process.argv[1]))) {
+if (process.argv[1] !== void 0 && realpathSync.native(fileURLToPath2(import.meta.url)) === realpathSync.native(resolve8(process.argv[1]))) {
   if (basename4(process.argv[1]) === "runtime-host") {
     runRuntimeHostEntry().catch((err) => {
       console.error(err);