@rogatio/cli 5.20.1 → 6.0.1

package/dist/node/index.js

@@ -186,7 +186,6 @@ var LIMITS = Object.freeze({
   maxGroups: 64,
   maxRulesPerGroup: 256,
   maxRulesPerProject: 4096,
-  maxOriginsPerScope: 32,
   maxIdLength: 64,
   maxLabelLength: 100,
   maxDescriptionLength: 1e3,
@@ -242,16 +241,7 @@ function normalizeSiteOrigin(value) {
 function isSiteOrigin(value) {
   return typeof value === "string" && normalizeSiteOrigin(value) !== null;
 }
-function compileUrlRegex(value) {
-  if (typeof value !== "string" || value.length === 0 || value.length > LIMITS.maxUrlRegexLength)
-    return null;
-  try {
-    return new RegExp(value);
-  } catch {
-    return null;
-  }
-}
-var PROJECT_VERSION = 1;
+var PROJECT_VERSION = 2;
 var RESOURCE_TYPES = Object.freeze([
   "main_frame",
   "sub_frame",
@@ -280,6 +270,296 @@ var HTTP_METHODS = Object.freeze([
   "CONNECT",
   "TRACE"
 ]);
+function isPlainObject(value) {
+  const proto = Object.getPrototypeOf(value);
+  return value !== null && typeof value === "object" && !Array.isArray(value) && (proto === Object.prototype || proto === null);
+}
+function ownString(value) {
+  return typeof value === "string" ? value : null;
+}
+function ownStringArray(value) {
+  if (!Array.isArray(value)) return null;
+  const out = [];
+  for (let i = 0; i < value.length; i += 1) {
+    if (!Object.hasOwn(value, i)) return null;
+    const entry = value[i];
+    if (typeof entry !== "string") return null;
+    out.push(entry);
+  }
+  return out;
+}
+var INVALID_INPUT = "migration.invalid-input";
+var MigrationError = class extends Error {
+  constructor() {
+    super(INVALID_INPUT);
+    this.name = "MigrationError";
+  }
+};
+function regexProvenInsideOrigins(urlRegex, effectiveOrigins) {
+  if (effectiveOrigins.size === 0) return false;
+  if (urlRegex.includes("|")) return false;
+  if (!urlRegex.startsWith("^")) return false;
+  let index = 1;
+  let schemes;
+  if (urlRegex.startsWith("https?://", index)) {
+    schemes = ["http", "https"];
+    index += "https?://".length;
+  } else if (urlRegex.startsWith("https://", index)) {
+    schemes = ["https"];
+    index += "https://".length;
+  } else if (urlRegex.startsWith("http://", index)) {
+    schemes = ["http"];
+    index += "http://".length;
+  } else {
+    return false;
+  }
+  let host = "";
+  while (index < urlRegex.length) {
+    const char = urlRegex[index];
+    if (char === "\\") {
+      if (urlRegex[index + 1] !== ".") return false;
+      host += ".";
+      index += 2;
+      continue;
+    }
+    if (char === "/" || char === ":" || char === "$") break;
+    if (!/^[A-Za-z0-9-]$/.test(char ?? "")) return false;
+    host += char;
+    index += 1;
+  }
+  if (!isLiteralHost(host)) return false;
+  let port = null;
+  if (urlRegex[index] === "/") {
+  } else if (urlRegex[index] === "$") {
+  } else if (urlRegex[index] === ":") {
+    index += 1;
+    const start = index;
+    while (index < urlRegex.length && (urlRegex[index] ?? "") >= "0" && (urlRegex[index] ?? "") <= "9") {
+      index += 1;
+    }
+    if (index === start) return false;
+    port = urlRegex.slice(start, index);
+    const portNumber = Number(port);
+    if (!Number.isInteger(portNumber) || portNumber < 1 || portNumber > 65535) {
+      return false;
+    }
+    if (urlRegex[index] !== "/" && urlRegex[index] !== "$") return false;
+  } else {
+    return false;
+  }
+  for (const scheme of schemes) {
+    const origin = normalizeSiteOrigin(
+      port === null ? `${scheme}://${host}` : `${scheme}://${host}:${port}`
+    );
+    if (origin === null || !effectiveOrigins.has(origin)) return false;
+  }
+  return true;
+}
+function isLiteralHost(host) {
+  if (host.length === 0 || host.startsWith(".") || host.endsWith(".") || host.includes("..")) {
+    return false;
+  }
+  if (/^(?:\d{1,3}\.){3}\d{1,3}$/.test(host)) {
+    const parts = host.split(".");
+    for (const part of parts) {
+      const value = Number(part);
+      if (!Number.isInteger(value) || value < 0 || value > 255) return false;
+    }
+    return true;
+  }
+  return /^(?:[A-Za-z0-9-]+\.)*[A-Za-z0-9-]+$/.test(host);
+}
+function effectiveOriginSet(groupOrigins, ruleOrigins) {
+  const set = /* @__PURE__ */ new Set();
+  for (const raw of [...groupOrigins, ...ruleOrigins]) {
+    const normalized = normalizeSiteOrigin(raw);
+    if (normalized !== null) set.add(normalized);
+  }
+  return set;
+}
+function migrateRule(raw, groupOrigins, groupIndex, ruleIndex, notices) {
+  if (!isPlainObject(raw)) return null;
+  const id2 = ownString(raw.id);
+  const name = ownString(raw.name);
+  const urlRegex = ownString(raw.urlRegex);
+  if (id2 === null || name === null || urlRegex === null) return null;
+  const ruleOrigins = ownStringArray(raw.origins);
+  if (ruleOrigins === null) return null;
+  const resourceTypes = raw.resourceTypes;
+  if (!Array.isArray(resourceTypes) || resourceTypes.length === 0) return null;
+  const priority = raw.priority;
+  if (typeof priority !== "number" || !Number.isInteger(priority)) return null;
+  const source = {
+    key: "url",
+    operator: "regex",
+    value: urlRegex
+  };
+  const effective = effectiveOriginSet(groupOrigins, ruleOrigins);
+  const path2 = `/groups/${groupIndex}/rules/${ruleIndex}`;
+  if (!regexProvenInsideOrigins(urlRegex, effective)) {
+    notices.push({
+      code: "migration.possible-scope-widen",
+      path: path2,
+      message: "dropping origins may widen this rule; source keeps the previous urlRegex bytes"
+    });
+  }
+  const rule = {
+    id: id2,
+    name,
+    source,
+    resourceTypes,
+    priority
+  };
+  for (const key of [
+    "method",
+    "type",
+    "redirect",
+    "action",
+    "headerDirection",
+    "headerOperation",
+    "headerName",
+    "headerValue",
+    "responseBody",
+    "requestBody",
+    "redactSensitiveInLogs"
+  ]) {
+    if (Object.hasOwn(raw, key)) {
+      const value = raw[key];
+      rule[key] = value === void 0 ? void 0 : structuredClone(value);
+    }
+  }
+  return rule;
+}
+function assertAcyclic(value, seen) {
+  if (value === null || typeof value !== "object") return;
+  if (seen.has(value)) throw new MigrationError();
+  seen.add(value);
+  if (Object.getOwnPropertySymbols(value).length > 0)
+    throw new MigrationError();
+  if (Array.isArray(value)) {
+    const lengthDesc = Object.getOwnPropertyDescriptor(value, "length");
+    if (lengthDesc === void 0 || !("value" in lengthDesc) || typeof lengthDesc.value !== "number" || !Number.isSafeInteger(lengthDesc.value) || lengthDesc.value < 0) {
+      throw new MigrationError();
+    }
+    const length = lengthDesc.value;
+    for (const key of Object.getOwnPropertyNames(value)) {
+      if (key === "length") continue;
+      if (!/^(?:0|[1-9]\d*)$/.test(key) || Number(key) >= length) {
+        throw new MigrationError();
+      }
+    }
+    for (let index = 0; index < length; index += 1) {
+      const desc = Object.getOwnPropertyDescriptor(value, String(index));
+      if (desc === void 0 || !("value" in desc) || desc.get || desc.set) {
+        throw new MigrationError();
+      }
+      assertAcyclic(desc.value, seen);
+    }
+    return;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new MigrationError();
+  }
+  for (const key of Object.getOwnPropertyNames(value)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      throw new MigrationError();
+    }
+    const desc = Object.getOwnPropertyDescriptor(value, key);
+    if (desc === void 0 || !("value" in desc) || desc.get || desc.set || !desc.enumerable) {
+      throw new MigrationError();
+    }
+    assertAcyclic(desc.value, seen);
+  }
+}
+function migrateV1Project(input) {
+  try {
+    assertAcyclic(input, /* @__PURE__ */ new WeakSet());
+    return migrateOwned(input);
+  } catch {
+    return { ok: false, error: INVALID_INPUT };
+  }
+}
+function migrateOwned(input) {
+  if (!isPlainObject(input)) {
+    return { ok: false, error: "migration.invalid-project" };
+  }
+  if (Object.getOwnPropertySymbols(input).length > 0) {
+    return { ok: false, error: "migration.invalid-project" };
+  }
+  const version = input.version;
+  if (version !== 1) {
+    return { ok: false, error: "migration.not-v1" };
+  }
+  const name = ownString(input.name);
+  if (name === null) {
+    return { ok: false, error: "migration.invalid-project" };
+  }
+  const groupsRaw = input.groups;
+  if (!Array.isArray(groupsRaw)) {
+    return { ok: false, error: "migration.invalid-project" };
+  }
+  const notices = [];
+  const groups = [];
+  for (let gi = 0; gi < groupsRaw.length; gi += 1) {
+    if (!Object.hasOwn(groupsRaw, gi)) {
+      return { ok: false, error: "migration.invalid-project" };
+    }
+    const groupRaw = groupsRaw[gi];
+    if (!isPlainObject(groupRaw)) {
+      return { ok: false, error: "migration.invalid-project" };
+    }
+    const groupId = ownString(groupRaw.id);
+    const groupName = ownString(groupRaw.name);
+    const groupOrigins = ownStringArray(groupRaw.origins);
+    const rulesRaw = groupRaw.rules;
+    if (groupId === null || groupName === null || groupOrigins === null || !Array.isArray(rulesRaw)) {
+      return { ok: false, error: "migration.invalid-project" };
+    }
+    const rules = [];
+    for (let ri = 0; ri < rulesRaw.length; ri += 1) {
+      if (!Object.hasOwn(rulesRaw, ri)) {
+        return { ok: false, error: "migration.invalid-project" };
+      }
+      const migrated = migrateRule(rulesRaw[ri], groupOrigins, gi, ri, notices);
+      if (migrated === null) {
+        return { ok: false, error: "migration.invalid-rule" };
+      }
+      rules.push(migrated);
+    }
+    groups.push({ id: groupId, name: groupName, rules });
+  }
+  notices.push({
+    code: "migration.initiator-policy",
+    path: "/",
+    message: "initiator must now be a present http(s) origin; the old origins allowlist no longer applies"
+  });
+  const project = {
+    version: PROJECT_VERSION,
+    name,
+    groups
+  };
+  if (Object.hasOwn(input, "description")) {
+    const description = ownString(input.description);
+    if (description === null) {
+      return { ok: false, error: "migration.invalid-project" };
+    }
+    project.description = description;
+  }
+  if (Object.hasOwn(input, "requestBodyPolicy")) {
+    project.requestBodyPolicy = input.requestBodyPolicy;
+  }
+  return { ok: true, project, notices };
+}
+function compileUrlRegex(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > LIMITS.maxUrlRegexLength)
+    return null;
+  try {
+    return new RegExp(value);
+  } catch {
+    return null;
+  }
+}
 var label = {
   type: "string",
   minLength: 1,
@@ -294,7 +574,7 @@ var id = {
 };
 var projectSchemaDefinition = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://rogatio.dev/schema/project-v1.json",
+  $id: "https://rogatio.dev/schema/project-v2.json",
   type: "object",
   additionalProperties: false,
   required: ["version", "name", "groups"],
@@ -313,19 +593,28 @@ var projectSchemaDefinition = {
     requestBodyPolicy: { $ref: "#/$defs/requestBodyPolicyConfig" }
   },
   $defs: {
+    sourceCondition: {
+      type: "object",
+      additionalProperties: false,
+      required: ["key", "operator", "value"],
+      properties: {
+        key: { type: "string", enum: ["url", "host"] },
+        operator: { type: "string", const: "regex" },
+        value: {
+          type: "string",
+          minLength: 1,
+          maxLength: LIMITS.maxUrlRegexLength,
+          format: "rogatio-url-regex"
+        }
+      }
+    },
     group: {
       type: "object",
       additionalProperties: false,
-      required: ["id", "name", "origins", "rules"],
+      required: ["id", "name", "rules"],
       properties: {
         id,
         name: label,
-        origins: {
-          type: "array",
-          maxItems: LIMITS.maxOriginsPerScope,
-          uniqueItems: true,
-          items: { type: "string", format: "rogatio-origin" }
-        },
         rules: {
           type: "array",
           maxItems: LIMITS.maxRulesPerGroup,
@@ -336,29 +625,11 @@ var projectSchemaDefinition = {
     rule: {
       type: "object",
       additionalProperties: false,
-      required: [
-        "id",
-        "name",
-        "urlRegex",
-        "origins",
-        "resourceTypes",
-        "priority"
-      ],
+      required: ["id", "name", "source", "resourceTypes", "priority"],
       properties: {
         id,
         name: label,
-        urlRegex: {
-          type: "string",
-          minLength: 1,
-          maxLength: LIMITS.maxUrlRegexLength,
-          format: "rogatio-url-regex"
-        },
-        origins: {
-          type: "array",
-          maxItems: LIMITS.maxOriginsPerScope,
-          uniqueItems: true,
-          items: { type: "string", format: "rogatio-origin" }
-        },
+        source: { $ref: "#/$defs/sourceCondition" },
         resourceTypes: {
           type: "array",
           minItems: 1,
@@ -855,7 +1126,7 @@ function semanticIssues(project) {
           const destinationPath = `${rulePath}/redirect/destination`;
           for (const issue of validateRedirectDestination(
             destination,
-            rule.urlRegex
+            rule.source.value
           )) {
             issues.push({
               instancePath: destinationPath,
@@ -867,29 +1138,12 @@ function semanticIssues(project) {
           issues.push(
             ...captureValidationIssues(
               destination,
-              rule.urlRegex,
+              rule.source.value,
               destinationPath
             )
           );
         }
       }
-      const effectiveOrigins = /* @__PURE__ */ new Set();
-      for (let originIndex = 0; originIndex < group.origins.length; originIndex += 1) {
-        const origin = normalizeSiteOrigin(group.origins[originIndex]);
-        if (origin !== null) effectiveOrigins.add(origin);
-      }
-      for (let originIndex = 0; originIndex < rule.origins.length; originIndex += 1) {
-        const origin = normalizeSiteOrigin(rule.origins[originIndex]);
-        if (origin !== null) effectiveOrigins.add(origin);
-      }
-      if (effectiveOrigins.size === 0) {
-        issues.push({
-          instancePath: `${rulePath}/origins`,
-          keyword: "effectiveOrigin",
-          message: "must combine with group origins to contain at least one origin",
-          params: {}
-        });
-      }
       const action = rule.action;
       if (action && "type" in action && action.type === "query") {
         const seenNames = /* @__PURE__ */ new Set();
@@ -920,7 +1174,7 @@ function semanticIssues(project) {
               issues.push(
                 ...captureValidationIssues(
                   param.value,
-                  rule.urlRegex,
+                  rule.source.value,
                   `${rulePath}/action/params/${p}/value`
                 )
               );
@@ -952,7 +1206,7 @@ function semanticIssues(project) {
           issues.push(
             ...captureValidationIssues(
               rule.headerValue,
-              rule.urlRegex,
+              rule.source.value,
               `${rulePath}/headerValue`
             )
           );
@@ -994,7 +1248,7 @@ function semanticIssues(project) {
             issues.push(
               ...captureValidationIssues(
                 action2.body,
-                rule.urlRegex,
+                rule.source.value,
                 `${actionPath}/body`
               )
             );
@@ -1075,7 +1329,7 @@ function semanticIssues(project) {
               issues.push(
                 ...captureValidationIssues(
                   action2.body,
-                  rule.urlRegex,
+                  rule.source.value,
                   `${actionPath}/body`
                 )
               );
@@ -1348,18 +1602,6 @@ function validateProjectDetailed(value) {
   return errors.length > 0 ? { valid: false, errors } : { valid: true, data: value };
 }
 
-// packages/runtime/dist/node/index.js
-import { isIP as isIP2 } from "node:net";
-import { Buffer as Buffer2 } from "node:buffer";
-import { existsSync } from "node:fs";
-import { createServer as createServer2 } from "node:http";
-import { join as join3 } from "node:path";
-import {
-  createServer
-} from "node:http";
-import { connect } from "node:net";
-import { Worker } from "node:worker_threads";
-
 // packages/compiler/dist/node/index.js
 var ISSUE_CODES = {
   required: "schema.required",
@@ -1378,7 +1620,6 @@ var ISSUE_CODES = {
   uniqueItems: "schema.out-of-range",
   ownProperties: "schema.invalid-structure",
   uniqueId: "schema.duplicate-id",
-  effectiveOrigin: "schema.no-effective-origin",
   maxRulesPerProject: "schema.rule-limit"
 };
 var SAFE_PARAM_KEYS = /* @__PURE__ */ new Set([
@@ -1406,7 +1647,6 @@ var MESSAGES = {
   "schema.out-of-range": "The project contains a value outside its allowed bounds.",
   "schema.invalid-structure": "The project contains invalid structure.",
   "schema.duplicate-id": "Project and rule IDs must be unique.",
-  "schema.no-effective-origin": "Each rule must have at least one effective origin.",
   "schema.rule-limit": "The project contains too many rules.",
   "compiler.invariant": "The compiler could not normalize validated project data.",
   "compiler.forbidden-header": "The header name is forbidden for this direction.",
@@ -1472,11 +1712,6 @@ function invariantDiagnostic(path2 = "") {
     params: {}
   };
 }
-function compareCodeUnits2(left, right) {
-  if (left < right) return -1;
-  if (left > right) return 1;
-  return 0;
-}
 function snapshotOwnData2(value, ancestors = /* @__PURE__ */ new WeakSet()) {
   if (value === null || typeof value !== "object") {
     return { valid: true, value };
@@ -1537,33 +1772,6 @@ function snapshotOwnData2(value, ancestors = /* @__PURE__ */ new WeakSet()) {
     ancestors.delete(value);
   }
 }
-var CompilerInvariantError = class extends Error {
-  constructor(path2) {
-    super("invalid normalized origin");
-    this.path = path2;
-    this.name = "CompilerInvariantError";
-  }
-  path;
-};
-function normalizeOrigins(group, rule, groupIndex, ruleIndex) {
-  const origins = /* @__PURE__ */ new Set();
-  const sourceArrays = [group.origins, rule.origins];
-  for (let sourceIndex = 0; sourceIndex < sourceArrays.length; sourceIndex += 1) {
-    const source = sourceArrays[sourceIndex];
-    for (let originIndex = 0; originIndex < source.length; originIndex += 1) {
-      const normalized = normalizeSiteOrigin(source[originIndex]);
-      if (normalized === null) {
-        const path2 = sourceIndex === 0 ? `/groups/${groupIndex}/origins/${originIndex}` : `/groups/${groupIndex}/rules/${ruleIndex}/origins/${originIndex}`;
-        throw new CompilerInvariantError(path2);
-      }
-      origins.add(normalized);
-    }
-  }
-  const normalizedOrigins = [];
-  for (const origin of origins) normalizedOrigins.push(origin);
-  normalizedOrigins.sort(compareCodeUnits2);
-  return normalizedOrigins;
-}
 function canonicalResourceTypes(resourceTypes) {
   const ordered = [];
   for (let canonicalIndex = 0; canonicalIndex < RESOURCE_TYPES.length; canonicalIndex += 1) {
@@ -1577,10 +1785,13 @@ function canonicalResourceTypes(resourceTypes) {
 function resolveRedactSensitiveInLogs(rule) {
   return rule.redactSensitiveInLogs === true;
 }
-function compileMatcher(group, rule, groupIndex, ruleIndex) {
+function compileMatcher(rule) {
   const matcher = {
-    urlRegex: { source: rule.urlRegex, flags: "" },
-    origins: normalizeOrigins(group, rule, groupIndex, ruleIndex),
+    source: {
+      key: rule.source.key,
+      operator: "regex",
+      value: rule.source.value
+    },
     resourceTypes: canonicalResourceTypes(rule.resourceTypes),
     priority: rule.priority
   };
@@ -1593,7 +1804,7 @@ function compileOperations(project) {
     const group = project.groups[groupIndex];
     for (let ruleIndex = 0; ruleIndex < group.rules.length; ruleIndex += 1) {
       const rule = group.rules[ruleIndex];
-      const matcher = compileMatcher(group, rule, groupIndex, ruleIndex);
+      const matcher = compileMatcher(rule);
       const redactSensitiveInLogs = resolveRedactSensitiveInLogs(rule);
       if (rule.type === "redirect") {
         const operation = {
@@ -1706,17 +1917,46 @@ function compileProject(value) {
       operations: compileOperations(validation.data),
       diagnostics: []
     };
-  } catch (error) {
-    const path2 = error instanceof CompilerInvariantError ? error.path : "";
+  } catch {
     return {
       ok: false,
       operations: [],
-      diagnostics: [invariantDiagnostic(path2)]
+      diagnostics: [invariantDiagnostic()]
     };
   }
 }
+function sourceMatches(source, url) {
+  const regex = compileUrlRegex(source.value);
+  if (regex === null) return false;
+  if (source.key === "url") {
+    return regex.test(url);
+  }
+  try {
+    const hostname = new URL(url).hostname;
+    return regex.test(hostname);
+  } catch {
+    return false;
+  }
+}
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
 
 // packages/runtime/dist/node/index.js
+import { isIP as isIP2 } from "node:net";
+import { Buffer as Buffer2 } from "node:buffer";
+import { existsSync } from "node:fs";
+import { createServer as createServer2 } from "node:http";
+import { join as join3 } from "node:path";
+import {
+  createServer
+} from "node:http";
+import { connect } from "node:net";
+import { Worker } from "node:worker_threads";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFile as readFile2, realpath as realpath2, stat } from "node:fs/promises";
@@ -20687,19 +20927,15 @@ function buildSystemPrompt(project) {
   const projectJson = formatProjectContext(project);
   return `You are an expert Rogatio rule author. Rogatio is a local-first browser request/response rule engine.
 
-## Schema Constraants
+## Schema Constraints (version 2)
 
-### URL Regular Expression
-- Maximum 2048 characters
-- Case-sensitive, no flags
-- Must be valid ECMAScript regex
-- Used to match request URLs
+### Source condition
+Each rule matches with \`source: { key, operator, value }\`.
+- \`key\`: \`"url"\` tests the full request URL; \`"host"\` tests the hostname only.
+- \`operator\`: must be the constant \`"regex"\`.
+- \`value\`: non-empty ECMAScript regex, max 2048 characters, case-sensitive, no flags.
 
-### Origins
-- Only explicit http:// and https:// origins with hostname
-- Optional port (e.g., https://example.com:8080)
-- No wildcards, credentials, paths, query strings, or fragments
-- Effective origins are union of project, group, and rule origins
+There are no group or rule \`origins\` fields and no \`urlRegex\` field.
 
 ### Forbidden Headers
 Cannot set/remove these headers:
@@ -20715,14 +20951,13 @@ ${formatHttpMethods()}
 - Max 64 projects per profile
 - Max 100 groups per project
 - Max 500 rules per project
-- Max 10 origins per group/rule
 
 ## Rule Types
 
-Each rule has: id, name, urlRegex, origins[], resourceTypes[], priority, method?, action
+Each rule has: id, name, source, resourceTypes[], priority, method?, action
 
 ### redirect
-Action: destination string. Use $1 through $9 for URL regex captures. $$ is a literal dollar sign. Existing redirect \\1 references remain compatible.
+Action: destination string. Use $1 through $9 for URL source captures when \`source.key\` is \`"url"\`. $$ is a literal dollar sign. Existing redirect \\\\1 references remain compatible.
 
 ### query
 Action: query parameters with name, operation, and value. Set values may use URL captures.
@@ -20731,15 +20966,14 @@ Action: query parameters with name, operation, and value. Set values may use URL
 Action: header direction, operation, name, and value. Set and append values may use URL captures.
 
 ### response-body
-Replace-mode body may use URL captures. Regex-mode replacement strings use captures from the body pattern, not the URL pattern.
+Replace-mode body may use URL captures. Regex-mode replacement strings use captures from the body pattern, not the source pattern.
 
 ### request-body
-Replace-mode body may use URL captures. Regex-mode replacement strings use captures from the body pattern, not the URL pattern.
+Replace-mode body may use URL captures. Regex-mode replacement strings use captures from the body pattern, not the source pattern.
 
 ## Compiler Diagnostic Codes (stable)
 - schema.invalid-regex - Invalid regex syntax
 - schema.duplicate-id - Duplicate group/rule ID
-- schema.invalid-origin - Invalid origin format
 - schema.invalid-resource-type - Unknown resource type
 - schema.invalid-method - Unknown HTTP method
 - schema.regex-too-long - Regex exceeds 2048 chars
@@ -20753,12 +20987,17 @@ ${projectJson}
 Return ONLY valid JSON matching this TypeScript interface:
 
 \`\`\`typescript
+interface SourceProposal {
+  key: "url" | "host";
+  operator: "regex";
+  value: string;
+}
+
 interface RuleProposal {
   kind: "redirect" | "query" | "header" | "response-body" | "request-body";
   groupId: string;
   name: string;
-  urlRegex: string;
-  origins?: string[];
+  source: SourceProposal;
   resourceTypes?: string[];
   priority?: number;
   method?: string;
@@ -20775,13 +21014,13 @@ interface AIProposal {
 
 1. Propose MINIMAL changes - only what the user asked for
 2. Use existing groups when possible; create new only if needed
-3. All regex must be valid ECMAScript
-4. All origins must be valid http/https with hostname
+3. All source.value regex must be valid ECMAScript
+4. source.operator must be exactly "regex"
 5. Resource types must be from the allowed list
 6. Methods must be from the allowed list
 7. Priority: higher = more specific (100 default)
 8. Action object must match the rule kind schema exactly
-9. Use $1\u2013$9 only when urlRegex defines those capture groups; use $$ for a literal dollar sign
+9. Use $1\u2013$9 only when source defines those capture groups; use $$ for a literal dollar sign
 10. Before proposing, mentally validate against dry-run: would this rule match the intended URLs?
 11. Explanation should be 1-2 sentences describing what the rules do
 `;
@@ -20790,7 +21029,7 @@ var MAX_FIX_ATTEMPTS = 3;
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function ownString(record, ...keys) {
+function ownString2(record, ...keys) {
   for (const key of keys) {
     if (!Object.hasOwn(record, key)) continue;
     const value = record[key];
@@ -20802,8 +21041,11 @@ function ruleFromProposal(proposal, ruleId) {
   const rule = {
     id: ruleId,
     name: proposal.name,
-    urlRegex: proposal.urlRegex,
-    origins: proposal.origins ? [...proposal.origins] : [],
+    source: {
+      key: proposal.source.key,
+      operator: "regex",
+      value: proposal.source.value
+    },
     resourceTypes: proposal.resourceTypes ? [...proposal.resourceTypes] : ["main_frame"],
     priority: proposal.priority ?? 100
   };
@@ -20822,18 +21064,18 @@ function ruleFromProposal(proposal, ruleId) {
     case "header": {
       rule.type = "header";
       if (isRecord(proposal.action)) {
-        const direction = ownString(
+        const direction = ownString2(
           proposal.action,
           "headerDirection",
           "direction"
         );
-        const operation = ownString(
+        const operation = ownString2(
           proposal.action,
           "headerOperation",
           "operation"
         );
-        const name = ownString(proposal.action, "headerName", "name");
-        const value = ownString(proposal.action, "headerValue", "value");
+        const name = ownString2(proposal.action, "headerName", "name");
+        const value = ownString2(proposal.action, "headerValue", "value");
         if (direction !== void 0) rule.headerDirection = direction;
         if (operation !== void 0) rule.headerOperation = operation;
         if (name !== void 0) rule.headerName = name;
@@ -20859,7 +21101,7 @@ function ruleFromProposal(proposal, ruleId) {
 function mergeProposalIntoProject(project, proposal) {
   const groups = Array.isArray(project.groups) ? project.groups.map((group) => {
     if (!isRecord(group)) {
-      return { id: "invalid", name: "invalid", origins: [], rules: [] };
+      return { id: "invalid", name: "invalid", rules: [] };
     }
     return {
       ...group,
@@ -20875,7 +21117,6 @@ function mergeProposalIntoProject(project, proposal) {
       group = {
         id: ruleProposal.groupId,
         name: "AI Group",
-        origins: [],
         rules: []
       };
       groups.push(group);
@@ -20923,18 +21164,29 @@ function stringArray(value) {
   );
   return items.length === value.length ? items : void 0;
 }
+function parseSourceProposal(value) {
+  if (!isRecord(value)) return null;
+  if (value.key !== "url" && value.key !== "host") return null;
+  if (value.operator !== "regex") return null;
+  if (typeof value.value !== "string" || value.value.length === 0) return null;
+  return {
+    key: value.key,
+    operator: "regex",
+    value: value.value
+  };
+}
 function parseProposalRule(value) {
   if (!isRecord(value)) return null;
   const kind = value.kind;
-  if (typeof kind !== "string" || !RULE_KINDS.has(kind) || typeof value.groupId !== "string" || typeof value.name !== "string" || typeof value.urlRegex !== "string" || !Object.hasOwn(value, "action")) {
+  const source = parseSourceProposal(value.source);
+  if (typeof kind !== "string" || !RULE_KINDS.has(kind) || typeof value.groupId !== "string" || typeof value.name !== "string" || source === null || !Object.hasOwn(value, "action")) {
     return null;
   }
   return {
     kind,
     groupId: value.groupId,
     name: value.name,
-    urlRegex: value.urlRegex,
-    origins: stringArray(value.origins),
+    source,
     resourceTypes: stringArray(value.resourceTypes),
     priority: typeof value.priority === "number" ? value.priority : void 0,
     method: typeof value.method === "string" ? value.method : void 0,
@@ -20944,7 +21196,7 @@ function parseProposalRule(value) {
 function repairProposalIntoProject(project, diagnostics, proposal) {
   const groups = Array.isArray(project.groups) ? project.groups.map((group) => {
     if (!isRecord(group)) {
-      return { id: "invalid", name: "invalid", origins: [], rules: [] };
+      return { id: "invalid", name: "invalid", rules: [] };
     }
     return {
       ...group,
@@ -20985,7 +21237,6 @@ function repairProposalIntoProject(project, diagnostics, proposal) {
       group = {
         id: ruleProposal.groupId,
         name: "AI Group",
-        origins: [],
         rules: []
       };
       groups.push(group);
@@ -21334,14 +21585,6 @@ function canonicalizeOutboundTarget(value) {
   if (canonical.includes("#") || canonical.includes("@")) return null;
   return canonical;
 }
-function targetOrigin(value) {
-  const origin = normalizeSiteOrigin(new URL(value).origin);
-  return origin;
-}
-function isOriginAllowed(target, origins) {
-  const origin = targetOrigin(target);
-  return origin !== null && origins.includes(origin);
-}
 function validMethod(value) {
   return typeof value === "string" && HTTP_METHODS.includes(value);
 }
@@ -21373,9 +21616,12 @@ function canonicalTarget(kind, target) {
 function matchesGrant(descriptor, grant) {
   return descriptor.groupId === grant.groupId && descriptor.ruleId === grant.ruleId && descriptor.operationId === grant.operationId && descriptor.kind === grant.kind && descriptor.target === grant.target && descriptor.method === grant.method;
 }
-function authorizeExact(preset, value) {
+function authorizeExact(preset, value, requestUrl) {
   const descriptor = exactDescriptor(value);
   if (descriptor === null) return failure("runtime.authorization-denied");
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) {
+    return failure("runtime.authorization-denied");
+  }
   const target = canonicalTarget(descriptor.kind, descriptor.target);
   if (target === null) return failure("runtime.authorization-denied");
   for (const grant of preset.grants) {
@@ -21383,7 +21629,10 @@ function authorizeExact(preset, value) {
     const matcher = preset.matchers.find(
       (candidate) => candidate.groupId === grant.groupId && candidate.ruleId === grant.ruleId
     );
-    if (matcher === void 0 || grant.kind === "outbound-http" && !isOriginAllowed(grant.target, matcher.matcher.origins)) {
+    if (matcher === void 0) {
+      return failure("runtime.authorization-denied");
+    }
+    if (grant.kind === "outbound-http" && !sameOrigin(grant.target, requestUrl)) {
       return failure("runtime.authorization-denied");
     }
     return {
@@ -21395,7 +21644,7 @@ function authorizeExact(preset, value) {
         kind: grant.kind,
         target: grant.target,
         method: grant.method,
-        urlRegex: matcher.matcher.urlRegex.source,
+        sourceValue: matcher.matcher.source.value,
         presetDigest: preset.digest
       })
     };
@@ -21432,7 +21681,7 @@ var RUNTIME_LIMITS = Object.freeze({
 });
 var PROTOCOL = "v1";
 var ENVELOPE_MAX_BYTES = 64 * 1024;
-var MAX_PAC_ORIGINS = 256;
+var MAX_PAC_ROUTES = 256;
 var FORBIDDEN_BODY_KEYS = /* @__PURE__ */ new Set(["body", "requestBody", "responseBody"]);
 var MOCK_BODY_KEY = "mockBody";
 var MOCK_BODY_ALLOWED_TYPES = /* @__PURE__ */ new Set(["mock.response"]);
@@ -21842,12 +22091,18 @@ function originOf(value) {
     return null;
   }
 }
+function isHttpOrigin(origin) {
+  return origin.startsWith("http://") || origin.startsWith("https://");
+}
 function projectHasRule(project, groupId, ruleId) {
   if (!Array.isArray(project.groups)) return false;
   const group = project.groups.find((candidate) => candidate.id === groupId);
   if (group === void 0 || !Array.isArray(group.rules)) return false;
   return group.rules.some((rule) => rule.id === ruleId);
 }
+function isBodyOperation(operation) {
+  return operation.kind === "request-body" || operation.kind === "response-body";
+}
 function revalidateAuthority(project, operations, request) {
   const projectSnap = snapshotOwnData3(project);
   if (!projectSnap.valid) return { allowed: false, reason: "project-invalid" };
@@ -21869,17 +22124,21 @@ function revalidateAuthority(project, operations, request) {
     return { allowed: false, reason: "project-inconsistent" };
   }
   const matcher = operation.matcher;
-  const regex = compileUrlRegex(matcher.urlRegex.source);
-  if (regex === null || !regex.test(request.url)) {
+  if (!sourceMatches(matcher.source, request.url)) {
     return { allowed: false, reason: "url-mismatch" };
   }
-  const targetOrigin2 = request.target ? originOf(request.target) : originOf(request.url);
-  if (targetOrigin2 === null || !matcher.origins.includes(targetOrigin2)) {
+  const requestOrigin = originOf(request.url);
+  const targetUrl = request.target ?? request.url;
+  const targetOrigin = originOf(targetUrl);
+  if (requestOrigin === null || targetOrigin === null || !sameOrigin(request.url, targetUrl)) {
     return { allowed: false, reason: "target-unauthorized" };
   }
-  if (request.initiator !== void 0) {
+  if (isBodyOperation(operation)) {
+    if (request.initiator === void 0) {
+      return { allowed: false, reason: "initiator-unauthorized" };
+    }
     const initiatorOrigin = originOf(request.initiator);
-    if (initiatorOrigin === null || !matcher.origins.includes(initiatorOrigin)) {
+    if (initiatorOrigin === null || !isHttpOrigin(initiatorOrigin)) {
       return { allowed: false, reason: "initiator-unauthorized" };
     }
   }
@@ -21902,21 +22161,11 @@ function revalidateAuthority(project, operations, request) {
     operation
   };
 }
-function originOf2(url) {
-  try {
-    return normalizeSiteOrigin(new URL(url).origin);
-  } catch {
-    return null;
-  }
-}
 function isBodyOp(op) {
   return op.kind === "request-body" || op.kind === "response-body";
 }
 function matcherMatches(op, url, method) {
-  const regex = compileUrlRegex(op.matcher.urlRegex.source);
-  if (regex === null || !regex.test(url)) return false;
-  const origin = originOf2(url);
-  if (origin === null || !op.matcher.origins.includes(origin)) return false;
+  if (!sourceMatches(op.matcher.source, url)) return false;
   if (op.matcher.method !== void 0 && op.matcher.method !== method.toUpperCase()) {
     return false;
   }
@@ -22144,13 +22393,33 @@ function writeResponse(res, status, statusMessage, headers, body) {
   res.writeHead(status, statusMessage, out);
   res.end(body);
 }
-function authorizeOp(policy, op, url, method) {
+function initiatorFromHeaders(headers, targetUrl) {
+  const origin = headerValue2(headers, "origin");
+  if (typeof origin === "string" && /^https?:\/\//i.test(origin)) {
+    return origin.endsWith("/") ? origin.slice(0, -1) : origin;
+  }
+  const referer = headerValue2(headers, "referer");
+  if (typeof referer === "string") {
+    try {
+      return new URL(referer).origin;
+    } catch {
+    }
+  }
+  try {
+    return new URL(targetUrl).origin;
+  } catch {
+    return void 0;
+  }
+}
+function authorizeOp(policy, op, url, method, headers) {
   const resourceType = op.matcher.resourceTypes[0];
+  const initiator = initiatorFromHeaders(headers, url);
   const decision = revalidateAuthority(policy.project, policy.operations, {
     groupId: op.groupId,
     ruleId: op.ruleId,
     url,
     method,
+    ...initiator !== void 0 ? { initiator } : {},
     ...resourceType !== void 0 ? { resourceType } : {}
   });
   return decision.allowed;
@@ -22212,7 +22481,7 @@ async function startInterceptProxy(options = {}) {
       }
       let requestBody = bodyResult.body;
       if (needsRequestBody && requestOp !== null && active !== null) {
-        if (!authorizeOp(active, requestOp, targetUrl, method)) {
+        if (!authorizeOp(active, requestOp, targetUrl, method, req.headers)) {
         } else {
           const rewritten = await rewriteRequestBody(
             {
@@ -22223,7 +22492,7 @@ async function startInterceptProxy(options = {}) {
             requestOp.requestBody,
             {
               url: targetUrl,
-              urlRegex: requestOp.matcher.urlRegex.source
+              urlRegex: requestOp.matcher.source.value
             }
           );
           if (rewritten.ok) {
@@ -22245,7 +22514,7 @@ async function startInterceptProxy(options = {}) {
       let responseBody = upstream.body;
       if (responseOp !== null && active !== null) {
         if (responseBody.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes) {
-        } else if (!authorizeOp(active, responseOp, targetUrl, method)) {
+        } else if (!authorizeOp(active, responseOp, targetUrl, method, req.headers)) {
         } else {
           const action = responseOp.responseBody;
           const isReplace = "mode" in action && action.mode === "replace";
@@ -22259,7 +22528,7 @@ async function startInterceptProxy(options = {}) {
             isReplace ? action : void 0,
             {
               url: targetUrl,
-              urlRegex: responseOp.matcher.urlRegex.source
+              urlRegex: responseOp.matcher.source.value
             }
           );
           if (rewritten.ok) {
@@ -22325,33 +22594,29 @@ async function startInterceptProxy(options = {}) {
     }
   };
 }
-function generatePacScript(origins, endpoint, options) {
-  if (!Array.isArray(origins)) {
-    throw new Error("pac origins must be an array");
-  }
-  const valid = [];
-  for (const origin of origins) {
-    const normalized = normalizeSiteOrigin(origin);
-    if (normalized !== null) valid.push(normalized);
+function generatePacScript(routes, endpoint, options) {
+  if (!Array.isArray(routes)) {
+    throw new Error("runtime.pac-route-limit");
   }
-  const unique = Array.from(new Set(valid)).sort();
-  if (unique.length > MAX_PAC_ORIGINS) {
-    throw new Error("pac origin count exceeds maximum");
+  const unique = routes.map((route) => route.hostname).filter((hostname) => typeof hostname === "string" && hostname.length > 0);
+  const sorted = [...new Set(unique)].sort();
+  if (sorted.length > MAX_PAC_ROUTES) {
+    throw new Error("runtime.pac-route-limit");
   }
   const proxyType = options?.proxyType ?? "PROXY";
   const proxy = `${proxyType} ${endpoint.host}:${endpoint.port}`;
-  const originsLiteral = JSON.stringify(unique);
   const proxyLiteral = JSON.stringify(proxy);
+  const checks = sorted.map(
+    (hostname) => `  if (host === ${JSON.stringify(hostname)}) {
+    return ${proxyLiteral};
+  }`
+  );
   return [
     "function FindProxyForURL(url, host) {",
-    `  var origins = ${originsLiteral};`,
-    "  var origin = null;",
-    "  try { origin = new URL(url).origin; } catch (e) { origin = null; }",
-    "  if (origin !== null && origins.indexOf(origin) !== -1) {",
-    `    return ${proxyLiteral};`,
-    "  }",
+    ...checks,
     "  return 'DIRECT';",
-    "}"
+    "}",
+    ""
   ].join("\n");
 }
 var registeredProvider = null;
@@ -22362,7 +22627,7 @@ function registerInterceptionProvider(provider) {
 function getCurrentSession() {
   return currentSession;
 }
-async function startInterception(activation, policyDigest, extensionId, pacOrigins, targetPolicy) {
+async function startInterception(activation, policyDigest, extensionId, pacRoutes, targetPolicy) {
   if (registeredProvider === null) {
     return { kind: "unsupported", reasons: ["no-interception-provider"] };
   }
@@ -22396,10 +22661,10 @@ async function startInterception(activation, policyDigest, extensionId, pacOrigi
   currentSession = {
     sessionId,
     provider: registeredProvider,
-    activation: { ...activation, proxy, pacOrigins },
+    activation: { ...activation, proxy, pacRoutes },
     policyDigest,
     extensionId,
-    pacOrigins,
+    pacRoutes,
     targetPolicy,
     startedAt: activation.startedAt
   };
@@ -22445,7 +22710,7 @@ function createPlatformInterceptionProvider(adapter) {
         reasons
       };
     },
-    async start(activation, origins) {
+    async start(activation, pacRoutes) {
       const capabilities = adapter.detect();
       const reasons = unsupportedReasons(capabilities);
       if (!capabilities.supported || reasons.length > 0) {
@@ -22457,7 +22722,10 @@ function createPlatformInterceptionProvider(adapter) {
         throw new Error("runtime.platform-unsupported");
       }
       const endpoint = await adapter.startTlsProxy(activation);
-      const pac = generatePacScript(origins, endpoint);
+      const pac = generatePacScript(
+        pacRoutes.map((hostname) => ({ hostname })),
+        endpoint
+      );
       try {
         await adapter.installPac(pac);
         active = true;
@@ -22655,8 +22923,9 @@ function arrayValue(values) {
 }
 function matcherValue(operation) {
   const matcher = operation.matcher;
+  const source = matcher.source;
   const method = matcher.method === void 0 ? "" : `,"method":${stringValue(matcher.method)}`;
-  return `{"kind":"matcher","groupId":${stringValue(operation.groupId)},"ruleId":${stringValue(operation.ruleId)},"matcher":{"urlRegex":{"source":${stringValue(matcher.urlRegex.source)},"flags":""},"origins":${arrayValue(matcher.origins)},"resourceTypes":${arrayValue(matcher.resourceTypes)},"priority":${String(matcher.priority)}${method}}}`;
+  return `{"kind":"matcher","groupId":${stringValue(operation.groupId)},"ruleId":${stringValue(operation.ruleId)},"matcher":{"source":{"key":${stringValue(source.key)},"operator":${stringValue(source.operator)},"value":${stringValue(source.value)}},"resourceTypes":${arrayValue(matcher.resourceTypes)},"priority":${String(matcher.priority)}${method}}}`;
 }
 function limitsValue(limits) {
   const fields = [
@@ -22799,12 +23068,13 @@ function validResourceType(value) {
   return typeof value === "string" && RESOURCE_TYPES.includes(value);
 }
 function freezeMatcher(operation) {
+  const source = Object.freeze({
+    key: operation.matcher.source.key,
+    operator: operation.matcher.source.operator,
+    value: operation.matcher.source.value
+  });
   const matcher = Object.freeze({
-    urlRegex: Object.freeze({
-      source: operation.matcher.urlRegex.source,
-      flags: ""
-    }),
-    origins: Object.freeze([...operation.matcher.origins]),
+    source,
     resourceTypes: Object.freeze([...operation.matcher.resourceTypes]),
     priority: operation.matcher.priority,
     ...operation.matcher.method === void 0 ? {} : { method: operation.matcher.method }
@@ -22834,14 +23104,8 @@ function normalizeMatcher(value) {
   if (record.kind !== "matcher" || !validId2(record.groupId) || !validId2(record.ruleId))
     return null;
   const matcherValue2 = record.matcher;
-  if (matcherValue2 === null || typeof matcherValue2 !== "object" || Array.isArray(matcherValue2) || !exactKeys(matcherValue2, [
-    "urlRegex",
-    "origins",
-    "resourceTypes",
-    "priority"
-  ]) && !exactKeys(matcherValue2, [
-    "urlRegex",
-    "origins",
+  if (matcherValue2 === null || typeof matcherValue2 !== "object" || Array.isArray(matcherValue2) || !exactKeys(matcherValue2, ["source", "resourceTypes", "priority"]) && !exactKeys(matcherValue2, [
+    "source",
     "resourceTypes",
     "priority",
     "method"
@@ -22849,22 +23113,14 @@ function normalizeMatcher(value) {
     return null;
   }
   const matcher = matcherValue2;
-  const regexValue = matcher.urlRegex;
-  if (regexValue === null || typeof regexValue !== "object" || Array.isArray(regexValue) || !exactKeys(regexValue, ["source", "flags"])) {
+  const sourceValue = matcher.source;
+  if (sourceValue === null || typeof sourceValue !== "object" || Array.isArray(sourceValue) || !exactKeys(sourceValue, ["key", "operator", "value"])) {
     return null;
   }
-  const regex = regexValue;
-  if (typeof regex.source !== "string" || regex.source.length > LIMITS.maxUrlRegexLength || regex.flags !== "" || compileUrlRegex(regex.source) === null) {
+  const source = sourceValue;
+  if (source.key !== "url" && source.key !== "host" || source.operator !== "regex" || typeof source.value !== "string" || source.value.length === 0 || source.value.length > LIMITS.maxUrlRegexLength || compileUrlRegex(source.value) === null) {
     return null;
   }
-  if (!Array.isArray(matcher.origins) || matcher.origins.length === 0 || matcher.origins.length > LIMITS.maxOriginsPerScope)
-    return null;
-  const origins = [];
-  for (const value2 of matcher.origins) {
-    const normalized = normalizeSiteOrigin(value2);
-    if (normalized === null || origins.includes(normalized)) return null;
-    origins.push(normalized);
-  }
   if (!Array.isArray(matcher.resourceTypes) || matcher.resourceTypes.length === 0 || matcher.resourceTypes.length > LIMITS.maxResourceTypesPerRule)
     return null;
   const resourceTypes = [];
@@ -22893,8 +23149,11 @@ function normalizeMatcher(value) {
     name: resolveMatcherName(record.ruleId, record.name),
     redactSensitiveInLogs,
     matcher: {
-      urlRegex: { source: regex.source, flags: "" },
-      origins,
+      source: {
+        key: source.key,
+        operator: "regex",
+        value: source.value
+      },
       resourceTypes,
       priority: matcher.priority,
       ...method === void 0 ? {} : { method }
@@ -22937,8 +23196,7 @@ function makeGrant(value, matcherById) {
   if (record.kind === "outbound-http") {
     if (record.method !== "GET" && record.method !== "HEAD") return null;
     target = canonicalizeOutboundTarget(record.target);
-    if (target === null || !isOriginAllowed(target, matcher.matcher.origins))
-      return null;
+    if (target === null) return null;
   } else {
     target = normalizeLogicalPath(record.target);
   }
@@ -23060,11 +23318,11 @@ function createNativeRuntimeController(options) {
     aiClient = createAIClient(options.aiProviderConfig);
   }
   async function bindInterception(current, sessionConfig) {
-    if (sessionConfig.pacOrigins.length === 0) {
+    if (sessionConfig.pacRoutes.length === 0) {
       return {
-        activation: { ...current, pacOrigins: [] },
+        activation: { ...current, pacRoutes: [] },
         session: null,
-        interception: { active: false, reasons: ["no-pac-origins"] }
+        interception: { active: false, reasons: ["no-pac-routes"] }
       };
     }
     if (hasActiveSession()) {
@@ -23082,7 +23340,7 @@ function createNativeRuntimeController(options) {
       current,
       sessionConfig.policyDigest,
       sessionConfig.extensionId,
-      sessionConfig.pacOrigins,
+      sessionConfig.pacRoutes,
       {
         public: sessionConfig.targetPolicy.public,
         localOrigins: sessionConfig.targetPolicy.localOrigins
@@ -23098,7 +23356,7 @@ function createNativeRuntimeController(options) {
     const session = getCurrentSession();
     const next = {
       ...current,
-      pacOrigins: sessionConfig.pacOrigins,
+      pacRoutes: sessionConfig.pacRoutes,
       proxy: result.proxy
     };
     return {
@@ -23135,7 +23393,7 @@ function createNativeRuntimeController(options) {
         state: "running",
         startedAt,
         presetDigest: preset.digest,
-        pacOrigins: sessionConfig?.pacOrigins ?? []
+        pacRoutes: sessionConfig?.pacRoutes ?? []
       };
       let session = null;
       if (sessionConfig) {
@@ -23316,7 +23574,7 @@ function createNativeRuntimeController(options) {
         const sessionConfig = {
           policyDigest: typeof meta.policyDigest === "string" ? meta.policyDigest : "",
           extensionId: typeof meta.extensionId === "string" ? meta.extensionId : "",
-          pacOrigins: Array.isArray(meta.pacOrigins) ? meta.pacOrigins : [],
+          pacRoutes: Array.isArray(meta.pacRoutes) ? meta.pacRoutes : [],
           targetPolicy: {
             public: meta.targetPolicy?.public === true || meta.targetPolicy?.publicAllowed === true,
             localOrigins: Array.isArray(meta.targetPolicy?.localOrigins) ? meta.targetPolicy.localOrigins : []
@@ -23333,7 +23591,7 @@ function createNativeRuntimeController(options) {
             ok: bound.interception.active,
             interception: bound.interception,
             ...activation.proxy !== void 0 ? { proxy: activation.proxy } : {},
-            pacOrigins: activation.pacOrigins
+            pacRoutes: activation.pacRoutes
           }
         };
       }
@@ -23406,7 +23664,9 @@ function createNativeRuntimeController(options) {
             };
           }
           if (!preset) throw new Error("runtime not started");
-          const result = authorizeExact(preset, meta.descriptor);
+          const descriptorRecord = typeof meta.descriptor === "object" && meta.descriptor !== null ? meta.descriptor : {};
+          const requestUrl = typeof meta.requestUrl === "string" && meta.requestUrl.length > 0 ? meta.requestUrl : typeof descriptorRecord.target === "string" ? descriptorRecord.target : "";
+          const result = authorizeExact(preset, meta.descriptor, requestUrl);
           op.value();
           if (!result.ok) {
             return {
@@ -24162,13 +24422,13 @@ function createNativeHost(options) {
     }
   };
   const platformProvider = createPlatformInterceptionProvider(platformAdapter);
-  let pendingOrigins = [];
+  let pendingRoutes = [];
   registerInterceptionProvider({
     platform: platformProvider.platform,
     detect: () => platformProvider.detect(),
     async start(activation) {
-      const origins = pendingOrigins.length > 0 ? pendingOrigins : activation.pacOrigins;
-      const endpoint = await platformProvider.start(activation, origins);
+      const routes = pendingRoutes.length > 0 ? pendingRoutes : activation.pacRoutes;
+      const endpoint = await platformProvider.start(activation, routes);
       const policy = controller.getActivePolicy();
       interceptProxy?.setPolicy(
         policy ? { project: policy.project, operations: policy.operations } : null
@@ -24220,8 +24480,8 @@ function createNativeHost(options) {
         }
       }
       if (envelope.type === "runtime.start") {
-        const origins = envelope.metadata.pacOrigins;
-        pendingOrigins = Array.isArray(origins) ? origins.filter((o) => typeof o === "string") : [];
+        const routes = envelope.metadata.pacRoutes;
+        pendingRoutes = Array.isArray(routes) ? routes.filter((o) => typeof o === "string") : [];
       }
       console.error(
         "[rogatio-host] received envelope:",
@@ -25209,6 +25469,10 @@ function buildDimension(state, detail) {
     detail
   };
 }
+function sourceDetail(source, matched) {
+  const subject = source.key === "host" ? "hostname" : "url";
+  return matched ? `${subject} matched /${source.value}/ (${source.key})` : `${subject} did not match /${source.value}/ (${source.key})`;
+}
 function emptySummary() {
   return {
     caseCount: 0,
@@ -25310,15 +25574,6 @@ function dryRunProject(operations, cases, options) {
       errors.push(result.error);
     }
   }
-  const regexCache = /* @__PURE__ */ new Map();
-  const getRegex = (source) => {
-    let cached = regexCache.get(source);
-    if (cached === void 0) {
-      cached = compileUrlRegex(source);
-      regexCache.set(source, cached);
-    }
-    return cached;
-  };
   const results = [];
   let matchedUrlCount = 0;
   let matchedRuleTotal = 0;
@@ -25332,21 +25587,16 @@ function dryRunProject(operations, cases, options) {
     const rules = [];
     for (const op of operations) {
       const matcher = op.matcher;
-      const regex = getRegex(matcher.urlRegex.source);
-      const regexState = regex ? regex.test(testCase.url) ? "matched" : "unmatched" : "unmatched";
-      const originState = matcher.origins.includes(
-        parsed.value.origin
+      const sourceState = sourceMatches(
+        matcher.source,
+        testCase.url
       ) ? "matched" : "unmatched";
       const methodState = testCase.method === void 0 ? "not-applicable" : matcher.method === void 0 || matcher.method === testCase.method ? "matched" : "unmatched";
       const resourceState = testCase.resourceType === void 0 ? "not-applicable" : matcher.resourceTypes.length === 0 || matcher.resourceTypes.includes(testCase.resourceType) ? "matched" : "unmatched";
-      const matched = regexState === "matched" && originState === "matched" && methodState !== "unmatched" && resourceState !== "unmatched";
-      const urlRegexDim = buildDimension(
-        regexState,
-        regexState === "matched" ? `matches /${matcher.urlRegex.source}/` : `does not match /${matcher.urlRegex.source}/`
-      );
-      const originDim = buildDimension(
-        originState,
-        originState === "matched" ? `origin ${parsed.value.origin} in [${matcher.origins.join(", ")}]` : `origin ${parsed.value.origin} not in [${matcher.origins.join(", ")}]`
+      const matched = sourceState === "matched" && methodState !== "unmatched" && resourceState !== "unmatched";
+      const sourceDim = buildDimension(
+        sourceState,
+        sourceDetail(matcher.source, sourceState === "matched")
       );
       const methodDim = buildDimension(
         methodState,
@@ -25366,8 +25616,7 @@ function dryRunProject(operations, cases, options) {
         groupId: op.groupId,
         ruleId: op.ruleId,
         matched,
-        urlRegex: urlRegexDim,
-        effectiveOrigin: originDim,
+        source: sourceDim,
         method: methodDim,
         resourceType: resourceDim,
         actionPreview
@@ -26106,7 +26355,7 @@ var ProjectFileError = class extends ProjectStorageError {
   }
 };
 function emptyProjectDocument() {
-  return { version: 1, name: randomCivilizationProjectName(), groups: [] };
+  return { version: 2, name: randomCivilizationProjectName(), groups: [] };
 }
 var PROJECT_NAME_LEADS = Object.freeze([
   "Apollo",
@@ -26201,6 +26450,18 @@ async function pathExists(path2) {
     );
   }
 }
+function migrateLoadedProject(parsed) {
+  if (parsed.version === 2) return parsed;
+  if (parsed.version !== 1) return parsed;
+  const migrated = migrateV1Project(parsed);
+  if (!migrated.ok) return parsed;
+  for (const notice of migrated.notices) {
+    console.error(
+      `[rogatio] ${notice.code}: ${notice.message} (${notice.path})`
+    );
+  }
+  return migrated.project;
+}
 async function readDocument(id2) {
   try {
     const content = await readFile5(id2, "utf-8");
@@ -26212,7 +26473,7 @@ async function readDocument(id2) {
         "Project file must contain a JSON object"
       );
     }
-    return parsed;
+    return migrateLoadedProject(parsed);
   } catch (e) {
     if (e instanceof ProjectFileError) throw e;
     if (e.code === "ENOENT") {
@@ -27088,8 +27349,18 @@ function usageError(message) {
   return `Error: ${message}
 `;
 }
+function captureSubject(matcher, url) {
+  if (matcher.source.key === "url") return url;
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return null;
+  }
+}
 function previewAction(operation, url) {
-  const captures = matchUrlCaptures(operation.matcher.urlRegex.source, url);
+  const subject = captureSubject(operation.matcher, url);
+  if (subject === null) return null;
+  const captures = matchUrlCaptures(operation.matcher.source.value, subject);
   if (captures === null) return null;
   const expand = (value) => substituteUrlCaptures(value, captures);
   if (operation.kind === "redirect") {
@@ -27396,9 +27667,7 @@ URL: ${urlResult.url}
       for (const rule of urlResult.rules) {
         output += `  ${rule.groupId}/${rule.ruleId}: ${rule.matched ? "MATCHED" : "NOT MATCHED"}
 `;
-        output += `    urlRegex: ${rule.urlRegex.state} - ${rule.urlRegex.detail}
-`;
-        output += `    effectiveOrigin: ${rule.effectiveOrigin.state} - ${rule.effectiveOrigin.detail}
+        output += `    source: ${rule.source.state} - ${rule.source.detail}
 `;
         output += `    method: ${rule.method.state} - ${rule.method.detail}
 `;