@rogatio/cli 6.14.1 → 6.14.3

package/dist/node/index.js

@@ -24445,8 +24445,8 @@ function normalizeMockConfig(value, matcherById) {
     if (!Array.isArray(record.headers) || record.headers.length > LIMITS.maxMockHeadersPerRule)
       return null;
     const normalizedHeaders = [];
-    for (const headerValue3 of record.headers) {
-      const header = normalizeMockHeader(headerValue3);
+    for (const headerValue32 of record.headers) {
+      const header = normalizeMockHeader(headerValue32);
       if (header === null) return null;
       normalizedHeaders.push(header);
     }
@@ -27188,25 +27188,6 @@ import { readFile as readFile4 } from "node:fs/promises";
 import { dirname as dirname6, isAbsolute as isAbsolute5, resolve as resolve2 } from "node:path";
 
 // packages/dry-run/dist/node/index.js
-function parseTestUrl(input) {
-  if (typeof input !== "string" || input.length === 0) {
-    return { ok: false };
-  }
-  let url;
-  try {
-    url = new URL(input);
-  } catch {
-    return { ok: false };
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    return { ok: false };
-  }
-  if (url.origin === "null") {
-    return { ok: false };
-  }
-  return { ok: true, value: { origin: url.origin, href: url.href } };
-}
-var DEFAULT_MAX_CASES = 256;
 function invalidCase(index, message = "Test case is invalid") {
   return {
     code: "dryrun.invalid-case",
@@ -27220,6 +27201,69 @@ function invalidUrl(index, message = "Test case URL is invalid") {
 function invalidOptions() {
   return invalidCase(void 0, "Dry-run options are invalid");
 }
+function batchLimit(maxCases) {
+  return {
+    code: "dryrun.batch-limit",
+    message: `Test batch exceeds maxCases (${maxCases})`
+  };
+}
+function buildDimension(state, detail) {
+  return {
+    state,
+    matched: state === "not-applicable" ? null : state === "matched",
+    detail
+  };
+}
+function sourceDetail(source, matched) {
+  const subject = source.key === "host" ? "hostname" : "url";
+  return matched ? `${subject} matched /${source.value}/ (${source.key})` : `${subject} did not match /${source.value}/ (${source.key})`;
+}
+function sourceDimension(matcher, url) {
+  const sourceState = sourceMatches(matcher.source, url) ? "matched" : "unmatched";
+  return buildDimension(
+    sourceState,
+    sourceDetail(matcher.source, sourceState === "matched")
+  );
+}
+function methodDimension(matcher, testCase) {
+  const methodState = testCase.method === void 0 ? "not-applicable" : matcher.method === void 0 || matcher.method === testCase.method ? "matched" : "unmatched";
+  return buildDimension(
+    methodState,
+    methodState === "not-applicable" ? "method not specified" : methodState === "matched" ? matcher.method === void 0 ? "rule has no method constraint" : `method ${testCase.method} matches` : `rule method ${matcher.method} != ${testCase.method}`
+  );
+}
+function resourceTypeDimension(matcher, testCase) {
+  const resourceState = testCase.resourceType === void 0 ? "not-applicable" : matcher.resourceTypes.length === 0 || matcher.resourceTypes.includes(testCase.resourceType) ? "matched" : "unmatched";
+  return buildDimension(
+    resourceState,
+    resourceState === "not-applicable" ? "resource type not specified" : resourceState === "matched" ? matcher.resourceTypes.length === 0 ? "rule has no resource type constraint" : `resource type ${testCase.resourceType} matches` : `rule resource types [${matcher.resourceTypes.join(", ")}] exclude ${testCase.resourceType}`
+  );
+}
+function safePreview(fn, operation, url, testCase) {
+  try {
+    return fn(operation, url, testCase);
+  } catch {
+    return null;
+  }
+}
+function evaluateRule(operation, testCase, previewAction) {
+  const matcher = operation.matcher;
+  const source = sourceDimension(matcher, testCase.url);
+  const method = methodDimension(matcher, testCase);
+  const resourceType = resourceTypeDimension(matcher, testCase);
+  const matched = source.state === "matched" && method.state !== "unmatched" && resourceType.state !== "unmatched";
+  const actionPreview = previewAction ? safePreview(previewAction, operation, testCase.url, testCase) : null;
+  return {
+    groupId: operation.groupId,
+    ruleId: operation.ruleId,
+    matched,
+    source,
+    method,
+    resourceType,
+    actionPreview
+  };
+}
+var DEFAULT_MAX_CASES = 256;
 function ownPropertyNames(value) {
   try {
     const names = Object.getOwnPropertyNames(value);
@@ -27291,32 +27335,6 @@ function validateCase(raw, index) {
     }
   };
 }
-function safePreview(fn, operation, url, testCase) {
-  try {
-    return fn(operation, url, testCase);
-  } catch {
-    return null;
-  }
-}
-function buildDimension(state, detail) {
-  return {
-    state,
-    matched: state === "not-applicable" ? null : state === "matched",
-    detail
-  };
-}
-function sourceDetail(source, matched) {
-  const subject = source.key === "host" ? "hostname" : "url";
-  return matched ? `${subject} matched /${source.value}/ (${source.key})` : `${subject} did not match /${source.value}/ (${source.key})`;
-}
-function emptySummary() {
-  return {
-    caseCount: 0,
-    urlCount: 0,
-    matchedUrlCount: 0,
-    matchedRuleTotal: 0
-  };
-}
 function normalizeOptions(raw) {
   if (raw === void 0) {
     return { ok: true, maxCases: DEFAULT_MAX_CASES };
@@ -27354,47 +27372,29 @@ function normalizeOptions(raw) {
   }
   return { ok: true, maxCases, previewAction };
 }
-function dryRunProject(operations, cases, options) {
-  const normalizedOptions = normalizeOptions(options);
-  if (!normalizedOptions.ok) {
-    return { results: [], errors: [invalidOptions()], summary: emptySummary() };
-  }
-  const errors = [];
+function readCaseBatch(cases, maxCases) {
   if (!Array.isArray(cases)) {
     return {
-      results: [],
-      errors: [invalidCase(void 0, "Test cases must be an array")],
-      summary: emptySummary()
+      ok: false,
+      error: invalidCase(void 0, "Test cases must be an array")
     };
   }
   let caseCount;
   try {
     caseCount = cases.length;
-    if (caseCount > normalizedOptions.maxCases) {
-      return {
-        results: [],
-        errors: [
-          {
-            code: "dryrun.batch-limit",
-            message: `Test batch exceeds maxCases (${normalizedOptions.maxCases})`
-          }
-        ],
-        summary: emptySummary()
-      };
+    if (caseCount > maxCases) {
+      return { ok: false, error: batchLimit(maxCases) };
     }
     for (let index = 0; index < caseCount; index += 1) {
       if (!Object.hasOwn(cases, index)) {
-        return {
-          results: [],
-          errors: [invalidCase(index)],
-          summary: emptySummary()
-        };
+        return { ok: false, error: invalidCase(index) };
       }
     }
   } catch {
-    return { results: [], errors: [invalidCase()], summary: emptySummary() };
+    return { ok: false, error: invalidCase() };
   }
-  const validCases = [];
+  const errors = [];
+  const valid = [];
   for (let index = 0; index < caseCount; index += 1) {
     let raw;
     try {
@@ -27405,15 +27405,57 @@ function dryRunProject(operations, cases, options) {
     }
     const result = validateCase(raw, index);
     if (result.ok) {
-      validCases.push({ value: result.value, index });
+      valid.push({ value: result.value, index });
     } else {
       errors.push(result.error);
     }
   }
+  return { ok: true, valid, errors };
+}
+function parseTestUrl(input) {
+  if (typeof input !== "string" || input.length === 0) {
+    return { ok: false };
+  }
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return { ok: false };
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return { ok: false };
+  }
+  if (url.origin === "null") {
+    return { ok: false };
+  }
+  return { ok: true, value: { origin: url.origin, href: url.href } };
+}
+function emptySummary() {
+  return {
+    caseCount: 0,
+    urlCount: 0,
+    matchedUrlCount: 0,
+    matchedRuleTotal: 0
+  };
+}
+function dryRunProject(operations, cases, options) {
+  const normalizedOptions = normalizeOptions(options);
+  if (!normalizedOptions.ok) {
+    return { results: [], errors: [invalidOptions()], summary: emptySummary() };
+  }
+  const batch = readCaseBatch(cases, normalizedOptions.maxCases);
+  if (!batch.ok) {
+    return {
+      results: [],
+      errors: [batch.error],
+      summary: emptySummary()
+    };
+  }
+  const errors = [...batch.errors];
   const results = [];
   let matchedUrlCount = 0;
   let matchedRuleTotal = 0;
-  for (const validCase of validCases) {
+  for (const validCase of batch.valid) {
     const testCase = validCase.value;
     const parsed = parseTestUrl(testCase.url);
     if (!parsed.ok) {
@@ -27422,41 +27464,7 @@ function dryRunProject(operations, cases, options) {
     }
     const rules = [];
     for (const op of operations) {
-      const matcher = op.matcher;
-      const sourceState = sourceMatches(
-        matcher.source,
-        testCase.url
-      ) ? "matched" : "unmatched";
-      const methodState = testCase.method === void 0 ? "not-applicable" : matcher.method === void 0 || matcher.method === testCase.method ? "matched" : "unmatched";
-      const resourceState = testCase.resourceType === void 0 ? "not-applicable" : matcher.resourceTypes.length === 0 || matcher.resourceTypes.includes(testCase.resourceType) ? "matched" : "unmatched";
-      const matched = sourceState === "matched" && methodState !== "unmatched" && resourceState !== "unmatched";
-      const sourceDim = buildDimension(
-        sourceState,
-        sourceDetail(matcher.source, sourceState === "matched")
-      );
-      const methodDim = buildDimension(
-        methodState,
-        methodState === "not-applicable" ? "method not specified" : methodState === "matched" ? matcher.method === void 0 ? "rule has no method constraint" : `method ${testCase.method} matches` : `rule method ${matcher.method} != ${testCase.method}`
-      );
-      const resourceDim = buildDimension(
-        resourceState,
-        resourceState === "not-applicable" ? "resource type not specified" : resourceState === "matched" ? matcher.resourceTypes.length === 0 ? "rule has no resource type constraint" : `resource type ${testCase.resourceType} matches` : `rule resource types [${matcher.resourceTypes.join(", ")}] exclude ${testCase.resourceType}`
-      );
-      const actionPreview = normalizedOptions.previewAction ? safePreview(
-        normalizedOptions.previewAction,
-        op,
-        testCase.url,
-        testCase
-      ) : null;
-      rules.push({
-        groupId: op.groupId,
-        ruleId: op.ruleId,
-        matched,
-        source: sourceDim,
-        method: methodDim,
-        resourceType: resourceDim,
-        actionPreview
-      });
+      rules.push(evaluateRule(op, testCase, normalizedOptions.previewAction));
     }
     const matchedRuleCount = rules.filter((rule) => rule.matched).length;
     results.push({
@@ -27473,7 +27481,7 @@ function dryRunProject(operations, cases, options) {
     results,
     errors,
     summary: {
-      caseCount: validCases.length,
+      caseCount: batch.valid.length,
       urlCount: results.length,
       matchedUrlCount,
       matchedRuleTotal
@@ -27548,6 +27556,45 @@ function previewRuleAction(operation, url) {
   return null;
 }
 
+// packages/cli/src/commands/diagnose.ts
+function diagnoseProject(projectData) {
+  const diagnostics = [];
+  const schemaResult = validateProjectDetailed(projectData);
+  if (!schemaResult.valid) {
+    for (const error of schemaResult.errors) {
+      diagnostics.push({
+        code: `schema.${error.keyword}`,
+        severity: "error",
+        path: error.instancePath || "/",
+        message: error.message,
+        params: error.params
+      });
+    }
+    return { diagnostics, stage: "schema" };
+  }
+  const compileResult = compileProject(schemaResult.data);
+  if (!compileResult.ok) {
+    for (const diag of compileResult.diagnostics) {
+      diagnostics.push({
+        code: diag.code,
+        severity: diag.severity,
+        path: diag.path,
+        message: diag.message,
+        params: { ...diag.params }
+      });
+    }
+    return { diagnostics, stage: "compiler" };
+  }
+  return {
+    diagnostics,
+    project: schemaResult.data,
+    operations: compileResult.operations
+  };
+}
+function formatDiagnostics(diagnostics) {
+  return diagnostics.map((diag) => `${diag.path}: ${diag.message} (${diag.code})`).join("\n");
+}
+
 // packages/cli/src/mock-root-config.ts
 import { mkdir as mkdir3, readFile as readFile3, realpath as realpath3, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -27616,6 +27663,26 @@ async function writeSavedMockRoot(filePath, root, env = process.env) {
 }
 
 // packages/cli/src/server/routes.ts
+function headerValue3(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length === 1 && typeof value[0] === "string") {
+    return value[0];
+  }
+  return void 0;
+}
+function isAllowedEditorHost(host, boundPort) {
+  if (host === void 0 || !Number.isInteger(boundPort) || boundPort <= 0) {
+    return false;
+  }
+  const expected = String(boundPort);
+  return host === `127.0.0.1:${expected}` || host === `localhost:${expected}`;
+}
+function isAllowedEditorOrigin(origin, boundPort) {
+  if (origin === void 0) return true;
+  if (!Number.isInteger(boundPort) || boundPort <= 0) return false;
+  const expected = String(boundPort);
+  return origin === `http://127.0.0.1:${expected}` || origin === `http://localhost:${expected}`;
+}
 function generateCsrfToken() {
   return randomBytes3(16).toString("hex");
 }
@@ -27694,26 +27761,14 @@ function parseUrl(req) {
   );
   return { pathname: url.pathname, searchParams: url.searchParams };
 }
-function parseDiagnostics(result) {
-  if (!result.valid) {
-    return result.errors.map((e) => ({
-      code: `schema.${e.keyword}`,
-      severity: "error",
-      path: e.instancePath || "/",
-      message: e.message,
-      params: e.params
-    }));
-  }
-  return [];
-}
 function schemaDiagnosticsForAssist(value) {
-  const result = validateProjectDetailed(value);
-  if (result.valid) return [];
-  return result.errors.map((error) => ({
-    code: `schema.${error.keyword}`,
+  const diagnosis = diagnoseProject(value);
+  if (diagnosis.stage !== "schema") return [];
+  return diagnosis.diagnostics.map((diagnostic) => ({
+    code: diagnostic.code,
     severity: "error",
-    path: error.instancePath || "/",
-    message: error.message ?? "The project contains invalid data."
+    path: diagnostic.path,
+    message: diagnostic.message
   }));
 }
 function isAIAssistRequestBody(body) {
@@ -27725,36 +27780,42 @@ function isAIAssistRequestBody(body) {
   if (!isRecord2(body.context) || !isRecord2(body.context.project)) return false;
   return true;
 }
-function parseCompilerDiagnostics(result) {
-  if (!result.ok) {
-    return result.diagnostics.map((d) => ({
-      code: d.code,
-      severity: d.severity,
-      path: d.path,
-      message: d.message,
-      params: d.params
-    }));
-  }
-  return [];
-}
 function createRoutes(context) {
   return async function handleRequest(req, res) {
+    const host = headerValue3(req.headers.host);
+    if (!isAllowedEditorHost(host, context.boundPort)) {
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          code: "host-invalid",
+          message: "Invalid Host header"
+        })
+      );
+      return;
+    }
     const { pathname } = parseUrl(req);
     const method = req.method || "GET";
-    const corsHeaders = {
-      "Access-Control-Allow-Origin": "http://127.0.0.1:*",
-      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-      "Access-Control-Allow-Headers": "Content-Type, X-CSRF-Token"
-    };
+    if (method === "POST") {
+      const origin = headerValue3(req.headers.origin);
+      if (!isAllowedEditorOrigin(origin, context.boundPort)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "origin-invalid",
+            message: "Invalid Origin header"
+          })
+        );
+        return;
+      }
+    }
     if (method === "OPTIONS") {
-      res.writeHead(204, corsHeaders);
+      res.writeHead(204);
       res.end();
       return;
     }
     if (pathname === "/editor.html" && method === "GET") {
       res.writeHead(200, {
-        "Content-Type": "text/html; charset=utf-8",
-        ...corsHeaders
+        "Content-Type": "text/html; charset=utf-8"
       });
       res.end(context.editorHtml);
       return;
@@ -27763,8 +27824,7 @@ function createRoutes(context) {
       try {
         const bundle = await readFile4(context.editorBundlePath, "utf-8");
         res.writeHead(200, {
-          "Content-Type": "text/javascript; charset=utf-8",
-          ...corsHeaders
+          "Content-Type": "text/javascript; charset=utf-8"
         });
         res.end(bundle);
       } catch (e) {
@@ -27782,8 +27842,7 @@ function createRoutes(context) {
       try {
         const css = await readFile4(context.editorCssPath, "utf-8");
         res.writeHead(200, {
-          "Content-Type": "text/css; charset=utf-8",
-          ...corsHeaders
+          "Content-Type": "text/css; charset=utf-8"
         });
         res.end(css);
       } catch (e) {
@@ -27807,8 +27866,7 @@ function createRoutes(context) {
       try {
         const font = await readFile4(resolve2(context.editorFontsPath, fileName));
         res.writeHead(200, {
-          "Content-Type": "font/woff2",
-          ...corsHeaders
+          "Content-Type": "font/woff2"
         });
         res.end(font);
       } catch {
@@ -27843,14 +27901,9 @@ function createRoutes(context) {
         res.end(JSON.stringify(failure2.body));
         return;
       }
-      const schemaResult = validateProjectDetailed(body);
-      const diagnostics = [...parseDiagnostics(schemaResult)];
-      if (schemaResult.valid) {
-        const compileResult = compileProject(schemaResult.data);
-        diagnostics.push(...parseCompilerDiagnostics(compileResult));
-      }
+      const diagnosis = diagnoseProject(body);
       res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ diagnostics }));
+      res.end(JSON.stringify({ diagnostics: diagnosis.diagnostics }));
       return;
     }
     if (pathname === "/api/mock-root" && method === "GET") {
@@ -27928,26 +27981,25 @@ function createRoutes(context) {
         res.end(JSON.stringify(failure2.body));
         return;
       }
-      const schemaResult = validateProjectDetailed(body);
-      if (!schemaResult.valid) {
+      const diagnosis = diagnoseProject(body);
+      if (diagnosis.stage === "schema") {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(
           JSON.stringify({
             code: "validation-failed",
             message: "Project validation failed",
-            diagnostics: parseDiagnostics(schemaResult)
+            diagnostics: diagnosis.diagnostics
           })
         );
         return;
       }
-      const compileResult = compileProject(schemaResult.data);
-      if (!compileResult.ok) {
+      if (diagnosis.stage === "compiler") {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(
           JSON.stringify({
             code: "compilation-failed",
             message: "Project compilation failed",
-            diagnostics: parseCompilerDiagnostics(compileResult)
+            diagnostics: diagnosis.diagnostics
           })
         );
         return;
@@ -28026,35 +28078,37 @@ function createRoutes(context) {
         );
         return;
       }
-      const schemaResult = validateProjectDetailed(body.project);
-      if (!schemaResult.valid) {
+      const diagnosis = diagnoseProject(body.project);
+      if (diagnosis.stage === "schema") {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(
           JSON.stringify({
             code: "validation-failed",
             message: "Project validation failed",
-            diagnostics: parseDiagnostics(schemaResult)
+            diagnostics: diagnosis.diagnostics
           })
         );
         return;
       }
-      const compileResult = compileProject(schemaResult.data);
-      if (!compileResult.ok) {
+      if (diagnosis.stage === "compiler") {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(
           JSON.stringify({
             code: "compilation-failed",
             message: "Project compilation failed",
-            diagnostics: parseCompilerDiagnostics(compileResult)
+            diagnostics: diagnosis.diagnostics
           })
         );
         return;
       }
+      if (diagnosis.operations === void 0) {
+        throw new Error("Valid project diagnosis is missing operations");
+      }
       const requested = isRecord2(body.options) && typeof body.options.maxCases === "number" && Number.isSafeInteger(body.options.maxCases) && body.options.maxCases > 0 ? body.options.maxCases : void 0;
       const options = { previewAction: previewRuleAction };
       if (requested !== void 0) options.maxCases = requested;
       const result = dryRunProject(
-        compileResult.operations,
+        diagnosis.operations,
         body.cases,
         options
       );
@@ -28177,8 +28231,7 @@ function createRoutes(context) {
         res.writeHead(200, {
           "Content-Type": "text/event-stream",
           "Cache-Control": "no-cache",
-          Connection: "keep-alive",
-          ...corsHeaders
+          Connection: "keep-alive"
         });
         const stream = context.aiClient?.stream(options);
         for await (const chunk of stream) {
@@ -28805,6 +28858,7 @@ async function editCommand(args, options = {}) {
     shutdown: () => {
       shutdown();
     },
+    boundPort: 0,
     editorHtml: "",
     editorBundlePath: "",
     editorCssPath: "",
@@ -28824,6 +28878,7 @@ async function editCommand(args, options = {}) {
     return { exitCode: Promise.resolve(2), shutdown: () => {
     } };
   }
+  context.boundPort = server.port;
   const serverUrl = `http://127.0.0.1:${server.port}`;
   const editorUrl = `${serverUrl}/editor.html`;
   const {
@@ -28950,9 +29005,9 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
       import { createEditor } from '@rogatio/editor';
     
     const root = document.getElementById('editor-root');
-    const apiBase = '${apiBase}';
-    const csrfToken = '${csrfToken}';
-    const filePath = '${filePath}';
+    const apiBase = ${JSON.stringify(apiBase)};
+    const csrfToken = ${JSON.stringify(csrfToken)};
+    const filePath = ${JSON.stringify(filePath)};
     
     async function fetchProject() {
       const res = await fetch(apiBase + '/api/project');
@@ -29181,9 +29236,12 @@ var METHOD_SET = new Set(HTTP_METHODS);
 var SOURCE_CHANGE = {
   caseInsensitive: "The case-insensitive match flag was dropped. Rogatio regular expressions are case-sensitive.",
   hostPort: "Requestly compares the host and a non-default port. This host condition matches the hostname on any port.",
-  hostAsUrl: "The host condition was imported as a URL regular expression so the port stays part of the match.",
+  hostAsUrl: "The host condition was imported as a URL regular expression over the authority. Wildcard host patterns accept any numeric port; Contains does not pin a port.",
   path: "The path condition was imported as a URL regular expression."
 };
+var HOST_MATCHES_SKIP_REASON = "Host regular expressions cannot be confined to the host in a URL regex.";
+var HOST_AUTHORITY_META_SKIP_REASON = "Host Contains or Wildcard values with /, ?, #, @, or \\ cannot be confined to the host in a URL regex.";
+var HOST_AUTHORITY_META = /[/?#@\\]/;
 function escapeRegex(literal) {
   return literal.replace(/[\\^$*+?.()|[\]{}]/g, "\\$&");
 }
@@ -29317,24 +29375,26 @@ function convertHost(operator, value) {
     };
   }
   if (operator === "Contains") {
-    const body = value.length === 0 ? "[^/?#]*" : `[^/?#]*${escapeRegex(value)}[^/?#]*`;
+    if (HOST_AUTHORITY_META.test(value)) {
+      return { ok: false, reason: HOST_AUTHORITY_META_SKIP_REASON };
+    }
+    const body = value.length === 0 ? "[^/?#@]*" : `[^/?#@]*${escapeRegex(value)}[^/?#@]*`;
     return finishUrl(`^https?:\\/\\/${body}(?:[/?#].*)?$`, [
       SOURCE_CHANGE.hostAsUrl
     ]);
   }
   if (operator === "Wildcard_Matches") {
-    return finishUrl(`^https?:\\/\\/${wildcardBody(value)}(?:[/?#].*)?$`, [
-      SOURCE_CHANGE.hostAsUrl
-    ]);
-  }
-  if (operator === "Matches") {
-    const parsed = parseRequestlyRegex(value);
-    if (!parsed.ok) return parsed;
+    if (HOST_AUTHORITY_META.test(value)) {
+      return { ok: false, reason: HOST_AUTHORITY_META_SKIP_REASON };
+    }
     return finishUrl(
-      `^https?:\\/\\/(?:${parsed.source})(?:[/?#].*)?$`,
-      parsed.caseInsensitive ? [SOURCE_CHANGE.hostAsUrl, SOURCE_CHANGE.caseInsensitive] : [SOURCE_CHANGE.hostAsUrl]
+      `^https?:\\/\\/${hostWildcardBody(value)}(?::[0-9]+)?(?:[/?#].*)?$`,
+      [SOURCE_CHANGE.hostAsUrl]
     );
   }
+  if (operator === "Matches") {
+    return { ok: false, reason: HOST_MATCHES_SKIP_REASON };
+  }
   return { ok: false, reason: `Unsupported source operator "${operator}".` };
 }
 function convertPath(operator, value) {
@@ -29403,6 +29463,9 @@ function parseRequestlyRegex(value) {
 function wildcardBody(pattern) {
   return pattern.split("*").map((part) => escapeRegex(part)).join("(.*?)");
 }
+function hostWildcardBody(pattern) {
+  return pattern.split("*").map((part) => escapeRegex(part)).join("([^/?#@]*?)");
+}
 function isRequestlyRegexLiteral(value) {
   return REQUESTLY_REGEX.test(value);
 }
@@ -30987,41 +31050,6 @@ function cloneProject(value) {
   return record;
 }
 
-// packages/cli/src/commands/diagnose.ts
-function diagnoseProject(projectData) {
-  const diagnostics = [];
-  const schemaResult = validateProjectDetailed(projectData);
-  if (!schemaResult.valid) {
-    for (const error of schemaResult.errors) {
-      diagnostics.push({
-        code: `schema.${error.keyword}`,
-        severity: "error",
-        path: error.instancePath || "/",
-        message: error.message,
-        params: error.params
-      });
-    }
-    return { diagnostics };
-  }
-  const compileResult = compileProject(schemaResult.data);
-  if (!compileResult.ok) {
-    for (const diag of compileResult.diagnostics) {
-      diagnostics.push({
-        code: diag.code,
-        severity: diag.severity,
-        path: diag.path,
-        message: diag.message,
-        params: { ...diag.params }
-      });
-    }
-    return { diagnostics };
-  }
-  return { diagnostics, project: schemaResult.data };
-}
-function formatDiagnostics(diagnostics) {
-  return diagnostics.map((diag) => `${diag.path}: ${diag.message} (${diag.code})`).join("\n");
-}
-
 // packages/cli/src/commands/import.ts
 async function importCommand(args) {
   const parsed = parseImportArgs(args);
@@ -31579,27 +31607,6 @@ function resultOptions(maxCases) {
   if (maxCases !== void 0) options.maxCases = maxCases;
   return options;
 }
-function diagnosticsFromSchema(projectData) {
-  const result = validateProjectDetailed(projectData);
-  if (result.valid) return [];
-  return result.errors.map((error) => ({
-    code: `schema.${error.keyword}`,
-    severity: "error",
-    path: error.instancePath || "/",
-    message: error.message,
-    params: error.params
-  }));
-}
-function diagnosticsFromCompiler(result) {
-  if (result.ok) return [];
-  return result.diagnostics.map((diagnostic) => ({
-    code: diagnostic.code,
-    severity: diagnostic.severity,
-    path: diagnostic.path,
-    message: diagnostic.message,
-    params: diagnostic.params
-  }));
-}
 function jsonOutput(value) {
   return `${JSON.stringify(value, null, 2)}
 `;
@@ -31741,21 +31748,9 @@ async function testCommandImpl(args, stdinInput, captureOutput, options = {}) {
     console.error(output.trim());
     return 2;
   }
-  const schemaResult = validateProjectDetailed(projectData);
-  let diagnostics = diagnosticsFromSchema(projectData);
-  if (!schemaResult.valid) {
-    const output = jsonMode ? jsonOutput({ diagnostics }) : diagnostics.map(
-      (diagnostic) => `${diagnostic.path}: ${diagnostic.message} (${diagnostic.code})
-`
-    ).join("");
-    if (captureOutput) return output;
-    if (jsonMode) console.log(output.trim());
-    else console.error(output.trim());
-    return 1;
-  }
-  const compileResult = compileProject(schemaResult.data);
-  diagnostics = diagnosticsFromCompiler(compileResult);
-  if (!compileResult.ok) {
+  const diagnosis = diagnoseProject(projectData);
+  if (diagnosis.stage !== void 0 || diagnosis.project === void 0 || diagnosis.operations === void 0) {
+    const diagnostics = diagnosis.diagnostics;
     const output = jsonMode ? jsonOutput({ diagnostics }) : diagnostics.map(
       (diagnostic) => `${diagnostic.path}: ${diagnostic.message} (${diagnostic.code})
 `
@@ -31771,7 +31766,7 @@ async function testCommandImpl(args, stdinInput, captureOutput, options = {}) {
     defaultResourceType
   );
   const dryRunResult = dryRunProject(
-    compileResult.operations,
+    diagnosis.operations,
     testCases,
     resultOptions(maxCases)
   );
@@ -31781,13 +31776,11 @@ async function testCommandImpl(args, stdinInput, captureOutput, options = {}) {
     console.log(output.trim());
   } else {
     const groupNames = /* @__PURE__ */ new Map();
-    if (schemaResult.valid) {
-      for (const group of schemaResult.data.groups) {
-        groupNames.set(group.id, group.name);
-      }
+    for (const group of diagnosis.project.groups) {
+      groupNames.set(group.id, group.name);
     }
     const labels = /* @__PURE__ */ new Map();
-    for (const operation of compileResult.operations) {
+    for (const operation of diagnosis.operations) {
       const groupName = groupNames.get(operation.groupId);
       labels.set(
         `${operation.groupId}/${operation.ruleId}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.14.1",
+  "version": "6.14.3",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",