@rogatio/cli 6.6.4 → 6.7.0

package/dist/node/index.js

@@ -2,7 +2,7 @@
 
 // packages/cli/src/index.ts
 import { realpathSync } from "node:fs";
-import { basename as basename3, dirname as dirname8, resolve as resolve8 } from "node:path";
+import { basename as basename3, dirname as dirname8, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/runtime/dist/node/index.js
@@ -219,6 +219,7 @@ var LIMITS = Object.freeze({
   maxRequestBodyOperations: 32,
   maxLocalOrigins: 32
 });
+var NON_ALPHANUMERIC = /[^a-z0-9]+/u;
 var WHITESPACE_RUN = /\s+/gu;
 var FALLBACK_PREFIX = Object.freeze({
   group: "Group",
@@ -228,6 +229,46 @@ function normalizeNameKey(name) {
   if (typeof name !== "string") return "";
   return name.trim().replace(WHITESPACE_RUN, " ").toLowerCase();
 }
+function pascalCase(value) {
+  const tokens = value.toLowerCase().split(NON_ALPHANUMERIC);
+  let result = "";
+  for (const token of tokens) {
+    const first = token.charAt(0);
+    if (first.length === 0) continue;
+    result += first.toUpperCase() + token.slice(1);
+  }
+  return result;
+}
+function allocate(stem, reserved, maxLength) {
+  for (let suffix = 1; ; suffix += 1) {
+    const suffixText = suffix === 1 ? "" : String(suffix);
+    const room = Math.max(1, maxLength - suffixText.length);
+    const candidate = `${stem.slice(0, room)}${suffixText}`;
+    if (reserved.has(candidate)) continue;
+    reserved.add(candidate);
+    return candidate;
+  }
+}
+function deriveEntityId(name, kind, reserved) {
+  const derived = pascalCase(typeof name === "string" ? name : "");
+  return allocate(
+    derived.length > 0 ? derived : FALLBACK_PREFIX[kind],
+    reserved,
+    LIMITS.maxIdLength
+  );
+}
+function uniqueName(base, reserved) {
+  const label2 = typeof base === "string" ? base : "";
+  for (let suffix = 1; ; suffix += 1) {
+    const suffixText = suffix === 1 ? "" : ` ${suffix}`;
+    const room = Math.max(1, LIMITS.maxLabelLength - suffixText.length);
+    const candidate = `${label2.slice(0, room)}${suffixText}`;
+    const key = normalizeNameKey(candidate);
+    if (reserved.has(key)) continue;
+    reserved.add(key);
+    return candidate;
+  }
+}
 function normalizeSiteOrigin(value) {
   if (typeof value !== "string" || value.length === 0 || value.trim() !== value)
     return null;
@@ -1023,7 +1064,7 @@ function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
           return { valid: false };
         }
       }
-      const snapshot2 = new Array(length);
+      const snapshot22 = new Array(length);
       for (let index = 0; index < length; index += 1) {
         const descriptor = Object.getOwnPropertyDescriptor(
           value,
@@ -1034,11 +1075,11 @@ function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
         }
         const child = snapshotOwnData(descriptor.value, ancestors);
         if (!child.valid) return child;
-        snapshot2[index] = child.value;
+        snapshot22[index] = child.value;
       }
-      return { valid: true, value: snapshot2 };
+      return { valid: true, value: snapshot22 };
     }
-    const snapshot = /* @__PURE__ */ Object.create(null);
+    const snapshot2 = /* @__PURE__ */ Object.create(null);
     for (const key of Object.getOwnPropertyNames(value)) {
       const descriptor = Object.getOwnPropertyDescriptor(value, key);
       if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
@@ -1046,14 +1087,14 @@ function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
       }
       const child = snapshotOwnData(descriptor.value, ancestors);
       if (!child.valid) return child;
-      Object.defineProperty(snapshot, key, {
+      Object.defineProperty(snapshot2, key, {
         configurable: true,
         enumerable: true,
         value: child.value,
         writable: true
       });
     }
-    return { valid: true, value: snapshot };
+    return { valid: true, value: snapshot2 };
   } catch {
     return { valid: false };
   } finally {
@@ -1070,12 +1111,12 @@ var ownArrayEntriesError = {
 };
 var guardedProjectValidator = Object.assign(
   (value) => {
-    const snapshot = snapshotOwnData(value);
-    if (!snapshot.valid) {
+    const snapshot2 = snapshotOwnData(value);
+    if (!snapshot2.valid) {
       guardedProjectValidator.errors = [ownArrayEntriesError];
       return false;
     }
-    const valid = compiledProjectValidator(snapshot.value);
+    const valid = compiledProjectValidator(snapshot2.value);
     guardedProjectValidator.errors = compiledProjectValidator.errors ?? null;
     return valid;
   },
@@ -1621,8 +1662,8 @@ function validateRedirectDestination(destination, urlRegex) {
   return issues;
 }
 function validateProjectDetailed(value) {
-  const snapshot = snapshotOwnData(value);
-  if (!snapshot.valid) {
+  const snapshot2 = snapshotOwnData(value);
+  if (!snapshot2.valid) {
     return {
       valid: false,
       errors: [
@@ -1635,10 +1676,10 @@ function validateProjectDetailed(value) {
       ]
     };
   }
-  if (!projectValidator(snapshot.value)) {
+  if (!projectValidator(snapshot2.value)) {
     return { valid: false, errors: ajvIssues(projectValidator.errors) };
   }
-  const errors = semanticIssues(snapshot.value);
+  const errors = semanticIssues(snapshot2.value);
   return errors.length > 0 ? { valid: false, errors } : { valid: true, data: value };
 }
 
@@ -1777,7 +1818,7 @@ function snapshotOwnData2(value, ancestors = /* @__PURE__ */ new WeakSet()) {
           return { valid: false };
         }
       }
-      const snapshot2 = new Array(length);
+      const snapshot22 = new Array(length);
       for (let index = 0; index < length; index += 1) {
         const descriptor = Object.getOwnPropertyDescriptor(
           value,
@@ -1788,11 +1829,11 @@ function snapshotOwnData2(value, ancestors = /* @__PURE__ */ new WeakSet()) {
         }
         const child = snapshotOwnData2(descriptor.value, ancestors);
         if (!child.valid) return child;
-        snapshot2[index] = child.value;
+        snapshot22[index] = child.value;
       }
-      return { valid: true, value: snapshot2 };
+      return { valid: true, value: snapshot22 };
     }
-    const snapshot = /* @__PURE__ */ Object.create(null);
+    const snapshot2 = /* @__PURE__ */ Object.create(null);
     for (const key of Object.getOwnPropertyNames(value)) {
       const descriptor = Object.getOwnPropertyDescriptor(value, key);
       if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
@@ -1800,14 +1841,14 @@ function snapshotOwnData2(value, ancestors = /* @__PURE__ */ new WeakSet()) {
       }
       const child = snapshotOwnData2(descriptor.value, ancestors);
       if (!child.valid) return child;
-      Object.defineProperty(snapshot, key, {
+      Object.defineProperty(snapshot2, key, {
         configurable: true,
         enumerable: true,
         value: child.value,
         writable: true
       });
     }
-    return { valid: true, value: snapshot };
+    return { valid: true, value: snapshot2 };
   } catch {
     return { valid: false };
   } finally {
@@ -1925,8 +1966,8 @@ function compileOperations(project) {
   return operations;
 }
 function compileProject(value) {
-  const snapshot = snapshotOwnData2(value);
-  if (!snapshot.valid) {
+  const snapshot2 = snapshotOwnData2(value);
+  if (!snapshot2.valid) {
     return {
       ok: false,
       operations: [],
@@ -1942,7 +1983,7 @@ function compileProject(value) {
   }
   let validation;
   try {
-    validation = validateProjectDetailed(snapshot.value);
+    validation = validateProjectDetailed(snapshot2.value);
   } catch {
     return { ok: false, operations: [], diagnostics: [invariantDiagnostic()] };
   }
@@ -21694,7 +21735,7 @@ function snapshotOwnData3(value, ancestors = /* @__PURE__ */ new WeakSet()) {
           return { valid: false };
         }
       }
-      const snapshot2 = new Array(length);
+      const snapshot22 = new Array(length);
       for (let index = 0; index < length; index += 1) {
         const descriptor = Object.getOwnPropertyDescriptor(
           value,
@@ -21705,13 +21746,13 @@ function snapshotOwnData3(value, ancestors = /* @__PURE__ */ new WeakSet()) {
         }
         const child = snapshotOwnData3(descriptor.value, ancestors);
         if (!child.valid) return child;
-        snapshot2[index] = child.value;
+        snapshot22[index] = child.value;
       }
-      return { valid: true, value: snapshot2 };
+      return { valid: true, value: snapshot22 };
     }
     const names = Object.getOwnPropertyNames(value);
     if (names.length > MAX_OBJECT_PROPERTIES) return { valid: false };
-    const snapshot = /* @__PURE__ */ Object.create(null);
+    const snapshot2 = /* @__PURE__ */ Object.create(null);
     for (const key of names) {
       const descriptor = Object.getOwnPropertyDescriptor(value, key);
       if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
@@ -21719,14 +21760,14 @@ function snapshotOwnData3(value, ancestors = /* @__PURE__ */ new WeakSet()) {
       }
       const child = snapshotOwnData3(descriptor.value, ancestors);
       if (!child.valid) return child;
-      Object.defineProperty(snapshot, key, {
+      Object.defineProperty(snapshot2, key, {
         configurable: true,
         enumerable: true,
         value: child.value,
         writable: true
       });
     }
-    return { valid: true, value: snapshot };
+    return { valid: true, value: snapshot2 };
   } catch {
     return { valid: false };
   } finally {
@@ -21808,10 +21849,10 @@ function validId(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(value);
 }
 function exactDescriptor(value) {
-  const snapshot = snapshotOwnData3(value);
-  if (!snapshot.valid || snapshot.value === null || typeof snapshot.value !== "object" || Array.isArray(snapshot.value))
+  const snapshot2 = snapshotOwnData3(value);
+  if (!snapshot2.valid || snapshot2.value === null || typeof snapshot2.value !== "object" || Array.isArray(snapshot2.value))
     return null;
-  const record = snapshot.value;
+  const record = snapshot2.value;
   const keys = ["groupId", "ruleId", "operationId", "kind", "target", "method"];
   if (Object.keys(record).length !== keys.length || !keys.every((key) => hasOwn(record, key)))
     return null;
@@ -22653,7 +22694,7 @@ function readBoundedBody(req, maxBytes) {
     const chunks = [];
     let total = 0;
     let settled = false;
-    const finish = (result) => {
+    const finish2 = (result) => {
       if (settled) return;
       settled = true;
       resolve22(result);
@@ -22662,16 +22703,16 @@ function readBoundedBody(req, maxBytes) {
       total += chunk.byteLength;
       if (total > maxBytes) {
         req.destroy();
-        finish({ ok: false, reason: "oversized" });
+        finish2({ ok: false, reason: "oversized" });
         return;
       }
       chunks.push(chunk);
     });
     req.on("end", () => {
-      finish({ ok: true, body: Buffer.concat(chunks) });
+      finish2({ ok: true, body: Buffer.concat(chunks) });
     });
     req.on("error", () => {
-      finish({ ok: true, body: Buffer.concat(chunks) });
+      finish2({ ok: true, body: Buffer.concat(chunks) });
     });
   });
 }
@@ -23841,12 +23882,12 @@ function makeGrant(value, matcherById) {
   });
 }
 function normalizeRuntimePreset(value) {
-  const snapshot = snapshotOwnData3(value);
-  if (!snapshot.valid || snapshot.value === null || typeof snapshot.value !== "object" || Array.isArray(snapshot.value)) {
+  const snapshot2 = snapshotOwnData3(value);
+  if (!snapshot2.valid || snapshot2.value === null || typeof snapshot2.value !== "object" || Array.isArray(snapshot2.value)) {
     console.error("[rogatio-host] preset: snapshot invalid");
     return failure("runtime.invalid-preset");
   }
-  const record = snapshot.value;
+  const record = snapshot2.value;
   const allowedKeys = ["version", "limits", "matchers", "grants", "mocks"];
   const requiredKeys = ["version", "limits", "matchers", "grants"];
   const keyCount = Object.keys(record).length;
@@ -25754,6 +25795,30 @@ Exit codes:
   1  Validation/compile/test errors
   2  Usage error (invalid arguments, missing input)`);
 }
+function showImportHelp() {
+  console.log(`Usage: rogatio import requestly <export.json> [options]
+
+Migrate a Requestly rule export into a Rogatio project file.
+
+Arguments:
+  export.json     Requestly export (a JSON array of rules and groups, a single
+                  rule, or an object with a rules array)
+
+Options:
+  --out <path>    Project file to write (default: .rogatio.json in the current directory)
+  --merge         Append imported groups onto an existing version-2 project
+  --json          Print the import report as JSON
+  --help, -h      Show this help
+
+The command validates the mapped project with the schema and compiler before
+writing. An existing --out file is left untouched unless --merge is set.
+Skipped and changed rules are listed; nothing is dropped silently.
+
+Exit codes:
+  0  The project was written (skipped rules do not fail the command)
+  1  The mapped or merged project failed validation. Nothing is written.
+  2  Usage, unreadable input, an export that is not Requestly data, or a refusal to overwrite`);
+}
 function showAIHelp() {
   console.log(`Usage: rogatio ai <command> [options]
 
@@ -25773,13 +25838,13 @@ Options:
 // packages/cli/src/commands/ai.ts
 var pendingInput = "";
 function readLine() {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const take = () => {
       const newline = pendingInput.search(/[\r\n]/u);
       if (newline === -1) return false;
       const line = pendingInput.slice(0, newline);
       pendingInput = pendingInput.slice(newline + 1);
-      resolve9(line);
+      resolve10(line);
       return true;
     };
     if (take()) return;
@@ -25801,14 +25866,14 @@ async function promptSecret(prompt) {
   process.stdout.write(prompt);
   process.stdin.setRawMode(true);
   try {
-    return await new Promise((resolve9) => {
+    return await new Promise((resolve10) => {
       let input = "";
       let settled = false;
-      const finish = () => {
+      const finish2 = () => {
         settled = true;
         process.stdin.off("data", onData);
         process.stdin.pause();
-        resolve9(input.trim());
+        resolve10(input.trim());
       };
       const consume = (text) => {
         if (settled) return;
@@ -25817,7 +25882,7 @@ async function promptSecret(prompt) {
           if (char === "\n" || char === "\r") {
             process.stdout.write("\n");
             pendingInput = text.slice(index + 1);
-            finish();
+            finish2();
             return;
           }
           if (char === "") {
@@ -26011,11 +26076,11 @@ function createServer3(handler, options = {}) {
   let port = null;
   let started = false;
   async function listenOn(candidatePort) {
-    await new Promise((resolve9, reject) => {
+    await new Promise((resolve10, reject) => {
       server.once("error", reject);
       server.listen(candidatePort, "127.0.0.1", () => {
         server.off("error", reject);
-        resolve9();
+        resolve10();
       });
     });
   }
@@ -26066,8 +26131,8 @@ function createServer3(handler, options = {}) {
     },
     async stop() {
       if (!started) return;
-      await new Promise((resolve9) => {
-        server.close(() => resolve9());
+      await new Promise((resolve10) => {
+        server.close(() => resolve10());
       });
       started = false;
     }
@@ -26386,7 +26451,7 @@ var RequestBodyError = class extends Error {
   code = "request-body-too-large";
 };
 function getRequestBody(req) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     let body = "";
     let bytes = 0;
     let settled = false;
@@ -26416,7 +26481,7 @@ function getRequestBody(req) {
     req.on("end", () => {
       if (!settled) {
         settled = true;
-        resolve9(body);
+        resolve10(body);
       }
     });
     req.on("error", (error) => {
@@ -27031,7 +27096,7 @@ async function launchBrowser(url) {
         `Unsupported platform: ${platform}`
       );
   }
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const child = spawn4(command, args, {
       detached: true,
       stdio: "ignore"
@@ -27039,13 +27104,13 @@ async function launchBrowser(url) {
     child.unref();
     child.on("error", (err) => {
       if (err.code === "ENOENT") {
-        resolve9(false);
+        resolve10(false);
       } else {
-        resolve9(false);
+        resolve10(false);
       }
     });
     child.on("close", (code) => {
-      resolve9(code === 0);
+      resolve10(code === 0);
     });
   });
 }
@@ -27374,6 +27439,17 @@ function createJsonFileProjectStorage() {
 
 // packages/cli/src/utils/file.ts
 var defaultStorage = createJsonFileProjectStorage();
+async function writeProject(path2, data) {
+  try {
+    await defaultStorage.update(path2, data);
+  } catch (e) {
+    if (e instanceof ProjectStorageError && e.code === "not-found") {
+      await defaultStorage.create({ id: path2, data });
+      return;
+    }
+    throw e;
+  }
+}
 
 // packages/cli/src/commands/edit.ts
 async function editCommand(args, options = {}) {
@@ -27527,11 +27603,11 @@ async function editCommand(args, options = {}) {
   } else {
     console.log(`Editor available at: ${editorUrl}`);
   }
-  const exitCodePromise = new Promise((resolve9) => {
+  const exitCodePromise = new Promise((resolve10) => {
     const checkShutdown = setInterval(() => {
       if (shutdownCalled) {
         clearInterval(checkShutdown);
-        resolve9(0);
+        resolve10(0);
       }
     }, 100);
     const handleSignal = () => {
@@ -27539,8 +27615,8 @@ async function editCommand(args, options = {}) {
     };
     process.on("SIGINT", handleSignal);
     process.on("SIGTERM", handleSignal);
-    const originalResolve = resolve9;
-    resolve9 = (code) => {
+    const originalResolve = resolve10;
+    resolve10 = (code) => {
       clearInterval(checkShutdown);
       process.off("SIGINT", handleSignal);
       process.off("SIGTERM", handleSignal);
@@ -27763,200 +27839,2241 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
 </html>`;
 }
 
-// packages/cli/src/commands/runtime.ts
-import { chmod, mkdir as mkdir4, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname7, join as join7, resolve as resolve5 } from "node:path";
-function toMatcherOperations2(operations) {
-  return operations.map(
-    ({ groupId, ruleId, name, matcher, redactSensitiveInLogs }) => ({
-      kind: "matcher",
-      groupId,
-      ruleId,
-      name,
-      matcher,
-      redactSensitiveInLogs
-    })
-  );
-}
-function generateHostWrapper(rogatioCommand, logPath) {
-  const parts = rogatioCommand.split(" ");
-  const nodeBin = parts[0] ?? "node";
-  const cliScript = parts.slice(1).join(" ");
-  return `#!/bin/sh
-# Rogatio native messaging host wrapper \u2014 generated by \`rogatio runtime install\`
-# Chrome launches this script when the extension connects via connectNative().
-# The extension sends the project data as the first envelope after launch.
-# stderr is redirected to a log file for debugging.
-exec "${nodeBin}" "${cliScript}" runtime host 2>>"${logPath}"
-`;
-}
-async function writeHostWrapper(hostPath, installRoot) {
-  await mkdir4(installRoot, { recursive: true });
-  const logPath = join7(installRoot, "runtime-host.log");
-  const script = generateHostWrapper(
-    `${process.execPath} ${process.argv[1] ?? "rogatio"}`,
-    logPath
-  );
-  await writeFile4(hostPath, script, "utf8");
-  await chmod(hostPath, 493);
-}
-function makeTrustController() {
-  const platform = process.platform;
-  const adapter = selectTrustPlatformAdapter(platform);
-  const installRoot = defaultTrustInstallRoot(platform);
-  return createRequestBodyTrustController({
-    platform,
-    installRoot,
-    hostPath: join7(installRoot, "runtime-host"),
-    hostName: "com.rogatio.runtime",
-    allowedOrigins: [],
-    manifestDir: adapter.defaultManifestDir(),
-    detectCapabilities: () => adapter.detect(),
-    caTrustInstaller: (cert) => adapter.caTrustInstaller(cert),
-    caTrustRemover: () => adapter.caTrustRemover()
-  });
-}
-function reportTrust(subcommand, result, okMessage) {
-  if (result.ok) {
-    console.log(okMessage);
-    return 0;
+// packages/cli/src/commands/import.ts
+import { access as access2, readFile as readFile6 } from "node:fs/promises";
+import { resolve as resolve5 } from "node:path";
+
+// packages/requestly-import/dist/node/index.js
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function ownString3(record, key) {
+  if (!Object.hasOwn(record, key)) return void 0;
+  const value = record[key];
+  return typeof value === "string" ? value : void 0;
+}
+function ownBoolean(record, key) {
+  if (!Object.hasOwn(record, key)) return void 0;
+  const value = record[key];
+  return typeof value === "boolean" ? value : void 0;
+}
+function displayName(name) {
+  const collapsed = name.replace(/\s+/g, " ").trim();
+  return collapsed.length > 0 ? collapsed : "(unnamed)";
+}
+function cleanLabel(name, fallback) {
+  const collapsed = name.replace(/\s+/g, " ").trim();
+  return collapsed.length > 0 ? collapsed : fallback;
+}
+var REQUESTLY_REGEX = /^\/(.+)\/(|i|g|ig|gi)$/;
+var LITERAL_HOSTNAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+var RESOURCE_SET = new Set(RESOURCE_TYPES);
+var METHOD_SET = new Set(HTTP_METHODS);
+var SOURCE_CHANGE = {
+  caseInsensitive: "The case-insensitive match flag was dropped. Rogatio regular expressions are case-sensitive.",
+  hostPort: "Requestly compares the host and a non-default port. This host condition matches the hostname on any port.",
+  hostAsUrl: "The host condition was imported as a URL regular expression so the port stays part of the match.",
+  path: "The path condition was imported as a URL regular expression."
+};
+function escapeRegex(literal) {
+  return literal.replace(/[\\^$*+?.()|[\]{}]/g, "\\$&");
+}
+function convertSource(source) {
+  const key = ownString3(source, "key");
+  const operator = ownString3(source, "operator");
+  const value = ownString3(source, "value");
+  if (key === void 0 || operator === void 0 || value === void 0) {
+    return { ok: false, reason: "The source condition is missing." };
+  }
+  if (operator === "Equals" && value.length === 0) {
+    return { ok: false, reason: "The source value is empty." };
+  }
+  if (key === "Url") return convertUrl(operator, value);
+  if (key === "host") return convertHost(operator, value);
+  if (key === "path") return convertPath(operator, value);
+  return { ok: false, reason: `Unsupported source key "${key}".` };
+}
+function readFilters(source) {
+  if (!Object.hasOwn(source, "filters") || source.filters === void 0) {
+    return {
+      ok: true,
+      filters: {
+        resourceTypes: [...RESOURCE_TYPES],
+        methods: "all",
+        changes: []
+      }
+    };
   }
-  if (result.state === "unsupported") {
-    const reasons = result.reasons ?? ["unknown"];
-    console.error(`trust unsupported: ${reasons.join(", ")}`);
-    const hints = {
-      "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates; Windows: certutil is built-in)",
-      "manifest-dir-unwritable": "Hint: check permissions on Chrome NativeMessagingHosts directory or run with appropriate access",
-      "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain",
-      "ca-store-unwritable": "Hint: /usr/local/share/ca-certificates not writable; check directory permissions",
-      "elevation-required": "Hint: device-local CA trust requires root (Linux: sudo, macOS: keychain password, Windows: Administrator). Re-run with elevated privileges"
+  const raw = source.filters;
+  const list = Array.isArray(raw) ? raw : [raw];
+  const changes = [];
+  let resourceTypes;
+  let methods;
+  for (const entry of list) {
+    if (!isRecord3(entry)) {
+      return { ok: false, reason: "A source filter is not an object." };
+    }
+    if (isActive(entry.pageUrl) || isActive(entry.pageDomains)) {
+      return {
+        ok: false,
+        reason: "Page URL and page domain filters are not supported, so the rule was not imported."
+      };
+    }
+    if (isActive(entry.requestPayload)) {
+      return {
+        ok: false,
+        reason: "Request payload filters are not supported, so the rule was not imported."
+      };
+    }
+    if (Object.hasOwn(entry, "resourceType")) {
+      const read = readResourceTypes(entry.resourceType);
+      if (!read.ok) return read;
+      resourceTypes = intersect(resourceTypes, read.values);
+      changes.push(...read.changes);
+    }
+    if (Object.hasOwn(entry, "requestMethod")) {
+      const read = readMethods(entry.requestMethod);
+      if (!read.ok) return read;
+      methods = intersect(methods, read.values);
+      changes.push(...read.changes);
+    }
+  }
+  if (resourceTypes !== void 0 && resourceTypes.length === 0) {
+    return {
+      ok: false,
+      reason: "The resource type filter matches no supported type."
     };
-    for (const reason of reasons) {
-      const hint = hints[reason];
-      if (hint) {
-        console.error(hint);
-      }
+  }
+  if (methods !== void 0 && methods.length === 0) {
+    return {
+      ok: false,
+      reason: "The request method filter matches no supported method."
+    };
+  }
+  return {
+    ok: true,
+    filters: {
+      resourceTypes: resourceTypes ?? [...RESOURCE_TYPES],
+      methods: methods ?? "all",
+      changes
     }
-    return 1;
+  };
+}
+function acceptRegex(pattern) {
+  if (pattern.length === 0 || pattern.length > LIMITS.maxUrlRegexLength) {
+    return {
+      ok: false,
+      reason: "The source regular expression exceeds the length limit."
+    };
   }
-  console.error(
-    `runtime ${subcommand} failed: ${(result.reasons ?? ["unknown"]).join(", ")}`
-  );
-  return 1;
+  if (compileUrlRegex(pattern) === null) {
+    return { ok: false, reason: "The source regular expression is invalid." };
+  }
+  return { ok: true };
 }
-async function trustRuntimeCommand(args) {
-  const subcommand = args[0];
-  let extensionId;
-  if (subcommand === "install") {
-    const extIdIndex = args.indexOf("--extension-id");
-    if (extIdIndex === -1 || extIdIndex + 1 >= args.length) {
-      console.error("Error: --extension-id is required for install command");
-      showRuntimeHelp();
-      return 2;
-    }
-    extensionId = args[extIdIndex + 1];
-    if (!/^[a-p]{32}$/.test(extensionId)) {
-      console.error(
-        "Error: --extension-id must be exactly 32 lowercase characters from a through p"
-      );
-      return 2;
-    }
+function convertUrl(operator, value) {
+  if (operator === "Equals") {
+    return finishUrl(`^${escapeRegex(value)}$`, []);
   }
-  const controller = makeTrustController();
-  const installRoot = defaultTrustInstallRoot(process.platform);
-  const hostPath = join7(installRoot, "runtime-host");
-  switch (subcommand) {
-    case "install": {
-      const installResult = await controller.install(extensionId ?? "");
-      if (installResult.ok) {
-        try {
-          await writeHostWrapper(hostPath, installRoot);
-        } catch (error) {
-          console.error(
-            `Warning: manifest and CA trusted, but failed to create runtime-host wrapper: ${error instanceof Error ? error.message : String(error)}`
-          );
-        }
-      }
-      return reportTrust(
-        "install",
-        installResult,
-        "runtime install complete: manifest + device-local CA trusted + runtime-host wrapper created\nNote: reload the extension at chrome://extensions for the native host to be detected."
+  if (operator === "Contains") {
+    const pattern = value.length === 0 ? "[\\s\\S]*" : escapeRegex(value);
+    return finishUrl(pattern, []);
+  }
+  if (operator === "Wildcard_Matches") {
+    return finishUrl(`^${wildcardBody(value)}$`, []);
+  }
+  if (operator === "Matches") return finishMatches(value);
+  return { ok: false, reason: `Unsupported source operator "${operator}".` };
+}
+function convertHost(operator, value) {
+  if (value.includes(":") && splitHostPort(value) === null) {
+    return { ok: false, reason: "IPv6 host conditions are not supported." };
+  }
+  if (operator === "Equals") {
+    if (isLiteralHostname(value)) {
+      return finish(
+        { key: "host", operator: "regex", value: `^${escapeRegex(value)}$` },
+        [SOURCE_CHANGE.hostPort]
       );
     }
-    case "uninstall": {
-      const uninstallResult = await controller.uninstall();
-      try {
-        await rm2(hostPath, { force: true });
-      } catch {
-      }
-      try {
-        await rm2(join7(installRoot, "runtime-host.log"), { force: true });
-      } catch {
-      }
-      return reportTrust(
-        "uninstall",
-        uninstallResult,
-        "runtime uninstall complete: manifest + device-local CA removed"
-      );
+    const port = splitHostPort(value);
+    if (port !== null) {
+      return finishUrl(`^https?:\\/\\/${escapeRegex(value)}(?:[/?#].*)?$`, [
+        SOURCE_CHANGE.hostAsUrl
+      ]);
     }
-    case "verify": {
-      const result = await controller.verify();
-      if (result.ok) {
-        console.log(
-          "runtime verification passed: manifest, binary, and CA trust all OK"
-        );
-        return 0;
-      }
-      console.error("runtime verification failed:");
-      if (!result.manifestExists) console.error("  manifest not found");
-      if (result.manifestExists && !result.manifestValid)
-        console.error("  manifest invalid");
-      if (!result.binaryExists)
-        console.error("  runtime-host binary not found");
-      if (result.binaryExists && !result.binaryExecutable)
-        console.error("  runtime-host binary not executable");
-      if (result.allowedOriginsCount === 0)
-        console.error("  no allowed_origins in manifest");
-      if (!result.caTrusted) console.error("  device-local CA not trusted");
-      for (const reason of result.reasons) {
-        if (reason === "manifest-not-found")
-          console.error(
-            "  Hint: run 'rogatio runtime install --extension-id <id>' to register the host manifest"
-          );
-        if (reason === "binary-not-found")
-          console.error(
-            `  Hint: ensure the runtime-host binary exists at the path specified in the manifest`
-          );
-        if (reason === "binary-not-executable")
-          console.error(
-            "  Hint: ensure the runtime-host binary has execute permission (chmod +x)"
-          );
-        if (reason === "no-allowed-origins")
-          console.error(
-            "  Hint: re-run 'rogatio runtime install --extension-id <id>' to pin your extension ID"
-          );
-        if (reason === "ca-not-trusted")
-          console.error(
-            "  Hint: re-run 'rogatio runtime install --extension-id <id>' with elevated privileges to trust the CA"
-          );
-      }
-      return 1;
+    return {
+      ok: false,
+      reason: "The host value is not a literal hostname or hostname:port."
+    };
+  }
+  if (operator === "Contains") {
+    const body = value.length === 0 ? "[^/?#]*" : `[^/?#]*${escapeRegex(value)}[^/?#]*`;
+    return finishUrl(`^https?:\\/\\/${body}(?:[/?#].*)?$`, [
+      SOURCE_CHANGE.hostAsUrl
+    ]);
+  }
+  if (operator === "Wildcard_Matches") {
+    return finishUrl(`^https?:\\/\\/${wildcardBody(value)}(?:[/?#].*)?$`, [
+      SOURCE_CHANGE.hostAsUrl
+    ]);
+  }
+  if (operator === "Matches") {
+    const parsed = parseRequestlyRegex(value);
+    if (!parsed.ok) return parsed;
+    return finishUrl(
+      `^https?:\\/\\/(?:${parsed.source})(?:[/?#].*)?$`,
+      parsed.caseInsensitive ? [SOURCE_CHANGE.hostAsUrl, SOURCE_CHANGE.caseInsensitive] : [SOURCE_CHANGE.hostAsUrl]
+    );
+  }
+  return { ok: false, reason: `Unsupported source operator "${operator}".` };
+}
+function convertPath(operator, value) {
+  const changes = [SOURCE_CHANGE.path];
+  if (operator === "Equals") {
+    if (value === "/" || value.length === 0) {
+      return finishUrl("^https?:\\/\\/[^/?#]+\\/?(?:[?#].*)?$", changes);
     }
-    default:
-      console.error(`Error: unknown runtime subcommand: ${subcommand ?? ""}`);
-      showRuntimeHelp();
-      return 2;
+    return finishUrl(
+      `^https?:\\/\\/[^/?#]+${escapeRegex(value)}(?:[?#].*)?$`,
+      changes
+    );
+  }
+  if (operator === "Contains") {
+    const body = value.length === 0 ? "[^?#]*" : `[^?#]*${escapeRegex(value)}[^?#]*`;
+    return finishUrl(`^https?:\\/\\/[^/?#]+\\/${body}(?:[?#].*)?$`, changes);
   }
+  if (operator === "Wildcard_Matches") {
+    return finishUrl(
+      `^https?:\\/\\/[^/?#]+${wildcardBody(value)}(?:[?#].*)?$`,
+      changes
+    );
+  }
+  if (operator === "Matches") {
+    const parsed = parseRequestlyRegex(value);
+    if (!parsed.ok) return parsed;
+    const inner = stripAnchors(parsed.source);
+    if (parsed.caseInsensitive) changes.push(SOURCE_CHANGE.caseInsensitive);
+    return finishUrl(`^https?:\\/\\/[^/?#]+(?:${inner})(?:[?#].*)?$`, changes);
+  }
+  return { ok: false, reason: `Unsupported source operator "${operator}".` };
+}
+function finishMatches(value) {
+  const parsed = parseRequestlyRegex(value);
+  if (!parsed.ok) return parsed;
+  return finishUrl(
+    parsed.source,
+    parsed.caseInsensitive ? [SOURCE_CHANGE.caseInsensitive] : []
+  );
 }
-async function runtimeHostCommand(args, options = {}) {
-  let root;
-  let mockPort;
-  const positional = [];
-  let argumentError;
+function finishUrl(pattern, changes) {
+  return finish({ key: "url", operator: "regex", value: pattern }, changes);
+}
+function finish(source, changes) {
+  const accepted = acceptRegex(source.value);
+  if (!accepted.ok) return accepted;
+  return { ok: true, converted: { source, changes } };
+}
+function parseRequestlyRegex(value) {
+  const match = REQUESTLY_REGEX.exec(value);
+  const source = match?.[1];
+  if (match === null || source === void 0) {
+    return {
+      ok: false,
+      reason: "A Matches value must be a /pattern/flags regular expression with flags i, g, or both."
+    };
+  }
+  const flags = match[2] ?? "";
+  try {
+    new RegExp(source);
+  } catch {
+    return { ok: false, reason: "The source regular expression is invalid." };
+  }
+  return { ok: true, source, caseInsensitive: flags.includes("i") };
+}
+function wildcardBody(pattern) {
+  return pattern.split("*").map((part) => escapeRegex(part)).join("(.*?)");
+}
+function isRequestlyRegexLiteral(value) {
+  return REQUESTLY_REGEX.test(value);
+}
+function stripAnchors(pattern) {
+  let next = pattern;
+  if (next.startsWith("^")) next = next.slice(1);
+  if (next.endsWith("$")) next = next.slice(0, -1);
+  return next;
+}
+function isLiteralHostname(value) {
+  return LITERAL_HOSTNAME.test(value);
+}
+function splitHostPort(value) {
+  const index = value.lastIndexOf(":");
+  if (index <= 0) return null;
+  const host = value.slice(0, index);
+  const port = value.slice(index + 1);
+  if (!/^[0-9]+$/.test(port) || host.includes(":") || !isLiteralHostname(host)) {
+    return null;
+  }
+  return { host, port };
+}
+function isActive(value) {
+  if (Array.isArray(value)) return value.length > 0;
+  if (isRecord3(value)) return Object.keys(value).length > 0;
+  if (typeof value === "string") return value.length > 0;
+  return value !== void 0 && value !== null;
+}
+function readResourceTypes(value) {
+  if (!Array.isArray(value)) {
+    return { ok: false, reason: "The resource type filter is not a list." };
+  }
+  if (value.length === 0) {
+    return {
+      ok: false,
+      reason: "The resource type filter matches no supported type."
+    };
+  }
+  const known = [];
+  const unknown = [];
+  for (const entry of value) {
+    if (typeof entry !== "string") continue;
+    if (RESOURCE_SET.has(entry)) known.push(entry);
+    else unknown.push(entry);
+  }
+  const ordered = RESOURCE_TYPES.filter((type) => known.includes(type));
+  const changes = unknown.length > 0 ? [`Dropped unrecognized resource types: ${unknown.join(", ")}.`] : [];
+  return { ok: true, values: ordered, changes };
+}
+function readMethods(value) {
+  if (!Array.isArray(value)) {
+    return { ok: false, reason: "The request method filter is not a list." };
+  }
+  if (value.length === 0) {
+    return {
+      ok: false,
+      reason: "The request method filter matches no supported method."
+    };
+  }
+  const known = [];
+  const unknown = [];
+  for (const entry of value) {
+    if (typeof entry !== "string") continue;
+    if (METHOD_SET.has(entry)) known.push(entry);
+    else unknown.push(entry);
+  }
+  const ordered = HTTP_METHODS.filter((method) => known.includes(method));
+  const changes = unknown.length > 0 ? [`Dropped unrecognized request methods: ${unknown.join(", ")}.`] : [];
+  return { ok: true, values: ordered, changes };
+}
+function intersect(current, next) {
+  if (current === void 0) return [...next];
+  const allowed = new Set(next);
+  return current.filter((entry) => allowed.has(entry));
+}
+var BASE_CHANGE = "Replace was imported as a redirect that substitutes the first literal occurrence.";
+function mapReplace(source, from, to) {
+  if (from.length === 0) {
+    return { ok: false, reason: "The replace text is empty." };
+  }
+  if (isRequestlyRegexLiteral(from)) {
+    return {
+      ok: false,
+      reason: "A regular-expression replace cannot be represented as one redirect destination."
+    };
+  }
+  if (to.includes("\\")) {
+    return {
+      ok: false,
+      reason: "The replacement contains a backslash, which Rogatio would read as a capture reference."
+    };
+  }
+  const key = ownString3(source, "key");
+  const operator = ownString3(source, "operator");
+  const value = ownString3(source, "value");
+  if (key === void 0 || operator === void 0 || value === void 0) {
+    return { ok: false, reason: "The source condition is missing." };
+  }
+  if (operator === "Matches") {
+    return {
+      ok: false,
+      reason: "Replace combined with a Matches source cannot be represented as one redirect destination."
+    };
+  }
+  const changes = [BASE_CHANGE];
+  if (to.includes("$")) {
+    changes.push(
+      "A literal $ in the replacement was escaped so it is not read as a capture reference."
+    );
+  }
+  const replacement = escapeDollars(to);
+  if (key === "Url" && operator === "Equals") {
+    return mapEquals(value, from, replacement, changes);
+  }
+  if (key === "Url" && operator === "Wildcard_Matches") {
+    return mapWildcard(value, from, replacement, changes);
+  }
+  if (key === "Url" && operator === "Contains") {
+    return mapContains(value, from, replacement, changes);
+  }
+  if (key === "host" && operator === "Equals") {
+    return mapHostEquals(value, from, replacement, changes);
+  }
+  return {
+    ok: false,
+    reason: `Replace is not supported for source ${key} ${operator}.`
+  };
+}
+function mapEquals(url, from, to, changes) {
+  if (!isAbsoluteHttpUrl(url)) {
+    return {
+      ok: false,
+      reason: "The exact URL is not an absolute http(s) URL."
+    };
+  }
+  const index = url.indexOf(from);
+  if (index < 0) {
+    return {
+      ok: false,
+      reason: "The URL does not contain the text to replace."
+    };
+  }
+  const destination = escapeDollars(
+    url.slice(0, index) + unescapeDollars(to) + url.slice(index + from.length)
+  );
+  const pattern = `^${escapeRegex(url)}$`;
+  const redirect = acceptRedirect(pattern, destination, "");
+  if (redirect === null) {
+    return {
+      ok: false,
+      reason: "The replacement does not produce an absolute http(s) redirect destination."
+    };
+  }
+  return { ok: true, redirects: [redirect], changes };
+}
+function mapWildcard(pattern, from, to, changes) {
+  if (!pattern.startsWith("http://") && !pattern.startsWith("https://")) {
+    return {
+      ok: false,
+      reason: "A wildcard replace must start with an absolute http(s) URL."
+    };
+  }
+  const pieces = pattern.split("*");
+  if (pieces.length - 1 > LIMITS.maxCaptureGroups) {
+    return {
+      ok: false,
+      reason: "The wildcard has more than 9 captures."
+    };
+  }
+  const replaced = replaceFirstLiteral(pieces, from, unescapeDollars(to));
+  if (replaced === null) {
+    return {
+      ok: false,
+      reason: "The text to replace is not a fixed part of the URL."
+    };
+  }
+  const source = `^${pieces.map((part) => escapeRegex(part)).join("(.*?)")}$`;
+  const destination = templateFromPieces(replaced);
+  const redirect = acceptRedirect(source, destination, "");
+  if (redirect === null) {
+    return {
+      ok: false,
+      reason: "The replacement does not produce an absolute http(s) redirect destination."
+    };
+  }
+  return { ok: true, redirects: [redirect], changes };
+}
+function mapContains(contains, from, to, changes) {
+  changes.push("Separate http and https rules were created.");
+  const lookahead = contains.length > 0 && contains !== from ? `(?=.*${escapeRegex(contains)})` : "";
+  const redirects = [];
+  for (const scheme of ["https", "http"]) {
+    const pattern = `^${lookahead}${scheme}://(.*?)${escapeRegex(from)}(.*)$`;
+    const destination = `${scheme}://\\1${to}\\2`;
+    const redirect = acceptRedirect(pattern, destination, scheme);
+    if (redirect !== null) redirects.push(redirect);
+  }
+  if (redirects.length === 0) {
+    return {
+      ok: false,
+      reason: "The replacement does not produce an absolute http(s) redirect destination."
+    };
+  }
+  return { ok: true, redirects, changes };
+}
+function mapHostEquals(host, from, to, changes) {
+  if (host.includes("/") || host.includes("?") || host.includes("#")) {
+    return {
+      ok: false,
+      reason: "The host value is not a literal hostname or hostname:port."
+    };
+  }
+  changes.push("Separate http and https rules were created.");
+  const redirects = [];
+  const schemes = [
+    { scheme: "https", port: host.includes(":") ? "" : "(?::443)?" },
+    { scheme: "http", port: host.includes(":") ? "" : "(?::80)?" }
+  ];
+  for (const entry of schemes) {
+    const prefix = `${entry.scheme}://${host}`;
+    const index = prefix.indexOf(from);
+    if (index < 0) continue;
+    const nextPrefix = prefix.slice(0, index) + unescapeDollars(to) + prefix.slice(index + from.length);
+    const pattern = `^${escapeRegex(entry.scheme)}:\\/\\/${escapeRegex(host)}${entry.port}((?:[/?#].*)?)$`;
+    const destination = `${escapeDollars(nextPrefix)}\\1`;
+    const redirect = acceptRedirect(pattern, destination, entry.scheme);
+    if (redirect !== null) redirects.push(redirect);
+  }
+  if (redirects.length === 0) {
+    return {
+      ok: false,
+      reason: "The text to replace is not a fixed part of the host."
+    };
+  }
+  return { ok: true, redirects, changes };
+}
+function acceptRedirect(pattern, destination, nameSuffix) {
+  if (!acceptRegex(pattern).ok) return null;
+  if (destination.length === 0 || destination.length > LIMITS.maxRedirectDestinationLength) {
+    return null;
+  }
+  if (validateRedirectDestination(destination, pattern).length > 0) return null;
+  return {
+    source: { key: "url", operator: "regex", value: pattern },
+    destination,
+    nameSuffix
+  };
+}
+function replaceFirstLiteral(pieces, from, to) {
+  const next = [...pieces];
+  for (let index = 0; index < next.length; index += 1) {
+    const piece = next[index] ?? "";
+    const at = piece.indexOf(from);
+    if (at < 0) continue;
+    next[index] = piece.slice(0, at) + to + piece.slice(at + from.length);
+    return next;
+  }
+  return null;
+}
+function templateFromPieces(pieces) {
+  let template = "";
+  for (let index = 0; index < pieces.length; index += 1) {
+    template += escapeDollars(pieces[index] ?? "");
+    if (index < pieces.length - 1) template += `\\${index + 1}`;
+  }
+  return template;
+}
+function isAbsoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && url.username.length === 0 && url.password.length === 0 && url.hostname.length > 0 && !url.hostname.includes("*");
+  } catch {
+    return false;
+  }
+}
+function escapeDollars(value) {
+  return value.replaceAll("$", "$$");
+}
+function unescapeDollars(value) {
+  return value.replaceAll("$$", "$");
+}
+var REQUEST_BODY_METHODS = ["POST", "PUT", "PATCH"];
+var DYNAMIC_FUNCTION = /rq_[A-Za-z0-9_]*\s*\(/;
+function mapRequestlyRule(rule) {
+  const ruleType = ownString3(rule, "ruleType") ?? "";
+  if (ruleType === "Cancel") {
+    return { status: "skipped", reason: "Cancel rules are not supported." };
+  }
+  if (ruleType === "Delay") {
+    return { status: "skipped", reason: "Delay rules are not supported." };
+  }
+  if (ruleType === "Script") {
+    return { status: "skipped", reason: "Script rules are not supported." };
+  }
+  if (ruleType === "Redirect") return mapRedirect(rule);
+  if (ruleType === "Replace") return mapReplaceRule(rule);
+  if (ruleType === "QueryParam") return mapQuery(rule);
+  if (ruleType === "Headers") return mapHeaders(rule);
+  if (ruleType === "UserAgent") return mapUserAgent(rule);
+  if (ruleType === "Request") return mapRequest(rule);
+  if (ruleType === "Response") return mapResponse(rule);
+  if (ruleType.length === 0) {
+    return { status: "skipped", reason: "The rule type is missing." };
+  }
+  return {
+    status: "skipped",
+    reason: `Unsupported rule type "${ruleType}".`
+  };
+}
+function mapRedirect(rule) {
+  const pairs = readPairs(rule);
+  if (!pairs.ok) return { status: "skipped", reason: pairs.reason };
+  const drafts = [];
+  const changes = [];
+  const failures = [];
+  if (ownBoolean(rule, "preserveCookie") === true) {
+    changes.push("preserveCookie was not imported.");
+  }
+  for (const pair of pairs.pairs) {
+    const built = buildRedirectPair(pair);
+    if (!built.ok) {
+      failures.push(built.reason);
+      continue;
+    }
+    changes.push(...built.changes);
+    drafts.push(...built.drafts);
+  }
+  if (drafts.length === 0) {
+    return {
+      status: "skipped",
+      reason: failures[0] ?? "The redirect rule has no supported pairs."
+    };
+  }
+  if (pairs.pairs.length > 1) {
+    changes.unshift(
+      "Redirect pairs were split into separate rules. Requestly applies pairs in sequence to the rewritten URL; each imported rule matches the original request."
+    );
+  }
+  return { status: "mapped", drafts: tagIds(drafts), changes: dedupe(changes) };
+}
+function buildRedirectPair(pair) {
+  const destinationType = ownString3(pair, "destinationType") ?? "url";
+  if (destinationType === "map_local" || destinationType === "mock_or_file_picker") {
+    return {
+      ok: false,
+      reason: "A local-file or mock redirect destination is not supported."
+    };
+  }
+  if (destinationType !== "url") {
+    return {
+      ok: false,
+      reason: `Unsupported redirect destination type "${destinationType}".`
+    };
+  }
+  const destination = ownString3(pair, "destination");
+  if (destination === void 0 || destination.length === 0) {
+    return { ok: false, reason: "The redirect destination is missing." };
+  }
+  const prepared = preparePair(pair);
+  if (!prepared.ok) return prepared;
+  const rewritten = rewriteDestination(destination);
+  const issues = validateRedirectDestination(
+    rewritten.destination,
+    prepared.source.value
+  );
+  if (issues.length > 0) {
+    return {
+      ok: false,
+      reason: "The redirect destination is not an absolute http(s) URL. Capture groups cannot stand in for the scheme or host."
+    };
+  }
+  const applied = applyMethods(prepared, {
+    source: prepared.base.source,
+    resourceTypes: prepared.base.resourceTypes,
+    type: "redirect",
+    redirect: { destination: rewritten.destination }
+  });
+  const changes = [
+    ...prepared.changes,
+    ...rewritten.changes,
+    ...applied.changes
+  ];
+  noteDynamic(destination, changes);
+  return { ok: true, changes, drafts: applied.drafts };
+}
+function mapReplaceRule(rule) {
+  const pairs = readPairs(rule);
+  if (!pairs.ok) return { status: "skipped", reason: pairs.reason };
+  const drafts = [];
+  const changes = [];
+  const failures = [];
+  for (const pair of pairs.pairs) {
+    const source = pairSource(pair);
+    if (!source.ok) {
+      failures.push(source.reason);
+      continue;
+    }
+    const from = ownString3(pair, "from");
+    const to = ownString3(pair, "to");
+    if (from === void 0 || to === void 0) {
+      failures.push("The replace pair is missing from or to.");
+      continue;
+    }
+    const replaced = mapReplace(source.source, from, to);
+    if (!replaced.ok) {
+      failures.push(replaced.reason);
+      continue;
+    }
+    const prepared = preparePair(pair);
+    if (!prepared.ok) {
+      failures.push(prepared.reason);
+      continue;
+    }
+    changes.push(...prepared.filterChanges, ...replaced.changes);
+    for (const redirect of replaced.redirects) {
+      const applied = applyMethods(
+        prepared,
+        {
+          source: redirect.source,
+          resourceTypes: prepared.base.resourceTypes,
+          type: "redirect",
+          redirect: { destination: redirect.destination }
+        },
+        redirect.nameSuffix
+      );
+      changes.push(...applied.changes);
+      drafts.push(...applied.drafts);
+    }
+  }
+  if (drafts.length === 0) {
+    return {
+      status: "skipped",
+      reason: failures[0] ?? "The replace rule has no supported pairs."
+    };
+  }
+  if (pairs.pairs.length > 1) {
+    changes.unshift(
+      "Replace pairs were split into separate rules. Requestly applies pairs in sequence to the rewritten URL."
+    );
+  }
+  return { status: "mapped", drafts: tagIds(drafts), changes: dedupe(changes) };
+}
+function mapQuery(rule) {
+  const pairs = readPairs(rule);
+  if (!pairs.ok) return { status: "skipped", reason: pairs.reason };
+  const drafts = [];
+  const changes = [];
+  const failures = [];
+  for (const pair of pairs.pairs) {
+    const prepared = preparePair(pair);
+    if (!prepared.ok) {
+      failures.push(prepared.reason);
+      continue;
+    }
+    const mods = readModificationList(pair);
+    if (!mods.ok) {
+      failures.push(mods.reason);
+      continue;
+    }
+    if (mods.mods.some((mod) => ownString3(mod, "type") === "Remove All")) {
+      failures.push("Remove All query parameters is not supported.");
+      continue;
+    }
+    const params = [];
+    const seen = /* @__PURE__ */ new Set();
+    const pairFailures = [];
+    let droppedDuplicate = false;
+    for (const mod of mods.mods) {
+      const type = ownString3(mod, "type");
+      const name = ownString3(mod, "param");
+      if (name === void 0 || name.length === 0 || name.length > LIMITS.maxQueryNameLength) {
+        pairFailures.push("A query parameter name is missing or too long.");
+        continue;
+      }
+      if (type === "Remove") {
+        if (seen.has(name)) droppedDuplicate = true;
+        seen.add(name);
+        params.push({ name, operation: "remove" });
+        continue;
+      }
+      if (type !== "Add") {
+        pairFailures.push(
+          type === void 0 ? "A query modification type is missing." : `Unsupported query modification "${type}".`
+        );
+        continue;
+      }
+      const value = ownString3(mod, "value") ?? "";
+      if (value.length === 0 || value.length > LIMITS.maxQueryValueLength) {
+        pairFailures.push("A query parameter value is missing or too long.");
+        continue;
+      }
+      if (hasLoneSurrogate(value)) {
+        pairFailures.push(
+          "A query parameter value contains an invalid character."
+        );
+        continue;
+      }
+      const action = ownString3(mod, "actionWhenParamExists");
+      if (action === "Ignore") {
+        changes.push(
+          "Add with Ignore was imported as set, which overwrites an existing parameter. Requestly leaves an existing parameter unchanged."
+        );
+      } else if (action !== "Overwrite") {
+        changes.push(
+          "Add was imported as set, which overwrites an existing parameter instead of appending another value."
+        );
+      }
+      const escaped = escapeDollars2(value);
+      if (escaped !== value) {
+        changes.push(
+          "A literal $ in a query value was escaped so it is not read as a capture reference."
+        );
+      }
+      noteDynamic(value, changes);
+      if (seen.has(name)) droppedDuplicate = true;
+      seen.add(name);
+      params.push({ name, operation: "set", value: escaped });
+    }
+    if (droppedDuplicate) {
+      changes.push(
+        "An earlier modification of the same query parameter was dropped."
+      );
+    }
+    const deduped = lastParamWins(params);
+    if (deduped.length === 0) continue;
+    const limited = deduped.slice(0, LIMITS.maxQueryParamsPerRule);
+    if (limited.length < deduped.length) {
+      changes.push(
+        `Query parameters after the first ${LIMITS.maxQueryParamsPerRule} were dropped.`
+      );
+    }
+    if (limited.length === 0) {
+      failures.push(
+        ...pairFailures,
+        "The query rule has no supported modifications."
+      );
+      continue;
+    }
+    for (const failure2 of pairFailures) {
+      changes.push(`Dropped a query modification: ${failure2}`);
+    }
+    const applied = applyMethods(prepared, {
+      source: prepared.base.source,
+      resourceTypes: prepared.base.resourceTypes,
+      type: "query",
+      action: { type: "query", params: limited }
+    });
+    changes.push(...prepared.changes, ...applied.changes);
+    drafts.push(...applied.drafts);
+  }
+  if (drafts.length === 0) {
+    return {
+      status: "skipped",
+      reason: failures[0] ?? "The query rule has no supported modifications."
+    };
+  }
+  if (drafts.length > 1) {
+    changes.unshift(
+      "Query pairs were split into separate rules. Requestly applies every matching pair."
+    );
+  }
+  return { status: "mapped", drafts: tagIds(drafts), changes: dedupe(changes) };
+}
+function mapHeaders(rule) {
+  const pairs = readPairs(rule);
+  if (!pairs.ok) return { status: "skipped", reason: pairs.reason };
+  const drafts = [];
+  const changes = [];
+  const failures = [];
+  for (const pair of pairs.pairs) {
+    const prepared = preparePair(pair);
+    if (!prepared.ok) {
+      failures.push(prepared.reason);
+      continue;
+    }
+    const mods = headerModifications(pair);
+    if (mods.length === 0) {
+      failures.push("The header rule has no supported modifications.");
+      continue;
+    }
+    const pairFailures = [];
+    let produced = 0;
+    for (const mod of mods) {
+      const header = ownString3(mod.record, "header");
+      const type = ownString3(mod.record, "type");
+      if (header === void 0 || header.length === 0 || header.length > LIMITS.maxHeaderNameLength) {
+        pairFailures.push("A header name is missing or too long.");
+        continue;
+      }
+      if (isForbiddenHeader(header, mod.direction)) {
+        pairFailures.push(
+          `Header "${header}" is forbidden on ${mod.direction} headers.`
+        );
+        continue;
+      }
+      const operation = headerOperation(type);
+      if (operation === null) {
+        pairFailures.push(
+          type === void 0 ? "A header modification type is missing." : `Unsupported header modification "${type}".`
+        );
+        continue;
+      }
+      if (operation.change !== void 0) changes.push(operation.change);
+      const value = ownString3(mod.record, "value") ?? "";
+      if (operation.kind !== "remove") {
+        if (value.length > LIMITS.maxHeaderValueLength) {
+          pairFailures.push("A header value exceeds the length limit.");
+          continue;
+        }
+        if (hasLoneSurrogate(value)) {
+          pairFailures.push("A header value contains an invalid character.");
+          continue;
+        }
+      }
+      const escaped = escapeDollars2(value);
+      if (operation.kind !== "remove" && escaped !== value) {
+        changes.push(
+          "A literal $ in a header value was escaped so it is not read as a capture reference."
+        );
+      }
+      if (operation.kind !== "remove") noteDynamic(value, changes);
+      const suffix = `${mod.direction} ${header}`;
+      const applied = applyMethods(
+        prepared,
+        {
+          source: prepared.base.source,
+          resourceTypes: prepared.base.resourceTypes,
+          type: "header",
+          headerDirection: mod.direction,
+          headerOperation: operation.kind,
+          headerName: header,
+          ...operation.kind === "remove" ? {} : { headerValue: escaped }
+        },
+        suffix
+      );
+      changes.push(...applied.changes);
+      drafts.push(...applied.drafts);
+      produced += 1;
+    }
+    if (produced > 0) {
+      changes.push(...prepared.changes);
+      for (const failure2 of pairFailures) {
+        changes.push(`Dropped a header modification: ${failure2}`);
+      }
+    } else {
+      failures.push(...pairFailures);
+    }
+    if (produced > 1) {
+      changes.push("Header modifications were split into one rule per header.");
+    }
+  }
+  if (drafts.length === 0) {
+    return {
+      status: "skipped",
+      reason: failures[0] ?? "The header rule has no supported modifications."
+    };
+  }
+  const tagged = tagIds(drafts);
+  if (tagged.length === 1 && tagged[0] !== void 0) {
+    return {
+      status: "mapped",
+      drafts: [{ ...tagged[0], nameSuffix: "", keepId: true }],
+      changes: dedupe(changes)
+    };
+  }
+  return { status: "mapped", drafts: tagged, changes: dedupe(changes) };
+}
+function mapUserAgent(rule) {
+  const pairs = readPairs(rule);
+  if (!pairs.ok) return { status: "skipped", reason: pairs.reason };
+  const drafts = [];
+  const changes = [];
+  const failures = [];
+  for (const pair of pairs.pairs) {
+    const prepared = preparePair(pair);
+    if (!prepared.ok) {
+      failures.push(prepared.reason);
+      continue;
+    }
+    const userAgent = ownString3(pair, "userAgent");
+    if (userAgent === void 0 || userAgent.length === 0) {
+      failures.push("The user-agent string is missing.");
+      continue;
+    }
+    if (userAgent.length > LIMITS.maxHeaderValueLength || hasLoneSurrogate(userAgent)) {
+      failures.push("The user-agent string is too long or invalid.");
+      continue;
+    }
+    if (isForbiddenHeader("User-Agent", "request")) {
+      failures.push('Header "User-Agent" is forbidden on request headers.');
+      continue;
+    }
+    const envType = ownString3(pair, "envType");
+    if (envType === "browser" || envType === "device") {
+      changes.push(
+        "The browser or device preset was imported as the stored user-agent string."
+      );
+    }
+    const escaped = escapeDollars2(userAgent);
+    if (escaped !== userAgent) {
+      changes.push(
+        "A literal $ in the user-agent was escaped so it is not read as a capture reference."
+      );
+    }
+    noteDynamic(userAgent, changes);
+    const applied = applyMethods(prepared, {
+      source: prepared.base.source,
+      resourceTypes: prepared.base.resourceTypes,
+      type: "header",
+      headerDirection: "request",
+      headerOperation: "set",
+      headerName: "User-Agent",
+      headerValue: escaped
+    });
+    changes.push(...prepared.changes, ...applied.changes);
+    drafts.push(...applied.drafts);
+  }
+  if (drafts.length === 0) {
+    return {
+      status: "skipped",
+      reason: failures[0] ?? "The user-agent rule has no supported pairs."
+    };
+  }
+  if (drafts.length > 1) {
+    changes.unshift("User-agent pairs were split into separate rules.");
+  }
+  return { status: "mapped", drafts: tagIds(drafts), changes: dedupe(changes) };
+}
+function mapRequest(rule) {
+  return mapBody(rule, "request");
+}
+function mapResponse(rule) {
+  return mapBody(rule, "response");
+}
+function mapBody(rule, kind) {
+  const pairs = readPairs(rule);
+  if (!pairs.ok) return { status: "skipped", reason: pairs.reason };
+  const drafts = [];
+  const changes = [];
+  const failures = [];
+  for (const pair of pairs.pairs) {
+    const prepared = preparePair(pair);
+    if (!prepared.ok) {
+      failures.push(prepared.reason);
+      continue;
+    }
+    const bodyRecord = pair[kind];
+    if (!isRecord3(bodyRecord)) {
+      failures.push(`The ${kind} body is missing.`);
+      continue;
+    }
+    const type = ownString3(bodyRecord, "type");
+    if (type === "code") {
+      failures.push(`JavaScript ${kind} functions are not supported.`);
+      continue;
+    }
+    if (type === "local_file") {
+      failures.push("A local-file response is not supported.");
+      continue;
+    }
+    if (type !== "static") {
+      failures.push(
+        type === void 0 ? `The ${kind} body type is missing.` : `Unsupported ${kind} body type "${type}".`
+      );
+      continue;
+    }
+    const value = ownString3(bodyRecord, "value") ?? "";
+    const limit = kind === "request" ? LIMITS.maxRequestBodyBytes : LIMITS.maxResponseBodyBytes;
+    if (value.length === 0 || value.length > limit || hasLoneSurrogate(value)) {
+      failures.push(`The ${kind} body is empty, too large, or invalid.`);
+      continue;
+    }
+    const escaped = escapeDollars2(value);
+    if (escaped !== value) {
+      changes.push(
+        "A literal $ in the body was escaped so it is not read as a capture reference."
+      );
+    }
+    noteDynamic(value, changes);
+    if (kind === "response") {
+      const status = ownString3(bodyRecord, "statusCode");
+      const statusNote = status !== void 0 && status.length > 0 ? ` Status ${status} was not imported.` : "";
+      changes.push(
+        `Requestly static responses replace the response and may skip the upstream request.${statusNote} Rogatio fetches the upstream response and replaces its body, keeping the upstream status and headers.`
+      );
+      const applied = applyMethods(prepared, {
+        source: prepared.base.source,
+        resourceTypes: prepared.base.resourceTypes,
+        type: "response-body",
+        responseBody: { mode: "replace", body: escaped }
+      });
+      changes.push(...prepared.changes, ...applied.changes);
+      drafts.push(...applied.drafts);
+      continue;
+    }
+    const narrowed = narrowRequestBody(
+      prepared.filters,
+      prepared.base.resourceTypes
+    );
+    if (!narrowed.ok) {
+      failures.push(narrowed.reason);
+      continue;
+    }
+    changes.push(...prepared.changes, ...narrowed.changes);
+    for (const method of narrowed.methods) {
+      drafts.push(
+        draftOf(
+          {
+            source: prepared.base.source,
+            resourceTypes: ["xmlhttprequest"],
+            method,
+            type: "request-body",
+            requestBody: { mode: "replace", body: escaped }
+          },
+          narrowed.methods.length > 1 ? method : ""
+        )
+      );
+    }
+  }
+  if (drafts.length === 0) {
+    return {
+      status: "skipped",
+      reason: failures[0] ?? `The ${kind} rule has no supported pairs.`
+    };
+  }
+  if (kind === "response" && drafts.length > 1) {
+    changes.unshift(
+      "Response pairs were split into separate rules. Requestly runs the first pair only."
+    );
+  }
+  return { status: "mapped", drafts: tagIds(drafts), changes: dedupe(changes) };
+}
+function preparePair(pair) {
+  const sourceRecord = pairSource(pair);
+  if (!sourceRecord.ok) return sourceRecord;
+  const converted = convertSource(sourceRecord.source);
+  if (!converted.ok) return converted;
+  const filters = readFilters(sourceRecord.source);
+  if (!filters.ok) return filters;
+  const method = filters.filters.methods !== "all" && filters.filters.methods.length === 1 ? filters.filters.methods[0] : void 0;
+  const sourceChanges = converted.converted.changes;
+  const filterChanges = filters.filters.changes;
+  return {
+    ok: true,
+    source: converted.converted.source,
+    filters: filters.filters,
+    sourceChanges,
+    filterChanges,
+    changes: [...sourceChanges, ...filterChanges],
+    base: {
+      source: converted.converted.source,
+      resourceTypes: [...filters.filters.resourceTypes],
+      ...method === void 0 ? {} : { method }
+    }
+  };
+}
+function narrowRequestBody(filters, resourceTypes) {
+  const changes = [];
+  if (resourceTypes.length !== 1 || resourceTypes[0] !== "xmlhttprequest") {
+    if (!resourceTypes.includes("xmlhttprequest")) {
+      return {
+        ok: false,
+        reason: "Request-body rules only match xmlhttprequest, which this rule does not include."
+      };
+    }
+    changes.push(
+      "Request-body rules only match xmlhttprequest. Other resource types were dropped."
+    );
+  }
+  const allowed = REQUEST_BODY_METHODS;
+  if (filters.methods === "all") {
+    changes.push(
+      "The request had no method filter. It was split into POST, PUT, and PATCH, the methods Rogatio request-body rules allow."
+    );
+    return { ok: true, methods: [...allowed], changes };
+  }
+  const methods = allowed.filter((method) => filters.methods.includes(method));
+  const dropped = filters.methods.filter(
+    (method) => !allowed.includes(method)
+  );
+  if (methods.length === 0) {
+    return {
+      ok: false,
+      reason: "Request-body rules only support POST, PUT, and PATCH."
+    };
+  }
+  if (dropped.length > 0) {
+    changes.push(
+      `Dropped request methods other than POST, PUT, and PATCH: ${dropped.join(", ")}.`
+    );
+  }
+  if (methods.length > 1) {
+    changes.push(
+      "The request was split into one rule per method because a request-body rule stores one method."
+    );
+  }
+  return { ok: true, methods, changes };
+}
+function pairSource(pair) {
+  const source = pair.source;
+  if (!isRecord3(source)) {
+    return { ok: false, reason: "The source condition is missing." };
+  }
+  return { ok: true, source };
+}
+function readPairs(rule) {
+  const pairs = rule.pairs;
+  if (!Array.isArray(pairs) || pairs.length === 0) {
+    return { ok: false, reason: "The rule has no pairs." };
+  }
+  const records = [];
+  for (const pair of pairs) {
+    if (!isRecord3(pair)) {
+      return { ok: false, reason: "A rule pair is not an object." };
+    }
+    records.push(pair);
+  }
+  return { ok: true, pairs: records };
+}
+function readModificationList(pair) {
+  const modifications = pair.modifications;
+  if (!Array.isArray(modifications) || modifications.length === 0) {
+    return { ok: false, reason: "The query rule has no modifications." };
+  }
+  const mods = [];
+  for (const mod of modifications) {
+    if (!isRecord3(mod)) {
+      return { ok: false, reason: "A query modification is not an object." };
+    }
+    mods.push(mod);
+  }
+  return { ok: true, mods };
+}
+function headerModifications(pair) {
+  const modifications = pair.modifications;
+  if (isRecord3(modifications)) {
+    const found = [];
+    for (const direction of ["Request", "Response"]) {
+      const list = modifications[direction];
+      if (!Array.isArray(list)) continue;
+      for (const entry of list) {
+        if (!isRecord3(entry)) continue;
+        found.push({
+          record: entry,
+          direction: direction === "Request" ? "request" : "response"
+        });
+      }
+    }
+    if (found.length > 0) return found;
+  }
+  if (ownString3(pair, "header") !== void 0) {
+    const target = ownString3(pair, "target");
+    return [
+      {
+        record: pair,
+        direction: target === "Response" ? "response" : "request"
+      }
+    ];
+  }
+  return [];
+}
+function headerOperation(type) {
+  if (type === "Add") return { kind: "append" };
+  if (type === "Remove") return { kind: "remove" };
+  if (type === "Modify") {
+    return {
+      kind: "set",
+      change: "Modify updates an existing header only. It was imported as set, which also adds the header when it is absent."
+    };
+  }
+  if (type === "Replace") {
+    return {
+      kind: "set",
+      change: "Header Replace was imported as set."
+    };
+  }
+  return null;
+}
+function rewriteDestination(destination) {
+  let output = "";
+  let captures = false;
+  let dollars = false;
+  for (let index = 0; index < destination.length; index += 1) {
+    const char = destination[index];
+    if (char !== "$") {
+      output += char ?? "";
+      continue;
+    }
+    const next = destination[index + 1];
+    if (next !== void 0 && next >= "1" && next <= "9") {
+      output += `\\${next}`;
+      captures = true;
+      index += 1;
+      continue;
+    }
+    output += "$$";
+    dollars = true;
+  }
+  const changes = [];
+  if (captures) {
+    changes.push(
+      "Redirect capture references were rewritten from $1\u2013$9 to \\1\u2013\\9."
+    );
+  }
+  if (dollars) {
+    changes.push(
+      "A literal $ in the redirect destination was escaped so it is not read as a capture reference."
+    );
+  }
+  return { destination: output, changes };
+}
+function lastParamWins(params) {
+  const order = [];
+  const byName = /* @__PURE__ */ new Map();
+  for (const param of params) {
+    if (!byName.has(param.name)) order.push(param.name);
+    byName.set(param.name, param);
+  }
+  const result = [];
+  for (const name of order) {
+    const param = byName.get(name);
+    if (param !== void 0) result.push(param);
+  }
+  return result;
+}
+function noteDynamic(value, changes) {
+  if (!DYNAMIC_FUNCTION.test(value)) return;
+  const message = "A Requestly dynamic function was kept as literal text and is not evaluated.";
+  if (!changes.includes(message)) changes.push(message);
+}
+function escapeDollars2(value) {
+  return value.replaceAll("$", "$$");
+}
+function draftOf(rule, nameSuffix = "") {
+  return { nameSuffix, keepId: false, rule };
+}
+function tagIds(drafts) {
+  return drafts.map((draft, index) => ({
+    ...draft,
+    keepId: index === 0
+  }));
+}
+function applyMethods(prepared, rule, nameSuffix = "") {
+  const methodFilter = prepared.filters.methods;
+  if (methodFilter === "all" || methodFilter.length <= 1) {
+    const method = prepared.base.method;
+    return {
+      changes: [],
+      drafts: [
+        draftOf(
+          {
+            ...rule,
+            ...method === void 0 ? {} : { method }
+          },
+          nameSuffix
+        )
+      ]
+    };
+  }
+  return {
+    changes: [
+      `Request methods were split into separate rules (${methodFilter.join(", ")}). Rogatio stores one method on a rule.`
+    ],
+    drafts: methodFilter.map(
+      (method) => draftOf(
+        { ...rule, method },
+        nameSuffix.length > 0 ? `${nameSuffix} ${method}` : method
+      )
+    )
+  };
+}
+function dedupe(changes) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const change of changes) {
+    if (seen.has(change)) continue;
+    seen.add(change);
+    result.push(change);
+  }
+  return result;
+}
+var MAX_DEPTH = 40;
+var MAX_STRING = 5e6;
+var MAX_ARRAY = 1e5;
+var BANNED_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function snapshotJson(value) {
+  return snapshot(value, /* @__PURE__ */ new WeakSet(), 0);
+}
+function snapshot(value, ancestors, depth) {
+  if (typeof value === "string") {
+    if (value.length > MAX_STRING) return tooLarge();
+    return { ok: true, value };
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      return {
+        ok: false,
+        error: "Requestly export contains a non-finite number."
+      };
+    }
+    return { ok: true, value };
+  }
+  if (typeof value === "boolean" || value === null) {
+    return { ok: true, value };
+  }
+  if (value === void 0) return { ok: true, value: void 0 };
+  if (typeof value !== "object") {
+    return {
+      ok: false,
+      error: "Requestly export contains a value that is not JSON data."
+    };
+  }
+  if (depth > MAX_DEPTH) {
+    return { ok: false, error: "Requestly export is nested too deeply." };
+  }
+  if (ancestors.has(value)) {
+    return { ok: false, error: "Requestly export contains a cycle." };
+  }
+  if (Object.getOwnPropertySymbols(value).length > 0) {
+    return {
+      ok: false,
+      error: "Requestly export contains a value that is not JSON data."
+    };
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) return snapshotArray(value, ancestors, depth);
+    return snapshotObject(value, ancestors, depth);
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function snapshotArray(value, ancestors, depth) {
+  if (Object.getPrototypeOf(value) !== Array.prototype) return notJson();
+  const length = Object.getOwnPropertyDescriptor(value, "length");
+  if (length === void 0 || !("value" in length) || !Number.isSafeInteger(length.value) || length.value < 0 || length.value > MAX_ARRAY) {
+    return tooLarge();
+  }
+  const result = [];
+  for (let index = 0; index < length.value; index += 1) {
+    const entry = Object.getOwnPropertyDescriptor(value, String(index));
+    if (entry === void 0 || !("value" in entry) || !entry.enumerable) {
+      return {
+        ok: false,
+        error: "Requestly export contains a sparse array."
+      };
+    }
+    const child = snapshot(entry.value, ancestors, depth + 1);
+    if (!child.ok) return child;
+    result.push(child.value);
+  }
+  return { ok: true, value: result };
+}
+function snapshotObject(value, ancestors, depth) {
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return notJson();
+  const result = /* @__PURE__ */ Object.create(null);
+  for (const key of Object.getOwnPropertyNames(value)) {
+    if (BANNED_KEYS.has(key)) continue;
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
+      return {
+        ok: false,
+        error: "Requestly export contains a value that is not JSON data."
+      };
+    }
+    if (descriptor.value === void 0) continue;
+    const child = snapshot(descriptor.value, ancestors, depth + 1);
+    if (!child.ok) return child;
+    Object.defineProperty(result, key, {
+      configurable: true,
+      enumerable: true,
+      writable: true,
+      value: child.value
+    });
+  }
+  return { ok: true, value: result };
+}
+function tooLarge() {
+  return {
+    ok: false,
+    error: "Requestly export contains a value that is too large."
+  };
+}
+function notJson() {
+  return {
+    ok: false,
+    error: "Requestly export contains a value that is not JSON data."
+  };
+}
+function asRecords(value) {
+  if (!Array.isArray(value)) return null;
+  const records = [];
+  for (const entry of value) {
+    if (!isRecord3(entry)) return null;
+    records.push(entry);
+  }
+  return records;
+}
+function parseRequestlyExport(value) {
+  const snapshot2 = snapshotJson(value);
+  if (!snapshot2.ok) return snapshot2;
+  const records = rootRecords(snapshot2.value);
+  if (records === null) {
+    return {
+      ok: false,
+      error: "Requestly export must be a JSON array of rules and groups, a single rule, or an object with a rules array."
+    };
+  }
+  const groups = [];
+  const rules = [];
+  const unknown = [];
+  const seenRuleIds = /* @__PURE__ */ new Set();
+  const addRule = (record, groupId) => {
+    const id2 = ownString3(record, "id");
+    if (id2 !== void 0 && id2.length > 0) {
+      if (seenRuleIds.has(id2)) return;
+      seenRuleIds.add(id2);
+    }
+    const ruleType = ownString3(record, "ruleType") ?? "";
+    rules.push({
+      raw: record,
+      id: id2 !== void 0 && id2.length > 0 ? id2 : void 0,
+      name: ownString3(record, "name") ?? "",
+      ruleType,
+      groupId
+    });
+  };
+  for (const record of records) {
+    const objectType = ownString3(record, "objectType");
+    if (objectType === "group") {
+      const id2 = ownString3(record, "id");
+      if (id2 === void 0 || id2.length === 0) {
+        unknown.push({
+          name: displayName(ownString3(record, "name") ?? ""),
+          type: "group"
+        });
+        continue;
+      }
+      groups.push({
+        id: id2,
+        name: cleanLabel(ownString3(record, "name") ?? "", "Imported group"),
+        status: ownString3(record, "status")
+      });
+      const children = record.children;
+      if (Array.isArray(children)) {
+        for (const child of children) {
+          if (!isRecord3(child)) continue;
+          const childType = ownString3(child, "objectType");
+          const childRuleType = ownString3(child, "ruleType");
+          if (childType === "group" || childRuleType === void 0) continue;
+          const childGroup = ownString3(child, "groupId");
+          addRule(
+            child,
+            childGroup !== void 0 && childGroup.length > 0 ? childGroup : id2
+          );
+        }
+      }
+      continue;
+    }
+    if (objectType === "rule" || ownString3(record, "ruleType") !== void 0) {
+      addRule(record, ownString3(record, "groupId") ?? "");
+      continue;
+    }
+    unknown.push({
+      name: displayName(ownString3(record, "name") ?? ""),
+      type: objectType ?? "unknown"
+    });
+  }
+  return { ok: true, export: { groups, rules, unknown } };
+}
+function rootRecords(value) {
+  if (Array.isArray(value)) return asRecords(value);
+  if (!isRecord3(value)) return null;
+  if (ownString3(value, "objectType") === "rule" || ownString3(value, "ruleType") !== void 0) {
+    return [value];
+  }
+  if (!Object.hasOwn(value, "rules")) return null;
+  const rules = asRecords(value.rules);
+  if (rules === null) return null;
+  const groupsValue = Object.hasOwn(value, "groups") ? value.groups : Object.hasOwn(value, "updatedGroups") ? value.updatedGroups : [];
+  if (groupsValue === void 0) return rules;
+  if (!Array.isArray(groupsValue)) return null;
+  const groups = asRecords(groupsValue);
+  if (groups === null) return null;
+  return [...rules, ...groups];
+}
+var ID_PATTERN3 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var UNGROUPED_NAME = "Ungrouped";
+var INACTIVE_CHANGE = "The rule was inactive in Requestly. Rogatio project files have no disabled flag, so the rule is active.";
+var DESCRIPTION_CHANGE = "The rule description was not imported.";
+var MISSING_GROUP_CHANGE = "The rule's group was not in the export. It was placed in Ungrouped.";
+var PRIORITY_NOTE = "Priorities were assigned from 1000 downward in export order so an earlier rule wins.";
+var PRIORITY_FLOOR_NOTE = "More than 1000 rules were imported, so the remaining rules share priority 1.";
+function emptyBucket() {
+  return {
+    requestlyId: void 0,
+    id: "",
+    name: "",
+    inactive: false,
+    rules: []
+  };
+}
+function importRequestlyExport(value) {
+  const parsed = parseRequestlyExport(value);
+  if (!parsed.ok) return parsed;
+  const ids = /* @__PURE__ */ new Set();
+  const names = /* @__PURE__ */ new Set();
+  const buckets = /* @__PURE__ */ new Map();
+  const ordered = [];
+  for (const group of parsed.export.groups) {
+    if (buckets.has(group.id)) continue;
+    const name = uniqueName(group.name, names);
+    const id2 = takeId(group.id, name, "group", ids, true);
+    const bucket = {
+      requestlyId: group.id,
+      id: id2,
+      name,
+      inactive: group.status === "Inactive",
+      rules: []
+    };
+    buckets.set(group.id, bucket);
+    ordered.push(bucket);
+  }
+  let ungrouped;
+  const ensureUngrouped = () => {
+    if (ungrouped !== void 0) return ungrouped;
+    const name = uniqueName(UNGROUPED_NAME, names);
+    const id2 = takeId("Ungrouped", name, "group", ids, true);
+    ungrouped = {
+      requestlyId: void 0,
+      id: id2,
+      name,
+      inactive: false,
+      rules: []
+    };
+    return ungrouped;
+  };
+  const rows = [];
+  let priority = LIMITS.maxPriority;
+  let assignedAtFloor = 0;
+  let produced = 0;
+  for (const rule of parsed.export.rules) {
+    const placed = placeRule(rule, buckets, ensureUngrouped);
+    const changes = [...placed.changes];
+    const rogatioRuleIds = [];
+    for (const draft of placed.drafts) {
+      const labeled = draft.nameSuffix.length > 0 ? `${cleanLabel(rule.name, "Imported rule")} (${draft.nameSuffix})` : cleanLabel(rule.name, "Imported rule");
+      const storedName = uniqueName(labeled, names);
+      if (storedName !== labeled) {
+        changes.push(
+          `The name was already used and was renamed to "${storedName}".`
+        );
+      }
+      const id2 = takeId(rule.id, storedName, "rule", ids, draft.keepId);
+      if (draft.keepId && rule.id !== void 0 && id2 !== rule.id) {
+        changes.push(
+          isRogatioId(rule.id) ? `The Requestly id "${rule.id}" was already used and became "${id2}".` : `The Requestly id "${rule.id}" is not a Rogatio id and became "${id2}".`
+        );
+      }
+      const next = priority;
+      if (next === LIMITS.minPriority) assignedAtFloor += 1;
+      else priority -= 1;
+      produced += 1;
+      rogatioRuleIds.push(id2);
+      placed.bucket.rules.push({
+        ...draft.rule,
+        id: id2,
+        name: storedName,
+        priority: next,
+        resourceTypes: [...draft.rule.resourceTypes]
+      });
+    }
+    if (placed.drafts.length === 0) {
+      rows.push({
+        ...rule.id === void 0 ? {} : { requestlyId: rule.id },
+        name: displayName(rule.name),
+        ruleType: rule.ruleType.length > 0 ? rule.ruleType : "unknown",
+        status: "skipped",
+        reason: placed.reason ?? "The rule was not imported."
+      });
+      continue;
+    }
+    const uniqueChanges = dedupe2(changes);
+    rows.push({
+      ...rule.id === void 0 ? {} : { requestlyId: rule.id },
+      name: displayName(rule.name),
+      ruleType: rule.ruleType.length > 0 ? rule.ruleType : "unknown",
+      status: uniqueChanges.length === 0 ? "imported" : "changed",
+      ...uniqueChanges.length === 0 ? {} : { changes: uniqueChanges },
+      rogatioRuleIds
+    });
+  }
+  for (const record of parsed.export.unknown) {
+    rows.push({
+      name: record.name,
+      ruleType: record.type,
+      status: "skipped",
+      reason: "The record is not a Requestly rule."
+    });
+  }
+  if (ungrouped !== void 0 && ungrouped.rules.length > 0) {
+    ordered.push(ungrouped);
+  }
+  const groups = ordered.map((bucket) => ({
+    id: bucket.id,
+    name: bucket.name,
+    rules: bucket.rules
+  }));
+  const limited = limitError(groups);
+  if (limited !== void 0) return { ok: false, error: limited };
+  const notes = [];
+  if (produced > 0) notes.push(PRIORITY_NOTE);
+  if (assignedAtFloor > 1) notes.push(PRIORITY_FLOOR_NOTE);
+  return {
+    ok: true,
+    project: {
+      version: PROJECT_VERSION,
+      name: "Imported from Requestly",
+      description: "Imported from a Requestly export.",
+      groups
+    },
+    report: summarize(rows, notes, parsed.export.unknown)
+  };
+}
+function placeRule(rule, buckets, ensureUngrouped) {
+  const mapped = mapRequestlyRule(rule.raw);
+  const known = rule.groupId.length > 0 ? buckets.get(rule.groupId) : void 0;
+  const missingGroup = rule.groupId.length > 0 && known === void 0;
+  if (mapped.status === "skipped") {
+    return {
+      drafts: [],
+      changes: [],
+      reason: mapped.reason,
+      bucket: known ?? emptyBucket()
+    };
+  }
+  const bucket = known ?? ensureUngrouped();
+  const changes = [...mapped.changes];
+  if (ownString3(rule.raw, "status") === "Inactive" || bucket.inactive) {
+    changes.push(INACTIVE_CHANGE);
+  }
+  const description = ownString3(rule.raw, "description") ?? "";
+  if (description.trim().length > 0) changes.push(DESCRIPTION_CHANGE);
+  if (missingGroup) changes.push(MISSING_GROUP_CHANGE);
+  return { drafts: mapped.drafts, changes, bucket };
+}
+function summarize(rows, notes, unknown) {
+  let imported = 0;
+  let changed = 0;
+  let skipped = 0;
+  for (const row of rows) {
+    if (row.status === "imported") imported += 1;
+    else if (row.status === "changed") changed += 1;
+    else skipped += 1;
+  }
+  return { imported, changed, skipped, rules: rows, notes, unknown };
+}
+function isRogatioId(value) {
+  return value.length > 0 && value.length <= LIMITS.maxIdLength && ID_PATTERN3.test(value);
+}
+function takeId(preferred, name, kind, reserved, keep) {
+  if (keep && preferred !== void 0 && isRogatioId(preferred) && !reserved.has(preferred)) {
+    reserved.add(preferred);
+    return preferred;
+  }
+  return deriveEntityId(name, kind, reserved);
+}
+function limitError(groups) {
+  if (groups.length > LIMITS.maxGroups) {
+    return `The import needs ${groups.length} groups, above the limit of ${LIMITS.maxGroups}.`;
+  }
+  let total = 0;
+  for (const group of groups) {
+    if (group.rules.length > LIMITS.maxRulesPerGroup) {
+      return `Group "${group.name}" has ${group.rules.length} rules, above the limit of ${LIMITS.maxRulesPerGroup}.`;
+    }
+    total += group.rules.length;
+  }
+  if (total > LIMITS.maxRulesPerProject) {
+    return `The import has ${total} rules, above the limit of ${LIMITS.maxRulesPerProject}.`;
+  }
+  return void 0;
+}
+function dedupe2(changes) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const change of changes) {
+    if (seen.has(change)) continue;
+    seen.add(change);
+    result.push(change);
+  }
+  return result;
+}
+function collectIdentity(project) {
+  const ids = /* @__PURE__ */ new Set();
+  const names = /* @__PURE__ */ new Set();
+  for (const group of project.groups) {
+    ids.add(group.id);
+    names.add(normalizeNameKey(group.name));
+    for (const rule of group.rules) {
+      ids.add(rule.id);
+      names.add(normalizeNameKey(rule.name));
+    }
+  }
+  return { ids, names };
+}
+function mergeProjects(existing, imported) {
+  const current = cloneProject(existing);
+  if (current === void 0) {
+    return {
+      ok: false,
+      error: "The existing project is not a version-2 Rogatio project."
+    };
+  }
+  const incoming = cloneProject(imported);
+  if (incoming === void 0) {
+    return { ok: false, error: "The imported project is not JSON data." };
+  }
+  const { ids, names } = collectIdentity(current);
+  const renamed = [];
+  const appended = [];
+  for (const group of incoming.groups) {
+    const name = uniqueName(group.name, names);
+    if (name !== group.name) {
+      renamed.push(
+        `Imported group name "${group.name}" was already used and became "${name}".`
+      );
+    }
+    const id2 = retakeId(group.id, name, "group", ids, renamed, "group");
+    const rules = [];
+    for (const rule of group.rules) {
+      const ruleName = uniqueName(rule.name, names);
+      if (ruleName !== rule.name) {
+        renamed.push(
+          `Imported rule name "${rule.name}" was already used and became "${ruleName}".`
+        );
+      }
+      const ruleId = retakeId(rule.id, ruleName, "rule", ids, renamed, "rule");
+      rules.push({ ...rule, id: ruleId, name: ruleName });
+    }
+    appended.push({ id: id2, name, rules });
+  }
+  const groups = [...current.groups, ...appended];
+  const limited = limitError(groups);
+  if (limited !== void 0) return { ok: false, error: limited };
+  const project = {
+    version: PROJECT_VERSION,
+    name: current.name,
+    ...current.description === void 0 ? {} : { description: current.description },
+    groups,
+    ...current.requestBodyPolicy === void 0 ? {} : { requestBodyPolicy: current.requestBodyPolicy }
+  };
+  return { ok: true, project, renamed };
+}
+function retakeId(preferred, name, kind, reserved, renamed, label2) {
+  if (isRogatioId(preferred) && !reserved.has(preferred)) {
+    reserved.add(preferred);
+    return preferred;
+  }
+  const next = deriveEntityId(name, kind, reserved);
+  renamed.push(
+    isRogatioId(preferred) ? `Imported ${label2} id "${preferred}" was already used and became "${next}".` : `Imported ${label2} id "${preferred}" is not a Rogatio id and became "${next}".`
+  );
+  return next;
+}
+function cloneProject(value) {
+  let cloned;
+  try {
+    cloned = JSON.parse(JSON.stringify(value));
+  } catch {
+    return void 0;
+  }
+  if (cloned === null || typeof cloned !== "object" || Array.isArray(cloned)) {
+    return void 0;
+  }
+  const record = cloned;
+  if (record.version !== PROJECT_VERSION || typeof record.name !== "string") {
+    return void 0;
+  }
+  if (!Array.isArray(record.groups)) return void 0;
+  return record;
+}
+
+// packages/cli/src/commands/diagnose.ts
+function diagnoseProject(projectData) {
+  const diagnostics = [];
+  const schemaResult = validateProjectDetailed(projectData);
+  if (!schemaResult.valid) {
+    for (const error of schemaResult.errors) {
+      diagnostics.push({
+        code: `schema.${error.keyword}`,
+        severity: "error",
+        path: error.instancePath || "/",
+        message: error.message,
+        params: error.params
+      });
+    }
+    return { diagnostics };
+  }
+  const compileResult = compileProject(schemaResult.data);
+  if (!compileResult.ok) {
+    for (const diag of compileResult.diagnostics) {
+      diagnostics.push({
+        code: diag.code,
+        severity: diag.severity,
+        path: diag.path,
+        message: diag.message,
+        params: { ...diag.params }
+      });
+    }
+    return { diagnostics };
+  }
+  return { diagnostics, project: schemaResult.data };
+}
+function formatDiagnostics(diagnostics) {
+  return diagnostics.map((diag) => `${diag.path}: ${diag.message} (${diag.code})`).join("\n");
+}
+
+// packages/cli/src/commands/import.ts
+async function importCommand(args) {
+  const parsed = parseImportArgs(args);
+  if (!parsed.ok) {
+    console.error(parsed.error);
+    return 2;
+  }
+  const flags = parsed.flags;
+  let exportData;
+  try {
+    exportData = JSON.parse(await readFile6(flags.sourcePath, "utf8"));
+  } catch (error) {
+    console.error(`Error: ${errorMessage(error)}`);
+    return 2;
+  }
+  const imported = importRequestlyExport(exportData);
+  if (!imported.ok) {
+    console.error(`Error: ${imported.error}`);
+    return 2;
+  }
+  let project = imported.project;
+  let renamed = [];
+  if (flags.merge) {
+    if (!await pathExists2(flags.outputPath)) {
+      console.error(`Error: No project to merge at ${flags.outputPath}`);
+      return 2;
+    }
+    let existing;
+    try {
+      existing = JSON.parse(await readFile6(flags.outputPath, "utf8"));
+    } catch (error) {
+      console.error(`Error: ${errorMessage(error)}`);
+      return 2;
+    }
+    const existingDiagnosis = diagnoseProject(existing);
+    if (existingDiagnosis.diagnostics.length > 0 || existingDiagnosis.project === void 0) {
+      console.error(formatDiagnostics(existingDiagnosis.diagnostics));
+      return 1;
+    }
+    const merged = mergeProjects(existingDiagnosis.project, project);
+    if (!merged.ok) {
+      console.error(`Error: ${merged.error}`);
+      return 2;
+    }
+    project = merged.project;
+    renamed = merged.renamed;
+  } else if (await pathExists2(flags.outputPath)) {
+    console.error(
+      `Error: ${flags.outputPath} already exists. Pass --merge to append imported groups, or choose another --out path.`
+    );
+    return 2;
+  }
+  const diagnostics = diagnoseProject(project).diagnostics;
+  if (diagnostics.length > 0) {
+    console.error(formatDiagnostics(diagnostics));
+    return 1;
+  }
+  try {
+    await writeProject(flags.outputPath, project);
+  } catch (error) {
+    console.error(`Error: ${errorMessage(error)}`);
+    return 2;
+  }
+  if (flags.json) {
+    console.log(
+      `${JSON.stringify(jsonReport(imported.report, flags.outputPath, renamed), null, 2)}
+`
+    );
+  } else {
+    console.log(formatReport(imported.report, flags.outputPath, renamed));
+  }
+  return 0;
+}
+function jsonReport(report, outputPath, renamed) {
+  return { ...report, renamed, outputPath };
+}
+function formatReport(report, outputPath, renamed) {
+  const lines = [
+    `Imported ${report.imported}, changed ${report.changed}, skipped ${report.skipped}.`
+  ];
+  for (const note of report.notes) lines.push(note);
+  const changed = report.rules.filter((row) => row.status === "changed");
+  const skipped = report.rules.filter((row) => row.status === "skipped");
+  if (changed.length > 0) {
+    lines.push("", "Changed:");
+    for (const row of changed) {
+      lines.push(`  ${row.name} (${row.ruleType})`);
+      for (const change of row.changes ?? []) lines.push(`    - ${change}`);
+    }
+  }
+  if (skipped.length > 0) {
+    lines.push("", "Skipped:");
+    for (const row of skipped) {
+      lines.push(`  ${row.name} (${row.ruleType}): ${row.reason ?? ""}`);
+    }
+  }
+  if (renamed.length > 0) {
+    lines.push("", "Renamed:");
+    for (const line of renamed) lines.push(`  ${line}`);
+  }
+  lines.push("", `Wrote ${outputPath}`);
+  return lines.join("\n");
+}
+function parseImportArgs(args) {
+  const positionals = [];
+  let outputPath;
+  let merge = false;
+  let json = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (arg === "--merge") {
+      merge = true;
+      continue;
+    }
+    if (arg === "--json") {
+      json = true;
+      continue;
+    }
+    if (arg === "--out") {
+      const value = args[index + 1];
+      if (value === void 0 || value.startsWith("-")) {
+        return { ok: false, error: "Error: --out requires a path" };
+      }
+      outputPath = resolve5(value);
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      return { ok: false, error: `Error: Unknown option: ${arg}` };
+    }
+    positionals.push(arg);
+  }
+  if (positionals[0] !== "requestly") {
+    return {
+      ok: false,
+      error: "Error: Usage: rogatio import requestly <export.json> [--out <path>] [--merge] [--json]"
+    };
+  }
+  const source = positionals[1];
+  if (source === void 0) {
+    return { ok: false, error: "Error: Missing Requestly export path" };
+  }
+  if (positionals.length > 2) {
+    return { ok: false, error: "Error: Too many arguments" };
+  }
+  return {
+    ok: true,
+    flags: {
+      sourcePath: resolve5(source),
+      outputPath: outputPath ?? resolve5(process.cwd(), ".rogatio.json"),
+      merge,
+      json
+    }
+  };
+}
+async function pathExists2(path2) {
+  try {
+    await access2(path2);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : "Unknown error";
+}
+
+// packages/cli/src/commands/runtime.ts
+import { chmod, mkdir as mkdir4, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname7, join as join7, resolve as resolve6 } from "node:path";
+function toMatcherOperations2(operations) {
+  return operations.map(
+    ({ groupId, ruleId, name, matcher, redactSensitiveInLogs }) => ({
+      kind: "matcher",
+      groupId,
+      ruleId,
+      name,
+      matcher,
+      redactSensitiveInLogs
+    })
+  );
+}
+function generateHostWrapper(rogatioCommand, logPath) {
+  const parts = rogatioCommand.split(" ");
+  const nodeBin = parts[0] ?? "node";
+  const cliScript = parts.slice(1).join(" ");
+  return `#!/bin/sh
+# Rogatio native messaging host wrapper \u2014 generated by \`rogatio runtime install\`
+# Chrome launches this script when the extension connects via connectNative().
+# The extension sends the project data as the first envelope after launch.
+# stderr is redirected to a log file for debugging.
+exec "${nodeBin}" "${cliScript}" runtime host 2>>"${logPath}"
+`;
+}
+async function writeHostWrapper(hostPath, installRoot) {
+  await mkdir4(installRoot, { recursive: true });
+  const logPath = join7(installRoot, "runtime-host.log");
+  const script = generateHostWrapper(
+    `${process.execPath} ${process.argv[1] ?? "rogatio"}`,
+    logPath
+  );
+  await writeFile4(hostPath, script, "utf8");
+  await chmod(hostPath, 493);
+}
+function makeTrustController() {
+  const platform = process.platform;
+  const adapter = selectTrustPlatformAdapter(platform);
+  const installRoot = defaultTrustInstallRoot(platform);
+  return createRequestBodyTrustController({
+    platform,
+    installRoot,
+    hostPath: join7(installRoot, "runtime-host"),
+    hostName: "com.rogatio.runtime",
+    allowedOrigins: [],
+    manifestDir: adapter.defaultManifestDir(),
+    detectCapabilities: () => adapter.detect(),
+    caTrustInstaller: (cert) => adapter.caTrustInstaller(cert),
+    caTrustRemover: () => adapter.caTrustRemover()
+  });
+}
+function reportTrust(subcommand, result, okMessage) {
+  if (result.ok) {
+    console.log(okMessage);
+    return 0;
+  }
+  if (result.state === "unsupported") {
+    const reasons = result.reasons ?? ["unknown"];
+    console.error(`trust unsupported: ${reasons.join(", ")}`);
+    const hints = {
+      "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates; Windows: certutil is built-in)",
+      "manifest-dir-unwritable": "Hint: check permissions on Chrome NativeMessagingHosts directory or run with appropriate access",
+      "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain",
+      "ca-store-unwritable": "Hint: /usr/local/share/ca-certificates not writable; check directory permissions",
+      "elevation-required": "Hint: device-local CA trust requires root (Linux: sudo, macOS: keychain password, Windows: Administrator). Re-run with elevated privileges"
+    };
+    for (const reason of reasons) {
+      const hint = hints[reason];
+      if (hint) {
+        console.error(hint);
+      }
+    }
+    return 1;
+  }
+  console.error(
+    `runtime ${subcommand} failed: ${(result.reasons ?? ["unknown"]).join(", ")}`
+  );
+  return 1;
+}
+async function trustRuntimeCommand(args) {
+  const subcommand = args[0];
+  let extensionId;
+  if (subcommand === "install") {
+    const extIdIndex = args.indexOf("--extension-id");
+    if (extIdIndex === -1 || extIdIndex + 1 >= args.length) {
+      console.error("Error: --extension-id is required for install command");
+      showRuntimeHelp();
+      return 2;
+    }
+    extensionId = args[extIdIndex + 1];
+    if (!/^[a-p]{32}$/.test(extensionId)) {
+      console.error(
+        "Error: --extension-id must be exactly 32 lowercase characters from a through p"
+      );
+      return 2;
+    }
+  }
+  const controller = makeTrustController();
+  const installRoot = defaultTrustInstallRoot(process.platform);
+  const hostPath = join7(installRoot, "runtime-host");
+  switch (subcommand) {
+    case "install": {
+      const installResult = await controller.install(extensionId ?? "");
+      if (installResult.ok) {
+        try {
+          await writeHostWrapper(hostPath, installRoot);
+        } catch (error) {
+          console.error(
+            `Warning: manifest and CA trusted, but failed to create runtime-host wrapper: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      }
+      return reportTrust(
+        "install",
+        installResult,
+        "runtime install complete: manifest + device-local CA trusted + runtime-host wrapper created\nNote: reload the extension at chrome://extensions for the native host to be detected."
+      );
+    }
+    case "uninstall": {
+      const uninstallResult = await controller.uninstall();
+      try {
+        await rm2(hostPath, { force: true });
+      } catch {
+      }
+      try {
+        await rm2(join7(installRoot, "runtime-host.log"), { force: true });
+      } catch {
+      }
+      return reportTrust(
+        "uninstall",
+        uninstallResult,
+        "runtime uninstall complete: manifest + device-local CA removed"
+      );
+    }
+    case "verify": {
+      const result = await controller.verify();
+      if (result.ok) {
+        console.log(
+          "runtime verification passed: manifest, binary, and CA trust all OK"
+        );
+        return 0;
+      }
+      console.error("runtime verification failed:");
+      if (!result.manifestExists) console.error("  manifest not found");
+      if (result.manifestExists && !result.manifestValid)
+        console.error("  manifest invalid");
+      if (!result.binaryExists)
+        console.error("  runtime-host binary not found");
+      if (result.binaryExists && !result.binaryExecutable)
+        console.error("  runtime-host binary not executable");
+      if (result.allowedOriginsCount === 0)
+        console.error("  no allowed_origins in manifest");
+      if (!result.caTrusted) console.error("  device-local CA not trusted");
+      for (const reason of result.reasons) {
+        if (reason === "manifest-not-found")
+          console.error(
+            "  Hint: run 'rogatio runtime install --extension-id <id>' to register the host manifest"
+          );
+        if (reason === "binary-not-found")
+          console.error(
+            `  Hint: ensure the runtime-host binary exists at the path specified in the manifest`
+          );
+        if (reason === "binary-not-executable")
+          console.error(
+            "  Hint: ensure the runtime-host binary has execute permission (chmod +x)"
+          );
+        if (reason === "no-allowed-origins")
+          console.error(
+            "  Hint: re-run 'rogatio runtime install --extension-id <id>' to pin your extension ID"
+          );
+        if (reason === "ca-not-trusted")
+          console.error(
+            "  Hint: re-run 'rogatio runtime install --extension-id <id>' with elevated privileges to trust the CA"
+          );
+      }
+      return 1;
+    }
+    default:
+      console.error(`Error: unknown runtime subcommand: ${subcommand ?? ""}`);
+      showRuntimeHelp();
+      return 2;
+  }
+}
+async function runtimeHostCommand(args, options = {}) {
+  let root;
+  let mockPort;
+  const positional = [];
+  let argumentError;
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--root" && index + 1 < args.length) {
-      root = resolve5(args[++index]);
+      root = resolve6(args[++index]);
     } else if (arg === "--root") {
       argumentError = "--root requires a value";
     } else if (arg === "--mock-port" && index + 1 < args.length) {
@@ -28004,7 +30121,7 @@ async function runtimeHostCommand(args, options = {}) {
       filePath = "<stdin>";
       projectData = JSON.parse(chunks.join(""));
     } else {
-      filePath = resolve5(inputPath);
+      filePath = resolve6(inputPath);
       projectData = await storage.get(filePath);
     }
   } catch (error) {
@@ -28073,8 +30190,8 @@ async function runRuntimeHostEntry() {
 }
 
 // packages/cli/src/commands/test.ts
-import { readFile as readFile6 } from "node:fs/promises";
-import { resolve as resolve6 } from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import { resolve as resolve7 } from "node:path";
 function usageError(message) {
   return `Error: ${message}
 `;
@@ -28236,7 +30353,7 @@ function testCommandNeedsStdin(args) {
   return !hasUrlSource && positionalUrls.length === 0;
 }
 async function testCommandImpl(args, stdinInput, captureOutput, options = {}) {
-  let filePath = resolve6(process.cwd(), ".rogatio.json");
+  let filePath = resolve7(process.cwd(), ".rogatio.json");
   let jsonMode = false;
   let maxCases;
   const urlCases = [];
@@ -28296,12 +30413,12 @@ async function testCommandImpl(args, stdinInput, captureOutput, options = {}) {
     }
     filePath = "<stdin>";
   } else if (inputPath) {
-    filePath = resolve6(inputPath);
+    filePath = resolve7(inputPath);
   }
   for (const url of positionalUrls) urlCases.push({ url });
   if (urlsFile) {
     try {
-      const content = urlsFile === "-" ? stdinInput ?? "" : await readFile6(urlsFile, "utf8");
+      const content = urlsFile === "-" ? stdinInput ?? "" : await readFile7(urlsFile, "utf8");
       const parsed = JSON.parse(content);
       if (!Array.isArray(parsed)) {
         const output = usageError(`${urlsFile} must contain a JSON array`);
@@ -28452,7 +30569,7 @@ async function testCommand(args, stdinInput, captureOutput = false, options = {}
 }
 
 // packages/cli/src/commands/verify.ts
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 async function verifyCommandImpl(args, stdinInput, captureOutput, options = {}) {
   let filePath;
   let jsonOutput2 = false;
@@ -28479,9 +30596,9 @@ async function verifyCommandImpl(args, stdinInput, captureOutput, options = {})
     }
     filePath = "<stdin>";
   } else if (inputPath) {
-    filePath = resolve7(inputPath);
+    filePath = resolve8(inputPath);
   } else {
-    filePath = resolve7(process.cwd(), ".rogatio.json");
+    filePath = resolve8(process.cwd(), ".rogatio.json");
   }
   let projectData;
   try {
@@ -28499,32 +30616,7 @@ async function verifyCommandImpl(args, stdinInput, captureOutput, options = {})
     console.error(output2.trim());
     return 2;
   }
-  const schemaResult = validateProjectDetailed(projectData);
-  const diagnostics = [];
-  if (!schemaResult.valid) {
-    for (const error of schemaResult.errors) {
-      diagnostics.push({
-        code: `schema.${error.keyword}`,
-        severity: "error",
-        path: error.instancePath || "/",
-        message: error.message,
-        params: error.params
-      });
-    }
-  } else {
-    const compileResult = compileProject(schemaResult.data);
-    if (!compileResult.ok) {
-      for (const diag of compileResult.diagnostics) {
-        diagnostics.push({
-          code: diag.code,
-          severity: diag.severity,
-          path: diag.path,
-          message: diag.message,
-          params: diag.params
-        });
-      }
-    }
-  }
+  const diagnostics = diagnoseProject(projectData).diagnostics;
   let output = "";
   if (jsonOutput2) {
     output = `${JSON.stringify(diagnostics, null, 2)}
@@ -28550,7 +30642,7 @@ async function verifyCommand(args, stdinInput, captureOutput = false, options =
 
 // packages/cli/src/index.ts
 var __dirname = dirname8(fileURLToPath2(import.meta.url));
-var packageJsonPath = resolve8(
+var packageJsonPath = resolve9(
   __dirname,
   isDistBuild(__dirname) ? "../../package.json" : "../package.json"
 );
@@ -28577,6 +30669,8 @@ async function cli(args = process.argv.slice(2)) {
       return handleRuntime(commandArgs);
     case "ai":
       return handleAI(commandArgs);
+    case "import":
+      return handleImport(commandArgs);
     case "--help":
     case "-h":
       return showHelp();
@@ -28621,6 +30715,13 @@ async function handleAI(args) {
   }
   return await aiCommand(args);
 }
+async function handleImport(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    showImportHelp();
+    return 0;
+  }
+  return importCommand(args);
+}
 async function handleTest(args) {
   if (args.includes("--help") || args.includes("-h")) {
     showTestHelp();
@@ -28653,6 +30754,7 @@ Commands:
   edit [path]     Launch browser editor for .rogatio.json
   test [path] [url...]  Run offline dry-run tests against .rogatio.json
   verify [path]   Validate .rogatio.json file
+  import requestly <export.json>  Migrate a Requestly export into .rogatio.json
   runtime <install|uninstall|verify|host>  Native messaging runtime control
   runtime host [path]  Run the native-messaging runtime host
   ai <setup|ls|show|delete|test>  AI provider configuration
@@ -28664,7 +30766,7 @@ Global Options:
 Run 'rogatio <command> --help' for command-specific help.`);
   return 0;
 }
-if (process.argv[1] !== void 0 && realpathSync.native(fileURLToPath2(import.meta.url)) === realpathSync.native(resolve8(process.argv[1]))) {
+if (process.argv[1] !== void 0 && realpathSync.native(fileURLToPath2(import.meta.url)) === realpathSync.native(resolve9(process.argv[1]))) {
   if (basename3(process.argv[1]) === "runtime-host") {
     runRuntimeHostEntry().catch((err) => {
       console.error(err);