@vm0/cli 9.222.2 → 9.222.3

package/chunk-ODQBZESC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../packages/connectors/src/firewall-rule-matcher.ts"],"sourcesContent":["import {\n  type FirewallConfig,\n  hasBaseUrlParams,\n  validateAuthBaseUrl,\n  validateBaseUrl,\n} from \"./firewall-types\";\nimport { hasRawWhitespace, hasUnsafeUrlCodepoint } from \"./firewall-url-utils\";\nimport { parseSegment, splitPathSegments } from \"./segment-parser\";\n\ntype PathSpecificity = readonly [\n  literalSegments: number,\n  mixedParamSegments: number,\n  plainParamSegments: number,\n  plusGreedySegments: number,\n  negativeStarGreedySegments: number,\n  literalChars: number,\n  segmentCount: number,\n];\n\nexport interface FindMatchingPermissionsOptions {\n  apiBase?: string;\n}\n\nexport interface FindMatchingRoutingPermissionsOptions extends FindMatchingPermissionsOptions {\n  serviceName?: string;\n}\n\nexport interface FirewallBaseUrlMatch {\n  displayBase: string;\n  relativePath: string;\n  score: number;\n}\n\nexport interface FirewallRoutingPermissionRoute {\n  readonly permissionName: string;\n  readonly rule: string;\n}\n\nexport interface FirewallRoutingPermissionApi {\n  readonly base: string;\n  readonly routes: readonly FirewallRoutingPermissionRoute[];\n}\n\ninterface ApiMatchState {\n  bestSpecificity: PathSpecificity | null;\n  matched: string[];\n}\n\ninterface PermissionRuleSet {\n  readonly name: string;\n  readonly rules: readonly string[];\n}\n\ninterface PermissionMatchApi {\n  readonly permissionRuleSets: readonly PermissionRuleSet[];\n}\n\nconst VALID_RULE_METHODS = new Set([\n  \"GET\",\n  \"POST\",\n  \"PUT\",\n  \"PATCH\",\n  \"DELETE\",\n  \"HEAD\",\n  \"OPTIONS\",\n  \"ANY\",\n]);\nconst FORBIDDEN_RUNTIME_HOST_CHARS = new Set(\"#%*,/<>?@\\\\^|{}\".split(\"\"));\nconst FORBIDDEN_BASE_PATTERN_HOST_CHARS = new Set(\"#%,/<>?@\\\\^|\".split(\"\"));\nconst PERCENT_ESCAPE_LENGTH = 3;\nconst HEX_DIGITS = new Set(\"0123456789abcdefABCDEF\".split(\"\"));\nconst PATH_SCORE_MULTIPLIER = 1_000_000;\nconst AUTHORITY_SCORE_MULTIPLIER = 100;\nconst LITERAL_SEGMENT_SCORE = 1_000;\nconst MIXED_PARAM_SEGMENT_SCORE = 100;\nconst PLAIN_PARAM_SEGMENT_SCORE = 10;\nconst PLUS_GREEDY_SEGMENT_SCORE = 1;\nconst ROOT_PATH_SCORE = 1;\nconst STATIC_BASE_SCORE_BONUS = 1;\nconst PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS = new Set([\n  \"{\",\n  \"}\",\n  \"*\",\n  \".\",\n  \"\\u3002\",\n  \"\\uff0e\",\n  \"\\uff61\",\n  \":\",\n]);\n\n/**\n * Match a runtime segment against a mixed pattern's literal prefix/suffix.\n *\n * Byte-exact comparison; callers must case-fold inputs themselves when\n * needed. Returns the captured middle on success, or null if prefix/suffix\n * don't match or the middle would be empty (non-empty guard).\n */\nfunction matchMixedSegment(\n  runtime: string,\n  prefix: string,\n  suffix: string,\n): string | null {\n  if (!runtime.startsWith(prefix)) return null;\n  if (!runtime.endsWith(suffix)) return null;\n  if (runtime.length <= prefix.length + suffix.length) return null;\n  return runtime.slice(prefix.length, runtime.length - suffix.length);\n}\n\nfunction hasNonEmptySegment(segments: string[], start: number): boolean {\n  for (let i = start; i < segments.length; i++) {\n    if (segments[i] !== \"\") return true;\n  }\n  return false;\n}\n\nfunction codePointLength(value: string): number {\n  return [...value].length;\n}\n\nfunction hasUnsafeRuntimeUrlSyntax(value: string): boolean {\n  return (\n    hasUnsafeUrlCodepoint(value) ||\n    hasRawWhitespace(value) ||\n    value.includes(\"\\\\\") ||\n    !value.includes(\"://\")\n  );\n}\n\nfunction stripTrailingSlash(value: string): string {\n  return value.endsWith(\"/\") ? value.slice(0, -1) : value;\n}\n\nfunction isInvalidGreedyParam(\n  patternIndex: number,\n  lastPatternIndex: number,\n  prefix: string,\n  suffix: string,\n): boolean {\n  return patternIndex !== lastPatternIndex || prefix !== \"\" || suffix !== \"\";\n}\n\nfunction pathSpecificity(pattern: string): PathSpecificity | null {\n  if (\n    !pattern.startsWith(\"/\") ||\n    pattern.includes(\"?\") ||\n    pattern.includes(\"#\") ||\n    pattern.includes(\"\\\\\") ||\n    hasRawWhitespace(pattern) ||\n    hasUnsafeUrlCodepoint(pattern)\n  ) {\n    return null;\n  }\n\n  let literalSegments = 0;\n  let mixedParamSegments = 0;\n  let plainParamSegments = 0;\n  let plusGreedySegments = 0;\n  let starGreedySegments = 0;\n  let literalChars = 0;\n  const segments = splitPathSegments(pattern);\n  const paramNames = new Set<string>();\n  const lastSegmentIndex = segments.length - 1;\n\n  for (let index = 0; index < segments.length; index += 1) {\n    const seg = segments[index]!;\n    const parsed = parseSegment(seg);\n    if (parsed.kind === \"error\") return null;\n    if (parsed.kind === \"literal\") {\n      literalSegments += 1;\n      literalChars += codePointLength(parsed.value);\n      continue;\n    }\n    if (paramNames.has(parsed.name)) return null;\n    paramNames.add(parsed.name);\n    if (\n      parsed.greedy !== \"\" &&\n      isInvalidGreedyParam(\n        index,\n        lastSegmentIndex,\n        parsed.prefix,\n        parsed.suffix,\n      )\n    ) {\n      return null;\n    }\n\n    literalChars +=\n      codePointLength(parsed.prefix) + codePointLength(parsed.suffix);\n    if (parsed.prefix !== \"\" || parsed.suffix !== \"\") {\n      mixedParamSegments += 1;\n    } else if (parsed.greedy === \"+\") {\n      plusGreedySegments += 1;\n    } else if (parsed.greedy === \"*\") {\n      starGreedySegments += 1;\n    } else {\n      plainParamSegments += 1;\n    }\n  }\n\n  return [\n    literalSegments,\n    mixedParamSegments,\n    plainParamSegments,\n    plusGreedySegments,\n    -starGreedySegments,\n    literalChars,\n    segments.length,\n  ];\n}\n\nfunction comparePathSpecificity(\n  left: PathSpecificity,\n  right: PathSpecificity,\n): number {\n  for (let i = 0; i < left.length; i++) {\n    const difference = left[i]! - right[i]!;\n    if (difference !== 0) return difference;\n  }\n  return 0;\n}\n\nfunction matchingRulePath(rule: string, upperMethod: string): string | null {\n  const spaceIdx = rule.indexOf(\" \");\n  if (spaceIdx === -1) return null;\n  const ruleMethod = rule.slice(0, spaceIdx);\n  if (!VALID_RULE_METHODS.has(ruleMethod)) return null;\n  if (ruleMethod !== \"ANY\" && ruleMethod !== upperMethod) return null;\n  return rule.slice(spaceIdx + 1);\n}\n\nfunction isValidPermissionName(permissionName: string): boolean {\n  return permissionName !== \"\" && permissionName !== \"all\";\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction isStringRecord(value: unknown): value is Record<string, string> {\n  if (!isObjectRecord(value)) return false;\n  return Object.values(value).every((entry) => {\n    return typeof entry === \"string\";\n  });\n}\n\nfunction hasEntries(value: Record<string, string> | undefined): boolean {\n  return value !== undefined && Object.keys(value).length > 0;\n}\n\nfunction isValidAwsSigv4AuthConfig(value: unknown): boolean {\n  if (!isObjectRecord(value)) return false;\n  const allowedKeys = new Set([\n    \"accessKeyId\",\n    \"secretAccessKey\",\n    \"sessionToken\",\n  ]);\n  if (\n    Object.keys(value).some((key) => {\n      return !allowedKeys.has(key);\n    })\n  ) {\n    return false;\n  }\n  if (typeof value.accessKeyId !== \"string\" || value.accessKeyId === \"\") {\n    return false;\n  }\n  if (\n    typeof value.secretAccessKey !== \"string\" ||\n    value.secretAccessKey === \"\"\n  ) {\n    return false;\n  }\n  const optionalValue = value.sessionToken;\n  if (\n    optionalValue !== undefined &&\n    (typeof optionalValue !== \"string\" || optionalValue === \"\")\n  ) {\n    return false;\n  }\n  return true;\n}\n\nfunction isValidAuthConfig(auth: unknown, serviceName: string): boolean {\n  if (!isObjectRecord(auth)) return false;\n  if (auth.headers !== undefined && !isStringRecord(auth.headers)) return false;\n  if (auth.query !== undefined && !isStringRecord(auth.query)) return false;\n  if (\n    auth.awsSigv4 !== undefined &&\n    !isValidAwsSigv4AuthConfig(auth.awsSigv4)\n  ) {\n    return false;\n  }\n  if (auth.awsSigv4 !== undefined) {\n    if (hasEntries(auth.headers as Record<string, string> | undefined)) {\n      return false;\n    }\n    if (hasEntries(auth.query as Record<string, string> | undefined)) {\n      return false;\n    }\n  }\n  if (auth.base !== undefined) {\n    if (typeof auth.base !== \"string\") return false;\n    validateAuthBaseUrl(auth.base, serviceName);\n  }\n  return true;\n}\n\nfunction isValidApiEntry(\n  api: FirewallConfig[\"apis\"][number],\n  serviceName: string,\n): boolean {\n  if (!isObjectRecord(api)) return false;\n  if (typeof api.base !== \"string\") return false;\n  try {\n    validateBaseUrl(api.base, serviceName);\n    if (!isValidAuthConfig(api.auth, serviceName)) return false;\n  } catch {\n    return false;\n  }\n  return true;\n}\n\nfunction getPermissionName(permission: unknown): string | null {\n  if (!isObjectRecord(permission)) return null;\n  if (typeof permission.name !== \"string\") return null;\n  if (!isValidPermissionName(permission.name)) return null;\n  return permission.name;\n}\n\nfunction getPermissionRules(permission: unknown): string[] {\n  if (!isObjectRecord(permission)) return [];\n  if (!Array.isArray(permission.rules)) return [];\n  const rules = permission.rules.filter((rule) => {\n    return typeof rule === \"string\";\n  });\n  return rules;\n}\n\nfunction getApiPermissionRuleSetsForMatch(\n  api: FirewallConfig[\"apis\"][number],\n  serviceName: string,\n  apiBase: string | null,\n): PermissionRuleSet[] | null {\n  if (!isValidApiEntry(api, serviceName)) return null;\n  if (apiBase !== null && stripTrailingSlash(api.base) !== apiBase) return null;\n  if (api.permissions === undefined) return null;\n  if (!Array.isArray(api.permissions)) return null;\n\n  const permissionRuleSets: PermissionRuleSet[] = [];\n  const seenPermissionNames = new Set<string>();\n  for (const rawPermission of api.permissions) {\n    const permissionName = getPermissionName(rawPermission);\n    if (permissionName === null) continue;\n    if (seenPermissionNames.has(permissionName)) continue;\n    seenPermissionNames.add(permissionName);\n    permissionRuleSets.push({\n      name: permissionName,\n      rules: getPermissionRules(rawPermission),\n    });\n  }\n  return permissionRuleSets;\n}\n\nfunction getRoutingApiPermissionRuleSetsForMatch(\n  api: FirewallRoutingPermissionApi,\n  serviceName: string,\n  apiBase: string | null,\n): PermissionRuleSet[] | null {\n  if (!isObjectRecord(api)) return null;\n  if (typeof api.base !== \"string\") return null;\n  try {\n    validateBaseUrl(api.base, serviceName);\n  } catch {\n    return null;\n  }\n  if (apiBase !== null && stripTrailingSlash(api.base) !== apiBase) return null;\n  if (!Array.isArray(api.routes)) return null;\n\n  const rulesByPermission = new Map<string, string[]>();\n  for (const route of api.routes) {\n    if (!isObjectRecord(route)) continue;\n    if (typeof route.permissionName !== \"string\") continue;\n    if (!isValidPermissionName(route.permissionName)) continue;\n    if (typeof route.rule !== \"string\") continue;\n\n    const rules = rulesByPermission.get(route.permissionName);\n    if (rules) {\n      rules.push(route.rule);\n    } else {\n      rulesByPermission.set(route.permissionName, [route.rule]);\n    }\n  }\n\n  return [...rulesByPermission.entries()].map(([name, rules]) => {\n    return { name, rules };\n  });\n}\n\nfunction recordPermissionMatch(\n  state: ApiMatchState,\n  permission: string,\n  specificity: PathSpecificity,\n): void {\n  if (\n    state.bestSpecificity === null ||\n    comparePathSpecificity(specificity, state.bestSpecificity) > 0\n  ) {\n    state.bestSpecificity = specificity;\n    state.matched.length = 0;\n  }\n  if (\n    comparePathSpecificity(specificity, state.bestSpecificity) === 0 &&\n    !state.matched.includes(permission)\n  ) {\n    state.matched.push(permission);\n  }\n}\n\nfunction relativePathFromSegments(\n  segments: string[],\n  consumed: number,\n): string {\n  const rest = segments.slice(consumed).join(\"/\");\n  return rest === \"\" ? \"/\" : `/${rest}`;\n}\n\nfunction stripUrlQueryAndFragment(url: string): string {\n  const queryIndex = url.indexOf(\"?\");\n  const fragmentIndex = url.indexOf(\"#\");\n  let end = url.length;\n  if (queryIndex !== -1) end = Math.min(end, queryIndex);\n  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);\n  return url.slice(0, end);\n}\n\nfunction rawPathFromUrl(url: string): string {\n  const urlWithoutQuery = stripUrlQueryAndFragment(url);\n  const schemeEnd = urlWithoutQuery.indexOf(\"://\");\n  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;\n  const pathStart = urlWithoutQuery.indexOf(\"/\", authorityStart);\n  return pathStart === -1 ? \"/\" : urlWithoutQuery.slice(pathStart);\n}\n\nfunction rawBasePathFromUrl(url: string): string {\n  const urlWithoutQuery = stripUrlQueryAndFragment(url);\n  const schemeEnd = urlWithoutQuery.indexOf(\"://\");\n  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;\n  const pathStart = urlWithoutQuery.indexOf(\"/\", authorityStart);\n  return pathStart === -1 ? \"\" : urlWithoutQuery.slice(pathStart);\n}\n\nfunction rawAuthorityFromUrl(url: string): string | null {\n  const urlWithoutQuery = stripUrlQueryAndFragment(url);\n  const schemeEnd = urlWithoutQuery.indexOf(\"://\");\n  if (schemeEnd === -1) return null;\n  const authorityStart = schemeEnd + 3;\n  const pathStart = urlWithoutQuery.indexOf(\"/\", authorityStart);\n  const authority =\n    pathStart === -1\n      ? urlWithoutQuery.slice(authorityStart)\n      : urlWithoutQuery.slice(authorityStart, pathStart);\n  return authority === \"\" ? null : authority;\n}\n\nfunction hasNonAscii(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    if (value.charCodeAt(index) > 0x7f) return true;\n  }\n  return false;\n}\n\nfunction rawHostFromAuthority(authority: string): string {\n  const withoutUserinfo = authority.slice(authority.lastIndexOf(\"@\") + 1);\n  if (withoutUserinfo.startsWith(\"[\")) {\n    const closeBracket = withoutUserinfo.indexOf(\"]\");\n    return closeBracket === -1\n      ? withoutUserinfo\n      : withoutUserinfo.slice(0, closeBracket + 1);\n  }\n  const portSeparator = withoutUserinfo.lastIndexOf(\":\");\n  return portSeparator === -1\n    ? withoutUserinfo\n    : withoutUserinfo.slice(0, portSeparator);\n}\n\nfunction authorityHasEmptyPort(authority: string): boolean {\n  const withoutUserinfo = authority.slice(authority.lastIndexOf(\"@\") + 1);\n  if (withoutUserinfo.startsWith(\"[\")) {\n    const closeBracket = withoutUserinfo.indexOf(\"]\");\n    if (closeBracket === -1) return false;\n    return withoutUserinfo.slice(closeBracket + 1) === \":\";\n  }\n\n  const portSeparator = withoutUserinfo.lastIndexOf(\":\");\n  if (portSeparator === -1) return false;\n  return (\n    withoutUserinfo.indexOf(\":\") === portSeparator &&\n    portSeparator === withoutUserinfo.length - 1\n  );\n}\n\nfunction rawAuthorityHostStartsWithDigit(authority: string): boolean {\n  const firstChar = rawHostFromAuthority(authority)[0];\n  return firstChar !== undefined && firstChar >= \"0\" && firstChar <= \"9\";\n}\n\nfunction runtimeAuthorityOriginForHostValidation(url: string): string | null {\n  const authority = rawAuthorityFromUrl(url);\n  if (authority === null) return null;\n  if (\n    !authority.includes(\"%\") &&\n    !hasNonAscii(authority) &&\n    !rawAuthorityHostStartsWithDigit(authority)\n  ) {\n    return null;\n  }\n\n  const schemeEnd = url.indexOf(\"://\");\n  if (schemeEnd === -1) return null;\n  return `${url.slice(0, schemeEnd)}://${authority}`;\n}\n\nfunction hasPercentEncodedAuthoritySyntax(value: string): boolean {\n  let index = value.indexOf(\"%\");\n  while (index !== -1) {\n    let runEnd = index;\n    while (runEnd < value.length && value[runEnd] === \"%\") {\n      const firstHexDigit = value[runEnd + 1];\n      const secondHexDigit = value[runEnd + 2];\n      if (\n        !firstHexDigit ||\n        !secondHexDigit ||\n        !HEX_DIGITS.has(firstHexDigit) ||\n        !HEX_DIGITS.has(secondHexDigit)\n      ) {\n        return true;\n      }\n      runEnd += PERCENT_ESCAPE_LENGTH;\n    }\n\n    let decodedRun: string;\n    try {\n      decodedRun = decodeURIComponent(value.slice(index, runEnd));\n    } catch {\n      return true;\n    }\n    for (const char of decodedRun) {\n      if (PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS.has(char)) {\n        return true;\n      }\n    }\n    index = value.indexOf(\"%\", runEnd);\n  }\n  return false;\n}\n\nfunction hasMalformedRuntimeAuthoritySyntax(url: string): boolean {\n  const authority = rawAuthorityFromUrl(url);\n  if (authority === null) return false;\n  return (\n    authority.includes(\"\\\\\") ||\n    authorityHasEmptyPort(authority) ||\n    hasPercentEncodedAuthoritySyntax(authority)\n  );\n}\n\nfunction scoreLiteralSegment(segment: string): number {\n  return LITERAL_SEGMENT_SCORE + codePointLength(segment);\n}\n\nfunction scorePatternSegment(segment: string, allowParams: boolean): number {\n  if (!allowParams) return scoreLiteralSegment(segment);\n\n  const parsed = parseSegment(segment);\n  if (parsed.kind === \"error\") return 0;\n  if (parsed.kind === \"literal\") {\n    return scoreLiteralSegment(parsed.value);\n  }\n\n  const literalChars =\n    codePointLength(parsed.prefix) + codePointLength(parsed.suffix);\n  if (parsed.prefix !== \"\" || parsed.suffix !== \"\") {\n    return MIXED_PARAM_SEGMENT_SCORE + literalChars;\n  }\n  if (parsed.greedy === \"+\") return PLUS_GREEDY_SEGMENT_SCORE;\n  if (parsed.greedy === \"*\") return 0;\n  return PLAIN_PARAM_SEGMENT_SCORE;\n}\n\nfunction scorePatternSegments(\n  segments: string[],\n  allowParams: boolean,\n): number {\n  return segments.reduce((score, segment) => {\n    return score + scorePatternSegment(segment, allowParams);\n  }, 0);\n}\n\nfunction scorePathPattern(path: string, allowParams: boolean): number {\n  if (path === \"\") return 0;\n  if (path === \"/\") return ROOT_PATH_SCORE;\n  return scorePatternSegments(splitPathSegments(path), allowParams);\n}\n\nfunction splitAuthoritySegments(authority: string): string[] {\n  if (authority.startsWith(\"[\")) return [authority];\n  const normalized = authority.endsWith(\".\")\n    ? authority.slice(0, -1)\n    : authority;\n  return normalized === \"\" ? [] : normalized.split(\".\");\n}\n\nfunction baseUrlSpecificityScore(rawBase: string, hasParams: boolean): number {\n  const baseForMatch = stripTrailingSlash(rawBase);\n  const authorityScore = scorePatternSegments(\n    splitAuthoritySegments(rawAuthorityFromUrl(baseForMatch) ?? \"\"),\n    hasParams,\n  );\n  const pathScore = scorePathPattern(\n    rawBasePathFromUrl(baseForMatch),\n    hasParams,\n  );\n  return (\n    pathScore * PATH_SCORE_MULTIPLIER +\n    authorityScore * AUTHORITY_SCORE_MULTIPLIER +\n    (hasParams ? 0 : STATIC_BASE_SCORE_BONUS)\n  );\n}\n\nfunction matchStaticBasePathPrefix(\n  path: string,\n  pattern: string,\n): string | null {\n  if (pattern === \"\") {\n    return path === \"\" ? \"/\" : path;\n  }\n  if (pattern === \"/\") {\n    if (!path.startsWith(pattern)) return null;\n    const relativePath = path.slice(pattern.length);\n    if (relativePath !== \"\" && !relativePath.startsWith(\"/\")) return null;\n    return relativePath === \"\" ? \"/\" : relativePath;\n  }\n  if (!path.startsWith(pattern)) return null;\n  const relativePath = path.slice(pattern.length);\n  if (relativePath !== \"\" && !relativePath.startsWith(\"/\")) return null;\n  return relativePath === \"\" ? \"/\" : relativePath;\n}\n\nfunction normalizeUrlHostname(\n  hostname: string,\n  options: { allowHostParams?: boolean } = {},\n): string | null {\n  let normalized = hostname.toLowerCase();\n  if (normalized.endsWith(\".\")) {\n    normalized = normalized.slice(0, -1);\n    if (normalized === \"\" || normalized.endsWith(\".\")) {\n      return null;\n    }\n  }\n  if (\n    normalized.split(\".\").some((label) => {\n      return label === \"\";\n    })\n  ) {\n    return null;\n  }\n  const forbiddenChars =\n    options.allowHostParams === true\n      ? FORBIDDEN_BASE_PATTERN_HOST_CHARS\n      : FORBIDDEN_RUNTIME_HOST_CHARS;\n  if (\n    !normalized.startsWith(\"[\") &&\n    [...normalized].some((char) => {\n      return forbiddenChars.has(char);\n    })\n  ) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction normalizedUrlAuthority(\n  parsed: URL,\n  options: { allowHostParams?: boolean } = {},\n): string | null {\n  if (parsed.username !== \"\" || parsed.password !== \"\") {\n    return null;\n  }\n\n  const hostname = normalizeUrlHostname(parsed.hostname, options);\n  if (hostname === null || hostname === \"\") {\n    return null;\n  }\n\n  return parsed.port === \"\" ? hostname : `${hostname}:${parsed.port}`;\n}\n\nfunction matchStaticFirewallBaseUrl(\n  url: string,\n  rawBase: string,\n): FirewallBaseUrlMatch | null {\n  const parsedUrl = new URL(url);\n  const parsedBase = new URL(rawBase);\n  if (parsedUrl.protocol.toLowerCase() !== parsedBase.protocol.toLowerCase()) {\n    return null;\n  }\n  const baseHasParams = hasBaseUrlParams(rawBase);\n  const baseForMatch = stripTrailingSlash(rawBase);\n\n  const urlAuthority = normalizedUrlAuthority(parsedUrl);\n  const baseAuthority = normalizedUrlAuthority(parsedBase, {\n    allowHostParams: baseHasParams,\n  });\n  if (urlAuthority === null || baseAuthority === null) return null;\n  if (baseHasParams) {\n    if (matchFirewallHost(urlAuthority, baseAuthority) === null) return null;\n  } else if (urlAuthority !== baseAuthority) {\n    return null;\n  }\n\n  const basePath = rawBasePathFromUrl(baseForMatch);\n  const relativePath = baseHasParams\n    ? matchFirewallPathPrefix(rawPathFromUrl(url), basePath)\n    : matchStaticBasePathPrefix(rawPathFromUrl(url), basePath);\n  if (relativePath === null) return null;\n\n  const displayBase = stripTrailingSlash(rawBase);\n  return {\n    displayBase,\n    relativePath,\n    score: baseUrlSpecificityScore(rawBase, baseHasParams),\n  };\n}\n\nexport function matchFirewallBaseUrl(\n  url: string,\n  rawBase: string,\n): FirewallBaseUrlMatch | null {\n  if (\n    hasUnsafeRuntimeUrlSyntax(url) ||\n    hasMalformedRuntimeAuthoritySyntax(url)\n  ) {\n    return null;\n  }\n\n  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);\n\n  try {\n    if (runtimeAuthorityOrigin !== null) {\n      validateBaseUrl(runtimeAuthorityOrigin, \"runtime\");\n    }\n    validateBaseUrl(rawBase, \"firewall\");\n    return matchStaticFirewallBaseUrl(url, rawBase);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Match a runtime host/authority against a firewall base host pattern.\n *\n * Host comparison is case-insensitive and mirrors the runner's right-to-left\n * host matcher. Non-default ports are part of the normalized authority and\n * therefore participate in the final host segment comparison.\n */\nexport function matchFirewallHost(\n  host: string,\n  pattern: string,\n): Record<string, string> | null {\n  const hostSegsOrig = host.split(\".\");\n  const hostSegsLower = hostSegsOrig.map((segment) => {\n    return segment.toLowerCase();\n  });\n  const patternSegs = pattern.split(\".\").reverse();\n\n  hostSegsOrig.reverse();\n  hostSegsLower.reverse();\n\n  const params: Record<string, string> = {};\n  let hi = 0;\n  const lastPatternIndex = patternSegs.length - 1;\n\n  for (\n    let patternIndex = 0;\n    patternIndex < patternSegs.length;\n    patternIndex++\n  ) {\n    const seg = patternSegs[patternIndex]!;\n    const parsed = parseSegment(seg);\n    if (parsed.kind === \"error\") return null;\n    if (parsed.kind === \"literal\") {\n      if (\n        hi >= hostSegsLower.length ||\n        hostSegsLower[hi] !== parsed.value.toLowerCase()\n      ) {\n        return null;\n      }\n      hi += 1;\n      continue;\n    }\n\n    const { name, prefix, suffix, greedy } = parsed;\n    if (greedy === \"+\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      if (hi >= hostSegsOrig.length) return null;\n      params[name] = hostSegsOrig.slice(hi).reverse().join(\".\");\n      return params;\n    }\n    if (greedy === \"*\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      params[name] = hostSegsOrig.slice(hi).reverse().join(\".\");\n      return params;\n    }\n    if (hi >= hostSegsOrig.length) return null;\n    if (prefix === \"\" && suffix === \"\") {\n      params[name] = hostSegsLower[hi]!;\n    } else {\n      const captured = matchMixedSegment(\n        hostSegsLower[hi]!,\n        prefix.toLowerCase(),\n        suffix.toLowerCase(),\n      );\n      if (captured === null) return null;\n      params[name] = captured;\n    }\n    hi += 1;\n  }\n\n  return hi === hostSegsOrig.length ? params : null;\n}\n\n/**\n * Match a runtime path against the beginning of a firewall base path pattern.\n *\n * Unlike matchFirewallPath(), this intentionally allows extra runtime path\n * segments and returns the remaining relative path after the base prefix.\n */\nexport function matchFirewallPathPrefix(\n  path: string,\n  pattern: string,\n): string | null {\n  const pathSegs = splitPathSegments(path);\n  const patternSegs = splitPathSegments(pattern);\n\n  let pi = 0;\n  const lastPatternIndex = patternSegs.length - 1;\n  for (\n    let patternIndex = 0;\n    patternIndex < patternSegs.length;\n    patternIndex++\n  ) {\n    const seg = patternSegs[patternIndex]!;\n    const parsed = parseSegment(seg);\n    if (parsed.kind === \"error\") return null;\n    if (parsed.kind === \"literal\") {\n      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;\n      pi += 1;\n      continue;\n    }\n\n    const { prefix, suffix, greedy } = parsed;\n    if (greedy === \"+\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {\n        return null;\n      }\n      return \"/\";\n    }\n    if (greedy === \"*\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      return \"/\";\n    }\n    if (pi >= pathSegs.length) return null;\n\n    const runtime = pathSegs[pi]!;\n    if (prefix === \"\" && suffix === \"\") {\n      if (runtime === \"\") return null;\n    } else if (matchMixedSegment(runtime, prefix, suffix) === null) {\n      return null;\n    }\n    pi += 1;\n  }\n\n  return relativePathFromSegments(pathSegs, pi);\n}\n\n/**\n * Match a URL path against a rule path pattern.\n *\n * Ported from the Python MITM addon's `match_path()` function\n * (crates/runner/mitm-addon/src/matching.py).\n *\n * - Literal segments must match exactly (case-sensitive).\n * - `{name}` matches a single non-empty path segment.\n * - `prefix{name}suffix` (mixed) matches a segment that starts with\n *   `prefix` and ends with `suffix`, with a non-empty middle captured\n *   into `name`.\n * - `{name+}` matches the rest of the path (one or more segments). Must be last.\n * - `{name*}` matches the rest of the path (zero or more segments). Must be last.\n *\n * Returns extracted parameters on match, or null on mismatch.\n */\nexport function matchFirewallPath(\n  path: string,\n  pattern: string,\n): Record<string, string> | null {\n  const pathSegs = splitPathSegments(path);\n  const patternSegs = splitPathSegments(pattern);\n\n  const params: Record<string, string> = {};\n  let pi = 0;\n  const lastPatternIndex = patternSegs.length - 1;\n\n  for (\n    let patternIndex = 0;\n    patternIndex < patternSegs.length;\n    patternIndex++\n  ) {\n    const seg = patternSegs[patternIndex]!;\n    const parsed = parseSegment(seg);\n    // Invalid patterns are rejected by validateRule at ingest time, so\n    // kind \"error\" should never appear here on validated inputs.\n    if (parsed.kind === \"error\") return null;\n    if (parsed.kind === \"literal\") {\n      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;\n      pi++;\n      continue;\n    }\n    const { name, prefix, suffix, greedy } = parsed;\n    if (greedy === \"+\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {\n        return null;\n      }\n      params[name] = pathSegs.slice(pi).join(\"/\");\n      return params;\n    }\n    if (greedy === \"*\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      params[name] = pathSegs.slice(pi).join(\"/\");\n      return params;\n    }\n    if (pi >= pathSegs.length) return null;\n    const runtime = pathSegs[pi]!;\n    if (prefix === \"\" && suffix === \"\") {\n      if (runtime === \"\") return null;\n      params[name] = runtime;\n    } else {\n      const captured = matchMixedSegment(runtime, prefix, suffix);\n      if (captured === null) return null;\n      params[name] = captured;\n    }\n    pi++;\n  }\n\n  // All pattern segments consumed; path must also be fully consumed\n  if (pi !== pathSegs.length) return null;\n  return params;\n}\n\n/**\n * Find permission names from a firewall config whose most-specific rules match\n * the given HTTP method and relative path.\n *\n * Method matching is case-insensitive. The special method `ANY` matches\n * any HTTP method. Path specificity mirrors the runner firewall matcher within\n * each API entry.\n */\nexport function findMatchingPermissions(\n  method: string,\n  path: string,\n  config: FirewallConfig,\n  options: FindMatchingPermissionsOptions = {},\n): string[] {\n  if (!isObjectRecord(config)) return [];\n  if (typeof config.name !== \"string\" || config.name === \"\") return [];\n  if (!Array.isArray(config.apis)) return [];\n\n  const apiBase =\n    options.apiBase === undefined ? null : stripTrailingSlash(options.apiBase);\n  const matchApis: PermissionMatchApi[] = [];\n\n  for (const api of config.apis) {\n    const permissionRuleSets = getApiPermissionRuleSetsForMatch(\n      api,\n      config.name,\n      apiBase,\n    );\n    if (permissionRuleSets !== null) {\n      matchApis.push({ permissionRuleSets });\n    }\n  }\n\n  return findMatchingPermissionRuleSets(method, path, matchApis);\n}\n\nexport function findMatchingRoutingPermissions(\n  method: string,\n  path: string,\n  apis: readonly FirewallRoutingPermissionApi[],\n  options: FindMatchingRoutingPermissionsOptions = {},\n): string[] {\n  if (!Array.isArray(apis)) return [];\n\n  const serviceName = options.serviceName ?? \"routing\";\n  const apiBase =\n    options.apiBase === undefined ? null : stripTrailingSlash(options.apiBase);\n  const matchApis: PermissionMatchApi[] = [];\n\n  for (const api of apis) {\n    const permissionRuleSets = getRoutingApiPermissionRuleSetsForMatch(\n      api,\n      serviceName,\n      apiBase,\n    );\n    if (permissionRuleSets !== null) {\n      matchApis.push({ permissionRuleSets });\n    }\n  }\n\n  return findMatchingPermissionRuleSets(method, path, matchApis);\n}\n\nfunction findMatchingPermissionRuleSets(\n  method: string,\n  path: string,\n  apis: readonly PermissionMatchApi[],\n): string[] {\n  const upperMethod = method.toUpperCase();\n  const matched: string[] = [];\n\n  for (const api of apis) {\n    const state: ApiMatchState = { bestSpecificity: null, matched: [] };\n\n    for (const permission of api.permissionRuleSets) {\n      for (const rule of permission.rules) {\n        const rest = matchingRulePath(rule, upperMethod);\n        if (rest === null) continue;\n\n        if (matchFirewallPath(path, rest) !== null) {\n          const specificity = pathSpecificity(rest);\n          if (specificity === null) continue;\n          recordPermissionMatch(state, permission.name, specificity);\n        }\n      }\n    }\n\n    for (const permission of state.matched) {\n      if (!matched.includes(permission)) {\n        matched.push(permission);\n      }\n    }\n  }\n\n  return matched;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAyDA,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,+BAA+B,IAAI,IAAI,kBAAkB,MAAM,EAAE,CAAC;AACxE,IAAM,oCAAoC,IAAI,IAAI,eAAe,MAAM,EAAE,CAAC;AAC1E,IAAM,wBAAwB;AAC9B,IAAM,aAAa,IAAI,IAAI,yBAAyB,MAAM,EAAE,CAAC;AAC7D,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAClC,IAAM,kBAAkB;AACxB,IAAM,0BAA0B;AAChC,IAAM,yCAAyC,oBAAI,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,kBACP,SACA,QACA,QACe;AACf,MAAI,CAAC,QAAQ,WAAW,MAAM,EAAG,QAAO;AACxC,MAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO;AACtC,MAAI,QAAQ,UAAU,OAAO,SAAS,OAAO,OAAQ,QAAO;AAC5D,SAAO,QAAQ,MAAM,OAAO,QAAQ,QAAQ,SAAS,OAAO,MAAM;AACpE;AAEA,SAAS,mBAAmB,UAAoB,OAAwB;AACtE,WAAS,IAAI,OAAO,IAAI,SAAS,QAAQ,KAAK;AAC5C,QAAI,SAAS,CAAC,MAAM,GAAI,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,CAAC,GAAG,KAAK,EAAE;AACpB;AAEA,SAAS,0BAA0B,OAAwB;AACzD,SACE,sBAAsB,KAAK,KAC3B,iBAAiB,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,CAAC,MAAM,SAAS,KAAK;AAEzB;AAEA,SAAS,mBAAmB,OAAuB;AACjD,SAAO,MAAM,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AACpD;AAEA,SAAS,qBACP,cACA,kBACA,QACA,QACS;AACT,SAAO,iBAAiB,oBAAoB,WAAW,MAAM,WAAW;AAC1E;AAEA,SAAS,gBAAgB,SAAyC;AAChE,MACE,CAAC,QAAQ,WAAW,GAAG,KACvB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,iBAAiB,OAAO,KACxB,sBAAsB,OAAO,GAC7B;AACA,WAAO;AAAA,EACT;AAEA,MAAI,kBAAkB;AACtB,MAAI,qBAAqB;AACzB,MAAI,qBAAqB;AACzB,MAAI,qBAAqB;AACzB,MAAI,qBAAqB;AACzB,MAAI,eAAe;AACnB,QAAM,WAAW,kBAAkB,OAAO;AAC1C,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,mBAAmB,SAAS,SAAS;AAE3C,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS,GAAG;AACvD,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,SAAS,aAAa,GAAG;AAC/B,QAAI,OAAO,SAAS,QAAS,QAAO;AACpC,QAAI,OAAO,SAAS,WAAW;AAC7B,yBAAmB;AACnB,sBAAgB,gBAAgB,OAAO,KAAK;AAC5C;AAAA,IACF;AACA,QAAI,WAAW,IAAI,OAAO,IAAI,EAAG,QAAO;AACxC,eAAW,IAAI,OAAO,IAAI;AAC1B,QACE,OAAO,WAAW,MAClB;AAAA,MACE;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,IACT,GACA;AACA,aAAO;AAAA,IACT;AAEA,oBACE,gBAAgB,OAAO,MAAM,IAAI,gBAAgB,OAAO,MAAM;AAChE,QAAI,OAAO,WAAW,MAAM,OAAO,WAAW,IAAI;AAChD,4BAAsB;AAAA,IACxB,WAAW,OAAO,WAAW,KAAK;AAChC,4BAAsB;AAAA,IACxB,WAAW,OAAO,WAAW,KAAK;AAChC,4BAAsB;AAAA,IACxB,OAAO;AACL,4BAAsB;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,uBACP,MACA,OACQ;AACR,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,aAAa,KAAK,CAAC,IAAK,MAAM,CAAC;AACrC,QAAI,eAAe,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAc,aAAoC;AAC1E,QAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,MAAI,aAAa,GAAI,QAAO;AAC5B,QAAM,aAAa,KAAK,MAAM,GAAG,QAAQ;AACzC,MAAI,CAAC,mBAAmB,IAAI,UAAU,EAAG,QAAO;AAChD,MAAI,eAAe,SAAS,eAAe,YAAa,QAAO;AAC/D,SAAO,KAAK,MAAM,WAAW,CAAC;AAChC;AAEA,SAAS,sBAAsB,gBAAiC;AAC9D,SAAO,mBAAmB,MAAM,mBAAmB;AACrD;AAEA,SAAS,eAAe,OAAkD;AACxE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AA+HA,SAAS,wCACP,KACA,aACA,SAC4B;AAC5B,MAAI,CAAC,eAAe,GAAG,EAAG,QAAO;AACjC,MAAI,OAAO,IAAI,SAAS,SAAU,QAAO;AACzC,MAAI;AACF,oBAAgB,IAAI,MAAM,WAAW;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,YAAY,QAAQ,mBAAmB,IAAI,IAAI,MAAM,QAAS,QAAO;AACzE,MAAI,CAAC,MAAM,QAAQ,IAAI,MAAM,EAAG,QAAO;AAEvC,QAAM,oBAAoB,oBAAI,IAAsB;AACpD,aAAW,SAAS,IAAI,QAAQ;AAC9B,QAAI,CAAC,eAAe,KAAK,EAAG;AAC5B,QAAI,OAAO,MAAM,mBAAmB,SAAU;AAC9C,QAAI,CAAC,sBAAsB,MAAM,cAAc,EAAG;AAClD,QAAI,OAAO,MAAM,SAAS,SAAU;AAEpC,UAAM,QAAQ,kBAAkB,IAAI,MAAM,cAAc;AACxD,QAAI,OAAO;AACT,YAAM,KAAK,MAAM,IAAI;AAAA,IACvB,OAAO;AACL,wBAAkB,IAAI,MAAM,gBAAgB,CAAC,MAAM,IAAI,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,kBAAkB,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAC7D,WAAO,EAAE,MAAM,MAAM;AAAA,EACvB,CAAC;AACH;AAEA,SAAS,sBACP,OACA,YACA,aACM;AACN,MACE,MAAM,oBAAoB,QAC1B,uBAAuB,aAAa,MAAM,eAAe,IAAI,GAC7D;AACA,UAAM,kBAAkB;AACxB,UAAM,QAAQ,SAAS;AAAA,EACzB;AACA,MACE,uBAAuB,aAAa,MAAM,eAAe,MAAM,KAC/D,CAAC,MAAM,QAAQ,SAAS,UAAU,GAClC;AACA,UAAM,QAAQ,KAAK,UAAU;AAAA,EAC/B;AACF;AAEA,SAAS,yBACP,UACA,UACQ;AACR,QAAM,OAAO,SAAS,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC9C,SAAO,SAAS,KAAK,MAAM,IAAI,IAAI;AACrC;AAEA,SAAS,yBAAyB,KAAqB;AACrD,QAAM,aAAa,IAAI,QAAQ,GAAG;AAClC,QAAM,gBAAgB,IAAI,QAAQ,GAAG;AACrC,MAAI,MAAM,IAAI;AACd,MAAI,eAAe,GAAI,OAAM,KAAK,IAAI,KAAK,UAAU;AACrD,MAAI,kBAAkB,GAAI,OAAM,KAAK,IAAI,KAAK,aAAa;AAC3D,SAAO,IAAI,MAAM,GAAG,GAAG;AACzB;AAEA,SAAS,eAAe,KAAqB;AAC3C,QAAM,kBAAkB,yBAAyB,GAAG;AACpD,QAAM,YAAY,gBAAgB,QAAQ,KAAK;AAC/C,QAAM,iBAAiB,cAAc,KAAK,IAAI,YAAY;AAC1D,QAAM,YAAY,gBAAgB,QAAQ,KAAK,cAAc;AAC7D,SAAO,cAAc,KAAK,MAAM,gBAAgB,MAAM,SAAS;AACjE;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,QAAM,kBAAkB,yBAAyB,GAAG;AACpD,QAAM,YAAY,gBAAgB,QAAQ,KAAK;AAC/C,QAAM,iBAAiB,cAAc,KAAK,IAAI,YAAY;AAC1D,QAAM,YAAY,gBAAgB,QAAQ,KAAK,cAAc;AAC7D,SAAO,cAAc,KAAK,KAAK,gBAAgB,MAAM,SAAS;AAChE;AAEA,SAAS,oBAAoB,KAA4B;AACvD,QAAM,kBAAkB,yBAAyB,GAAG;AACpD,QAAM,YAAY,gBAAgB,QAAQ,KAAK;AAC/C,MAAI,cAAc,GAAI,QAAO;AAC7B,QAAM,iBAAiB,YAAY;AACnC,QAAM,YAAY,gBAAgB,QAAQ,KAAK,cAAc;AAC7D,QAAM,YACJ,cAAc,KACV,gBAAgB,MAAM,cAAc,IACpC,gBAAgB,MAAM,gBAAgB,SAAS;AACrD,SAAO,cAAc,KAAK,OAAO;AACnC;AAEA,SAAS,YAAY,OAAwB;AAC3C,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,QAAI,MAAM,WAAW,KAAK,IAAI,IAAM,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,WAA2B;AACvD,QAAM,kBAAkB,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC;AACtE,MAAI,gBAAgB,WAAW,GAAG,GAAG;AACnC,UAAM,eAAe,gBAAgB,QAAQ,GAAG;AAChD,WAAO,iBAAiB,KACpB,kBACA,gBAAgB,MAAM,GAAG,eAAe,CAAC;AAAA,EAC/C;AACA,QAAM,gBAAgB,gBAAgB,YAAY,GAAG;AACrD,SAAO,kBAAkB,KACrB,kBACA,gBAAgB,MAAM,GAAG,aAAa;AAC5C;AAEA,SAAS,sBAAsB,WAA4B;AACzD,QAAM,kBAAkB,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC;AACtE,MAAI,gBAAgB,WAAW,GAAG,GAAG;AACnC,UAAM,eAAe,gBAAgB,QAAQ,GAAG;AAChD,QAAI,iBAAiB,GAAI,QAAO;AAChC,WAAO,gBAAgB,MAAM,eAAe,CAAC,MAAM;AAAA,EACrD;AAEA,QAAM,gBAAgB,gBAAgB,YAAY,GAAG;AACrD,MAAI,kBAAkB,GAAI,QAAO;AACjC,SACE,gBAAgB,QAAQ,GAAG,MAAM,iBACjC,kBAAkB,gBAAgB,SAAS;AAE/C;AAEA,SAAS,gCAAgC,WAA4B;AACnE,QAAM,YAAY,qBAAqB,SAAS,EAAE,CAAC;AACnD,SAAO,cAAc,UAAa,aAAa,OAAO,aAAa;AACrE;AAEA,SAAS,wCAAwC,KAA4B;AAC3E,QAAM,YAAY,oBAAoB,GAAG;AACzC,MAAI,cAAc,KAAM,QAAO;AAC/B,MACE,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,YAAY,SAAS,KACtB,CAAC,gCAAgC,SAAS,GAC1C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,QAAQ,KAAK;AACnC,MAAI,cAAc,GAAI,QAAO;AAC7B,SAAO,GAAG,IAAI,MAAM,GAAG,SAAS,CAAC,MAAM,SAAS;AAClD;AAEA,SAAS,iCAAiC,OAAwB;AAChE,MAAI,QAAQ,MAAM,QAAQ,GAAG;AAC7B,SAAO,UAAU,IAAI;AACnB,QAAI,SAAS;AACb,WAAO,SAAS,MAAM,UAAU,MAAM,MAAM,MAAM,KAAK;AACrD,YAAM,gBAAgB,MAAM,SAAS,CAAC;AACtC,YAAM,iBAAiB,MAAM,SAAS,CAAC;AACvC,UACE,CAAC,iBACD,CAAC,kBACD,CAAC,WAAW,IAAI,aAAa,KAC7B,CAAC,WAAW,IAAI,cAAc,GAC9B;AACA,eAAO;AAAA,MACT;AACA,gBAAU;AAAA,IACZ;AAEA,QAAI;AACJ,QAAI;AACF,mBAAa,mBAAmB,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,IAC5D,QAAQ;AACN,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,YAAY;AAC7B,UAAI,uCAAuC,IAAI,IAAI,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,YAAQ,MAAM,QAAQ,KAAK,MAAM;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,mCAAmC,KAAsB;AAChE,QAAM,YAAY,oBAAoB,GAAG;AACzC,MAAI,cAAc,KAAM,QAAO;AAC/B,SACE,UAAU,SAAS,IAAI,KACvB,sBAAsB,SAAS,KAC/B,iCAAiC,SAAS;AAE9C;AAEA,SAAS,oBAAoB,SAAyB;AACpD,SAAO,wBAAwB,gBAAgB,OAAO;AACxD;AAEA,SAAS,oBAAoB,SAAiB,aAA8B;AAC1E,MAAI,CAAC,YAAa,QAAO,oBAAoB,OAAO;AAEpD,QAAM,SAAS,aAAa,OAAO;AACnC,MAAI,OAAO,SAAS,QAAS,QAAO;AACpC,MAAI,OAAO,SAAS,WAAW;AAC7B,WAAO,oBAAoB,OAAO,KAAK;AAAA,EACzC;AAEA,QAAM,eACJ,gBAAgB,OAAO,MAAM,IAAI,gBAAgB,OAAO,MAAM;AAChE,MAAI,OAAO,WAAW,MAAM,OAAO,WAAW,IAAI;AAChD,WAAO,4BAA4B;AAAA,EACrC;AACA,MAAI,OAAO,WAAW,IAAK,QAAO;AAClC,MAAI,OAAO,WAAW,IAAK,QAAO;AAClC,SAAO;AACT;AAEA,SAAS,qBACP,UACA,aACQ;AACR,SAAO,SAAS,OAAO,CAAC,OAAO,YAAY;AACzC,WAAO,QAAQ,oBAAoB,SAAS,WAAW;AAAA,EACzD,GAAG,CAAC;AACN;AAEA,SAAS,iBAAiB,MAAc,aAA8B;AACpE,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,IAAK,QAAO;AACzB,SAAO,qBAAqB,kBAAkB,IAAI,GAAG,WAAW;AAClE;AAEA,SAAS,uBAAuB,WAA6B;AAC3D,MAAI,UAAU,WAAW,GAAG,EAAG,QAAO,CAAC,SAAS;AAChD,QAAM,aAAa,UAAU,SAAS,GAAG,IACrC,UAAU,MAAM,GAAG,EAAE,IACrB;AACJ,SAAO,eAAe,KAAK,CAAC,IAAI,WAAW,MAAM,GAAG;AACtD;AAEA,SAAS,wBAAwB,SAAiB,WAA4B;AAC5E,QAAM,eAAe,mBAAmB,OAAO;AAC/C,QAAM,iBAAiB;AAAA,IACrB,uBAAuB,oBAAoB,YAAY,KAAK,EAAE;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,YAAY;AAAA,IAChB,mBAAmB,YAAY;AAAA,IAC/B;AAAA,EACF;AACA,SACE,YAAY,wBACZ,iBAAiB,8BAChB,YAAY,IAAI;AAErB;AAEA,SAAS,0BACP,MACA,SACe;AACf,MAAI,YAAY,IAAI;AAClB,WAAO,SAAS,KAAK,MAAM;AAAA,EAC7B;AACA,MAAI,YAAY,KAAK;AACnB,QAAI,CAAC,KAAK,WAAW,OAAO,EAAG,QAAO;AACtC,UAAMA,gBAAe,KAAK,MAAM,QAAQ,MAAM;AAC9C,QAAIA,kBAAiB,MAAM,CAACA,cAAa,WAAW,GAAG,EAAG,QAAO;AACjE,WAAOA,kBAAiB,KAAK,MAAMA;AAAA,EACrC;AACA,MAAI,CAAC,KAAK,WAAW,OAAO,EAAG,QAAO;AACtC,QAAM,eAAe,KAAK,MAAM,QAAQ,MAAM;AAC9C,MAAI,iBAAiB,MAAM,CAAC,aAAa,WAAW,GAAG,EAAG,QAAO;AACjE,SAAO,iBAAiB,KAAK,MAAM;AACrC;AAEA,SAAS,qBACP,UACA,UAAyC,CAAC,GAC3B;AACf,MAAI,aAAa,SAAS,YAAY;AACtC,MAAI,WAAW,SAAS,GAAG,GAAG;AAC5B,iBAAa,WAAW,MAAM,GAAG,EAAE;AACnC,QAAI,eAAe,MAAM,WAAW,SAAS,GAAG,GAAG;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AACA,MACE,WAAW,MAAM,GAAG,EAAE,KAAK,CAAC,UAAU;AACpC,WAAO,UAAU;AAAA,EACnB,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,QAAM,iBACJ,QAAQ,oBAAoB,OACxB,oCACA;AACN,MACE,CAAC,WAAW,WAAW,GAAG,KAC1B,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,SAAS;AAC7B,WAAO,eAAe,IAAI,IAAI;AAAA,EAChC,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,uBACP,QACA,UAAyC,CAAC,GAC3B;AACf,MAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI;AACpD,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,qBAAqB,OAAO,UAAU,OAAO;AAC9D,MAAI,aAAa,QAAQ,aAAa,IAAI;AACxC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS,KAAK,WAAW,GAAG,QAAQ,IAAI,OAAO,IAAI;AACnE;AAEA,SAAS,2BACP,KACA,SAC6B;AAC7B,QAAM,YAAY,IAAI,IAAI,GAAG;AAC7B,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,MAAI,UAAU,SAAS,YAAY,MAAM,WAAW,SAAS,YAAY,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,iBAAiB,OAAO;AAC9C,QAAM,eAAe,mBAAmB,OAAO;AAE/C,QAAM,eAAe,uBAAuB,SAAS;AACrD,QAAM,gBAAgB,uBAAuB,YAAY;AAAA,IACvD,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,iBAAiB,QAAQ,kBAAkB,KAAM,QAAO;AAC5D,MAAI,eAAe;AACjB,QAAI,kBAAkB,cAAc,aAAa,MAAM,KAAM,QAAO;AAAA,EACtE,WAAW,iBAAiB,eAAe;AACzC,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,mBAAmB,YAAY;AAChD,QAAM,eAAe,gBACjB,wBAAwB,eAAe,GAAG,GAAG,QAAQ,IACrD,0BAA0B,eAAe,GAAG,GAAG,QAAQ;AAC3D,MAAI,iBAAiB,KAAM,QAAO;AAElC,QAAM,cAAc,mBAAmB,OAAO;AAC9C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,wBAAwB,SAAS,aAAa;AAAA,EACvD;AACF;AAEO,SAAS,qBACd,KACA,SAC6B;AAC7B,MACE,0BAA0B,GAAG,KAC7B,mCAAmC,GAAG,GACtC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,yBAAyB,wCAAwC,GAAG;AAE1E,MAAI;AACF,QAAI,2BAA2B,MAAM;AACnC,sBAAgB,wBAAwB,SAAS;AAAA,IACnD;AACA,oBAAgB,SAAS,UAAU;AACnC,WAAO,2BAA2B,KAAK,OAAO;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,kBACd,MACA,SAC+B;AAC/B,QAAM,eAAe,KAAK,MAAM,GAAG;AACnC,QAAM,gBAAgB,aAAa,IAAI,CAAC,YAAY;AAClD,WAAO,QAAQ,YAAY;AAAA,EAC7B,CAAC;AACD,QAAM,cAAc,QAAQ,MAAM,GAAG,EAAE,QAAQ;AAE/C,eAAa,QAAQ;AACrB,gBAAc,QAAQ;AAEtB,QAAM,SAAiC,CAAC;AACxC,MAAI,KAAK;AACT,QAAM,mBAAmB,YAAY,SAAS;AAE9C,WACM,eAAe,GACnB,eAAe,YAAY,QAC3B,gBACA;AACA,UAAM,MAAM,YAAY,YAAY;AACpC,UAAM,SAAS,aAAa,GAAG;AAC/B,QAAI,OAAO,SAAS,QAAS,QAAO;AACpC,QAAI,OAAO,SAAS,WAAW;AAC7B,UACE,MAAM,cAAc,UACpB,cAAc,EAAE,MAAM,OAAO,MAAM,YAAY,GAC/C;AACA,eAAO;AAAA,MACT;AACA,YAAM;AACN;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,IAAI;AACzC,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,UAAI,MAAM,aAAa,OAAQ,QAAO;AACtC,aAAO,IAAI,IAAI,aAAa,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAG;AACxD,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,aAAO,IAAI,IAAI,aAAa,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAG;AACxD,aAAO;AAAA,IACT;AACA,QAAI,MAAM,aAAa,OAAQ,QAAO;AACtC,QAAI,WAAW,MAAM,WAAW,IAAI;AAClC,aAAO,IAAI,IAAI,cAAc,EAAE;AAAA,IACjC,OAAO;AACL,YAAM,WAAW;AAAA,QACf,cAAc,EAAE;AAAA,QAChB,OAAO,YAAY;AAAA,QACnB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,aAAa,KAAM,QAAO;AAC9B,aAAO,IAAI,IAAI;AAAA,IACjB;AACA,UAAM;AAAA,EACR;AAEA,SAAO,OAAO,aAAa,SAAS,SAAS;AAC/C;AAQO,SAAS,wBACd,MACA,SACe;AACf,QAAM,WAAW,kBAAkB,IAAI;AACvC,QAAM,cAAc,kBAAkB,OAAO;AAE7C,MAAI,KAAK;AACT,QAAM,mBAAmB,YAAY,SAAS;AAC9C,WACM,eAAe,GACnB,eAAe,YAAY,QAC3B,gBACA;AACA,UAAM,MAAM,YAAY,YAAY;AACpC,UAAM,SAAS,aAAa,GAAG;AAC/B,QAAI,OAAO,SAAS,QAAS,QAAO;AACpC,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,MAAM,SAAS,UAAU,SAAS,EAAE,MAAM,OAAO,MAAO,QAAO;AACnE,YAAM;AACN;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,QAAQ,OAAO,IAAI;AACnC,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,UAAI,MAAM,SAAS,UAAU,CAAC,mBAAmB,UAAU,EAAE,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,OAAQ,QAAO;AAElC,UAAM,UAAU,SAAS,EAAE;AAC3B,QAAI,WAAW,MAAM,WAAW,IAAI;AAClC,UAAI,YAAY,GAAI,QAAO;AAAA,IAC7B,WAAW,kBAAkB,SAAS,QAAQ,MAAM,MAAM,MAAM;AAC9D,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AAEA,SAAO,yBAAyB,UAAU,EAAE;AAC9C;AAkBO,SAAS,kBACd,MACA,SAC+B;AAC/B,QAAM,WAAW,kBAAkB,IAAI;AACvC,QAAM,cAAc,kBAAkB,OAAO;AAE7C,QAAM,SAAiC,CAAC;AACxC,MAAI,KAAK;AACT,QAAM,mBAAmB,YAAY,SAAS;AAE9C,WACM,eAAe,GACnB,eAAe,YAAY,QAC3B,gBACA;AACA,UAAM,MAAM,YAAY,YAAY;AACpC,UAAM,SAAS,aAAa,GAAG;AAG/B,QAAI,OAAO,SAAS,QAAS,QAAO;AACpC,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,MAAM,SAAS,UAAU,SAAS,EAAE,MAAM,OAAO,MAAO,QAAO;AACnE;AACA;AAAA,IACF;AACA,UAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,IAAI;AACzC,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,UAAI,MAAM,SAAS,UAAU,CAAC,mBAAmB,UAAU,EAAE,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO,IAAI,IAAI,SAAS,MAAM,EAAE,EAAE,KAAK,GAAG;AAC1C,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,aAAO,IAAI,IAAI,SAAS,MAAM,EAAE,EAAE,KAAK,GAAG;AAC1C,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,OAAQ,QAAO;AAClC,UAAM,UAAU,SAAS,EAAE;AAC3B,QAAI,WAAW,MAAM,WAAW,IAAI;AAClC,UAAI,YAAY,GAAI,QAAO;AAC3B,aAAO,IAAI,IAAI;AAAA,IACjB,OAAO;AACL,YAAM,WAAW,kBAAkB,SAAS,QAAQ,MAAM;AAC1D,UAAI,aAAa,KAAM,QAAO;AAC9B,aAAO,IAAI,IAAI;AAAA,IACjB;AACA;AAAA,EACF;AAGA,MAAI,OAAO,SAAS,OAAQ,QAAO;AACnC,SAAO;AACT;AAsCO,SAAS,+BACd,QACA,MACA,MACA,UAAiD,CAAC,GACxC;AACV,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO,CAAC;AAElC,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,UACJ,QAAQ,YAAY,SAAY,OAAO,mBAAmB,QAAQ,OAAO;AAC3E,QAAM,YAAkC,CAAC;AAEzC,aAAW,OAAO,MAAM;AACtB,UAAM,qBAAqB;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,uBAAuB,MAAM;AAC/B,gBAAU,KAAK,EAAE,mBAAmB,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,SAAO,+BAA+B,QAAQ,MAAM,SAAS;AAC/D;AAEA,SAAS,+BACP,QACA,MACA,MACU;AACV,QAAM,cAAc,OAAO,YAAY;AACvC,QAAM,UAAoB,CAAC;AAE3B,aAAW,OAAO,MAAM;AACtB,UAAM,QAAuB,EAAE,iBAAiB,MAAM,SAAS,CAAC,EAAE;AAElE,eAAW,cAAc,IAAI,oBAAoB;AAC/C,iBAAW,QAAQ,WAAW,OAAO;AACnC,cAAM,OAAO,iBAAiB,MAAM,WAAW;AAC/C,YAAI,SAAS,KAAM;AAEnB,YAAI,kBAAkB,MAAM,IAAI,MAAM,MAAM;AAC1C,gBAAM,cAAc,gBAAgB,IAAI;AACxC,cAAI,gBAAgB,KAAM;AAC1B,gCAAsB,OAAO,WAAW,MAAM,WAAW;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAEA,eAAW,cAAc,MAAM,SAAS;AACtC,UAAI,CAAC,QAAQ,SAAS,UAAU,GAAG;AACjC,gBAAQ,KAAK,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;","names":["relativePath"]}