@vm0/cli 9.222.2 → 9.222.3

package/chunk-72DXWQL4.js

@@ -0,0 +1,1178 @@
+#!/usr/bin/env node
+import { createRequire as __createRequire } from "node:module";
+const require = __createRequire(import.meta.url);
+import {
+  hasBaseUrlParams,
+  hasRawWhitespace,
+  hasUnsafeFirewallPath,
+  hasUnsafeUrlCodepoint,
+  parseSegment,
+  splitPathSegments,
+  validateAuthBaseUrl,
+  validateBaseUrl
+} from "./chunk-3QZMZ46V.js";
+import {
+  init_esm_shims
+} from "./chunk-DIRAZ3YX.js";
+
+// ../../packages/connectors/src/firewall-rule-matcher.ts
+init_esm_shims();
+var VALID_RULE_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "ANY"
+]);
+var FORBIDDEN_RUNTIME_HOST_CHARS = new Set("#%*,/<>?@\\^|{}".split(""));
+var FORBIDDEN_BASE_PATTERN_HOST_CHARS = new Set("#%,/<>?@\\^|".split(""));
+var PERCENT_ESCAPE_LENGTH = 3;
+var HEX_DIGITS = new Set("0123456789abcdefABCDEF".split(""));
+var PATH_SCORE_MULTIPLIER = 1e6;
+var AUTHORITY_SCORE_MULTIPLIER = 100;
+var LITERAL_SEGMENT_SCORE = 1e3;
+var MIXED_PARAM_SEGMENT_SCORE = 100;
+var PLAIN_PARAM_SEGMENT_SCORE = 10;
+var PLUS_GREEDY_SEGMENT_SCORE = 1;
+var ROOT_PATH_SCORE = 1;
+var STATIC_BASE_SCORE_BONUS = 1;
+var PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS = /* @__PURE__ */ new Set([
+  "{",
+  "}",
+  "*",
+  ".",
+  "\u3002",
+  "\uFF0E",
+  "\uFF61",
+  ":"
+]);
+function matchMixedSegment(runtime, prefix, suffix) {
+  if (!runtime.startsWith(prefix)) return null;
+  if (!runtime.endsWith(suffix)) return null;
+  if (runtime.length <= prefix.length + suffix.length) return null;
+  return runtime.slice(prefix.length, runtime.length - suffix.length);
+}
+function hasNonEmptySegment(segments, start) {
+  for (let i = start; i < segments.length; i++) {
+    if (segments[i] !== "") return true;
+  }
+  return false;
+}
+function codePointLength(value) {
+  return [...value].length;
+}
+function hasUnsafeRuntimeUrlSyntax(value) {
+  return hasUnsafeUrlCodepoint(value) || hasRawWhitespace(value) || value.includes("\\") || !value.includes("://");
+}
+function stripTrailingSlash(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix) {
+  return patternIndex !== lastPatternIndex || prefix !== "" || suffix !== "";
+}
+function parseStrictMatchSegment(segment, patternIndex, lastPatternIndex) {
+  const parsed = parseSegment(segment);
+  if (parsed.kind === "error") return null;
+  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
+    patternIndex,
+    lastPatternIndex,
+    parsed.prefix,
+    parsed.suffix
+  )) {
+    return null;
+  }
+  return parsed;
+}
+function pathSpecificity(pattern) {
+  if (!pattern.startsWith("/") || pattern.includes("?") || pattern.includes("#") || pattern.includes("\\") || hasRawWhitespace(pattern) || hasUnsafeUrlCodepoint(pattern)) {
+    return null;
+  }
+  let literalSegments = 0;
+  let mixedParamSegments = 0;
+  let plainParamSegments = 0;
+  let plusGreedySegments = 0;
+  let starGreedySegments = 0;
+  let literalChars = 0;
+  const segments = splitPathSegments(pattern);
+  const paramNames = /* @__PURE__ */ new Set();
+  const lastSegmentIndex = segments.length - 1;
+  for (let index = 0; index < segments.length; index += 1) {
+    const seg = segments[index];
+    const parsed = parseSegment(seg);
+    if (parsed.kind === "error") return null;
+    if (parsed.kind === "literal") {
+      literalSegments += 1;
+      literalChars += codePointLength(parsed.value);
+      continue;
+    }
+    if (paramNames.has(parsed.name)) return null;
+    paramNames.add(parsed.name);
+    if (parsed.greedy !== "" && isInvalidGreedyParam(
+      index,
+      lastSegmentIndex,
+      parsed.prefix,
+      parsed.suffix
+    )) {
+      return null;
+    }
+    literalChars += codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
+    if (parsed.prefix !== "" || parsed.suffix !== "") {
+      mixedParamSegments += 1;
+    } else if (parsed.greedy === "+") {
+      plusGreedySegments += 1;
+    } else if (parsed.greedy === "*") {
+      starGreedySegments += 1;
+    } else {
+      plainParamSegments += 1;
+    }
+  }
+  return [
+    literalSegments,
+    mixedParamSegments,
+    plainParamSegments,
+    plusGreedySegments,
+    -starGreedySegments,
+    literalChars,
+    segments.length
+  ];
+}
+function comparePathSpecificity(left, right) {
+  for (let i = 0; i < left.length; i++) {
+    const difference = left[i] - right[i];
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+function compileDecisionRule(permission, rule) {
+  const spaceIdx = rule.indexOf(" ");
+  if (spaceIdx === -1) return null;
+  const method = rule.slice(0, spaceIdx);
+  if (!VALID_RULE_METHODS.has(method)) return null;
+  const path = rule.slice(spaceIdx + 1);
+  const specificity = pathSpecificity(path);
+  if (specificity === null) return null;
+  return { permission, raw: rule, method, path, specificity };
+}
+function isValidPermissionName(permissionName) {
+  return permissionName !== "" && permissionName !== "all";
+}
+function isObjectRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function isStringRecord(value) {
+  if (!isObjectRecord(value)) return false;
+  return Object.values(value).every((entry) => {
+    return typeof entry === "string";
+  });
+}
+function hasEntries(value) {
+  return value !== void 0 && Object.keys(value).length > 0;
+}
+function isValidAwsSigv4AuthConfig(value) {
+  if (!isObjectRecord(value)) return false;
+  const allowedKeys = /* @__PURE__ */ new Set([
+    "accessKeyId",
+    "secretAccessKey",
+    "sessionToken"
+  ]);
+  if (Object.keys(value).some((key) => {
+    return !allowedKeys.has(key);
+  })) {
+    return false;
+  }
+  if (typeof value.accessKeyId !== "string" || value.accessKeyId === "") {
+    return false;
+  }
+  if (typeof value.secretAccessKey !== "string" || value.secretAccessKey === "") {
+    return false;
+  }
+  const optionalValue = value.sessionToken;
+  if (optionalValue !== void 0 && (typeof optionalValue !== "string" || optionalValue === "")) {
+    return false;
+  }
+  return true;
+}
+function isValidAuthConfig(auth, serviceName) {
+  if (!isObjectRecord(auth)) return false;
+  if (auth.headers !== void 0 && !isStringRecord(auth.headers)) return false;
+  if (auth.query !== void 0 && !isStringRecord(auth.query)) return false;
+  if (auth.awsSigv4 !== void 0 && !isValidAwsSigv4AuthConfig(auth.awsSigv4)) {
+    return false;
+  }
+  if (auth.awsSigv4 !== void 0) {
+    if (hasEntries(auth.headers)) {
+      return false;
+    }
+    if (hasEntries(auth.query)) {
+      return false;
+    }
+  }
+  if (auth.base !== void 0) {
+    if (typeof auth.base !== "string") return false;
+    validateAuthBaseUrl(auth.base, serviceName);
+  }
+  return true;
+}
+function rawObjectHasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function isValidAuthConfigForDecision(auth, serviceName) {
+  try {
+    return isValidAuthConfig(auth, serviceName);
+  } catch {
+    return false;
+  }
+}
+function compileDecisionApi(api, serviceName, nameMalformed) {
+  if (typeof api.base !== "string") return null;
+  let baseMalformed = false;
+  try {
+    validateBaseUrl(api.base, serviceName);
+  } catch {
+    baseMalformed = true;
+  }
+  const authMalformed = !isValidAuthConfigForDecision(api.auth, serviceName);
+  const rules = [];
+  const seenPermissionNames = /* @__PURE__ */ new Set();
+  let hasMalformedRules = nameMalformed;
+  const rawPermissions = api.permissions;
+  if (Array.isArray(rawPermissions)) {
+    for (const rawPermission of rawPermissions) {
+      if (!isObjectRecord(rawPermission)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      const permissionName = rawPermission.name;
+      if (typeof permissionName !== "string" || !isValidPermissionName(permissionName)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      if (seenPermissionNames.has(permissionName)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      seenPermissionNames.add(permissionName);
+      const rawRules = rawPermission.rules;
+      if (!Array.isArray(rawRules)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      if (rawRules.length === 0) {
+        hasMalformedRules = true;
+      }
+      for (const rawRule of rawRules) {
+        if (typeof rawRule !== "string") {
+          hasMalformedRules = true;
+          continue;
+        }
+        const compiledRule = compileDecisionRule(permissionName, rawRule);
+        if (compiledRule === null) {
+          hasMalformedRules = true;
+          continue;
+        }
+        rules.push(compiledRule);
+      }
+    }
+  } else if (rawObjectHasOwn(api, "permissions")) {
+    hasMalformedRules = true;
+  }
+  return {
+    rawBase: api.base,
+    baseMalformed,
+    authMalformed,
+    hasMalformedRules,
+    rules
+  };
+}
+function compileDecisionFirewall(rawFirewall) {
+  if (!isObjectRecord(rawFirewall)) return null;
+  const rawName = rawFirewall.name;
+  const nameMalformed = typeof rawName !== "string" || rawName === "";
+  const name = typeof rawName === "string" ? rawName : "";
+  const rawApis = rawFirewall.apis;
+  if (!Array.isArray(rawApis)) return null;
+  const apis = [];
+  for (const rawApi of rawApis) {
+    if (!isObjectRecord(rawApi)) continue;
+    const api = compileDecisionApi(rawApi, name, nameMalformed);
+    if (api !== null) {
+      apis.push(api);
+    }
+  }
+  if (apis.length === 0) return null;
+  return { name, nameMalformed, apis };
+}
+function compileDecisionFirewalls(rawFirewalls) {
+  if (!Array.isArray(rawFirewalls) || rawFirewalls.length === 0) return [];
+  const firewalls = [];
+  for (const rawFirewall of rawFirewalls) {
+    const firewall = compileDecisionFirewall(rawFirewall);
+    if (firewall !== null) {
+      firewalls.push(firewall);
+    }
+  }
+  return firewalls;
+}
+function compilePermissionSet(rawValue) {
+  if (rawValue === void 0 || rawValue === null) {
+    return { values: /* @__PURE__ */ new Set(), malformed: false };
+  }
+  if (!Array.isArray(rawValue) || rawValue.some((item) => {
+    return typeof item !== "string";
+  })) {
+    return { values: /* @__PURE__ */ new Set(), malformed: true };
+  }
+  return { values: new Set(rawValue), malformed: false };
+}
+function compileNetworkPolicies(rawNetworkPolicies) {
+  if (rawNetworkPolicies === void 0 || rawNetworkPolicies === null) {
+    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: false };
+  }
+  if (!isObjectRecord(rawNetworkPolicies)) {
+    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: true };
+  }
+  const policies = /* @__PURE__ */ new Map();
+  for (const [firewallName, grant] of Object.entries(rawNetworkPolicies)) {
+    if (!isObjectRecord(grant)) {
+      policies.set(firewallName, {
+        blockedPermissions: /* @__PURE__ */ new Set(),
+        unknownPolicy: "allow",
+        permissionMalformed: true,
+        unknownPolicyMalformed: false
+      });
+      continue;
+    }
+    const allow = compilePermissionSet(grant.allow);
+    const deny = compilePermissionSet(grant.deny);
+    const ask = compilePermissionSet(grant.ask);
+    const blockedPermissions = /* @__PURE__ */ new Set([...deny.values, ...ask.values]);
+    let unknownPolicy = "allow";
+    let unknownPolicyMalformed = false;
+    const rawUnknownPolicy = grant.unknownPolicy;
+    if (rawUnknownPolicy === "allow" || rawUnknownPolicy === "deny" || rawUnknownPolicy === "ask") {
+      unknownPolicy = rawUnknownPolicy;
+    } else if (rawUnknownPolicy !== void 0 && rawUnknownPolicy !== null) {
+      unknownPolicyMalformed = true;
+    }
+    policies.set(firewallName, {
+      blockedPermissions,
+      unknownPolicy,
+      permissionMalformed: allow.malformed || deny.malformed || ask.malformed,
+      unknownPolicyMalformed
+    });
+  }
+  return { policies, topLevelMalformed: false };
+}
+function relativePathFromSegments(segments, consumed) {
+  const rest = segments.slice(consumed).join("/");
+  return rest === "" ? "/" : `/${rest}`;
+}
+function stripUrlQueryAndFragment(url) {
+  const queryIndex = url.indexOf("?");
+  const fragmentIndex = url.indexOf("#");
+  let end = url.length;
+  if (queryIndex !== -1) end = Math.min(end, queryIndex);
+  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);
+  return url.slice(0, end);
+}
+function rawUrlAuthorityBounds(url) {
+  const schemeEnd = url.indexOf("://");
+  if (schemeEnd === -1) return null;
+  const authorityStart = schemeEnd + 3;
+  let authorityEnd = url.length;
+  for (const delimiter of ["/", "?", "#"]) {
+    const delimiterIndex = url.indexOf(delimiter, authorityStart);
+    if (delimiterIndex !== -1)
+      authorityEnd = Math.min(authorityEnd, delimiterIndex);
+  }
+  return { authorityStart, authorityEnd };
+}
+function replaceRawUrlAuthority(url, bounds, authority) {
+  return `${url.slice(0, bounds.authorityStart)}${authority}${url.slice(bounds.authorityEnd)}`;
+}
+function stripRawUrlUserinfo(url) {
+  const bounds = rawUrlAuthorityBounds(url);
+  if (bounds === null) return url;
+  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
+  const userinfoEnd = authority.lastIndexOf("@");
+  if (userinfoEnd === -1) return url;
+  return replaceRawUrlAuthority(url, bounds, authority.slice(userinfoEnd + 1));
+}
+function rawAuthorityPortIsMalformed(port) {
+  if (port === "") return true;
+  if (![...port].every((char) => {
+    return char >= "0" && char <= "9";
+  })) {
+    return true;
+  }
+  return Number(port) > 65535;
+}
+function stripRawUrlMalformedPort(url) {
+  const bounds = rawUrlAuthorityBounds(url);
+  if (bounds === null) return url;
+  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
+  if (authority.startsWith("[")) {
+    const closeBracketIndex = authority.indexOf("]");
+    if (closeBracketIndex === -1) return url;
+    const portPrefix = authority.slice(closeBracketIndex + 1);
+    if (!portPrefix.startsWith(":")) return url;
+    if (!rawAuthorityPortIsMalformed(portPrefix.slice(1))) return url;
+    return replaceRawUrlAuthority(
+      url,
+      bounds,
+      authority.slice(0, closeBracketIndex + 1)
+    );
+  }
+  const portSeparator = authority.lastIndexOf(":");
+  if (portSeparator === -1) return url;
+  if (authority.indexOf(":") !== portSeparator) return url;
+  if (!rawAuthorityPortIsMalformed(authority.slice(portSeparator + 1))) {
+    return url;
+  }
+  return replaceRawUrlAuthority(url, bounds, authority.slice(0, portSeparator));
+}
+function rawBaseForDecisionMatch(rawBase) {
+  if (stripUrlQueryAndFragment(rawBase).includes("\\")) return null;
+  return stripRawUrlMalformedPort(stripRawUrlUserinfo(rawBase));
+}
+function rawPathFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  return pathStart === -1 ? "/" : urlWithoutQuery.slice(pathStart);
+}
+function rawBasePathFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  return pathStart === -1 ? "" : urlWithoutQuery.slice(pathStart);
+}
+function rawAuthorityFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  if (schemeEnd === -1) return null;
+  const authorityStart = schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  const authority = pathStart === -1 ? urlWithoutQuery.slice(authorityStart) : urlWithoutQuery.slice(authorityStart, pathStart);
+  return authority === "" ? null : authority;
+}
+function hasNonAscii(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) > 127) return true;
+  }
+  return false;
+}
+function rawHostFromAuthority(authority) {
+  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (withoutUserinfo.startsWith("[")) {
+    const closeBracket = withoutUserinfo.indexOf("]");
+    return closeBracket === -1 ? withoutUserinfo : withoutUserinfo.slice(0, closeBracket + 1);
+  }
+  const portSeparator = withoutUserinfo.lastIndexOf(":");
+  return portSeparator === -1 ? withoutUserinfo : withoutUserinfo.slice(0, portSeparator);
+}
+function authorityHasEmptyPort(authority) {
+  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (withoutUserinfo.startsWith("[")) {
+    const closeBracket = withoutUserinfo.indexOf("]");
+    if (closeBracket === -1) return false;
+    return withoutUserinfo.slice(closeBracket + 1) === ":";
+  }
+  const portSeparator = withoutUserinfo.lastIndexOf(":");
+  if (portSeparator === -1) return false;
+  return withoutUserinfo.indexOf(":") === portSeparator && portSeparator === withoutUserinfo.length - 1;
+}
+function rawAuthorityHostStartsWithDigit(authority) {
+  const firstChar = rawHostFromAuthority(authority)[0];
+  return firstChar !== void 0 && firstChar >= "0" && firstChar <= "9";
+}
+function runtimeAuthorityOriginForHostValidation(url) {
+  const authority = rawAuthorityFromUrl(url);
+  if (authority === null) return null;
+  if (!authority.includes("%") && !hasNonAscii(authority) && !rawAuthorityHostStartsWithDigit(authority)) {
+    return null;
+  }
+  const schemeEnd = url.indexOf("://");
+  if (schemeEnd === -1) return null;
+  return `${url.slice(0, schemeEnd)}://${authority}`;
+}
+function hasPercentEncodedAuthoritySyntax(value) {
+  let index = value.indexOf("%");
+  while (index !== -1) {
+    let runEnd = index;
+    while (runEnd < value.length && value[runEnd] === "%") {
+      const firstHexDigit = value[runEnd + 1];
+      const secondHexDigit = value[runEnd + 2];
+      if (!firstHexDigit || !secondHexDigit || !HEX_DIGITS.has(firstHexDigit) || !HEX_DIGITS.has(secondHexDigit)) {
+        return true;
+      }
+      runEnd += PERCENT_ESCAPE_LENGTH;
+    }
+    let decodedRun;
+    try {
+      decodedRun = decodeURIComponent(value.slice(index, runEnd));
+    } catch {
+      return true;
+    }
+    for (const char of decodedRun) {
+      if (PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS.has(char)) {
+        return true;
+      }
+    }
+    index = value.indexOf("%", runEnd);
+  }
+  return false;
+}
+function hasMalformedRuntimeAuthoritySyntax(url) {
+  const authority = rawAuthorityFromUrl(url);
+  if (authority === null) return false;
+  return authority.includes("\\") || authorityHasEmptyPort(authority) || hasPercentEncodedAuthoritySyntax(authority);
+}
+function scoreLiteralSegment(segment) {
+  return LITERAL_SEGMENT_SCORE + codePointLength(segment);
+}
+function scoreParsedPatternSegment(parsed) {
+  if (parsed.kind === "literal") {
+    return scoreLiteralSegment(parsed.value);
+  }
+  const literalChars = codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
+  if (parsed.prefix !== "" || parsed.suffix !== "") {
+    return MIXED_PARAM_SEGMENT_SCORE + literalChars;
+  }
+  if (parsed.greedy === "+") return PLUS_GREEDY_SEGMENT_SCORE;
+  if (parsed.greedy === "*") return 0;
+  return PLAIN_PARAM_SEGMENT_SCORE;
+}
+function scoreStaticSegments(segments) {
+  return segments.reduce((score, segment) => {
+    return score + scoreLiteralSegment(segment);
+  }, 0);
+}
+function scorePatternSegmentsWithParser(segments, parsePatternSegment) {
+  const lastPatternIndex = segments.length - 1;
+  let score = 0;
+  for (let index = 0; index < segments.length; index += 1) {
+    const segment = segments[index];
+    const parsed = parsePatternSegment(segment, index, lastPatternIndex);
+    if (parsed !== null) {
+      score += scoreParsedPatternSegment(parsed);
+    }
+  }
+  return score;
+}
+function scorePathPattern(path, parsePatternSegment) {
+  if (path === "") return 0;
+  if (path === "/") return ROOT_PATH_SCORE;
+  const segments = splitPathSegments(path);
+  return parsePatternSegment === null ? scoreStaticSegments(segments) : scorePatternSegmentsWithParser(segments, parsePatternSegment);
+}
+function splitAuthoritySegments(authority) {
+  if (authority.startsWith("[")) return [authority];
+  const normalized = authority.endsWith(".") ? authority.slice(0, -1) : authority;
+  return normalized === "" ? [] : normalized.split(".");
+}
+function baseUrlSpecificityScore({
+  authority,
+  path,
+  hasParams,
+  tolerateMalformedBaseParams = false
+}) {
+  const patternParser = hasParams ? tolerateMalformedBaseParams ? parseMalformedTolerantBaseSegment : parseStrictMatchSegment : null;
+  const authoritySegments = splitAuthoritySegments(authority);
+  const authorityScore = patternParser === null ? scoreStaticSegments(authoritySegments) : scorePatternSegmentsWithParser(
+    [...authoritySegments].reverse(),
+    patternParser
+  );
+  const pathScore = scorePathPattern(path, patternParser);
+  return pathScore * PATH_SCORE_MULTIPLIER + authorityScore * AUTHORITY_SCORE_MULTIPLIER + (hasParams ? 0 : STATIC_BASE_SCORE_BONUS);
+}
+function matchStaticBasePathPrefix(path, pattern) {
+  if (pattern === "") {
+    return path === "" ? "/" : path;
+  }
+  if (pattern === "/") {
+    if (!path.startsWith(pattern)) return null;
+    const relativePath2 = path.slice(pattern.length);
+    if (relativePath2 !== "" && !relativePath2.startsWith("/")) return null;
+    return relativePath2 === "" ? "/" : relativePath2;
+  }
+  if (!path.startsWith(pattern)) return null;
+  const relativePath = path.slice(pattern.length);
+  if (relativePath !== "" && !relativePath.startsWith("/")) return null;
+  return relativePath === "" ? "/" : relativePath;
+}
+function normalizeUrlHostname(hostname, options = {}) {
+  let normalized = hostname.toLowerCase();
+  if (normalized.endsWith(".")) {
+    normalized = normalized.slice(0, -1);
+    if (normalized === "" || normalized.endsWith(".")) {
+      return null;
+    }
+  }
+  if (normalized.split(".").some((label) => {
+    return label === "";
+  })) {
+    return null;
+  }
+  const forbiddenChars = options.allowHostParams === true ? FORBIDDEN_BASE_PATTERN_HOST_CHARS : FORBIDDEN_RUNTIME_HOST_CHARS;
+  if (!normalized.startsWith("[") && [...normalized].some((char) => {
+    return forbiddenChars.has(char);
+  })) {
+    return null;
+  }
+  return normalized;
+}
+function normalizedUrlAuthority(parsed, options = {}) {
+  if (parsed.username !== "" || parsed.password !== "") {
+    return null;
+  }
+  const hostname = normalizeUrlHostname(parsed.hostname, options);
+  if (hostname === null || hostname === "") {
+    return null;
+  }
+  return parsed.port === "" ? hostname : `${hostname}:${parsed.port}`;
+}
+function matchStaticFirewallBaseUrl(url, rawBase, options = {}) {
+  const parsedUrl = new URL(url);
+  const parsedBase = new URL(rawBase);
+  if (parsedUrl.protocol.toLowerCase() !== parsedBase.protocol.toLowerCase()) {
+    return null;
+  }
+  const baseHasParams = hasBaseUrlParams(rawBase);
+  const baseForMatch = stripTrailingSlash(rawBase);
+  const urlAuthority = normalizedUrlAuthority(parsedUrl);
+  const baseAuthority = normalizedUrlAuthority(parsedBase, {
+    allowHostParams: baseHasParams
+  });
+  if (urlAuthority === null || baseAuthority === null) return null;
+  if (baseHasParams) {
+    const hostParams = options.tolerateMalformedBaseParams === true ? matchFirewallHostForMalformedBaseDecision(urlAuthority, baseAuthority) : matchFirewallHost(urlAuthority, baseAuthority);
+    if (hostParams === null) return null;
+  } else if (urlAuthority !== baseAuthority) {
+    return null;
+  }
+  const basePath = rawBasePathFromUrl(baseForMatch);
+  const relativePath = baseHasParams ? options.tolerateMalformedBaseParams === true ? matchFirewallPathPrefixForMalformedBaseDecision(
+    rawPathFromUrl(url),
+    basePath
+  ) : matchFirewallPathPrefix(rawPathFromUrl(url), basePath) : matchStaticBasePathPrefix(rawPathFromUrl(url), basePath);
+  if (relativePath === null) return null;
+  const displayBase = stripTrailingSlash(rawBase);
+  return {
+    displayBase,
+    relativePath,
+    score: baseUrlSpecificityScore({
+      authority: baseAuthority,
+      path: basePath,
+      hasParams: baseHasParams,
+      tolerateMalformedBaseParams: options.tolerateMalformedBaseParams === true
+    })
+  };
+}
+function runtimeUrlCanMatchFirewallBase(url) {
+  if (hasUnsafeUrlCodepoint(url) || hasRawWhitespace(url) || !url.includes("://") || hasMalformedRuntimeAuthoritySyntax(url)) {
+    return false;
+  }
+  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
+  if (runtimeAuthorityOrigin === null) return true;
+  try {
+    validateBaseUrl(runtimeAuthorityOrigin, "runtime");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function matchFirewallBaseUrlForDecision(url, rawBase) {
+  if (!runtimeUrlCanMatchFirewallBase(url)) return null;
+  const baseForMatch = rawBaseForDecisionMatch(rawBase);
+  if (baseForMatch === null) return null;
+  try {
+    const match = matchStaticFirewallBaseUrl(url, baseForMatch, {
+      tolerateMalformedBaseParams: true
+    });
+    if (match === null) return null;
+    return { ...match, displayBase: stripTrailingSlash(rawBase) };
+  } catch {
+    return null;
+  }
+}
+function createDecisionState() {
+  return {
+    bestBaseScore: null,
+    bestRuleSpecificity: null,
+    baseMatch: null,
+    allowedMatch: null,
+    deniedMatch: null,
+    deniedPermissionNames: [],
+    malformedConfigMatch: null,
+    malformedPolicyMatch: null
+  };
+}
+function acceptDecisionBaseMatch(state, match, score) {
+  if (state.bestBaseScore === null || score > state.bestBaseScore) {
+    state.bestBaseScore = score;
+    state.bestRuleSpecificity = null;
+    state.baseMatch = null;
+    state.allowedMatch = null;
+    state.deniedMatch = null;
+    state.deniedPermissionNames = [];
+    state.malformedConfigMatch = null;
+    state.malformedPolicyMatch = null;
+  } else if (score < state.bestBaseScore) {
+    return false;
+  }
+  state.baseMatch ??= match;
+  return true;
+}
+function canRuleSpecificityAffectDecision(state, specificity) {
+  if (state.bestRuleSpecificity === null) return true;
+  const comparison = comparePathSpecificity(
+    specificity,
+    state.bestRuleSpecificity
+  );
+  if (comparison > 0) return true;
+  if (comparison < 0) return false;
+  return state.allowedMatch === null;
+}
+function acceptRuleSpecificity(state, specificity) {
+  if (state.bestRuleSpecificity === null) {
+    state.bestRuleSpecificity = specificity;
+    return true;
+  }
+  const comparison = comparePathSpecificity(
+    specificity,
+    state.bestRuleSpecificity
+  );
+  if (comparison > 0) {
+    state.bestRuleSpecificity = specificity;
+    state.allowedMatch = null;
+    state.deniedMatch = null;
+    state.deniedPermissionNames = [];
+    return true;
+  }
+  return comparison === 0;
+}
+function recordDeniedRule(state, match, permission) {
+  if (!state.deniedPermissionNames.includes(permission)) {
+    state.deniedPermissionNames.push(permission);
+  }
+  state.deniedMatch ??= match;
+}
+function resolveFirewallDecision(state, networkPolicies) {
+  const baseMatch = state.baseMatch;
+  if (baseMatch === null) {
+    return { kind: "no_match" };
+  }
+  if (state.allowedMatch !== null) {
+    return {
+      kind: "allow",
+      firewallName: state.allowedMatch.firewallName,
+      base: state.allowedMatch.base,
+      relativePath: state.allowedMatch.relativePath,
+      permission: state.allowedMatch.permission,
+      rule: state.allowedMatch.rule
+    };
+  }
+  if (state.deniedMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.deniedMatch.firewallName,
+      base: state.deniedMatch.base,
+      relativePath: state.deniedMatch.relativePath,
+      reason: "permission_denied",
+      permissions: state.deniedPermissionNames
+    };
+  }
+  if (state.malformedPolicyMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.malformedPolicyMatch.firewallName,
+      base: state.malformedPolicyMatch.base,
+      relativePath: state.malformedPolicyMatch.relativePath,
+      reason: "malformed_network_policy",
+      permissions: []
+    };
+  }
+  if (state.malformedConfigMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.malformedConfigMatch.firewallName,
+      base: state.malformedConfigMatch.base,
+      relativePath: state.malformedConfigMatch.relativePath,
+      reason: "malformed_firewall_config",
+      permissions: []
+    };
+  }
+  const policy = networkPolicies.policies.get(baseMatch.firewallName);
+  if (policy === void 0) {
+    return {
+      kind: "allow",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.allowBase,
+      relativePath: baseMatch.relativePath
+    };
+  }
+  if (policy.unknownPolicyMalformed) {
+    return {
+      kind: "block",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.base,
+      relativePath: baseMatch.relativePath,
+      reason: "malformed_network_policy",
+      permissions: []
+    };
+  }
+  if (policy.unknownPolicy === "allow") {
+    return {
+      kind: "allow",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.allowBase,
+      relativePath: baseMatch.relativePath
+    };
+  }
+  return {
+    kind: "block",
+    firewallName: baseMatch.firewallName,
+    base: baseMatch.base,
+    relativePath: baseMatch.relativePath,
+    reason: "unknown_endpoint",
+    permissions: []
+  };
+}
+function unsafePathBlockDecision(firewall, baseMatch) {
+  return {
+    kind: "block",
+    firewallName: firewall.name,
+    base: baseMatch.displayBase,
+    relativePath: baseMatch.relativePath,
+    reason: "unsafe_path",
+    permissions: []
+  };
+}
+function recordMalformedDecisionState(state, api, blockMatch) {
+  if (api.baseMalformed || api.authMalformed || api.hasMalformedRules) {
+    state.malformedConfigMatch ??= blockMatch;
+  }
+}
+function apiCannotEvaluateRules(firewall, api) {
+  return firewall.nameMalformed || api.baseMalformed || api.authMalformed;
+}
+function policyCannotEvaluateRules(networkPolicies, policy) {
+  return networkPolicies.topLevelMalformed || policy !== void 0 && policy.permissionMalformed;
+}
+function evaluateDecisionRule({
+  state,
+  rule,
+  policy,
+  blockMatch,
+  baseMatch,
+  upperMethod
+}) {
+  if (rule.method !== "ANY" && rule.method !== upperMethod) return;
+  if (!canRuleSpecificityAffectDecision(state, rule.specificity)) return;
+  const permissionBlocked = policy !== void 0 && policy.blockedPermissions.has(rule.permission);
+  if (matchFirewallPath(baseMatch.relativePath, rule.path) === null) return;
+  if (!acceptRuleSpecificity(state, rule.specificity)) return;
+  if (permissionBlocked) {
+    recordDeniedRule(state, blockMatch, rule.permission);
+    return;
+  }
+  state.allowedMatch ??= {
+    firewallName: baseMatch.firewallName,
+    base: baseMatch.allowBase,
+    relativePath: baseMatch.relativePath,
+    permission: rule.permission,
+    rule: rule.raw
+  };
+}
+function evaluateDecisionRules({
+  state,
+  api,
+  policy,
+  blockMatch,
+  baseMatch,
+  upperMethod
+}) {
+  for (const rule of api.rules) {
+    evaluateDecisionRule({
+      state,
+      rule,
+      policy,
+      blockMatch,
+      baseMatch,
+      upperMethod
+    });
+  }
+}
+function evaluateDecisionApi({
+  state,
+  firewall,
+  api,
+  url,
+  unsafePath,
+  networkPolicies,
+  upperMethod
+}) {
+  const policy = networkPolicies.policies.get(firewall.name);
+  const baseMatch = matchFirewallBaseUrlForDecision(url, api.rawBase);
+  if (baseMatch === null) return null;
+  if (unsafePath) return unsafePathBlockDecision(firewall, baseMatch);
+  const decisionBaseMatch = {
+    firewallName: firewall.name,
+    base: baseMatch.displayBase,
+    allowBase: api.rawBase,
+    relativePath: baseMatch.relativePath
+  };
+  const blockMatch = {
+    firewallName: decisionBaseMatch.firewallName,
+    base: decisionBaseMatch.base,
+    relativePath: decisionBaseMatch.relativePath
+  };
+  if (!acceptDecisionBaseMatch(state, decisionBaseMatch, baseMatch.score)) {
+    return null;
+  }
+  recordMalformedDecisionState(state, api, blockMatch);
+  if (apiCannotEvaluateRules(firewall, api)) return null;
+  if (policyCannotEvaluateRules(networkPolicies, policy)) {
+    state.malformedPolicyMatch ??= blockMatch;
+    return null;
+  }
+  evaluateDecisionRules({
+    state,
+    api,
+    policy,
+    blockMatch,
+    baseMatch: decisionBaseMatch,
+    upperMethod
+  });
+  return null;
+}
+function matchFirewallBaseUrl(url, rawBase) {
+  if (hasUnsafeRuntimeUrlSyntax(url) || hasMalformedRuntimeAuthoritySyntax(url)) {
+    return null;
+  }
+  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
+  try {
+    if (runtimeAuthorityOrigin !== null) {
+      validateBaseUrl(runtimeAuthorityOrigin, "runtime");
+    }
+    validateBaseUrl(rawBase, "firewall");
+    return matchStaticFirewallBaseUrl(url, rawBase);
+  } catch {
+    return null;
+  }
+}
+function matchFirewallRequestDecision(firewalls, method, url, networkPolicies = void 0) {
+  const decisionFirewalls = compileDecisionFirewalls(firewalls);
+  if (decisionFirewalls.length === 0) return { kind: "no_match" };
+  const compiledNetworkPolicies = compileNetworkPolicies(networkPolicies);
+  const upperMethod = method.toUpperCase();
+  const state = createDecisionState();
+  const unsafePath = url.includes("\\") || hasUnsafeFirewallPath(rawPathFromUrl(url));
+  for (const firewall of decisionFirewalls) {
+    for (const api of firewall.apis) {
+      const immediateDecision = evaluateDecisionApi({
+        state,
+        firewall,
+        api,
+        url,
+        unsafePath,
+        networkPolicies: compiledNetworkPolicies,
+        upperMethod
+      });
+      if (immediateDecision !== null) {
+        return immediateDecision;
+      }
+    }
+  }
+  return resolveFirewallDecision(state, compiledNetworkPolicies);
+}
+function matchFirewallHostWithParser(host, pattern, parsePatternSegment) {
+  const hostSegsOrig = host.split(".");
+  const hostSegsLower = hostSegsOrig.map((segment) => {
+    return segment.toLowerCase();
+  });
+  const patternSegs = pattern.split(".").reverse();
+  hostSegsOrig.reverse();
+  hostSegsLower.reverse();
+  const params = {};
+  let hi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
+    if (parsed === null) return null;
+    if (parsed.kind === "literal") {
+      if (hi >= hostSegsLower.length || hostSegsLower[hi] !== parsed.value.toLowerCase()) {
+        return null;
+      }
+      hi += 1;
+      continue;
+    }
+    const { name, prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (hi >= hostSegsOrig.length) return null;
+      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
+      return params;
+    }
+    if (greedy === "*") {
+      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
+      return params;
+    }
+    if (hi >= hostSegsOrig.length) return null;
+    if (prefix === "" && suffix === "") {
+      params[name] = hostSegsLower[hi];
+    } else {
+      const captured = matchMixedSegment(
+        hostSegsLower[hi],
+        prefix.toLowerCase(),
+        suffix.toLowerCase()
+      );
+      if (captured === null) return null;
+      params[name] = captured;
+    }
+    hi += 1;
+  }
+  return hi === hostSegsOrig.length ? params : null;
+}
+function matchFirewallHost(host, pattern) {
+  return matchFirewallHostWithParser(host, pattern, parseStrictMatchSegment);
+}
+function parseMalformedTolerantBaseSegment(segment, patternIndex, lastPatternIndex) {
+  const parsed = parseSegment(segment);
+  if (parsed.kind === "error") {
+    return {
+      kind: "param",
+      prefix: "",
+      name: `__malformed_base_segment_${patternIndex}`,
+      suffix: "",
+      greedy: ""
+    };
+  }
+  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
+    patternIndex,
+    lastPatternIndex,
+    parsed.prefix,
+    parsed.suffix
+  )) {
+    return { ...parsed, greedy: "" };
+  }
+  return parsed;
+}
+function matchFirewallHostForMalformedBaseDecision(host, pattern) {
+  return matchFirewallHostWithParser(
+    host,
+    pattern,
+    parseMalformedTolerantBaseSegment
+  );
+}
+function matchFirewallPathPrefixWithParser(path, pattern, parsePatternSegment) {
+  const pathSegs = splitPathSegments(path);
+  const patternSegs = splitPathSegments(pattern);
+  let pi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
+    if (parsed === null) return null;
+    if (parsed.kind === "literal") {
+      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
+      pi += 1;
+      continue;
+    }
+    const { prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
+        return null;
+      }
+      return "/";
+    }
+    if (greedy === "*") {
+      return "/";
+    }
+    if (pi >= pathSegs.length) return null;
+    const runtime = pathSegs[pi];
+    if (prefix === "" && suffix === "") {
+      if (runtime === "") return null;
+    } else if (matchMixedSegment(runtime, prefix, suffix) === null) {
+      return null;
+    }
+    pi += 1;
+  }
+  return relativePathFromSegments(pathSegs, pi);
+}
+function matchFirewallPathPrefix(path, pattern) {
+  return matchFirewallPathPrefixWithParser(
+    path,
+    pattern,
+    parseStrictMatchSegment
+  );
+}
+function matchFirewallPathPrefixForMalformedBaseDecision(path, pattern) {
+  return matchFirewallPathPrefixWithParser(
+    path,
+    pattern,
+    parseMalformedTolerantBaseSegment
+  );
+}
+function matchFirewallPath(path, pattern) {
+  const pathSegs = splitPathSegments(path);
+  const patternSegs = splitPathSegments(pattern);
+  const params = {};
+  let pi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parseSegment(seg);
+    if (parsed.kind === "error") return null;
+    if (parsed.kind === "literal") {
+      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
+      pi++;
+      continue;
+    }
+    const { name, prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
+        return null;
+      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
+        return null;
+      }
+      params[name] = pathSegs.slice(pi).join("/");
+      return params;
+    }
+    if (greedy === "*") {
+      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
+        return null;
+      params[name] = pathSegs.slice(pi).join("/");
+      return params;
+    }
+    if (pi >= pathSegs.length) return null;
+    const runtime = pathSegs[pi];
+    if (prefix === "" && suffix === "") {
+      if (runtime === "") return null;
+      params[name] = runtime;
+    } else {
+      const captured = matchMixedSegment(runtime, prefix, suffix);
+      if (captured === null) return null;
+      params[name] = captured;
+    }
+    pi++;
+  }
+  if (pi !== pathSegs.length) return null;
+  return params;
+}
+
+export {
+  matchFirewallBaseUrl,
+  matchFirewallRequestDecision
+};
+//# sourceMappingURL=chunk-72DXWQL4.js.map