@vm0/cli 9.237.1 → 9.237.2

package/{teams-K2XTVCGT.js → teams-IWY7IFLD.js}

@@ -7,10 +7,10 @@ import {
   downloadTeamsFile,
   initTeamsFileUpload,
   sendTeamsMessage
-} from "./chunk-G55J25QR.js";
+} from "./chunk-GPZFXJF6.js";
 import {
   withErrorHandler
-} from "./chunk-DNWL4DAH.js";
+} from "./chunk-NPC4JKK2.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -281,4 +281,4 @@ Examples:
 export {
   zeroTeamsCommand
 };
-//# sourceMappingURL=teams-K2XTVCGT.js.map
+//# sourceMappingURL=teams-IWY7IFLD.js.map

package/{telegram-XNU3XVPW.js → telegram-QWZYLAJW.js}

@@ -8,10 +8,10 @@ import {
   initTelegramFileUpload,
   listTelegramBots,
   sendTelegramMessage
-} from "./chunk-G55J25QR.js";
+} from "./chunk-GPZFXJF6.js";
 import {
   withErrorHandler
-} from "./chunk-DNWL4DAH.js";
+} from "./chunk-NPC4JKK2.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -335,4 +335,4 @@ Examples:
 export {
   zeroTelegramCommand
 };
-//# sourceMappingURL=telegram-XNU3XVPW.js.map
+//# sourceMappingURL=telegram-QWZYLAJW.js.map

package/{variable-J5FV4HHC.js → variable-3LUSNJRP.js}

@@ -10,10 +10,10 @@ import {
   deleteZeroVariable,
   listZeroVariables,
   setZeroVariable
-} from "./chunk-G55J25QR.js";
+} from "./chunk-GPZFXJF6.js";
 import {
   withErrorHandler
-} from "./chunk-DNWL4DAH.js";
+} from "./chunk-NPC4JKK2.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -117,4 +117,4 @@ var zeroVariableCommand = new Command().name("variable").description("Read or wr
 export {
   zeroVariableCommand
 };
-//# sourceMappingURL=variable-J5FV4HHC.js.map
+//# sourceMappingURL=variable-3LUSNJRP.js.map

package/{video-HSB2R7TK.js → video-XHTZYJWK.js}

@@ -6,7 +6,7 @@ import {
   downloadWebFile,
   transcribeAudio,
   withErrorHandler
-} from "./chunk-DNWL4DAH.js";
+} from "./chunk-NPC4JKK2.js";
 import "./chunk-JUTUEPIR.js";
 import "./chunk-LRHXR7JT.js";
 import {
@@ -246,4 +246,4 @@ Tip (video understanding):
 export {
   zeroVideoCommand
 };
-//# sourceMappingURL=video-HSB2R7TK.js.map
+//# sourceMappingURL=video-XHTZYJWK.js.map

package/{web-MRZE6CNW.js → web-C76UB3WO.js}

@@ -2,12 +2,12 @@
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import "./chunk-LTDQISD7.js";
-import "./chunk-G55J25QR.js";
+import "./chunk-GPZFXJF6.js";
 import {
   downloadWebFile,
   uploadWebFile,
   withErrorHandler
-} from "./chunk-DNWL4DAH.js";
+} from "./chunk-NPC4JKK2.js";
 import "./chunk-JUTUEPIR.js";
 import "./chunk-LRHXR7JT.js";
 import {
@@ -106,4 +106,4 @@ Examples:
 export {
   zeroWebCommand
 };
-//# sourceMappingURL=web-MRZE6CNW.js.map
+//# sourceMappingURL=web-C76UB3WO.js.map

package/{whoami-5SM2Z5BX.js → whoami-K6I3CEDK.js}

@@ -4,22 +4,22 @@ const require = __createRequire(import.meta.url);
 import {
   loadConnectorPermissionInfos,
   policyIcon
-} from "./chunk-ZJOHVGBX.js";
+} from "./chunk-2JZ66FKH.js";
 import {
   permissionGrantsToFirewallPolicies
-} from "./chunk-AJUYZVZU.js";
+} from "./chunk-AEL2XKIL.js";
 import "./chunk-LTDQISD7.js";
 import {
   getZeroAgentUserConnectors,
   listZeroConnectors,
   listZeroUserPermissionGrants
-} from "./chunk-G55J25QR.js";
+} from "./chunk-GPZFXJF6.js";
 import {
   getActiveOrg,
   getApiUrl,
   getToken,
   withErrorHandler
-} from "./chunk-DNWL4DAH.js";
+} from "./chunk-NPC4JKK2.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -192,4 +192,4 @@ Notes:
 export {
   zeroWhoamiCommand
 };
-//# sourceMappingURL=whoami-5SM2Z5BX.js.map
+//# sourceMappingURL=whoami-K6I3CEDK.js.map

package/{workflow-6ZJZKTJ5.js → workflow-K2OP7MBH.js}

@@ -20,10 +20,10 @@ import {
   listWorkflows,
   updateWorkflow,
   updateWorkflowTrigger
-} from "./chunk-G55J25QR.js";
+} from "./chunk-GPZFXJF6.js";
 import {
   withErrorHandler
-} from "./chunk-DNWL4DAH.js";
+} from "./chunk-NPC4JKK2.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -1753,4 +1753,4 @@ Examples:
 export {
   zeroWorkflowCommand
 };
-//# sourceMappingURL=workflow-6ZJZKTJ5.js.map
+//# sourceMappingURL=workflow-K2OP7MBH.js.map

package/zero.js

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   configureGlobalProxyFromEnv
-} from "./chunk-RNGEJBP2.js";
+} from "./chunk-OHQONXKG.js";
 import {
   decodeZeroTokenPayload
 } from "./chunk-LRHXR7JT.js";
@@ -55,70 +55,70 @@ var ZERO_COMMAND_DEFINITIONS = [
     name: "org",
     description: "Manage organization settings, members, and providers",
     load: async () => {
-      return (await import("./org-NY3ZQYMJ.js")).zeroOrgCommand;
+      return (await import("./org-2UDAOW4R.js")).zeroOrgCommand;
     }
   },
   {
     name: "model",
     description: "List available models and model-switching guidance",
     load: async () => {
-      return (await import("./model-5YKXB5ND.js")).zeroModelCommand;
+      return (await import("./model-U6DTR7JY.js")).zeroModelCommand;
     }
   },
   {
     name: "model-provider",
     description: "Inspect model provider routing",
     load: async () => {
-      return (await import("./model-provider-4EUN45KQ.js")).zeroModelProviderCommand;
+      return (await import("./model-provider-5LGQU6VF.js")).zeroModelProviderCommand;
     }
   },
   {
     name: "agent",
     description: "View or manage zero agents",
     load: async () => {
-      return (await import("./agent-G5NJDTZD.js")).zeroAgentCommand;
+      return (await import("./agent-2NTLUZ3Q.js")).zeroAgentCommand;
     }
   },
   {
     name: "connector",
     description: "Check third-party service connections (GitHub, Slack, etc.)",
     load: async () => {
-      return (await import("./connector-SDQMMKIT.js")).zeroConnectorCommand;
+      return (await import("./connector-4LDVG2YU.js")).zeroConnectorCommand;
     }
   },
   {
     name: "relationship",
     description: "Query relationship memory",
     load: async () => {
-      return (await import("./relationship-2OHALC26.js")).zeroRelationshipCommand;
+      return (await import("./relationship-XC64ZBSX.js")).zeroRelationshipCommand;
     }
   },
   {
     name: "memory",
     description: "Recall structured memory",
     load: async () => {
-      return (await import("./memory-EJSR4TVG.js")).zeroMemoryCommand;
+      return (await import("./memory-KV2RFKQS.js")).zeroMemoryCommand;
     }
   },
   {
     name: "credit",
     description: "Create a Stripe checkout link to buy credits",
     load: async () => {
-      return (await import("./credit-JTKH4UMZ.js")).zeroCreditCommand;
+      return (await import("./credit-ASJ5RACS.js")).zeroCreditCommand;
     }
   },
   {
     name: "doctor",
     description: "Diagnose runtime issues (connector health, permission denials)",
     load: async () => {
-      return (await import("./doctor-VPBYKX77.js")).zeroDoctorCommand;
+      return (await import("./doctor-4XKNSIOM.js")).zeroDoctorCommand;
     }
   },
   {
     name: "preference",
     description: "View or update user preferences (timezone, notifications)",
     load: async () => {
-      return (await import("./preference-H4WF5NXY.js")).zeroPreferenceCommand;
+      return (await import("./preference-MSMPINCM.js")).zeroPreferenceCommand;
     }
   },
   {
@@ -139,84 +139,84 @@ var ZERO_COMMAND_DEFINITIONS = [
     name: "secret",
     description: "Read or write secrets (API keys, tokens)",
     load: async () => {
-      return (await import("./secret-DYZ2K6QX.js")).zeroSecretCommand;
+      return (await import("./secret-5CFIBLLI.js")).zeroSecretCommand;
     }
   },
   {
     name: "github",
     description: "Upload and download GitHub files",
     load: async () => {
-      return (await import("./github-GDPM257C.js")).zeroGithubCommand;
+      return (await import("./github-SVWWHKGN.js")).zeroGithubCommand;
     }
   },
   {
     name: "slack",
     description: "Send messages, upload files, and download files from Slack as the bot",
     load: async () => {
-      return (await import("./slack-DRX6JAGE.js")).zeroSlackCommand;
+      return (await import("./slack-7J33PAP5.js")).zeroSlackCommand;
     }
   },
   {
     name: "teams",
     description: "Send Microsoft Teams messages, upload files, and download files",
     load: async () => {
-      return (await import("./teams-K2XTVCGT.js")).zeroTeamsCommand;
+      return (await import("./teams-IWY7IFLD.js")).zeroTeamsCommand;
     }
   },
   {
     name: "telegram",
     description: "Inspect bots, send messages, upload files, and download files from Telegram",
     load: async () => {
-      return (await import("./telegram-XNU3XVPW.js")).zeroTelegramCommand;
+      return (await import("./telegram-QWZYLAJW.js")).zeroTelegramCommand;
     }
   },
   {
     name: "phone",
     description: "Send AgentPhone messages, upload files, and download media",
     load: async () => {
-      return (await import("./phone-LJFIA4YV.js")).zeroPhoneCommand;
+      return (await import("./phone-7WJLTTW2.js")).zeroPhoneCommand;
     }
   },
   {
     name: "variable",
     description: "Read or write non-sensitive configuration values",
     load: async () => {
-      return (await import("./variable-J5FV4HHC.js")).zeroVariableCommand;
+      return (await import("./variable-3LUSNJRP.js")).zeroVariableCommand;
     }
   },
   {
     name: "logs",
     description: "View and search agent run logs",
     load: async () => {
-      return (await import("./logs-H5JYXHA6.js")).zeroLogsCommand;
+      return (await import("./logs-YIPQV5UX.js")).zeroLogsCommand;
     }
   },
   {
     name: "search",
     description: "Search logs, chat, or get a recipe for external sources",
     load: async () => {
-      return (await import("./search-BDC7KHXU.js")).zeroSearchCommand;
+      return (await import("./search-XK5LO4BC.js")).zeroSearchCommand;
     }
   },
   {
     name: "chat",
     description: "Manage the current web chat thread",
     load: async () => {
-      return (await import("./chat-TRC4V4LW.js")).zeroChatCommand;
+      return (await import("./chat-6UAO4EJO.js")).zeroChatCommand;
     }
   },
   {
     name: "resource",
     description: "Pull registry resources from private R2-backed archives",
     load: async () => {
-      return (await import("./resource-2DLQU6OU.js")).zeroResourceCommand;
+      return (await import("./resource-W7JNLMJP.js")).zeroResourceCommand;
     }
   },
   {
     name: "whoami",
     description: "Show agent identity, run ID, and capabilities",
     load: async () => {
-      return (await import("./whoami-5SM2Z5BX.js")).zeroWhoamiCommand;
+      return (await import("./whoami-K6I3CEDK.js")).zeroWhoamiCommand;
     }
   },
   {
@@ -230,70 +230,70 @@ var ZERO_COMMAND_DEFINITIONS = [
     name: "workflow",
     description: "Manage workflows",
     load: async () => {
-      return (await import("./workflow-6ZJZKTJ5.js")).zeroWorkflowCommand;
+      return (await import("./workflow-K2OP7MBH.js")).zeroWorkflowCommand;
     }
   },
   {
     name: "goal",
     description: "Manage the current thread goal",
     load: async () => {
-      return (await import("./goal-M2AYUQJ4.js")).zeroGoalCommand;
+      return (await import("./goal-CQDVC4YO.js")).zeroGoalCommand;
     }
   },
   {
     name: "developer-support",
     description: "Submit a diagnostic report to the dev team",
     load: async () => {
-      return (await import("./developer-support-2JW3QPDC.js")).zeroDeveloperSupportCommand;
+      return (await import("./developer-support-CUUQTNHK.js")).zeroDeveloperSupportCommand;
     }
   },
   {
     name: "computer-use",
     description: "Desktop app computer use through Zero CLI",
     load: async () => {
-      return (await import("./computer-use-GESXXHFG.js")).zeroComputerUseCommand;
+      return (await import("./computer-use-TZP5D27S.js")).zeroComputerUseCommand;
     }
   },
   {
     name: "generate",
     description: "Generate assets via vm0's built-in pipelines or get connector skill-invocation guidance",
     load: async () => {
-      return (await import("./generate-F7ZPK6IV.js")).generateCommand;
+      return (await import("./generate-I2VLS2N6.js")).generateCommand;
     }
   },
   {
     name: "web",
     description: "Upload and download files via the web chat endpoint",
     load: async () => {
-      return (await import("./web-MRZE6CNW.js")).zeroWebCommand;
+      return (await import("./web-C76UB3WO.js")).zeroWebCommand;
     }
   },
   {
     name: "video",
     description: "Video processing utilities",
     load: async () => {
-      return (await import("./video-HSB2R7TK.js")).zeroVideoCommand;
+      return (await import("./video-XHTZYJWK.js")).zeroVideoCommand;
     }
   },
   {
     name: "host",
     description: "Publish static sites and clone owned hosted site files",
     load: async () => {
-      return (await import("./host-OJR3FPYM.js")).zeroHostCommand;
+      return (await import("./host-HOMIDNAL.js")).zeroHostCommand;
     }
   },
   {
     name: "maps",
     description: "Use managed zero maps services",
     load: async () => {
-      return (await import("./maps-PLCIA2DA.js")).zeroMapsCommand;
+      return (await import("./maps-SO3MLFWJ.js")).zeroMapsCommand;
     }
   },
   {
     name: "banking",
     description: "Use managed zero banking services",
     load: async () => {
-      return (await import("./banking-RE4Y55OB.js")).zeroBankingCommand;
+      return (await import("./banking-GYL2ITBM.js")).zeroBankingCommand;
     }
   }
 ];
@@ -406,7 +406,7 @@ function registerZeroCommands(prog, commands) {
 var program = new Command();
 program.name("zero").description(
   "Zero CLI \u2014 interact with the zero platform from inside the sandbox"
-).version("9.237.1").addHelpText("after", () => {
+).version("9.237.2").addHelpText("after", () => {
   return buildZeroHelpText();
 });
 if (process.argv[1]?.endsWith("zero.js") || process.argv[1]?.endsWith("zero.ts") || process.argv[1]?.endsWith("zero")) {

package/chunk-FAIVSEFV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../packages/connectors/src/firewall-rule-matcher.ts"],"sourcesContent":["import {\n  type FirewallConfig,\n  hasUnsafeFirewallPath,\n  hasBaseUrlParams,\n  validateAuthBaseUrl,\n  validateBaseUrl,\n} from \"./firewall-types\";\nimport { hasRawWhitespace, hasUnsafeUrlCodepoint } from \"./firewall-url-utils\";\nimport { parseSegment, splitPathSegments } from \"./segment-parser\";\n\ntype SegmentParseResult = ReturnType<typeof parseSegment>;\ntype MatchableSegment = Exclude<SegmentParseResult, { kind: \"error\" }>;\ntype SegmentMatchParser = (\n  segment: string,\n  patternIndex: number,\n  lastPatternIndex: number,\n) => MatchableSegment | null;\n\ntype PathSpecificity = readonly [\n  literalSegments: number,\n  mixedParamSegments: number,\n  plainParamSegments: number,\n  plusGreedySegments: number,\n  negativeStarGreedySegments: number,\n  literalChars: number,\n  segmentCount: number,\n];\n\nexport interface FindMatchingPermissionsOptions {\n  apiBase?: string;\n}\n\nexport interface FirewallBaseUrlMatch {\n  displayBase: string;\n  relativePath: string;\n  score: number;\n}\n\nexport interface FirewallRoutingPermissionRoute {\n  readonly permissionName: string;\n  readonly rule: string;\n}\n\nexport interface FirewallRoutingPermissionApi {\n  readonly base: string;\n  readonly routes: readonly FirewallRoutingPermissionRoute[];\n}\n\nexport type FirewallRequestBlockReason =\n  | \"permission_denied\"\n  | \"unknown_endpoint\"\n  | \"malformed_firewall_config\"\n  | \"malformed_network_policy\"\n  | \"unsafe_path\";\n\nexport type FirewallRequestDecision =\n  | {\n      readonly kind: \"no_match\";\n    }\n  | {\n      readonly kind: \"allow\";\n      readonly firewallName: string;\n      readonly base: string;\n      readonly relativePath: string;\n      readonly permission?: string;\n      readonly rule?: string;\n    }\n  | {\n      readonly kind: \"block\";\n      readonly firewallName: string;\n      readonly base: string;\n      readonly relativePath: string;\n      readonly reason: FirewallRequestBlockReason;\n      readonly permissions: readonly string[];\n    };\n\ninterface ApiMatchState {\n  bestSpecificity: PathSpecificity | null;\n  matched: string[];\n}\n\ninterface PermissionRuleSet {\n  readonly name: string;\n  readonly rules: readonly string[];\n}\n\ninterface PermissionMatchApi {\n  readonly permissionRuleSets: readonly PermissionRuleSet[];\n}\n\ntype UnknownPolicy = \"allow\" | \"deny\" | \"ask\";\n\ninterface CompiledNetworkPolicy {\n  readonly blockedPermissions: ReadonlySet<string>;\n  readonly unknownPolicy: UnknownPolicy;\n  readonly permissionMalformed: boolean;\n  readonly unknownPolicyMalformed: boolean;\n}\n\ninterface CompiledNetworkPolicies {\n  readonly policies: ReadonlyMap<string, CompiledNetworkPolicy>;\n  readonly topLevelMalformed: boolean;\n}\n\ninterface DecisionRule {\n  readonly permission: string;\n  readonly raw: string;\n  readonly method: string;\n  readonly path: string;\n  readonly specificity: PathSpecificity;\n}\n\ninterface DecisionApi {\n  readonly rawBase: string;\n  readonly baseMalformed: boolean;\n  readonly authMalformed: boolean;\n  readonly hasMalformedRules: boolean;\n  readonly rules: readonly DecisionRule[];\n}\n\ninterface DecisionFirewall {\n  readonly name: string;\n  readonly nameMalformed: boolean;\n  readonly apis: readonly DecisionApi[];\n}\n\ninterface DecisionBaseMatch {\n  readonly firewallName: string;\n  readonly base: string;\n  readonly allowBase: string;\n  readonly relativePath: string;\n}\n\ninterface DecisionAllowedRuleMatch {\n  readonly firewallName: string;\n  readonly base: string;\n  readonly relativePath: string;\n  readonly permission: string;\n  readonly rule: string;\n}\n\ninterface DecisionBlockMatch {\n  readonly firewallName: string;\n  readonly base: string;\n  readonly relativePath: string;\n}\n\ninterface FirewallDecisionState {\n  bestBaseScore: number | null;\n  bestRuleSpecificity: PathSpecificity | null;\n  baseMatch: DecisionBaseMatch | null;\n  allowedMatch: DecisionAllowedRuleMatch | null;\n  deniedMatch: DecisionBlockMatch | null;\n  deniedPermissionNames: string[];\n  malformedConfigMatch: DecisionBlockMatch | null;\n  malformedPolicyMatch: DecisionBlockMatch | null;\n}\n\nconst VALID_RULE_METHODS = new Set([\n  \"GET\",\n  \"POST\",\n  \"PUT\",\n  \"PATCH\",\n  \"DELETE\",\n  \"HEAD\",\n  \"OPTIONS\",\n  \"ANY\",\n]);\nconst FORBIDDEN_RUNTIME_HOST_CHARS = new Set(\"#%*,/<>?@\\\\^|{}\".split(\"\"));\nconst FORBIDDEN_BASE_PATTERN_HOST_CHARS = new Set(\"#%,/<>?@\\\\^|\".split(\"\"));\nconst PERCENT_ESCAPE_LENGTH = 3;\nconst HEX_DIGITS = new Set(\"0123456789abcdefABCDEF\".split(\"\"));\nconst PATH_SCORE_MULTIPLIER = 1_000_000;\nconst AUTHORITY_SCORE_MULTIPLIER = 100;\nconst LITERAL_SEGMENT_SCORE = 1_000;\nconst MIXED_PARAM_SEGMENT_SCORE = 100;\nconst PLAIN_PARAM_SEGMENT_SCORE = 10;\nconst PLUS_GREEDY_SEGMENT_SCORE = 1;\nconst ROOT_PATH_SCORE = 1;\nconst STATIC_BASE_SCORE_BONUS = 1;\nconst PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS = new Set([\n  \"{\",\n  \"}\",\n  \"*\",\n  \".\",\n  \"\\u3002\",\n  \"\\uff0e\",\n  \"\\uff61\",\n  \":\",\n]);\n\n/**\n * Match a runtime segment against a mixed pattern's literal prefix/suffix.\n *\n * Byte-exact comparison; callers must case-fold inputs themselves when\n * needed. Returns the captured middle on success, or null if prefix/suffix\n * don't match or the middle would be empty (non-empty guard).\n */\nfunction matchMixedSegment(\n  runtime: string,\n  prefix: string,\n  suffix: string,\n): string | null {\n  if (!runtime.startsWith(prefix)) return null;\n  if (!runtime.endsWith(suffix)) return null;\n  if (runtime.length <= prefix.length + suffix.length) return null;\n  return runtime.slice(prefix.length, runtime.length - suffix.length);\n}\n\nfunction hasNonEmptySegment(segments: string[], start: number): boolean {\n  for (let i = start; i < segments.length; i++) {\n    if (segments[i] !== \"\") return true;\n  }\n  return false;\n}\n\nfunction codePointLength(value: string): number {\n  return [...value].length;\n}\n\nfunction hasUnsafeRuntimeUrlSyntax(value: string): boolean {\n  return (\n    hasUnsafeUrlCodepoint(value) ||\n    hasRawWhitespace(value) ||\n    value.includes(\"\\\\\") ||\n    !value.includes(\"://\")\n  );\n}\n\nfunction stripTrailingSlash(value: string): string {\n  return value.endsWith(\"/\") ? value.slice(0, -1) : value;\n}\n\nfunction isInvalidGreedyParam(\n  patternIndex: number,\n  lastPatternIndex: number,\n  prefix: string,\n  suffix: string,\n): boolean {\n  return patternIndex !== lastPatternIndex || prefix !== \"\" || suffix !== \"\";\n}\n\nfunction parseStrictMatchSegment(\n  segment: string,\n  patternIndex: number,\n  lastPatternIndex: number,\n): MatchableSegment | null {\n  const parsed = parseSegment(segment);\n  if (parsed.kind === \"error\") return null;\n  if (\n    parsed.kind === \"param\" &&\n    parsed.greedy !== \"\" &&\n    isInvalidGreedyParam(\n      patternIndex,\n      lastPatternIndex,\n      parsed.prefix,\n      parsed.suffix,\n    )\n  ) {\n    return null;\n  }\n  return parsed;\n}\n\nfunction pathSpecificity(pattern: string): PathSpecificity | null {\n  if (\n    !pattern.startsWith(\"/\") ||\n    pattern.includes(\"?\") ||\n    pattern.includes(\"#\") ||\n    pattern.includes(\"\\\\\") ||\n    hasRawWhitespace(pattern) ||\n    hasUnsafeUrlCodepoint(pattern)\n  ) {\n    return null;\n  }\n\n  let literalSegments = 0;\n  let mixedParamSegments = 0;\n  let plainParamSegments = 0;\n  let plusGreedySegments = 0;\n  let starGreedySegments = 0;\n  let literalChars = 0;\n  const segments = splitPathSegments(pattern);\n  const paramNames = new Set<string>();\n  const lastSegmentIndex = segments.length - 1;\n\n  for (let index = 0; index < segments.length; index += 1) {\n    const seg = segments[index]!;\n    const parsed = parseSegment(seg);\n    if (parsed.kind === \"error\") return null;\n    if (parsed.kind === \"literal\") {\n      literalSegments += 1;\n      literalChars += codePointLength(parsed.value);\n      continue;\n    }\n    if (paramNames.has(parsed.name)) return null;\n    paramNames.add(parsed.name);\n    if (\n      parsed.greedy !== \"\" &&\n      isInvalidGreedyParam(\n        index,\n        lastSegmentIndex,\n        parsed.prefix,\n        parsed.suffix,\n      )\n    ) {\n      return null;\n    }\n\n    literalChars +=\n      codePointLength(parsed.prefix) + codePointLength(parsed.suffix);\n    if (parsed.prefix !== \"\" || parsed.suffix !== \"\") {\n      mixedParamSegments += 1;\n    } else if (parsed.greedy === \"+\") {\n      plusGreedySegments += 1;\n    } else if (parsed.greedy === \"*\") {\n      starGreedySegments += 1;\n    } else {\n      plainParamSegments += 1;\n    }\n  }\n\n  return [\n    literalSegments,\n    mixedParamSegments,\n    plainParamSegments,\n    plusGreedySegments,\n    -starGreedySegments,\n    literalChars,\n    segments.length,\n  ];\n}\n\nfunction comparePathSpecificity(\n  left: PathSpecificity,\n  right: PathSpecificity,\n): number {\n  for (let i = 0; i < left.length; i++) {\n    const difference = left[i]! - right[i]!;\n    if (difference !== 0) return difference;\n  }\n  return 0;\n}\n\nfunction matchingRulePath(rule: string, upperMethod: string): string | null {\n  const spaceIdx = rule.indexOf(\" \");\n  if (spaceIdx === -1) return null;\n  const ruleMethod = rule.slice(0, spaceIdx);\n  if (!VALID_RULE_METHODS.has(ruleMethod)) return null;\n  if (ruleMethod !== \"ANY\" && ruleMethod !== upperMethod) return null;\n  return rule.slice(spaceIdx + 1);\n}\n\nfunction compileDecisionRule(\n  permission: string,\n  rule: string,\n): DecisionRule | null {\n  const spaceIdx = rule.indexOf(\" \");\n  if (spaceIdx === -1) return null;\n  const method = rule.slice(0, spaceIdx);\n  if (!VALID_RULE_METHODS.has(method)) return null;\n  const path = rule.slice(spaceIdx + 1);\n  const specificity = pathSpecificity(path);\n  if (specificity === null) return null;\n  return { permission, raw: rule, method, path, specificity };\n}\n\nfunction isValidPermissionName(permissionName: string): boolean {\n  return permissionName !== \"\" && permissionName !== \"all\";\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction isStringRecord(value: unknown): value is Record<string, string> {\n  if (!isObjectRecord(value)) return false;\n  return Object.values(value).every((entry) => {\n    return typeof entry === \"string\";\n  });\n}\n\nfunction hasEntries(value: Record<string, string> | undefined): boolean {\n  return value !== undefined && Object.keys(value).length > 0;\n}\n\nfunction isValidAwsSigv4AuthConfig(value: unknown): boolean {\n  if (!isObjectRecord(value)) return false;\n  const allowedKeys = new Set([\n    \"accessKeyId\",\n    \"secretAccessKey\",\n    \"sessionToken\",\n  ]);\n  if (\n    Object.keys(value).some((key) => {\n      return !allowedKeys.has(key);\n    })\n  ) {\n    return false;\n  }\n  if (typeof value.accessKeyId !== \"string\" || value.accessKeyId === \"\") {\n    return false;\n  }\n  if (\n    typeof value.secretAccessKey !== \"string\" ||\n    value.secretAccessKey === \"\"\n  ) {\n    return false;\n  }\n  const optionalValue = value.sessionToken;\n  if (\n    optionalValue !== undefined &&\n    (typeof optionalValue !== \"string\" || optionalValue === \"\")\n  ) {\n    return false;\n  }\n  return true;\n}\n\nfunction isValidAuthConfig(auth: unknown, serviceName: string): boolean {\n  if (!isObjectRecord(auth)) return false;\n  if (auth.headers !== undefined && !isStringRecord(auth.headers)) return false;\n  if (auth.query !== undefined && !isStringRecord(auth.query)) return false;\n  if (\n    auth.awsSigv4 !== undefined &&\n    !isValidAwsSigv4AuthConfig(auth.awsSigv4)\n  ) {\n    return false;\n  }\n  if (auth.awsSigv4 !== undefined) {\n    if (hasEntries(auth.headers as Record<string, string> | undefined)) {\n      return false;\n    }\n    if (hasEntries(auth.query as Record<string, string> | undefined)) {\n      return false;\n    }\n  }\n  if (auth.base !== undefined) {\n    if (typeof auth.base !== \"string\") return false;\n    validateAuthBaseUrl(auth.base, serviceName);\n  }\n  return true;\n}\n\nfunction isValidApiEntry(\n  api: FirewallConfig[\"apis\"][number],\n  serviceName: string,\n): boolean {\n  if (!isObjectRecord(api)) return false;\n  if (typeof api.base !== \"string\") return false;\n  try {\n    validateBaseUrl(api.base, serviceName);\n    if (!isValidAuthConfig(api.auth, serviceName)) return false;\n  } catch {\n    return false;\n  }\n  return true;\n}\n\nfunction getPermissionName(permission: unknown): string | null {\n  if (!isObjectRecord(permission)) return null;\n  if (typeof permission.name !== \"string\") return null;\n  if (!isValidPermissionName(permission.name)) return null;\n  return permission.name;\n}\n\nfunction getPermissionRules(permission: unknown): string[] {\n  if (!isObjectRecord(permission)) return [];\n  if (!Array.isArray(permission.rules)) return [];\n  const rules = permission.rules.filter((rule) => {\n    return typeof rule === \"string\";\n  });\n  return rules;\n}\n\nfunction rawObjectHasOwn(value: Record<string, unknown>, key: string): boolean {\n  return Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isValidAuthConfigForDecision(\n  auth: unknown,\n  serviceName: string,\n): boolean {\n  try {\n    return isValidAuthConfig(auth, serviceName);\n  } catch {\n    return false;\n  }\n}\n\nfunction compileDecisionApi(\n  api: Record<string, unknown>,\n  serviceName: string,\n  nameMalformed: boolean,\n): DecisionApi | null {\n  if (typeof api.base !== \"string\") return null;\n\n  let baseMalformed = false;\n  try {\n    validateBaseUrl(api.base, serviceName);\n  } catch {\n    baseMalformed = true;\n  }\n  const authMalformed = !isValidAuthConfigForDecision(api.auth, serviceName);\n  const rules: DecisionRule[] = [];\n  const seenPermissionNames = new Set<string>();\n  let hasMalformedRules = nameMalformed;\n  const rawPermissions = api.permissions;\n\n  if (Array.isArray(rawPermissions)) {\n    for (const rawPermission of rawPermissions) {\n      if (!isObjectRecord(rawPermission)) {\n        hasMalformedRules = true;\n        continue;\n      }\n      const permissionName = rawPermission.name;\n      if (\n        typeof permissionName !== \"string\" ||\n        !isValidPermissionName(permissionName)\n      ) {\n        hasMalformedRules = true;\n        continue;\n      }\n      if (seenPermissionNames.has(permissionName)) {\n        hasMalformedRules = true;\n        continue;\n      }\n      seenPermissionNames.add(permissionName);\n\n      const rawRules = rawPermission.rules;\n      if (!Array.isArray(rawRules)) {\n        hasMalformedRules = true;\n        continue;\n      }\n      if (rawRules.length === 0) {\n        hasMalformedRules = true;\n      }\n\n      for (const rawRule of rawRules) {\n        if (typeof rawRule !== \"string\") {\n          hasMalformedRules = true;\n          continue;\n        }\n        const compiledRule = compileDecisionRule(permissionName, rawRule);\n        if (compiledRule === null) {\n          hasMalformedRules = true;\n          continue;\n        }\n        rules.push(compiledRule);\n      }\n    }\n  } else if (rawObjectHasOwn(api, \"permissions\")) {\n    hasMalformedRules = true;\n  }\n\n  return {\n    rawBase: api.base,\n    baseMalformed,\n    authMalformed,\n    hasMalformedRules,\n    rules,\n  };\n}\n\nfunction compileDecisionFirewall(\n  rawFirewall: unknown,\n): DecisionFirewall | null {\n  if (!isObjectRecord(rawFirewall)) return null;\n\n  const rawName = rawFirewall.name;\n  const nameMalformed = typeof rawName !== \"string\" || rawName === \"\";\n  const name = typeof rawName === \"string\" ? rawName : \"\";\n  const rawApis = rawFirewall.apis;\n  if (!Array.isArray(rawApis)) return null;\n\n  const apis: DecisionApi[] = [];\n  for (const rawApi of rawApis) {\n    if (!isObjectRecord(rawApi)) continue;\n    const api = compileDecisionApi(rawApi, name, nameMalformed);\n    if (api !== null) {\n      apis.push(api);\n    }\n  }\n\n  if (apis.length === 0) return null;\n  return { name, nameMalformed, apis };\n}\n\nfunction compileDecisionFirewalls(rawFirewalls: unknown): DecisionFirewall[] {\n  if (!Array.isArray(rawFirewalls) || rawFirewalls.length === 0) return [];\n\n  const firewalls: DecisionFirewall[] = [];\n  for (const rawFirewall of rawFirewalls) {\n    const firewall = compileDecisionFirewall(rawFirewall);\n    if (firewall !== null) {\n      firewalls.push(firewall);\n    }\n  }\n  return firewalls;\n}\n\nfunction compilePermissionSet(rawValue: unknown): {\n  readonly values: ReadonlySet<string>;\n  readonly malformed: boolean;\n} {\n  if (rawValue === undefined || rawValue === null) {\n    return { values: new Set<string>(), malformed: false };\n  }\n  if (\n    !Array.isArray(rawValue) ||\n    rawValue.some((item) => {\n      return typeof item !== \"string\";\n    })\n  ) {\n    return { values: new Set<string>(), malformed: true };\n  }\n  return { values: new Set(rawValue), malformed: false };\n}\n\nfunction compileNetworkPolicies(\n  rawNetworkPolicies: unknown,\n): CompiledNetworkPolicies {\n  if (rawNetworkPolicies === undefined || rawNetworkPolicies === null) {\n    return { policies: new Map(), topLevelMalformed: false };\n  }\n  if (!isObjectRecord(rawNetworkPolicies)) {\n    return { policies: new Map(), topLevelMalformed: true };\n  }\n\n  const policies = new Map<string, CompiledNetworkPolicy>();\n  for (const [firewallName, grant] of Object.entries(rawNetworkPolicies)) {\n    if (!isObjectRecord(grant)) {\n      policies.set(firewallName, {\n        blockedPermissions: new Set<string>(),\n        unknownPolicy: \"allow\",\n        permissionMalformed: true,\n        unknownPolicyMalformed: false,\n      });\n      continue;\n    }\n\n    const allow = compilePermissionSet(grant.allow);\n    const deny = compilePermissionSet(grant.deny);\n    const ask = compilePermissionSet(grant.ask);\n    const blockedPermissions = new Set<string>([...deny.values, ...ask.values]);\n\n    let unknownPolicy: UnknownPolicy = \"allow\";\n    let unknownPolicyMalformed = false;\n    const rawUnknownPolicy = grant.unknownPolicy;\n    if (\n      rawUnknownPolicy === \"allow\" ||\n      rawUnknownPolicy === \"deny\" ||\n      rawUnknownPolicy === \"ask\"\n    ) {\n      unknownPolicy = rawUnknownPolicy;\n    } else if (rawUnknownPolicy !== undefined && rawUnknownPolicy !== null) {\n      unknownPolicyMalformed = true;\n    }\n\n    policies.set(firewallName, {\n      blockedPermissions,\n      unknownPolicy,\n      permissionMalformed: allow.malformed || deny.malformed || ask.malformed,\n      unknownPolicyMalformed,\n    });\n  }\n\n  return { policies, topLevelMalformed: false };\n}\n\nfunction getApiPermissionRuleSetsForMatch(\n  api: FirewallConfig[\"apis\"][number],\n  serviceName: string,\n  apiBase: string | null,\n): PermissionRuleSet[] | null {\n  if (!isValidApiEntry(api, serviceName)) return null;\n  if (apiBase !== null && stripTrailingSlash(api.base) !== apiBase) return null;\n  if (api.permissions === undefined) return null;\n  if (!Array.isArray(api.permissions)) return null;\n\n  const permissionRuleSets: PermissionRuleSet[] = [];\n  const seenPermissionNames = new Set<string>();\n  for (const rawPermission of api.permissions) {\n    const permissionName = getPermissionName(rawPermission);\n    if (permissionName === null) continue;\n    if (seenPermissionNames.has(permissionName)) continue;\n    seenPermissionNames.add(permissionName);\n    permissionRuleSets.push({\n      name: permissionName,\n      rules: getPermissionRules(rawPermission),\n    });\n  }\n  return permissionRuleSets;\n}\n\nfunction recordPermissionMatch(\n  state: ApiMatchState,\n  permission: string,\n  specificity: PathSpecificity,\n): void {\n  if (\n    state.bestSpecificity === null ||\n    comparePathSpecificity(specificity, state.bestSpecificity) > 0\n  ) {\n    state.bestSpecificity = specificity;\n    state.matched.length = 0;\n  }\n  if (\n    comparePathSpecificity(specificity, state.bestSpecificity) === 0 &&\n    !state.matched.includes(permission)\n  ) {\n    state.matched.push(permission);\n  }\n}\n\nfunction relativePathFromSegments(\n  segments: string[],\n  consumed: number,\n): string {\n  const rest = segments.slice(consumed).join(\"/\");\n  return rest === \"\" ? \"/\" : `/${rest}`;\n}\n\nfunction stripUrlQueryAndFragment(url: string): string {\n  const queryIndex = url.indexOf(\"?\");\n  const fragmentIndex = url.indexOf(\"#\");\n  let end = url.length;\n  if (queryIndex !== -1) end = Math.min(end, queryIndex);\n  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);\n  return url.slice(0, end);\n}\n\nfunction rawUrlAuthorityBounds(url: string): {\n  readonly authorityStart: number;\n  readonly authorityEnd: number;\n} | null {\n  const schemeEnd = url.indexOf(\"://\");\n  if (schemeEnd === -1) return null;\n\n  const authorityStart = schemeEnd + 3;\n  let authorityEnd = url.length;\n  for (const delimiter of [\"/\", \"?\", \"#\"]) {\n    const delimiterIndex = url.indexOf(delimiter, authorityStart);\n    if (delimiterIndex !== -1)\n      authorityEnd = Math.min(authorityEnd, delimiterIndex);\n  }\n\n  return { authorityStart, authorityEnd };\n}\n\nfunction replaceRawUrlAuthority(\n  url: string,\n  bounds: { readonly authorityStart: number; readonly authorityEnd: number },\n  authority: string,\n): string {\n  return `${url.slice(0, bounds.authorityStart)}${authority}${url.slice(bounds.authorityEnd)}`;\n}\n\nfunction stripRawUrlUserinfo(url: string): string {\n  const bounds = rawUrlAuthorityBounds(url);\n  if (bounds === null) return url;\n\n  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);\n  const userinfoEnd = authority.lastIndexOf(\"@\");\n  if (userinfoEnd === -1) return url;\n\n  return replaceRawUrlAuthority(url, bounds, authority.slice(userinfoEnd + 1));\n}\n\nfunction rawAuthorityPortIsMalformed(port: string): boolean {\n  if (port === \"\") return true;\n  if (\n    ![...port].every((char) => {\n      return char >= \"0\" && char <= \"9\";\n    })\n  ) {\n    return true;\n  }\n  return Number(port) > 65535;\n}\n\nfunction stripRawUrlMalformedPort(url: string): string {\n  const bounds = rawUrlAuthorityBounds(url);\n  if (bounds === null) return url;\n\n  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);\n  if (authority.startsWith(\"[\")) {\n    const closeBracketIndex = authority.indexOf(\"]\");\n    if (closeBracketIndex === -1) return url;\n    const portPrefix = authority.slice(closeBracketIndex + 1);\n    if (!portPrefix.startsWith(\":\")) return url;\n    if (!rawAuthorityPortIsMalformed(portPrefix.slice(1))) return url;\n    return replaceRawUrlAuthority(\n      url,\n      bounds,\n      authority.slice(0, closeBracketIndex + 1),\n    );\n  }\n\n  const portSeparator = authority.lastIndexOf(\":\");\n  if (portSeparator === -1) return url;\n  if (authority.indexOf(\":\") !== portSeparator) return url;\n  if (!rawAuthorityPortIsMalformed(authority.slice(portSeparator + 1))) {\n    return url;\n  }\n  return replaceRawUrlAuthority(url, bounds, authority.slice(0, portSeparator));\n}\n\nfunction rawBaseForDecisionMatch(rawBase: string): string | null {\n  if (stripUrlQueryAndFragment(rawBase).includes(\"\\\\\")) return null;\n  return stripRawUrlMalformedPort(stripRawUrlUserinfo(rawBase));\n}\n\nfunction rawPathFromUrl(url: string): string {\n  const urlWithoutQuery = stripUrlQueryAndFragment(url);\n  const schemeEnd = urlWithoutQuery.indexOf(\"://\");\n  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;\n  const pathStart = urlWithoutQuery.indexOf(\"/\", authorityStart);\n  return pathStart === -1 ? \"/\" : urlWithoutQuery.slice(pathStart);\n}\n\nfunction rawBasePathFromUrl(url: string): string {\n  const urlWithoutQuery = stripUrlQueryAndFragment(url);\n  const schemeEnd = urlWithoutQuery.indexOf(\"://\");\n  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;\n  const pathStart = urlWithoutQuery.indexOf(\"/\", authorityStart);\n  return pathStart === -1 ? \"\" : urlWithoutQuery.slice(pathStart);\n}\n\nfunction rawAuthorityFromUrl(url: string): string | null {\n  const urlWithoutQuery = stripUrlQueryAndFragment(url);\n  const schemeEnd = urlWithoutQuery.indexOf(\"://\");\n  if (schemeEnd === -1) return null;\n  const authorityStart = schemeEnd + 3;\n  const pathStart = urlWithoutQuery.indexOf(\"/\", authorityStart);\n  const authority =\n    pathStart === -1\n      ? urlWithoutQuery.slice(authorityStart)\n      : urlWithoutQuery.slice(authorityStart, pathStart);\n  return authority === \"\" ? null : authority;\n}\n\nfunction hasNonAscii(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    if (value.charCodeAt(index) > 0x7f) return true;\n  }\n  return false;\n}\n\nfunction rawHostFromAuthority(authority: string): string {\n  const withoutUserinfo = authority.slice(authority.lastIndexOf(\"@\") + 1);\n  if (withoutUserinfo.startsWith(\"[\")) {\n    const closeBracket = withoutUserinfo.indexOf(\"]\");\n    return closeBracket === -1\n      ? withoutUserinfo\n      : withoutUserinfo.slice(0, closeBracket + 1);\n  }\n  const portSeparator = withoutUserinfo.lastIndexOf(\":\");\n  return portSeparator === -1\n    ? withoutUserinfo\n    : withoutUserinfo.slice(0, portSeparator);\n}\n\nfunction authorityHasEmptyPort(authority: string): boolean {\n  const withoutUserinfo = authority.slice(authority.lastIndexOf(\"@\") + 1);\n  if (withoutUserinfo.startsWith(\"[\")) {\n    const closeBracket = withoutUserinfo.indexOf(\"]\");\n    if (closeBracket === -1) return false;\n    return withoutUserinfo.slice(closeBracket + 1) === \":\";\n  }\n\n  const portSeparator = withoutUserinfo.lastIndexOf(\":\");\n  if (portSeparator === -1) return false;\n  return (\n    withoutUserinfo.indexOf(\":\") === portSeparator &&\n    portSeparator === withoutUserinfo.length - 1\n  );\n}\n\nfunction rawAuthorityHostStartsWithDigit(authority: string): boolean {\n  const firstChar = rawHostFromAuthority(authority)[0];\n  return firstChar !== undefined && firstChar >= \"0\" && firstChar <= \"9\";\n}\n\nfunction runtimeAuthorityOriginForHostValidation(url: string): string | null {\n  const authority = rawAuthorityFromUrl(url);\n  if (authority === null) return null;\n  if (\n    !authority.includes(\"%\") &&\n    !hasNonAscii(authority) &&\n    !rawAuthorityHostStartsWithDigit(authority)\n  ) {\n    return null;\n  }\n\n  const schemeEnd = url.indexOf(\"://\");\n  if (schemeEnd === -1) return null;\n  return `${url.slice(0, schemeEnd)}://${authority}`;\n}\n\nfunction hasPercentEncodedAuthoritySyntax(value: string): boolean {\n  let index = value.indexOf(\"%\");\n  while (index !== -1) {\n    let runEnd = index;\n    while (runEnd < value.length && value[runEnd] === \"%\") {\n      const firstHexDigit = value[runEnd + 1];\n      const secondHexDigit = value[runEnd + 2];\n      if (\n        !firstHexDigit ||\n        !secondHexDigit ||\n        !HEX_DIGITS.has(firstHexDigit) ||\n        !HEX_DIGITS.has(secondHexDigit)\n      ) {\n        return true;\n      }\n      runEnd += PERCENT_ESCAPE_LENGTH;\n    }\n\n    let decodedRun: string;\n    try {\n      decodedRun = decodeURIComponent(value.slice(index, runEnd));\n    } catch {\n      return true;\n    }\n    for (const char of decodedRun) {\n      if (PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS.has(char)) {\n        return true;\n      }\n    }\n    index = value.indexOf(\"%\", runEnd);\n  }\n  return false;\n}\n\nfunction hasMalformedRuntimeAuthoritySyntax(url: string): boolean {\n  const authority = rawAuthorityFromUrl(url);\n  if (authority === null) return false;\n  return (\n    authority.includes(\"\\\\\") ||\n    authorityHasEmptyPort(authority) ||\n    hasPercentEncodedAuthoritySyntax(authority)\n  );\n}\n\nfunction scoreLiteralSegment(segment: string): number {\n  return LITERAL_SEGMENT_SCORE + codePointLength(segment);\n}\n\nfunction scoreParsedPatternSegment(parsed: MatchableSegment): number {\n  if (parsed.kind === \"literal\") {\n    return scoreLiteralSegment(parsed.value);\n  }\n\n  const literalChars =\n    codePointLength(parsed.prefix) + codePointLength(parsed.suffix);\n  if (parsed.prefix !== \"\" || parsed.suffix !== \"\") {\n    return MIXED_PARAM_SEGMENT_SCORE + literalChars;\n  }\n  if (parsed.greedy === \"+\") return PLUS_GREEDY_SEGMENT_SCORE;\n  if (parsed.greedy === \"*\") return 0;\n  return PLAIN_PARAM_SEGMENT_SCORE;\n}\n\nfunction scoreStaticSegments(segments: string[]): number {\n  return segments.reduce((score, segment) => {\n    return score + scoreLiteralSegment(segment);\n  }, 0);\n}\n\nfunction scorePatternSegmentsWithParser(\n  segments: string[],\n  parsePatternSegment: SegmentMatchParser,\n): number {\n  const lastPatternIndex = segments.length - 1;\n  let score = 0;\n  for (let index = 0; index < segments.length; index += 1) {\n    const segment = segments[index]!;\n    const parsed = parsePatternSegment(segment, index, lastPatternIndex);\n    if (parsed !== null) {\n      score += scoreParsedPatternSegment(parsed);\n    }\n  }\n  return score;\n}\n\nfunction scorePathPattern(\n  path: string,\n  parsePatternSegment: SegmentMatchParser | null,\n): number {\n  if (path === \"\") return 0;\n  if (path === \"/\") return ROOT_PATH_SCORE;\n  const segments = splitPathSegments(path);\n  return parsePatternSegment === null\n    ? scoreStaticSegments(segments)\n    : scorePatternSegmentsWithParser(segments, parsePatternSegment);\n}\n\nfunction splitAuthoritySegments(authority: string): string[] {\n  if (authority.startsWith(\"[\")) return [authority];\n  const normalized = authority.endsWith(\".\")\n    ? authority.slice(0, -1)\n    : authority;\n  return normalized === \"\" ? [] : normalized.split(\".\");\n}\n\nfunction baseUrlSpecificityScore({\n  authority,\n  path,\n  hasParams,\n  tolerateMalformedBaseParams = false,\n}: {\n  readonly authority: string;\n  readonly path: string;\n  readonly hasParams: boolean;\n  readonly tolerateMalformedBaseParams?: boolean;\n}): number {\n  const patternParser = hasParams\n    ? tolerateMalformedBaseParams\n      ? parseMalformedTolerantBaseSegment\n      : parseStrictMatchSegment\n    : null;\n  const authoritySegments = splitAuthoritySegments(authority);\n  const authorityScore =\n    patternParser === null\n      ? scoreStaticSegments(authoritySegments)\n      : scorePatternSegmentsWithParser(\n          [...authoritySegments].reverse(),\n          patternParser,\n        );\n  const pathScore = scorePathPattern(path, patternParser);\n  return (\n    pathScore * PATH_SCORE_MULTIPLIER +\n    authorityScore * AUTHORITY_SCORE_MULTIPLIER +\n    (hasParams ? 0 : STATIC_BASE_SCORE_BONUS)\n  );\n}\n\nfunction matchStaticBasePathPrefix(\n  path: string,\n  pattern: string,\n): string | null {\n  if (pattern === \"\") {\n    return path === \"\" ? \"/\" : path;\n  }\n  if (pattern === \"/\") {\n    if (!path.startsWith(pattern)) return null;\n    const relativePath = path.slice(pattern.length);\n    if (relativePath !== \"\" && !relativePath.startsWith(\"/\")) return null;\n    return relativePath === \"\" ? \"/\" : relativePath;\n  }\n  if (!path.startsWith(pattern)) return null;\n  const relativePath = path.slice(pattern.length);\n  if (relativePath !== \"\" && !relativePath.startsWith(\"/\")) return null;\n  return relativePath === \"\" ? \"/\" : relativePath;\n}\n\nfunction normalizeUrlHostname(\n  hostname: string,\n  options: { allowHostParams?: boolean } = {},\n): string | null {\n  let normalized = hostname.toLowerCase();\n  if (normalized.endsWith(\".\")) {\n    normalized = normalized.slice(0, -1);\n    if (normalized === \"\" || normalized.endsWith(\".\")) {\n      return null;\n    }\n  }\n  if (\n    normalized.split(\".\").some((label) => {\n      return label === \"\";\n    })\n  ) {\n    return null;\n  }\n  const forbiddenChars =\n    options.allowHostParams === true\n      ? FORBIDDEN_BASE_PATTERN_HOST_CHARS\n      : FORBIDDEN_RUNTIME_HOST_CHARS;\n  if (\n    !normalized.startsWith(\"[\") &&\n    [...normalized].some((char) => {\n      return forbiddenChars.has(char);\n    })\n  ) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction normalizedUrlAuthority(\n  parsed: URL,\n  options: { allowHostParams?: boolean } = {},\n): string | null {\n  if (parsed.username !== \"\" || parsed.password !== \"\") {\n    return null;\n  }\n\n  const hostname = normalizeUrlHostname(parsed.hostname, options);\n  if (hostname === null || hostname === \"\") {\n    return null;\n  }\n\n  return parsed.port === \"\" ? hostname : `${hostname}:${parsed.port}`;\n}\n\nfunction matchStaticFirewallBaseUrl(\n  url: string,\n  rawBase: string,\n  options: {\n    readonly tolerateMalformedBaseParams?: boolean;\n  } = {},\n): FirewallBaseUrlMatch | null {\n  const parsedUrl = new URL(url);\n  const parsedBase = new URL(rawBase);\n  if (parsedUrl.protocol.toLowerCase() !== parsedBase.protocol.toLowerCase()) {\n    return null;\n  }\n  const baseHasParams = hasBaseUrlParams(rawBase);\n  const baseForMatch = stripTrailingSlash(rawBase);\n\n  const urlAuthority = normalizedUrlAuthority(parsedUrl);\n  const baseAuthority = normalizedUrlAuthority(parsedBase, {\n    allowHostParams: baseHasParams,\n  });\n  if (urlAuthority === null || baseAuthority === null) return null;\n  if (baseHasParams) {\n    const hostParams =\n      options.tolerateMalformedBaseParams === true\n        ? matchFirewallHostForMalformedBaseDecision(urlAuthority, baseAuthority)\n        : matchFirewallHost(urlAuthority, baseAuthority);\n    if (hostParams === null) return null;\n  } else if (urlAuthority !== baseAuthority) {\n    return null;\n  }\n\n  const basePath = rawBasePathFromUrl(baseForMatch);\n  const relativePath = baseHasParams\n    ? options.tolerateMalformedBaseParams === true\n      ? matchFirewallPathPrefixForMalformedBaseDecision(\n          rawPathFromUrl(url),\n          basePath,\n        )\n      : matchFirewallPathPrefix(rawPathFromUrl(url), basePath)\n    : matchStaticBasePathPrefix(rawPathFromUrl(url), basePath);\n  if (relativePath === null) return null;\n\n  const displayBase = stripTrailingSlash(rawBase);\n  return {\n    displayBase,\n    relativePath,\n    score: baseUrlSpecificityScore({\n      authority: baseAuthority,\n      path: basePath,\n      hasParams: baseHasParams,\n      tolerateMalformedBaseParams: options.tolerateMalformedBaseParams === true,\n    }),\n  };\n}\n\nfunction runtimeUrlCanMatchFirewallBase(url: string): boolean {\n  if (\n    hasUnsafeUrlCodepoint(url) ||\n    hasRawWhitespace(url) ||\n    !url.includes(\"://\") ||\n    hasMalformedRuntimeAuthoritySyntax(url)\n  ) {\n    return false;\n  }\n\n  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);\n  if (runtimeAuthorityOrigin === null) return true;\n\n  try {\n    validateBaseUrl(runtimeAuthorityOrigin, \"runtime\");\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction matchFirewallBaseUrlForDecision(\n  url: string,\n  rawBase: string,\n): FirewallBaseUrlMatch | null {\n  if (!runtimeUrlCanMatchFirewallBase(url)) return null;\n  const baseForMatch = rawBaseForDecisionMatch(rawBase);\n  if (baseForMatch === null) return null;\n\n  try {\n    const match = matchStaticFirewallBaseUrl(url, baseForMatch, {\n      tolerateMalformedBaseParams: true,\n    });\n    if (match === null) return null;\n    return { ...match, displayBase: stripTrailingSlash(rawBase) };\n  } catch {\n    return null;\n  }\n}\n\nfunction createDecisionState(): FirewallDecisionState {\n  return {\n    bestBaseScore: null,\n    bestRuleSpecificity: null,\n    baseMatch: null,\n    allowedMatch: null,\n    deniedMatch: null,\n    deniedPermissionNames: [],\n    malformedConfigMatch: null,\n    malformedPolicyMatch: null,\n  };\n}\n\nfunction acceptDecisionBaseMatch(\n  state: FirewallDecisionState,\n  match: DecisionBaseMatch,\n  score: number,\n): boolean {\n  if (state.bestBaseScore === null || score > state.bestBaseScore) {\n    state.bestBaseScore = score;\n    state.bestRuleSpecificity = null;\n    state.baseMatch = null;\n    state.allowedMatch = null;\n    state.deniedMatch = null;\n    state.deniedPermissionNames = [];\n    state.malformedConfigMatch = null;\n    state.malformedPolicyMatch = null;\n  } else if (score < state.bestBaseScore) {\n    return false;\n  }\n\n  state.baseMatch ??= match;\n  return true;\n}\n\nfunction canRuleSpecificityAffectDecision(\n  state: FirewallDecisionState,\n  specificity: PathSpecificity,\n): boolean {\n  if (state.bestRuleSpecificity === null) return true;\n  const comparison = comparePathSpecificity(\n    specificity,\n    state.bestRuleSpecificity,\n  );\n  if (comparison > 0) return true;\n  if (comparison < 0) return false;\n  return state.allowedMatch === null;\n}\n\nfunction acceptRuleSpecificity(\n  state: FirewallDecisionState,\n  specificity: PathSpecificity,\n): boolean {\n  if (state.bestRuleSpecificity === null) {\n    state.bestRuleSpecificity = specificity;\n    return true;\n  }\n\n  const comparison = comparePathSpecificity(\n    specificity,\n    state.bestRuleSpecificity,\n  );\n  if (comparison > 0) {\n    state.bestRuleSpecificity = specificity;\n    state.allowedMatch = null;\n    state.deniedMatch = null;\n    state.deniedPermissionNames = [];\n    return true;\n  }\n  return comparison === 0;\n}\n\nfunction recordDeniedRule(\n  state: FirewallDecisionState,\n  match: DecisionBlockMatch,\n  permission: string,\n): void {\n  if (!state.deniedPermissionNames.includes(permission)) {\n    state.deniedPermissionNames.push(permission);\n  }\n  state.deniedMatch ??= match;\n}\n\nfunction resolveFirewallDecision(\n  state: FirewallDecisionState,\n  networkPolicies: CompiledNetworkPolicies,\n): FirewallRequestDecision {\n  const baseMatch = state.baseMatch;\n  if (baseMatch === null) {\n    return { kind: \"no_match\" };\n  }\n\n  if (state.allowedMatch !== null) {\n    return {\n      kind: \"allow\",\n      firewallName: state.allowedMatch.firewallName,\n      base: state.allowedMatch.base,\n      relativePath: state.allowedMatch.relativePath,\n      permission: state.allowedMatch.permission,\n      rule: state.allowedMatch.rule,\n    };\n  }\n\n  if (state.deniedMatch !== null) {\n    return {\n      kind: \"block\",\n      firewallName: state.deniedMatch.firewallName,\n      base: state.deniedMatch.base,\n      relativePath: state.deniedMatch.relativePath,\n      reason: \"permission_denied\",\n      permissions: state.deniedPermissionNames,\n    };\n  }\n\n  if (state.malformedPolicyMatch !== null) {\n    return {\n      kind: \"block\",\n      firewallName: state.malformedPolicyMatch.firewallName,\n      base: state.malformedPolicyMatch.base,\n      relativePath: state.malformedPolicyMatch.relativePath,\n      reason: \"malformed_network_policy\",\n      permissions: [],\n    };\n  }\n\n  if (state.malformedConfigMatch !== null) {\n    return {\n      kind: \"block\",\n      firewallName: state.malformedConfigMatch.firewallName,\n      base: state.malformedConfigMatch.base,\n      relativePath: state.malformedConfigMatch.relativePath,\n      reason: \"malformed_firewall_config\",\n      permissions: [],\n    };\n  }\n\n  const policy = networkPolicies.policies.get(baseMatch.firewallName);\n  if (policy === undefined) {\n    return {\n      kind: \"allow\",\n      firewallName: baseMatch.firewallName,\n      base: baseMatch.allowBase,\n      relativePath: baseMatch.relativePath,\n    };\n  }\n  if (policy.unknownPolicyMalformed) {\n    return {\n      kind: \"block\",\n      firewallName: baseMatch.firewallName,\n      base: baseMatch.base,\n      relativePath: baseMatch.relativePath,\n      reason: \"malformed_network_policy\",\n      permissions: [],\n    };\n  }\n  if (policy.unknownPolicy === \"allow\") {\n    return {\n      kind: \"allow\",\n      firewallName: baseMatch.firewallName,\n      base: baseMatch.allowBase,\n      relativePath: baseMatch.relativePath,\n    };\n  }\n\n  return {\n    kind: \"block\",\n    firewallName: baseMatch.firewallName,\n    base: baseMatch.base,\n    relativePath: baseMatch.relativePath,\n    reason: \"unknown_endpoint\",\n    permissions: [],\n  };\n}\n\nfunction unsafePathBlockDecision(\n  firewall: DecisionFirewall,\n  baseMatch: FirewallBaseUrlMatch,\n): FirewallRequestDecision {\n  return {\n    kind: \"block\",\n    firewallName: firewall.name,\n    base: baseMatch.displayBase,\n    relativePath: baseMatch.relativePath,\n    reason: \"unsafe_path\",\n    permissions: [],\n  };\n}\n\nfunction recordMalformedDecisionState(\n  state: FirewallDecisionState,\n  api: DecisionApi,\n  blockMatch: DecisionBlockMatch,\n): void {\n  if (api.baseMalformed || api.authMalformed || api.hasMalformedRules) {\n    state.malformedConfigMatch ??= blockMatch;\n  }\n}\n\nfunction apiCannotEvaluateRules(\n  firewall: DecisionFirewall,\n  api: DecisionApi,\n): boolean {\n  return firewall.nameMalformed || api.baseMalformed || api.authMalformed;\n}\n\nfunction policyCannotEvaluateRules(\n  networkPolicies: CompiledNetworkPolicies,\n  policy: CompiledNetworkPolicy | undefined,\n): boolean {\n  return (\n    networkPolicies.topLevelMalformed ||\n    (policy !== undefined && policy.permissionMalformed)\n  );\n}\n\nfunction evaluateDecisionRule({\n  state,\n  rule,\n  policy,\n  blockMatch,\n  baseMatch,\n  upperMethod,\n}: {\n  readonly state: FirewallDecisionState;\n  readonly rule: DecisionRule;\n  readonly policy: CompiledNetworkPolicy | undefined;\n  readonly blockMatch: DecisionBlockMatch;\n  readonly baseMatch: DecisionBaseMatch;\n  readonly upperMethod: string;\n}): void {\n  if (rule.method !== \"ANY\" && rule.method !== upperMethod) return;\n  if (!canRuleSpecificityAffectDecision(state, rule.specificity)) return;\n\n  const permissionBlocked =\n    policy !== undefined && policy.blockedPermissions.has(rule.permission);\n  if (matchFirewallPath(baseMatch.relativePath, rule.path) === null) return;\n  if (!acceptRuleSpecificity(state, rule.specificity)) return;\n\n  if (permissionBlocked) {\n    recordDeniedRule(state, blockMatch, rule.permission);\n    return;\n  }\n\n  state.allowedMatch ??= {\n    firewallName: baseMatch.firewallName,\n    base: baseMatch.allowBase,\n    relativePath: baseMatch.relativePath,\n    permission: rule.permission,\n    rule: rule.raw,\n  };\n}\n\nfunction evaluateDecisionRules({\n  state,\n  api,\n  policy,\n  blockMatch,\n  baseMatch,\n  upperMethod,\n}: {\n  readonly state: FirewallDecisionState;\n  readonly api: DecisionApi;\n  readonly policy: CompiledNetworkPolicy | undefined;\n  readonly blockMatch: DecisionBlockMatch;\n  readonly baseMatch: DecisionBaseMatch;\n  readonly upperMethod: string;\n}): void {\n  for (const rule of api.rules) {\n    evaluateDecisionRule({\n      state,\n      rule,\n      policy,\n      blockMatch,\n      baseMatch,\n      upperMethod,\n    });\n  }\n}\n\nfunction evaluateDecisionApi({\n  state,\n  firewall,\n  api,\n  url,\n  unsafePath,\n  networkPolicies,\n  upperMethod,\n}: {\n  readonly state: FirewallDecisionState;\n  readonly firewall: DecisionFirewall;\n  readonly api: DecisionApi;\n  readonly url: string;\n  readonly unsafePath: boolean;\n  readonly networkPolicies: CompiledNetworkPolicies;\n  readonly upperMethod: string;\n}): FirewallRequestDecision | null {\n  const policy = networkPolicies.policies.get(firewall.name);\n  const baseMatch = matchFirewallBaseUrlForDecision(url, api.rawBase);\n  if (baseMatch === null) return null;\n  if (unsafePath) return unsafePathBlockDecision(firewall, baseMatch);\n\n  const decisionBaseMatch: DecisionBaseMatch = {\n    firewallName: firewall.name,\n    base: baseMatch.displayBase,\n    allowBase: api.rawBase,\n    relativePath: baseMatch.relativePath,\n  };\n  const blockMatch: DecisionBlockMatch = {\n    firewallName: decisionBaseMatch.firewallName,\n    base: decisionBaseMatch.base,\n    relativePath: decisionBaseMatch.relativePath,\n  };\n  if (!acceptDecisionBaseMatch(state, decisionBaseMatch, baseMatch.score)) {\n    return null;\n  }\n\n  recordMalformedDecisionState(state, api, blockMatch);\n  if (apiCannotEvaluateRules(firewall, api)) return null;\n  if (policyCannotEvaluateRules(networkPolicies, policy)) {\n    state.malformedPolicyMatch ??= blockMatch;\n    return null;\n  }\n\n  evaluateDecisionRules({\n    state,\n    api,\n    policy,\n    blockMatch,\n    baseMatch: decisionBaseMatch,\n    upperMethod,\n  });\n  return null;\n}\n\nexport function matchFirewallBaseUrl(\n  url: string,\n  rawBase: string,\n): FirewallBaseUrlMatch | null {\n  if (\n    hasUnsafeRuntimeUrlSyntax(url) ||\n    hasMalformedRuntimeAuthoritySyntax(url)\n  ) {\n    return null;\n  }\n\n  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);\n\n  try {\n    if (runtimeAuthorityOrigin !== null) {\n      validateBaseUrl(runtimeAuthorityOrigin, \"runtime\");\n    }\n    validateBaseUrl(rawBase, \"firewall\");\n    return matchStaticFirewallBaseUrl(url, rawBase);\n  } catch {\n    return null;\n  }\n}\n\nexport function matchFirewallRequestDecision(\n  firewalls: unknown,\n  method: string,\n  url: string,\n  networkPolicies: unknown = undefined,\n): FirewallRequestDecision {\n  const decisionFirewalls = compileDecisionFirewalls(firewalls);\n  if (decisionFirewalls.length === 0) return { kind: \"no_match\" };\n\n  const compiledNetworkPolicies = compileNetworkPolicies(networkPolicies);\n  const upperMethod = method.toUpperCase();\n  const state = createDecisionState();\n  const unsafePath =\n    url.includes(\"\\\\\") || hasUnsafeFirewallPath(rawPathFromUrl(url));\n\n  for (const firewall of decisionFirewalls) {\n    for (const api of firewall.apis) {\n      const immediateDecision = evaluateDecisionApi({\n        state,\n        firewall,\n        api,\n        url,\n        unsafePath,\n        networkPolicies: compiledNetworkPolicies,\n        upperMethod,\n      });\n      if (immediateDecision !== null) {\n        return immediateDecision;\n      }\n    }\n  }\n\n  return resolveFirewallDecision(state, compiledNetworkPolicies);\n}\n\nfunction matchFirewallHostWithParser(\n  host: string,\n  pattern: string,\n  parsePatternSegment: SegmentMatchParser,\n): Record<string, string> | null {\n  const hostSegsOrig = host.split(\".\");\n  const hostSegsLower = hostSegsOrig.map((segment) => {\n    return segment.toLowerCase();\n  });\n  const patternSegs = pattern.split(\".\").reverse();\n\n  hostSegsOrig.reverse();\n  hostSegsLower.reverse();\n\n  const params: Record<string, string> = {};\n  let hi = 0;\n  const lastPatternIndex = patternSegs.length - 1;\n\n  for (\n    let patternIndex = 0;\n    patternIndex < patternSegs.length;\n    patternIndex++\n  ) {\n    const seg = patternSegs[patternIndex]!;\n    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);\n    if (parsed === null) return null;\n    if (parsed.kind === \"literal\") {\n      if (\n        hi >= hostSegsLower.length ||\n        hostSegsLower[hi] !== parsed.value.toLowerCase()\n      ) {\n        return null;\n      }\n      hi += 1;\n      continue;\n    }\n\n    const { name, prefix, suffix, greedy } = parsed;\n    if (greedy === \"+\") {\n      if (hi >= hostSegsOrig.length) return null;\n      params[name] = hostSegsOrig.slice(hi).reverse().join(\".\");\n      return params;\n    }\n    if (greedy === \"*\") {\n      params[name] = hostSegsOrig.slice(hi).reverse().join(\".\");\n      return params;\n    }\n    if (hi >= hostSegsOrig.length) return null;\n    if (prefix === \"\" && suffix === \"\") {\n      params[name] = hostSegsLower[hi]!;\n    } else {\n      const captured = matchMixedSegment(\n        hostSegsLower[hi]!,\n        prefix.toLowerCase(),\n        suffix.toLowerCase(),\n      );\n      if (captured === null) return null;\n      params[name] = captured;\n    }\n    hi += 1;\n  }\n\n  return hi === hostSegsOrig.length ? params : null;\n}\n\n/**\n * Match a runtime host/authority against a firewall base host pattern.\n *\n * Host comparison is case-insensitive and mirrors the runner's right-to-left\n * host matcher. Non-default ports are part of the normalized authority and\n * therefore participate in the final host segment comparison.\n */\nexport function matchFirewallHost(\n  host: string,\n  pattern: string,\n): Record<string, string> | null {\n  return matchFirewallHostWithParser(host, pattern, parseStrictMatchSegment);\n}\n\nfunction parseMalformedTolerantBaseSegment(\n  segment: string,\n  patternIndex: number,\n  lastPatternIndex: number,\n): MatchableSegment {\n  const parsed = parseSegment(segment);\n  if (parsed.kind === \"error\") {\n    return {\n      kind: \"param\",\n      prefix: \"\",\n      name: `__malformed_base_segment_${patternIndex}`,\n      suffix: \"\",\n      greedy: \"\",\n    };\n  }\n  if (\n    parsed.kind === \"param\" &&\n    parsed.greedy !== \"\" &&\n    isInvalidGreedyParam(\n      patternIndex,\n      lastPatternIndex,\n      parsed.prefix,\n      parsed.suffix,\n    )\n  ) {\n    return { ...parsed, greedy: \"\" };\n  }\n  return parsed;\n}\n\nfunction matchFirewallHostForMalformedBaseDecision(\n  host: string,\n  pattern: string,\n): Record<string, string> | null {\n  return matchFirewallHostWithParser(\n    host,\n    pattern,\n    parseMalformedTolerantBaseSegment,\n  );\n}\n\nfunction matchFirewallPathPrefixWithParser(\n  path: string,\n  pattern: string,\n  parsePatternSegment: SegmentMatchParser,\n): string | null {\n  const pathSegs = splitPathSegments(path);\n  const patternSegs = splitPathSegments(pattern);\n\n  let pi = 0;\n  const lastPatternIndex = patternSegs.length - 1;\n  for (\n    let patternIndex = 0;\n    patternIndex < patternSegs.length;\n    patternIndex++\n  ) {\n    const seg = patternSegs[patternIndex]!;\n    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);\n    if (parsed === null) return null;\n    if (parsed.kind === \"literal\") {\n      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;\n      pi += 1;\n      continue;\n    }\n\n    const { prefix, suffix, greedy } = parsed;\n    if (greedy === \"+\") {\n      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {\n        return null;\n      }\n      return \"/\";\n    }\n    if (greedy === \"*\") {\n      return \"/\";\n    }\n    if (pi >= pathSegs.length) return null;\n\n    const runtime = pathSegs[pi]!;\n    if (prefix === \"\" && suffix === \"\") {\n      if (runtime === \"\") return null;\n    } else if (matchMixedSegment(runtime, prefix, suffix) === null) {\n      return null;\n    }\n    pi += 1;\n  }\n\n  return relativePathFromSegments(pathSegs, pi);\n}\n\n/**\n * Match a runtime path against the beginning of a firewall base path pattern.\n *\n * Unlike matchFirewallPath(), this intentionally allows extra runtime path\n * segments and returns the remaining relative path after the base prefix.\n */\nexport function matchFirewallPathPrefix(\n  path: string,\n  pattern: string,\n): string | null {\n  return matchFirewallPathPrefixWithParser(\n    path,\n    pattern,\n    parseStrictMatchSegment,\n  );\n}\n\nfunction matchFirewallPathPrefixForMalformedBaseDecision(\n  path: string,\n  pattern: string,\n): string | null {\n  return matchFirewallPathPrefixWithParser(\n    path,\n    pattern,\n    parseMalformedTolerantBaseSegment,\n  );\n}\n\n/**\n * Match a URL path against a rule path pattern.\n *\n * Ported from the Python MITM addon's `match_path()` function\n * (crates/runner/mitm-addon/src/matching.py).\n *\n * - Literal segments must match exactly (case-sensitive).\n * - `{name}` matches a single non-empty path segment.\n * - `prefix{name}suffix` (mixed) matches a segment that starts with\n *   `prefix` and ends with `suffix`, with a non-empty middle captured\n *   into `name`.\n * - `{name+}` matches the rest of the path (one or more segments). Must be last.\n * - `{name*}` matches the rest of the path (zero or more segments). Must be last.\n *\n * Returns extracted parameters on match, or null on mismatch.\n */\nexport function matchFirewallPath(\n  path: string,\n  pattern: string,\n): Record<string, string> | null {\n  const pathSegs = splitPathSegments(path);\n  const patternSegs = splitPathSegments(pattern);\n\n  const params: Record<string, string> = {};\n  let pi = 0;\n  const lastPatternIndex = patternSegs.length - 1;\n\n  for (\n    let patternIndex = 0;\n    patternIndex < patternSegs.length;\n    patternIndex++\n  ) {\n    const seg = patternSegs[patternIndex]!;\n    const parsed = parseSegment(seg);\n    // Invalid patterns are rejected by validateRule at ingest time, so\n    // kind \"error\" should never appear here on validated inputs.\n    if (parsed.kind === \"error\") return null;\n    if (parsed.kind === \"literal\") {\n      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;\n      pi++;\n      continue;\n    }\n    const { name, prefix, suffix, greedy } = parsed;\n    if (greedy === \"+\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {\n        return null;\n      }\n      params[name] = pathSegs.slice(pi).join(\"/\");\n      return params;\n    }\n    if (greedy === \"*\") {\n      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))\n        return null;\n      params[name] = pathSegs.slice(pi).join(\"/\");\n      return params;\n    }\n    if (pi >= pathSegs.length) return null;\n    const runtime = pathSegs[pi]!;\n    if (prefix === \"\" && suffix === \"\") {\n      if (runtime === \"\") return null;\n      params[name] = runtime;\n    } else {\n      const captured = matchMixedSegment(runtime, prefix, suffix);\n      if (captured === null) return null;\n      params[name] = captured;\n    }\n    pi++;\n  }\n\n  // All pattern segments consumed; path must also be fully consumed\n  if (pi !== pathSegs.length) return null;\n  return params;\n}\n\n/**\n * Find permission names from a firewall config whose most-specific rules match\n * the given HTTP method and relative path.\n *\n * Method matching is case-insensitive. The special method `ANY` matches\n * any HTTP method. Path specificity mirrors the runner firewall matcher within\n * each API entry.\n */\nexport function findMatchingPermissions(\n  method: string,\n  path: string,\n  config: unknown,\n  options: FindMatchingPermissionsOptions = {},\n): string[] {\n  if (!isObjectRecord(config)) return [];\n  if (typeof config.name !== \"string\" || config.name === \"\") return [];\n  if (!Array.isArray(config.apis)) return [];\n\n  const apiBase =\n    options.apiBase === undefined ? null : stripTrailingSlash(options.apiBase);\n  const matchApis: PermissionMatchApi[] = [];\n\n  for (const api of config.apis) {\n    const permissionRuleSets = getApiPermissionRuleSetsForMatch(\n      api,\n      config.name,\n      apiBase,\n    );\n    if (permissionRuleSets !== null) {\n      matchApis.push({ permissionRuleSets });\n    }\n  }\n\n  return findMatchingPermissionRuleSets(method, path, matchApis);\n}\n\nfunction findMatchingPermissionRuleSets(\n  method: string,\n  path: string,\n  apis: readonly PermissionMatchApi[],\n): string[] {\n  const upperMethod = method.toUpperCase();\n  const matched: string[] = [];\n\n  for (const api of apis) {\n    const state: ApiMatchState = { bestSpecificity: null, matched: [] };\n\n    for (const permission of api.permissionRuleSets) {\n      for (const rule of permission.rules) {\n        const rest = matchingRulePath(rule, upperMethod);\n        if (rest === null) continue;\n\n        if (matchFirewallPath(path, rest) !== null) {\n          const specificity = pathSpecificity(rest);\n          if (specificity === null) continue;\n          recordPermissionMatch(state, permission.name, specificity);\n        }\n      }\n    }\n\n    for (const permission of state.matched) {\n      if (!matched.includes(permission)) {\n        matched.push(permission);\n      }\n    }\n  }\n\n  return matched;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AA8JA,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,+BAA+B,IAAI,IAAI,kBAAkB,MAAM,EAAE,CAAC;AACxE,IAAM,oCAAoC,IAAI,IAAI,eAAe,MAAM,EAAE,CAAC;AAC1E,IAAM,wBAAwB;AAC9B,IAAM,aAAa,IAAI,IAAI,yBAAyB,MAAM,EAAE,CAAC;AAC7D,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAClC,IAAM,kBAAkB;AACxB,IAAM,0BAA0B;AAChC,IAAM,yCAAyC,oBAAI,IAAI;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,kBACP,SACA,QACA,QACe;AACf,MAAI,CAAC,QAAQ,WAAW,MAAM,EAAG,QAAO;AACxC,MAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO;AACtC,MAAI,QAAQ,UAAU,OAAO,SAAS,OAAO,OAAQ,QAAO;AAC5D,SAAO,QAAQ,MAAM,OAAO,QAAQ,QAAQ,SAAS,OAAO,MAAM;AACpE;AAEA,SAAS,mBAAmB,UAAoB,OAAwB;AACtE,WAAS,IAAI,OAAO,IAAI,SAAS,QAAQ,KAAK;AAC5C,QAAI,SAAS,CAAC,MAAM,GAAI,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,CAAC,GAAG,KAAK,EAAE;AACpB;AAEA,SAAS,0BAA0B,OAAwB;AACzD,SACE,sBAAsB,KAAK,KAC3B,iBAAiB,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,CAAC,MAAM,SAAS,KAAK;AAEzB;AAEA,SAAS,mBAAmB,OAAuB;AACjD,SAAO,MAAM,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AACpD;AAEA,SAAS,qBACP,cACA,kBACA,QACA,QACS;AACT,SAAO,iBAAiB,oBAAoB,WAAW,MAAM,WAAW;AAC1E;AAEA,SAAS,wBACP,SACA,cACA,kBACyB;AACzB,QAAM,SAAS,aAAa,OAAO;AACnC,MAAI,OAAO,SAAS,QAAS,QAAO;AACpC,MACE,OAAO,SAAS,WAChB,OAAO,WAAW,MAClB;AAAA,IACE;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP,OAAO;AAAA,EACT,GACA;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAyC;AAChE,MACE,CAAC,QAAQ,WAAW,GAAG,KACvB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,iBAAiB,OAAO,KACxB,sBAAsB,OAAO,GAC7B;AACA,WAAO;AAAA,EACT;AAEA,MAAI,kBAAkB;AACtB,MAAI,qBAAqB;AACzB,MAAI,qBAAqB;AACzB,MAAI,qBAAqB;AACzB,MAAI,qBAAqB;AACzB,MAAI,eAAe;AACnB,QAAM,WAAW,kBAAkB,OAAO;AAC1C,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,mBAAmB,SAAS,SAAS;AAE3C,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS,GAAG;AACvD,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,SAAS,aAAa,GAAG;AAC/B,QAAI,OAAO,SAAS,QAAS,QAAO;AACpC,QAAI,OAAO,SAAS,WAAW;AAC7B,yBAAmB;AACnB,sBAAgB,gBAAgB,OAAO,KAAK;AAC5C;AAAA,IACF;AACA,QAAI,WAAW,IAAI,OAAO,IAAI,EAAG,QAAO;AACxC,eAAW,IAAI,OAAO,IAAI;AAC1B,QACE,OAAO,WAAW,MAClB;AAAA,MACE;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,IACT,GACA;AACA,aAAO;AAAA,IACT;AAEA,oBACE,gBAAgB,OAAO,MAAM,IAAI,gBAAgB,OAAO,MAAM;AAChE,QAAI,OAAO,WAAW,MAAM,OAAO,WAAW,IAAI;AAChD,4BAAsB;AAAA,IACxB,WAAW,OAAO,WAAW,KAAK;AAChC,4BAAsB;AAAA,IACxB,WAAW,OAAO,WAAW,KAAK;AAChC,4BAAsB;AAAA,IACxB,OAAO;AACL,4BAAsB;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,uBACP,MACA,OACQ;AACR,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,aAAa,KAAK,CAAC,IAAK,MAAM,CAAC;AACrC,QAAI,eAAe,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAWA,SAAS,oBACP,YACA,MACqB;AACrB,QAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,MAAI,aAAa,GAAI,QAAO;AAC5B,QAAM,SAAS,KAAK,MAAM,GAAG,QAAQ;AACrC,MAAI,CAAC,mBAAmB,IAAI,MAAM,EAAG,QAAO;AAC5C,QAAM,OAAO,KAAK,MAAM,WAAW,CAAC;AACpC,QAAM,cAAc,gBAAgB,IAAI;AACxC,MAAI,gBAAgB,KAAM,QAAO;AACjC,SAAO,EAAE,YAAY,KAAK,MAAM,QAAQ,MAAM,YAAY;AAC5D;AAEA,SAAS,sBAAsB,gBAAiC;AAC9D,SAAO,mBAAmB,MAAM,mBAAmB;AACrD;AAEA,SAAS,eAAe,OAAkD;AACxE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,eAAe,OAAiD;AACvE,MAAI,CAAC,eAAe,KAAK,EAAG,QAAO;AACnC,SAAO,OAAO,OAAO,KAAK,EAAE,MAAM,CAAC,UAAU;AAC3C,WAAO,OAAO,UAAU;AAAA,EAC1B,CAAC;AACH;AAEA,SAAS,WAAW,OAAoD;AACtE,SAAO,UAAU,UAAa,OAAO,KAAK,KAAK,EAAE,SAAS;AAC5D;AAEA,SAAS,0BAA0B,OAAyB;AAC1D,MAAI,CAAC,eAAe,KAAK,EAAG,QAAO;AACnC,QAAM,cAAc,oBAAI,IAAI;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MACE,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ;AAC/B,WAAO,CAAC,YAAY,IAAI,GAAG;AAAA,EAC7B,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,MAAM,gBAAgB,YAAY,MAAM,gBAAgB,IAAI;AACrE,WAAO;AAAA,EACT;AACA,MACE,OAAO,MAAM,oBAAoB,YACjC,MAAM,oBAAoB,IAC1B;AACA,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM;AAC5B,MACE,kBAAkB,WACjB,OAAO,kBAAkB,YAAY,kBAAkB,KACxD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAe,aAA8B;AACtE,MAAI,CAAC,eAAe,IAAI,EAAG,QAAO;AAClC,MAAI,KAAK,YAAY,UAAa,CAAC,eAAe,KAAK,OAAO,EAAG,QAAO;AACxE,MAAI,KAAK,UAAU,UAAa,CAAC,eAAe,KAAK,KAAK,EAAG,QAAO;AACpE,MACE,KAAK,aAAa,UAClB,CAAC,0BAA0B,KAAK,QAAQ,GACxC;AACA,WAAO;AAAA,EACT;AACA,MAAI,KAAK,aAAa,QAAW;AAC/B,QAAI,WAAW,KAAK,OAA6C,GAAG;AAClE,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK,KAA2C,GAAG;AAChE,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,KAAK,SAAS,QAAW;AAC3B,QAAI,OAAO,KAAK,SAAS,SAAU,QAAO;AAC1C,wBAAoB,KAAK,MAAM,WAAW;AAAA,EAC5C;AACA,SAAO;AACT;AAiCA,SAAS,gBAAgB,OAAgC,KAAsB;AAC7E,SAAO,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG;AACxD;AAEA,SAAS,6BACP,MACA,aACS;AACT,MAAI;AACF,WAAO,kBAAkB,MAAM,WAAW;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBACP,KACA,aACA,eACoB;AACpB,MAAI,OAAO,IAAI,SAAS,SAAU,QAAO;AAEzC,MAAI,gBAAgB;AACpB,MAAI;AACF,oBAAgB,IAAI,MAAM,WAAW;AAAA,EACvC,QAAQ;AACN,oBAAgB;AAAA,EAClB;AACA,QAAM,gBAAgB,CAAC,6BAA6B,IAAI,MAAM,WAAW;AACzE,QAAM,QAAwB,CAAC;AAC/B,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI,oBAAoB;AACxB,QAAM,iBAAiB,IAAI;AAE3B,MAAI,MAAM,QAAQ,cAAc,GAAG;AACjC,eAAW,iBAAiB,gBAAgB;AAC1C,UAAI,CAAC,eAAe,aAAa,GAAG;AAClC,4BAAoB;AACpB;AAAA,MACF;AACA,YAAM,iBAAiB,cAAc;AACrC,UACE,OAAO,mBAAmB,YAC1B,CAAC,sBAAsB,cAAc,GACrC;AACA,4BAAoB;AACpB;AAAA,MACF;AACA,UAAI,oBAAoB,IAAI,cAAc,GAAG;AAC3C,4BAAoB;AACpB;AAAA,MACF;AACA,0BAAoB,IAAI,cAAc;AAEtC,YAAM,WAAW,cAAc;AAC/B,UAAI,CAAC,MAAM,QAAQ,QAAQ,GAAG;AAC5B,4BAAoB;AACpB;AAAA,MACF;AACA,UAAI,SAAS,WAAW,GAAG;AACzB,4BAAoB;AAAA,MACtB;AAEA,iBAAW,WAAW,UAAU;AAC9B,YAAI,OAAO,YAAY,UAAU;AAC/B,8BAAoB;AACpB;AAAA,QACF;AACA,cAAM,eAAe,oBAAoB,gBAAgB,OAAO;AAChE,YAAI,iBAAiB,MAAM;AACzB,8BAAoB;AACpB;AAAA,QACF;AACA,cAAM,KAAK,YAAY;AAAA,MACzB;AAAA,IACF;AAAA,EACF,WAAW,gBAAgB,KAAK,aAAa,GAAG;AAC9C,wBAAoB;AAAA,EACtB;AAEA,SAAO;AAAA,IACL,SAAS,IAAI;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,wBACP,aACyB;AACzB,MAAI,CAAC,eAAe,WAAW,EAAG,QAAO;AAEzC,QAAM,UAAU,YAAY;AAC5B,QAAM,gBAAgB,OAAO,YAAY,YAAY,YAAY;AACjE,QAAM,OAAO,OAAO,YAAY,WAAW,UAAU;AACrD,QAAM,UAAU,YAAY;AAC5B,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO;AAEpC,QAAM,OAAsB,CAAC;AAC7B,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,eAAe,MAAM,EAAG;AAC7B,UAAM,MAAM,mBAAmB,QAAQ,MAAM,aAAa;AAC1D,QAAI,QAAQ,MAAM;AAChB,WAAK,KAAK,GAAG;AAAA,IACf;AAAA,EACF;AAEA,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,SAAO,EAAE,MAAM,eAAe,KAAK;AACrC;AAEA,SAAS,yBAAyB,cAA2C;AAC3E,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,EAAG,QAAO,CAAC;AAEvE,QAAM,YAAgC,CAAC;AACvC,aAAW,eAAe,cAAc;AACtC,UAAM,WAAW,wBAAwB,WAAW;AACpD,QAAI,aAAa,MAAM;AACrB,gBAAU,KAAK,QAAQ;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,UAG5B;AACA,MAAI,aAAa,UAAa,aAAa,MAAM;AAC/C,WAAO,EAAE,QAAQ,oBAAI,IAAY,GAAG,WAAW,MAAM;AAAA,EACvD;AACA,MACE,CAAC,MAAM,QAAQ,QAAQ,KACvB,SAAS,KAAK,CAAC,SAAS;AACtB,WAAO,OAAO,SAAS;AAAA,EACzB,CAAC,GACD;AACA,WAAO,EAAE,QAAQ,oBAAI,IAAY,GAAG,WAAW,KAAK;AAAA,EACtD;AACA,SAAO,EAAE,QAAQ,IAAI,IAAI,QAAQ,GAAG,WAAW,MAAM;AACvD;AAEA,SAAS,uBACP,oBACyB;AACzB,MAAI,uBAAuB,UAAa,uBAAuB,MAAM;AACnE,WAAO,EAAE,UAAU,oBAAI,IAAI,GAAG,mBAAmB,MAAM;AAAA,EACzD;AACA,MAAI,CAAC,eAAe,kBAAkB,GAAG;AACvC,WAAO,EAAE,UAAU,oBAAI,IAAI,GAAG,mBAAmB,KAAK;AAAA,EACxD;AAEA,QAAM,WAAW,oBAAI,IAAmC;AACxD,aAAW,CAAC,cAAc,KAAK,KAAK,OAAO,QAAQ,kBAAkB,GAAG;AACtE,QAAI,CAAC,eAAe,KAAK,GAAG;AAC1B,eAAS,IAAI,cAAc;AAAA,QACzB,oBAAoB,oBAAI,IAAY;AAAA,QACpC,eAAe;AAAA,QACf,qBAAqB;AAAA,QACrB,wBAAwB;AAAA,MAC1B,CAAC;AACD;AAAA,IACF;AAEA,UAAM,QAAQ,qBAAqB,MAAM,KAAK;AAC9C,UAAM,OAAO,qBAAqB,MAAM,IAAI;AAC5C,UAAM,MAAM,qBAAqB,MAAM,GAAG;AAC1C,UAAM,qBAAqB,oBAAI,IAAY,CAAC,GAAG,KAAK,QAAQ,GAAG,IAAI,MAAM,CAAC;AAE1E,QAAI,gBAA+B;AACnC,QAAI,yBAAyB;AAC7B,UAAM,mBAAmB,MAAM;AAC/B,QACE,qBAAqB,WACrB,qBAAqB,UACrB,qBAAqB,OACrB;AACA,sBAAgB;AAAA,IAClB,WAAW,qBAAqB,UAAa,qBAAqB,MAAM;AACtE,+BAAyB;AAAA,IAC3B;AAEA,aAAS,IAAI,cAAc;AAAA,MACzB;AAAA,MACA;AAAA,MACA,qBAAqB,MAAM,aAAa,KAAK,aAAa,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,UAAU,mBAAmB,MAAM;AAC9C;AA+CA,SAAS,yBACP,UACA,UACQ;AACR,QAAM,OAAO,SAAS,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC9C,SAAO,SAAS,KAAK,MAAM,IAAI,IAAI;AACrC;AAEA,SAAS,yBAAyB,KAAqB;AACrD,QAAM,aAAa,IAAI,QAAQ,GAAG;AAClC,QAAM,gBAAgB,IAAI,QAAQ,GAAG;AACrC,MAAI,MAAM,IAAI;AACd,MAAI,eAAe,GAAI,OAAM,KAAK,IAAI,KAAK,UAAU;AACrD,MAAI,kBAAkB,GAAI,OAAM,KAAK,IAAI,KAAK,aAAa;AAC3D,SAAO,IAAI,MAAM,GAAG,GAAG;AACzB;AAEA,SAAS,sBAAsB,KAGtB;AACP,QAAM,YAAY,IAAI,QAAQ,KAAK;AACnC,MAAI,cAAc,GAAI,QAAO;AAE7B,QAAM,iBAAiB,YAAY;AACnC,MAAI,eAAe,IAAI;AACvB,aAAW,aAAa,CAAC,KAAK,KAAK,GAAG,GAAG;AACvC,UAAM,iBAAiB,IAAI,QAAQ,WAAW,cAAc;AAC5D,QAAI,mBAAmB;AACrB,qBAAe,KAAK,IAAI,cAAc,cAAc;AAAA,EACxD;AAEA,SAAO,EAAE,gBAAgB,aAAa;AACxC;AAEA,SAAS,uBACP,KACA,QACA,WACQ;AACR,SAAO,GAAG,IAAI,MAAM,GAAG,OAAO,cAAc,CAAC,GAAG,SAAS,GAAG,IAAI,MAAM,OAAO,YAAY,CAAC;AAC5F;AAEA,SAAS,oBAAoB,KAAqB;AAChD,QAAM,SAAS,sBAAsB,GAAG;AACxC,MAAI,WAAW,KAAM,QAAO;AAE5B,QAAM,YAAY,IAAI,MAAM,OAAO,gBAAgB,OAAO,YAAY;AACtE,QAAM,cAAc,UAAU,YAAY,GAAG;AAC7C,MAAI,gBAAgB,GAAI,QAAO;AAE/B,SAAO,uBAAuB,KAAK,QAAQ,UAAU,MAAM,cAAc,CAAC,CAAC;AAC7E;AAEA,SAAS,4BAA4B,MAAuB;AAC1D,MAAI,SAAS,GAAI,QAAO;AACxB,MACE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,SAAS;AACzB,WAAO,QAAQ,OAAO,QAAQ;AAAA,EAChC,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO,IAAI,IAAI;AACxB;AAEA,SAAS,yBAAyB,KAAqB;AACrD,QAAM,SAAS,sBAAsB,GAAG;AACxC,MAAI,WAAW,KAAM,QAAO;AAE5B,QAAM,YAAY,IAAI,MAAM,OAAO,gBAAgB,OAAO,YAAY;AACtE,MAAI,UAAU,WAAW,GAAG,GAAG;AAC7B,UAAM,oBAAoB,UAAU,QAAQ,GAAG;AAC/C,QAAI,sBAAsB,GAAI,QAAO;AACrC,UAAM,aAAa,UAAU,MAAM,oBAAoB,CAAC;AACxD,QAAI,CAAC,WAAW,WAAW,GAAG,EAAG,QAAO;AACxC,QAAI,CAAC,4BAA4B,WAAW,MAAM,CAAC,CAAC,EAAG,QAAO;AAC9D,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,UAAU,MAAM,GAAG,oBAAoB,CAAC;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,gBAAgB,UAAU,YAAY,GAAG;AAC/C,MAAI,kBAAkB,GAAI,QAAO;AACjC,MAAI,UAAU,QAAQ,GAAG,MAAM,cAAe,QAAO;AACrD,MAAI,CAAC,4BAA4B,UAAU,MAAM,gBAAgB,CAAC,CAAC,GAAG;AACpE,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,KAAK,QAAQ,UAAU,MAAM,GAAG,aAAa,CAAC;AAC9E;AAEA,SAAS,wBAAwB,SAAgC;AAC/D,MAAI,yBAAyB,OAAO,EAAE,SAAS,IAAI,EAAG,QAAO;AAC7D,SAAO,yBAAyB,oBAAoB,OAAO,CAAC;AAC9D;AAEA,SAAS,eAAe,KAAqB;AAC3C,QAAM,kBAAkB,yBAAyB,GAAG;AACpD,QAAM,YAAY,gBAAgB,QAAQ,KAAK;AAC/C,QAAM,iBAAiB,cAAc,KAAK,IAAI,YAAY;AAC1D,QAAM,YAAY,gBAAgB,QAAQ,KAAK,cAAc;AAC7D,SAAO,cAAc,KAAK,MAAM,gBAAgB,MAAM,SAAS;AACjE;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,QAAM,kBAAkB,yBAAyB,GAAG;AACpD,QAAM,YAAY,gBAAgB,QAAQ,KAAK;AAC/C,QAAM,iBAAiB,cAAc,KAAK,IAAI,YAAY;AAC1D,QAAM,YAAY,gBAAgB,QAAQ,KAAK,cAAc;AAC7D,SAAO,cAAc,KAAK,KAAK,gBAAgB,MAAM,SAAS;AAChE;AAEA,SAAS,oBAAoB,KAA4B;AACvD,QAAM,kBAAkB,yBAAyB,GAAG;AACpD,QAAM,YAAY,gBAAgB,QAAQ,KAAK;AAC/C,MAAI,cAAc,GAAI,QAAO;AAC7B,QAAM,iBAAiB,YAAY;AACnC,QAAM,YAAY,gBAAgB,QAAQ,KAAK,cAAc;AAC7D,QAAM,YACJ,cAAc,KACV,gBAAgB,MAAM,cAAc,IACpC,gBAAgB,MAAM,gBAAgB,SAAS;AACrD,SAAO,cAAc,KAAK,OAAO;AACnC;AAEA,SAAS,YAAY,OAAwB;AAC3C,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,QAAI,MAAM,WAAW,KAAK,IAAI,IAAM,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,WAA2B;AACvD,QAAM,kBAAkB,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC;AACtE,MAAI,gBAAgB,WAAW,GAAG,GAAG;AACnC,UAAM,eAAe,gBAAgB,QAAQ,GAAG;AAChD,WAAO,iBAAiB,KACpB,kBACA,gBAAgB,MAAM,GAAG,eAAe,CAAC;AAAA,EAC/C;AACA,QAAM,gBAAgB,gBAAgB,YAAY,GAAG;AACrD,SAAO,kBAAkB,KACrB,kBACA,gBAAgB,MAAM,GAAG,aAAa;AAC5C;AAEA,SAAS,sBAAsB,WAA4B;AACzD,QAAM,kBAAkB,UAAU,MAAM,UAAU,YAAY,GAAG,IAAI,CAAC;AACtE,MAAI,gBAAgB,WAAW,GAAG,GAAG;AACnC,UAAM,eAAe,gBAAgB,QAAQ,GAAG;AAChD,QAAI,iBAAiB,GAAI,QAAO;AAChC,WAAO,gBAAgB,MAAM,eAAe,CAAC,MAAM;AAAA,EACrD;AAEA,QAAM,gBAAgB,gBAAgB,YAAY,GAAG;AACrD,MAAI,kBAAkB,GAAI,QAAO;AACjC,SACE,gBAAgB,QAAQ,GAAG,MAAM,iBACjC,kBAAkB,gBAAgB,SAAS;AAE/C;AAEA,SAAS,gCAAgC,WAA4B;AACnE,QAAM,YAAY,qBAAqB,SAAS,EAAE,CAAC;AACnD,SAAO,cAAc,UAAa,aAAa,OAAO,aAAa;AACrE;AAEA,SAAS,wCAAwC,KAA4B;AAC3E,QAAM,YAAY,oBAAoB,GAAG;AACzC,MAAI,cAAc,KAAM,QAAO;AAC/B,MACE,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,YAAY,SAAS,KACtB,CAAC,gCAAgC,SAAS,GAC1C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,IAAI,QAAQ,KAAK;AACnC,MAAI,cAAc,GAAI,QAAO;AAC7B,SAAO,GAAG,IAAI,MAAM,GAAG,SAAS,CAAC,MAAM,SAAS;AAClD;AAEA,SAAS,iCAAiC,OAAwB;AAChE,MAAI,QAAQ,MAAM,QAAQ,GAAG;AAC7B,SAAO,UAAU,IAAI;AACnB,QAAI,SAAS;AACb,WAAO,SAAS,MAAM,UAAU,MAAM,MAAM,MAAM,KAAK;AACrD,YAAM,gBAAgB,MAAM,SAAS,CAAC;AACtC,YAAM,iBAAiB,MAAM,SAAS,CAAC;AACvC,UACE,CAAC,iBACD,CAAC,kBACD,CAAC,WAAW,IAAI,aAAa,KAC7B,CAAC,WAAW,IAAI,cAAc,GAC9B;AACA,eAAO;AAAA,MACT;AACA,gBAAU;AAAA,IACZ;AAEA,QAAI;AACJ,QAAI;AACF,mBAAa,mBAAmB,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,IAC5D,QAAQ;AACN,aAAO;AAAA,IACT;AACA,eAAW,QAAQ,YAAY;AAC7B,UAAI,uCAAuC,IAAI,IAAI,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AACA,YAAQ,MAAM,QAAQ,KAAK,MAAM;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,mCAAmC,KAAsB;AAChE,QAAM,YAAY,oBAAoB,GAAG;AACzC,MAAI,cAAc,KAAM,QAAO;AAC/B,SACE,UAAU,SAAS,IAAI,KACvB,sBAAsB,SAAS,KAC/B,iCAAiC,SAAS;AAE9C;AAEA,SAAS,oBAAoB,SAAyB;AACpD,SAAO,wBAAwB,gBAAgB,OAAO;AACxD;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,OAAO,SAAS,WAAW;AAC7B,WAAO,oBAAoB,OAAO,KAAK;AAAA,EACzC;AAEA,QAAM,eACJ,gBAAgB,OAAO,MAAM,IAAI,gBAAgB,OAAO,MAAM;AAChE,MAAI,OAAO,WAAW,MAAM,OAAO,WAAW,IAAI;AAChD,WAAO,4BAA4B;AAAA,EACrC;AACA,MAAI,OAAO,WAAW,IAAK,QAAO;AAClC,MAAI,OAAO,WAAW,IAAK,QAAO;AAClC,SAAO;AACT;AAEA,SAAS,oBAAoB,UAA4B;AACvD,SAAO,SAAS,OAAO,CAAC,OAAO,YAAY;AACzC,WAAO,QAAQ,oBAAoB,OAAO;AAAA,EAC5C,GAAG,CAAC;AACN;AAEA,SAAS,+BACP,UACA,qBACQ;AACR,QAAM,mBAAmB,SAAS,SAAS;AAC3C,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS,GAAG;AACvD,UAAM,UAAU,SAAS,KAAK;AAC9B,UAAM,SAAS,oBAAoB,SAAS,OAAO,gBAAgB;AACnE,QAAI,WAAW,MAAM;AACnB,eAAS,0BAA0B,MAAM;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBACP,MACA,qBACQ;AACR,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,IAAK,QAAO;AACzB,QAAM,WAAW,kBAAkB,IAAI;AACvC,SAAO,wBAAwB,OAC3B,oBAAoB,QAAQ,IAC5B,+BAA+B,UAAU,mBAAmB;AAClE;AAEA,SAAS,uBAAuB,WAA6B;AAC3D,MAAI,UAAU,WAAW,GAAG,EAAG,QAAO,CAAC,SAAS;AAChD,QAAM,aAAa,UAAU,SAAS,GAAG,IACrC,UAAU,MAAM,GAAG,EAAE,IACrB;AACJ,SAAO,eAAe,KAAK,CAAC,IAAI,WAAW,MAAM,GAAG;AACtD;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA,8BAA8B;AAChC,GAKW;AACT,QAAM,gBAAgB,YAClB,8BACE,oCACA,0BACF;AACJ,QAAM,oBAAoB,uBAAuB,SAAS;AAC1D,QAAM,iBACJ,kBAAkB,OACd,oBAAoB,iBAAiB,IACrC;AAAA,IACE,CAAC,GAAG,iBAAiB,EAAE,QAAQ;AAAA,IAC/B;AAAA,EACF;AACN,QAAM,YAAY,iBAAiB,MAAM,aAAa;AACtD,SACE,YAAY,wBACZ,iBAAiB,8BAChB,YAAY,IAAI;AAErB;AAEA,SAAS,0BACP,MACA,SACe;AACf,MAAI,YAAY,IAAI;AAClB,WAAO,SAAS,KAAK,MAAM;AAAA,EAC7B;AACA,MAAI,YAAY,KAAK;AACnB,QAAI,CAAC,KAAK,WAAW,OAAO,EAAG,QAAO;AACtC,UAAMA,gBAAe,KAAK,MAAM,QAAQ,MAAM;AAC9C,QAAIA,kBAAiB,MAAM,CAACA,cAAa,WAAW,GAAG,EAAG,QAAO;AACjE,WAAOA,kBAAiB,KAAK,MAAMA;AAAA,EACrC;AACA,MAAI,CAAC,KAAK,WAAW,OAAO,EAAG,QAAO;AACtC,QAAM,eAAe,KAAK,MAAM,QAAQ,MAAM;AAC9C,MAAI,iBAAiB,MAAM,CAAC,aAAa,WAAW,GAAG,EAAG,QAAO;AACjE,SAAO,iBAAiB,KAAK,MAAM;AACrC;AAEA,SAAS,qBACP,UACA,UAAyC,CAAC,GAC3B;AACf,MAAI,aAAa,SAAS,YAAY;AACtC,MAAI,WAAW,SAAS,GAAG,GAAG;AAC5B,iBAAa,WAAW,MAAM,GAAG,EAAE;AACnC,QAAI,eAAe,MAAM,WAAW,SAAS,GAAG,GAAG;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AACA,MACE,WAAW,MAAM,GAAG,EAAE,KAAK,CAAC,UAAU;AACpC,WAAO,UAAU;AAAA,EACnB,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,QAAM,iBACJ,QAAQ,oBAAoB,OACxB,oCACA;AACN,MACE,CAAC,WAAW,WAAW,GAAG,KAC1B,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,SAAS;AAC7B,WAAO,eAAe,IAAI,IAAI;AAAA,EAChC,CAAC,GACD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,uBACP,QACA,UAAyC,CAAC,GAC3B;AACf,MAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI;AACpD,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,qBAAqB,OAAO,UAAU,OAAO;AAC9D,MAAI,aAAa,QAAQ,aAAa,IAAI;AACxC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS,KAAK,WAAW,GAAG,QAAQ,IAAI,OAAO,IAAI;AACnE;AAEA,SAAS,2BACP,KACA,SACA,UAEI,CAAC,GACwB;AAC7B,QAAM,YAAY,IAAI,IAAI,GAAG;AAC7B,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,MAAI,UAAU,SAAS,YAAY,MAAM,WAAW,SAAS,YAAY,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,iBAAiB,OAAO;AAC9C,QAAM,eAAe,mBAAmB,OAAO;AAE/C,QAAM,eAAe,uBAAuB,SAAS;AACrD,QAAM,gBAAgB,uBAAuB,YAAY;AAAA,IACvD,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,iBAAiB,QAAQ,kBAAkB,KAAM,QAAO;AAC5D,MAAI,eAAe;AACjB,UAAM,aACJ,QAAQ,gCAAgC,OACpC,0CAA0C,cAAc,aAAa,IACrE,kBAAkB,cAAc,aAAa;AACnD,QAAI,eAAe,KAAM,QAAO;AAAA,EAClC,WAAW,iBAAiB,eAAe;AACzC,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,mBAAmB,YAAY;AAChD,QAAM,eAAe,gBACjB,QAAQ,gCAAgC,OACtC;AAAA,IACE,eAAe,GAAG;AAAA,IAClB;AAAA,EACF,IACA,wBAAwB,eAAe,GAAG,GAAG,QAAQ,IACvD,0BAA0B,eAAe,GAAG,GAAG,QAAQ;AAC3D,MAAI,iBAAiB,KAAM,QAAO;AAElC,QAAM,cAAc,mBAAmB,OAAO;AAC9C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,wBAAwB;AAAA,MAC7B,WAAW;AAAA,MACX,MAAM;AAAA,MACN,WAAW;AAAA,MACX,6BAA6B,QAAQ,gCAAgC;AAAA,IACvE,CAAC;AAAA,EACH;AACF;AAEA,SAAS,+BAA+B,KAAsB;AAC5D,MACE,sBAAsB,GAAG,KACzB,iBAAiB,GAAG,KACpB,CAAC,IAAI,SAAS,KAAK,KACnB,mCAAmC,GAAG,GACtC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,yBAAyB,wCAAwC,GAAG;AAC1E,MAAI,2BAA2B,KAAM,QAAO;AAE5C,MAAI;AACF,oBAAgB,wBAAwB,SAAS;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gCACP,KACA,SAC6B;AAC7B,MAAI,CAAC,+BAA+B,GAAG,EAAG,QAAO;AACjD,QAAM,eAAe,wBAAwB,OAAO;AACpD,MAAI,iBAAiB,KAAM,QAAO;AAElC,MAAI;AACF,UAAM,QAAQ,2BAA2B,KAAK,cAAc;AAAA,MAC1D,6BAA6B;AAAA,IAC/B,CAAC;AACD,QAAI,UAAU,KAAM,QAAO;AAC3B,WAAO,EAAE,GAAG,OAAO,aAAa,mBAAmB,OAAO,EAAE;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAA6C;AACpD,SAAO;AAAA,IACL,eAAe;AAAA,IACf,qBAAqB;AAAA,IACrB,WAAW;AAAA,IACX,cAAc;AAAA,IACd,aAAa;AAAA,IACb,uBAAuB,CAAC;AAAA,IACxB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AACF;AAEA,SAAS,wBACP,OACA,OACA,OACS;AACT,MAAI,MAAM,kBAAkB,QAAQ,QAAQ,MAAM,eAAe;AAC/D,UAAM,gBAAgB;AACtB,UAAM,sBAAsB;AAC5B,UAAM,YAAY;AAClB,UAAM,eAAe;AACrB,UAAM,cAAc;AACpB,UAAM,wBAAwB,CAAC;AAC/B,UAAM,uBAAuB;AAC7B,UAAM,uBAAuB;AAAA,EAC/B,WAAW,QAAQ,MAAM,eAAe;AACtC,WAAO;AAAA,EACT;AAEA,QAAM,cAAc;AACpB,SAAO;AACT;AAEA,SAAS,iCACP,OACA,aACS;AACT,MAAI,MAAM,wBAAwB,KAAM,QAAO;AAC/C,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,MAAM;AAAA,EACR;AACA,MAAI,aAAa,EAAG,QAAO;AAC3B,MAAI,aAAa,EAAG,QAAO;AAC3B,SAAO,MAAM,iBAAiB;AAChC;AAEA,SAAS,sBACP,OACA,aACS;AACT,MAAI,MAAM,wBAAwB,MAAM;AACtC,UAAM,sBAAsB;AAC5B,WAAO;AAAA,EACT;AAEA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,MAAM;AAAA,EACR;AACA,MAAI,aAAa,GAAG;AAClB,UAAM,sBAAsB;AAC5B,UAAM,eAAe;AACrB,UAAM,cAAc;AACpB,UAAM,wBAAwB,CAAC;AAC/B,WAAO;AAAA,EACT;AACA,SAAO,eAAe;AACxB;AAEA,SAAS,iBACP,OACA,OACA,YACM;AACN,MAAI,CAAC,MAAM,sBAAsB,SAAS,UAAU,GAAG;AACrD,UAAM,sBAAsB,KAAK,UAAU;AAAA,EAC7C;AACA,QAAM,gBAAgB;AACxB;AAEA,SAAS,wBACP,OACA,iBACyB;AACzB,QAAM,YAAY,MAAM;AACxB,MAAI,cAAc,MAAM;AACtB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AAEA,MAAI,MAAM,iBAAiB,MAAM;AAC/B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,MAAM,aAAa;AAAA,MACjC,MAAM,MAAM,aAAa;AAAA,MACzB,cAAc,MAAM,aAAa;AAAA,MACjC,YAAY,MAAM,aAAa;AAAA,MAC/B,MAAM,MAAM,aAAa;AAAA,IAC3B;AAAA,EACF;AAEA,MAAI,MAAM,gBAAgB,MAAM;AAC9B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,MAAM,YAAY;AAAA,MAChC,MAAM,MAAM,YAAY;AAAA,MACxB,cAAc,MAAM,YAAY;AAAA,MAChC,QAAQ;AAAA,MACR,aAAa,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,MAAM,yBAAyB,MAAM;AACvC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,MAAM,qBAAqB;AAAA,MACzC,MAAM,MAAM,qBAAqB;AAAA,MACjC,cAAc,MAAM,qBAAqB;AAAA,MACzC,QAAQ;AAAA,MACR,aAAa,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,MAAM,yBAAyB,MAAM;AACvC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,MAAM,qBAAqB;AAAA,MACzC,MAAM,MAAM,qBAAqB;AAAA,MACjC,cAAc,MAAM,qBAAqB;AAAA,MACzC,QAAQ;AAAA,MACR,aAAa,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,gBAAgB,SAAS,IAAI,UAAU,YAAY;AAClE,MAAI,WAAW,QAAW;AACxB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,UAAU;AAAA,MACxB,MAAM,UAAU;AAAA,MAChB,cAAc,UAAU;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,OAAO,wBAAwB;AACjC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,UAAU;AAAA,MACxB,MAAM,UAAU;AAAA,MAChB,cAAc,UAAU;AAAA,MACxB,QAAQ;AAAA,MACR,aAAa,CAAC;AAAA,IAChB;AAAA,EACF;AACA,MAAI,OAAO,kBAAkB,SAAS;AACpC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cAAc,UAAU;AAAA,MACxB,MAAM,UAAU;AAAA,MAChB,cAAc,UAAU;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,UAAU;AAAA,IACxB,MAAM,UAAU;AAAA,IAChB,cAAc,UAAU;AAAA,IACxB,QAAQ;AAAA,IACR,aAAa,CAAC;AAAA,EAChB;AACF;AAEA,SAAS,wBACP,UACA,WACyB;AACzB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,SAAS;AAAA,IACvB,MAAM,UAAU;AAAA,IAChB,cAAc,UAAU;AAAA,IACxB,QAAQ;AAAA,IACR,aAAa,CAAC;AAAA,EAChB;AACF;AAEA,SAAS,6BACP,OACA,KACA,YACM;AACN,MAAI,IAAI,iBAAiB,IAAI,iBAAiB,IAAI,mBAAmB;AACnE,UAAM,yBAAyB;AAAA,EACjC;AACF;AAEA,SAAS,uBACP,UACA,KACS;AACT,SAAO,SAAS,iBAAiB,IAAI,iBAAiB,IAAI;AAC5D;AAEA,SAAS,0BACP,iBACA,QACS;AACT,SACE,gBAAgB,qBACf,WAAW,UAAa,OAAO;AAEpC;AAEA,SAAS,qBAAqB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOS;AACP,MAAI,KAAK,WAAW,SAAS,KAAK,WAAW,YAAa;AAC1D,MAAI,CAAC,iCAAiC,OAAO,KAAK,WAAW,EAAG;AAEhE,QAAM,oBACJ,WAAW,UAAa,OAAO,mBAAmB,IAAI,KAAK,UAAU;AACvE,MAAI,kBAAkB,UAAU,cAAc,KAAK,IAAI,MAAM,KAAM;AACnE,MAAI,CAAC,sBAAsB,OAAO,KAAK,WAAW,EAAG;AAErD,MAAI,mBAAmB;AACrB,qBAAiB,OAAO,YAAY,KAAK,UAAU;AACnD;AAAA,EACF;AAEA,QAAM,iBAAiB;AAAA,IACrB,cAAc,UAAU;AAAA,IACxB,MAAM,UAAU;AAAA,IAChB,cAAc,UAAU;AAAA,IACxB,YAAY,KAAK;AAAA,IACjB,MAAM,KAAK;AAAA,EACb;AACF;AAEA,SAAS,sBAAsB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOS;AACP,aAAW,QAAQ,IAAI,OAAO;AAC5B,yBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,oBAAoB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAQmC;AACjC,QAAM,SAAS,gBAAgB,SAAS,IAAI,SAAS,IAAI;AACzD,QAAM,YAAY,gCAAgC,KAAK,IAAI,OAAO;AAClE,MAAI,cAAc,KAAM,QAAO;AAC/B,MAAI,WAAY,QAAO,wBAAwB,UAAU,SAAS;AAElE,QAAM,oBAAuC;AAAA,IAC3C,cAAc,SAAS;AAAA,IACvB,MAAM,UAAU;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,cAAc,UAAU;AAAA,EAC1B;AACA,QAAM,aAAiC;AAAA,IACrC,cAAc,kBAAkB;AAAA,IAChC,MAAM,kBAAkB;AAAA,IACxB,cAAc,kBAAkB;AAAA,EAClC;AACA,MAAI,CAAC,wBAAwB,OAAO,mBAAmB,UAAU,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AAEA,+BAA6B,OAAO,KAAK,UAAU;AACnD,MAAI,uBAAuB,UAAU,GAAG,EAAG,QAAO;AAClD,MAAI,0BAA0B,iBAAiB,MAAM,GAAG;AACtD,UAAM,yBAAyB;AAC/B,WAAO;AAAA,EACT;AAEA,wBAAsB;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAEO,SAAS,qBACd,KACA,SAC6B;AAC7B,MACE,0BAA0B,GAAG,KAC7B,mCAAmC,GAAG,GACtC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,yBAAyB,wCAAwC,GAAG;AAE1E,MAAI;AACF,QAAI,2BAA2B,MAAM;AACnC,sBAAgB,wBAAwB,SAAS;AAAA,IACnD;AACA,oBAAgB,SAAS,UAAU;AACnC,WAAO,2BAA2B,KAAK,OAAO;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,6BACd,WACA,QACA,KACA,kBAA2B,QACF;AACzB,QAAM,oBAAoB,yBAAyB,SAAS;AAC5D,MAAI,kBAAkB,WAAW,EAAG,QAAO,EAAE,MAAM,WAAW;AAE9D,QAAM,0BAA0B,uBAAuB,eAAe;AACtE,QAAM,cAAc,OAAO,YAAY;AACvC,QAAM,QAAQ,oBAAoB;AAClC,QAAM,aACJ,IAAI,SAAS,IAAI,KAAK,sBAAsB,eAAe,GAAG,CAAC;AAEjE,aAAW,YAAY,mBAAmB;AACxC,eAAW,OAAO,SAAS,MAAM;AAC/B,YAAM,oBAAoB,oBAAoB;AAAA,QAC5C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,iBAAiB;AAAA,QACjB;AAAA,MACF,CAAC;AACD,UAAI,sBAAsB,MAAM;AAC9B,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,wBAAwB,OAAO,uBAAuB;AAC/D;AAEA,SAAS,4BACP,MACA,SACA,qBAC+B;AAC/B,QAAM,eAAe,KAAK,MAAM,GAAG;AACnC,QAAM,gBAAgB,aAAa,IAAI,CAAC,YAAY;AAClD,WAAO,QAAQ,YAAY;AAAA,EAC7B,CAAC;AACD,QAAM,cAAc,QAAQ,MAAM,GAAG,EAAE,QAAQ;AAE/C,eAAa,QAAQ;AACrB,gBAAc,QAAQ;AAEtB,QAAM,SAAiC,CAAC;AACxC,MAAI,KAAK;AACT,QAAM,mBAAmB,YAAY,SAAS;AAE9C,WACM,eAAe,GACnB,eAAe,YAAY,QAC3B,gBACA;AACA,UAAM,MAAM,YAAY,YAAY;AACpC,UAAM,SAAS,oBAAoB,KAAK,cAAc,gBAAgB;AACtE,QAAI,WAAW,KAAM,QAAO;AAC5B,QAAI,OAAO,SAAS,WAAW;AAC7B,UACE,MAAM,cAAc,UACpB,cAAc,EAAE,MAAM,OAAO,MAAM,YAAY,GAC/C;AACA,eAAO;AAAA,MACT;AACA,YAAM;AACN;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,IAAI;AACzC,QAAI,WAAW,KAAK;AAClB,UAAI,MAAM,aAAa,OAAQ,QAAO;AACtC,aAAO,IAAI,IAAI,aAAa,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAG;AACxD,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK;AAClB,aAAO,IAAI,IAAI,aAAa,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAG;AACxD,aAAO;AAAA,IACT;AACA,QAAI,MAAM,aAAa,OAAQ,QAAO;AACtC,QAAI,WAAW,MAAM,WAAW,IAAI;AAClC,aAAO,IAAI,IAAI,cAAc,EAAE;AAAA,IACjC,OAAO;AACL,YAAM,WAAW;AAAA,QACf,cAAc,EAAE;AAAA,QAChB,OAAO,YAAY;AAAA,QACnB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,aAAa,KAAM,QAAO;AAC9B,aAAO,IAAI,IAAI;AAAA,IACjB;AACA,UAAM;AAAA,EACR;AAEA,SAAO,OAAO,aAAa,SAAS,SAAS;AAC/C;AASO,SAAS,kBACd,MACA,SAC+B;AAC/B,SAAO,4BAA4B,MAAM,SAAS,uBAAuB;AAC3E;AAEA,SAAS,kCACP,SACA,cACA,kBACkB;AAClB,QAAM,SAAS,aAAa,OAAO;AACnC,MAAI,OAAO,SAAS,SAAS;AAC3B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,4BAA4B,YAAY;AAAA,MAC9C,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MACE,OAAO,SAAS,WAChB,OAAO,WAAW,MAClB;AAAA,IACE;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP,OAAO;AAAA,EACT,GACA;AACA,WAAO,EAAE,GAAG,QAAQ,QAAQ,GAAG;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,0CACP,MACA,SAC+B;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,kCACP,MACA,SACA,qBACe;AACf,QAAM,WAAW,kBAAkB,IAAI;AACvC,QAAM,cAAc,kBAAkB,OAAO;AAE7C,MAAI,KAAK;AACT,QAAM,mBAAmB,YAAY,SAAS;AAC9C,WACM,eAAe,GACnB,eAAe,YAAY,QAC3B,gBACA;AACA,UAAM,MAAM,YAAY,YAAY;AACpC,UAAM,SAAS,oBAAoB,KAAK,cAAc,gBAAgB;AACtE,QAAI,WAAW,KAAM,QAAO;AAC5B,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,MAAM,SAAS,UAAU,SAAS,EAAE,MAAM,OAAO,MAAO,QAAO;AACnE,YAAM;AACN;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,QAAQ,OAAO,IAAI;AACnC,QAAI,WAAW,KAAK;AAClB,UAAI,MAAM,SAAS,UAAU,CAAC,mBAAmB,UAAU,EAAE,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK;AAClB,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,OAAQ,QAAO;AAElC,UAAM,UAAU,SAAS,EAAE;AAC3B,QAAI,WAAW,MAAM,WAAW,IAAI;AAClC,UAAI,YAAY,GAAI,QAAO;AAAA,IAC7B,WAAW,kBAAkB,SAAS,QAAQ,MAAM,MAAM,MAAM;AAC9D,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AAEA,SAAO,yBAAyB,UAAU,EAAE;AAC9C;AAQO,SAAS,wBACd,MACA,SACe;AACf,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,gDACP,MACA,SACe;AACf,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAkBO,SAAS,kBACd,MACA,SAC+B;AAC/B,QAAM,WAAW,kBAAkB,IAAI;AACvC,QAAM,cAAc,kBAAkB,OAAO;AAE7C,QAAM,SAAiC,CAAC;AACxC,MAAI,KAAK;AACT,QAAM,mBAAmB,YAAY,SAAS;AAE9C,WACM,eAAe,GACnB,eAAe,YAAY,QAC3B,gBACA;AACA,UAAM,MAAM,YAAY,YAAY;AACpC,UAAM,SAAS,aAAa,GAAG;AAG/B,QAAI,OAAO,SAAS,QAAS,QAAO;AACpC,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,MAAM,SAAS,UAAU,SAAS,EAAE,MAAM,OAAO,MAAO,QAAO;AACnE;AACA;AAAA,IACF;AACA,UAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,IAAI;AACzC,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,UAAI,MAAM,SAAS,UAAU,CAAC,mBAAmB,UAAU,EAAE,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO,IAAI,IAAI,SAAS,MAAM,EAAE,EAAE,KAAK,GAAG;AAC1C,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK;AAClB,UAAI,qBAAqB,cAAc,kBAAkB,QAAQ,MAAM;AACrE,eAAO;AACT,aAAO,IAAI,IAAI,SAAS,MAAM,EAAE,EAAE,KAAK,GAAG;AAC1C,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,OAAQ,QAAO;AAClC,UAAM,UAAU,SAAS,EAAE;AAC3B,QAAI,WAAW,MAAM,WAAW,IAAI;AAClC,UAAI,YAAY,GAAI,QAAO;AAC3B,aAAO,IAAI,IAAI;AAAA,IACjB,OAAO;AACL,YAAM,WAAW,kBAAkB,SAAS,QAAQ,MAAM;AAC1D,UAAI,aAAa,KAAM,QAAO;AAC9B,aAAO,IAAI,IAAI;AAAA,IACjB;AACA;AAAA,EACF;AAGA,MAAI,OAAO,SAAS,OAAQ,QAAO;AACnC,SAAO;AACT;","names":["relativePath"]}