@vm0/cli 9.237.4 → 9.238.0

package/chunk-YYANCEBQ.js

@@ -1,1179 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __createRequire } from "node:module";
-const require = __createRequire(import.meta.url);
-import {
-  hasBaseUrlParams,
-  hasRawWhitespace,
-  hasUnsafeFirewallPath,
-  hasUnsafeUrlCodepoint,
-  parseSegment,
-  splitPathSegments,
-  validateAuthBaseUrl,
-  validateBaseUrl
-} from "./chunk-JYENHNFY.js";
-import {
-  init_esm_shims
-} from "./chunk-DIRAZ3YX.js";
-
-// ../../packages/connectors/src/firewall-rule-matcher.ts
-init_esm_shims();
-var VALID_RULE_METHODS = /* @__PURE__ */ new Set([
-  "GET",
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE",
-  "HEAD",
-  "OPTIONS",
-  "ANY"
-]);
-var FORBIDDEN_RUNTIME_HOST_CHARS = new Set("#%*,/<>?@\\^|{}".split(""));
-var FORBIDDEN_BASE_PATTERN_HOST_CHARS = new Set("#%,/<>?@\\^|".split(""));
-var PERCENT_ESCAPE_LENGTH = 3;
-var HEX_DIGITS = new Set("0123456789abcdefABCDEF".split(""));
-var PATH_SCORE_MULTIPLIER = 1e6;
-var AUTHORITY_SCORE_MULTIPLIER = 100;
-var LITERAL_SEGMENT_SCORE = 1e3;
-var MIXED_PARAM_SEGMENT_SCORE = 100;
-var PLAIN_PARAM_SEGMENT_SCORE = 10;
-var PLUS_GREEDY_SEGMENT_SCORE = 1;
-var ROOT_PATH_SCORE = 1;
-var STATIC_BASE_SCORE_BONUS = 1;
-var PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS = /* @__PURE__ */ new Set([
-  "{",
-  "}",
-  "*",
-  ".",
-  "\u3002",
-  "\uFF0E",
-  "\uFF61",
-  ":"
-]);
-function matchMixedSegment(runtime, prefix, suffix) {
-  if (!runtime.startsWith(prefix)) return null;
-  if (!runtime.endsWith(suffix)) return null;
-  if (runtime.length <= prefix.length + suffix.length) return null;
-  return runtime.slice(prefix.length, runtime.length - suffix.length);
-}
-function hasNonEmptySegment(segments, start) {
-  for (let i = start; i < segments.length; i++) {
-    if (segments[i] !== "") return true;
-  }
-  return false;
-}
-function codePointLength(value) {
-  return [...value].length;
-}
-function hasUnsafeRuntimeUrlSyntax(value) {
-  return hasUnsafeUrlCodepoint(value) || hasRawWhitespace(value) || value.includes("\\") || !value.includes("://");
-}
-function stripTrailingSlash(value) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-function isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix) {
-  return patternIndex !== lastPatternIndex || prefix !== "" || suffix !== "";
-}
-function parseStrictMatchSegment(segment, patternIndex, lastPatternIndex) {
-  const parsed = parseSegment(segment);
-  if (parsed.kind === "error") return null;
-  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
-    patternIndex,
-    lastPatternIndex,
-    parsed.prefix,
-    parsed.suffix
-  )) {
-    return null;
-  }
-  return parsed;
-}
-function pathSpecificity(pattern) {
-  if (!pattern.startsWith("/") || pattern.includes("?") || pattern.includes("#") || pattern.includes("\\") || hasRawWhitespace(pattern) || hasUnsafeUrlCodepoint(pattern)) {
-    return null;
-  }
-  let literalSegments = 0;
-  let mixedParamSegments = 0;
-  let plainParamSegments = 0;
-  let plusGreedySegments = 0;
-  let starGreedySegments = 0;
-  let literalChars = 0;
-  const segments = splitPathSegments(pattern);
-  const paramNames = /* @__PURE__ */ new Set();
-  const lastSegmentIndex = segments.length - 1;
-  for (let index = 0; index < segments.length; index += 1) {
-    const seg = segments[index];
-    const parsed = parseSegment(seg);
-    if (parsed.kind === "error") return null;
-    if (parsed.kind === "literal") {
-      literalSegments += 1;
-      literalChars += codePointLength(parsed.value);
-      continue;
-    }
-    if (paramNames.has(parsed.name)) return null;
-    paramNames.add(parsed.name);
-    if (parsed.greedy !== "" && isInvalidGreedyParam(
-      index,
-      lastSegmentIndex,
-      parsed.prefix,
-      parsed.suffix
-    )) {
-      return null;
-    }
-    literalChars += codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
-    if (parsed.prefix !== "" || parsed.suffix !== "") {
-      mixedParamSegments += 1;
-    } else if (parsed.greedy === "+") {
-      plusGreedySegments += 1;
-    } else if (parsed.greedy === "*") {
-      starGreedySegments += 1;
-    } else {
-      plainParamSegments += 1;
-    }
-  }
-  return [
-    literalSegments,
-    mixedParamSegments,
-    plainParamSegments,
-    plusGreedySegments,
-    -starGreedySegments,
-    literalChars,
-    segments.length
-  ];
-}
-function comparePathSpecificity(left, right) {
-  for (let i = 0; i < left.length; i++) {
-    const difference = left[i] - right[i];
-    if (difference !== 0) return difference;
-  }
-  return 0;
-}
-function compileDecisionRule(permission, rule) {
-  const spaceIdx = rule.indexOf(" ");
-  if (spaceIdx === -1) return null;
-  const method = rule.slice(0, spaceIdx);
-  if (!VALID_RULE_METHODS.has(method)) return null;
-  const path = rule.slice(spaceIdx + 1);
-  const specificity = pathSpecificity(path);
-  if (specificity === null) return null;
-  return { permission, raw: rule, method, path, specificity };
-}
-function isValidPermissionName(permissionName) {
-  return permissionName !== "" && permissionName !== "all";
-}
-function isObjectRecord(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
-function isStringRecord(value) {
-  if (!isObjectRecord(value)) return false;
-  return Object.values(value).every((entry) => {
-    return typeof entry === "string";
-  });
-}
-function hasEntries(value) {
-  return value !== void 0 && Object.keys(value).length > 0;
-}
-function isValidAwsSigv4AuthConfig(value) {
-  if (!isObjectRecord(value)) return false;
-  const allowedKeys = /* @__PURE__ */ new Set([
-    "accessKeyId",
-    "secretAccessKey",
-    "sessionToken"
-  ]);
-  if (Object.keys(value).some((key) => {
-    return !allowedKeys.has(key);
-  })) {
-    return false;
-  }
-  if (typeof value.accessKeyId !== "string" || value.accessKeyId === "") {
-    return false;
-  }
-  if (typeof value.secretAccessKey !== "string" || value.secretAccessKey === "") {
-    return false;
-  }
-  const optionalValue = value.sessionToken;
-  if (optionalValue !== void 0 && (typeof optionalValue !== "string" || optionalValue === "")) {
-    return false;
-  }
-  return true;
-}
-function isValidAuthConfig(auth, serviceName) {
-  if (!isObjectRecord(auth)) return false;
-  if (auth.headers !== void 0 && !isStringRecord(auth.headers)) return false;
-  if (auth.query !== void 0 && !isStringRecord(auth.query)) return false;
-  if (auth.awsSigv4 !== void 0 && !isValidAwsSigv4AuthConfig(auth.awsSigv4)) {
-    return false;
-  }
-  if (auth.awsSigv4 !== void 0) {
-    if (hasEntries(auth.headers)) {
-      return false;
-    }
-    if (hasEntries(auth.query)) {
-      return false;
-    }
-  }
-  if (auth.base !== void 0) {
-    if (typeof auth.base !== "string") return false;
-    validateAuthBaseUrl(auth.base, serviceName);
-    if (auth.awsSigv4 !== void 0) return false;
-  }
-  return true;
-}
-function rawObjectHasOwn(value, key) {
-  return Object.prototype.hasOwnProperty.call(value, key);
-}
-function isValidAuthConfigForDecision(auth, serviceName) {
-  try {
-    return isValidAuthConfig(auth, serviceName);
-  } catch {
-    return false;
-  }
-}
-function compileDecisionApi(api, serviceName, nameMalformed) {
-  if (typeof api.base !== "string") return null;
-  let baseMalformed = false;
-  try {
-    validateBaseUrl(api.base, serviceName);
-  } catch {
-    baseMalformed = true;
-  }
-  const authMalformed = !isValidAuthConfigForDecision(api.auth, serviceName);
-  const rules = [];
-  const seenPermissionNames = /* @__PURE__ */ new Set();
-  let hasMalformedRules = nameMalformed;
-  const rawPermissions = api.permissions;
-  if (Array.isArray(rawPermissions)) {
-    for (const rawPermission of rawPermissions) {
-      if (!isObjectRecord(rawPermission)) {
-        hasMalformedRules = true;
-        continue;
-      }
-      const permissionName = rawPermission.name;
-      if (typeof permissionName !== "string" || !isValidPermissionName(permissionName)) {
-        hasMalformedRules = true;
-        continue;
-      }
-      if (seenPermissionNames.has(permissionName)) {
-        hasMalformedRules = true;
-        continue;
-      }
-      seenPermissionNames.add(permissionName);
-      const rawRules = rawPermission.rules;
-      if (!Array.isArray(rawRules)) {
-        hasMalformedRules = true;
-        continue;
-      }
-      if (rawRules.length === 0) {
-        hasMalformedRules = true;
-      }
-      for (const rawRule of rawRules) {
-        if (typeof rawRule !== "string") {
-          hasMalformedRules = true;
-          continue;
-        }
-        const compiledRule = compileDecisionRule(permissionName, rawRule);
-        if (compiledRule === null) {
-          hasMalformedRules = true;
-          continue;
-        }
-        rules.push(compiledRule);
-      }
-    }
-  } else if (rawObjectHasOwn(api, "permissions")) {
-    hasMalformedRules = true;
-  }
-  return {
-    rawBase: api.base,
-    baseMalformed,
-    authMalformed,
-    hasMalformedRules,
-    rules
-  };
-}
-function compileDecisionFirewall(rawFirewall) {
-  if (!isObjectRecord(rawFirewall)) return null;
-  const rawName = rawFirewall.name;
-  const nameMalformed = typeof rawName !== "string" || rawName === "";
-  const name = typeof rawName === "string" ? rawName : "";
-  const rawApis = rawFirewall.apis;
-  if (!Array.isArray(rawApis)) return null;
-  const apis = [];
-  for (const rawApi of rawApis) {
-    if (!isObjectRecord(rawApi)) continue;
-    const api = compileDecisionApi(rawApi, name, nameMalformed);
-    if (api !== null) {
-      apis.push(api);
-    }
-  }
-  if (apis.length === 0) return null;
-  return { name, nameMalformed, apis };
-}
-function compileDecisionFirewalls(rawFirewalls) {
-  if (!Array.isArray(rawFirewalls) || rawFirewalls.length === 0) return [];
-  const firewalls = [];
-  for (const rawFirewall of rawFirewalls) {
-    const firewall = compileDecisionFirewall(rawFirewall);
-    if (firewall !== null) {
-      firewalls.push(firewall);
-    }
-  }
-  return firewalls;
-}
-function compilePermissionSet(rawValue) {
-  if (rawValue === void 0 || rawValue === null) {
-    return { values: /* @__PURE__ */ new Set(), malformed: false };
-  }
-  if (!Array.isArray(rawValue) || rawValue.some((item) => {
-    return typeof item !== "string";
-  })) {
-    return { values: /* @__PURE__ */ new Set(), malformed: true };
-  }
-  return { values: new Set(rawValue), malformed: false };
-}
-function compileNetworkPolicies(rawNetworkPolicies) {
-  if (rawNetworkPolicies === void 0 || rawNetworkPolicies === null) {
-    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: false };
-  }
-  if (!isObjectRecord(rawNetworkPolicies)) {
-    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: true };
-  }
-  const policies = /* @__PURE__ */ new Map();
-  for (const [firewallName, grant] of Object.entries(rawNetworkPolicies)) {
-    if (!isObjectRecord(grant)) {
-      policies.set(firewallName, {
-        blockedPermissions: /* @__PURE__ */ new Set(),
-        unknownPolicy: "allow",
-        permissionMalformed: true,
-        unknownPolicyMalformed: false
-      });
-      continue;
-    }
-    const allow = compilePermissionSet(grant.allow);
-    const deny = compilePermissionSet(grant.deny);
-    const ask = compilePermissionSet(grant.ask);
-    const blockedPermissions = /* @__PURE__ */ new Set([...deny.values, ...ask.values]);
-    let unknownPolicy = "allow";
-    let unknownPolicyMalformed = false;
-    const rawUnknownPolicy = grant.unknownPolicy;
-    if (rawUnknownPolicy === "allow" || rawUnknownPolicy === "deny" || rawUnknownPolicy === "ask") {
-      unknownPolicy = rawUnknownPolicy;
-    } else if (rawUnknownPolicy !== void 0 && rawUnknownPolicy !== null) {
-      unknownPolicyMalformed = true;
-    }
-    policies.set(firewallName, {
-      blockedPermissions,
-      unknownPolicy,
-      permissionMalformed: allow.malformed || deny.malformed || ask.malformed,
-      unknownPolicyMalformed
-    });
-  }
-  return { policies, topLevelMalformed: false };
-}
-function relativePathFromSegments(segments, consumed) {
-  const rest = segments.slice(consumed).join("/");
-  return rest === "" ? "/" : `/${rest}`;
-}
-function stripUrlQueryAndFragment(url) {
-  const queryIndex = url.indexOf("?");
-  const fragmentIndex = url.indexOf("#");
-  let end = url.length;
-  if (queryIndex !== -1) end = Math.min(end, queryIndex);
-  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);
-  return url.slice(0, end);
-}
-function rawUrlAuthorityBounds(url) {
-  const schemeEnd = url.indexOf("://");
-  if (schemeEnd === -1) return null;
-  const authorityStart = schemeEnd + 3;
-  let authorityEnd = url.length;
-  for (const delimiter of ["/", "?", "#"]) {
-    const delimiterIndex = url.indexOf(delimiter, authorityStart);
-    if (delimiterIndex !== -1)
-      authorityEnd = Math.min(authorityEnd, delimiterIndex);
-  }
-  return { authorityStart, authorityEnd };
-}
-function replaceRawUrlAuthority(url, bounds, authority) {
-  return `${url.slice(0, bounds.authorityStart)}${authority}${url.slice(bounds.authorityEnd)}`;
-}
-function stripRawUrlUserinfo(url) {
-  const bounds = rawUrlAuthorityBounds(url);
-  if (bounds === null) return url;
-  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
-  const userinfoEnd = authority.lastIndexOf("@");
-  if (userinfoEnd === -1) return url;
-  return replaceRawUrlAuthority(url, bounds, authority.slice(userinfoEnd + 1));
-}
-function rawAuthorityPortIsMalformed(port) {
-  if (port === "") return true;
-  if (![...port].every((char) => {
-    return char >= "0" && char <= "9";
-  })) {
-    return true;
-  }
-  return Number(port) > 65535;
-}
-function stripRawUrlMalformedPort(url) {
-  const bounds = rawUrlAuthorityBounds(url);
-  if (bounds === null) return url;
-  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
-  if (authority.startsWith("[")) {
-    const closeBracketIndex = authority.indexOf("]");
-    if (closeBracketIndex === -1) return url;
-    const portPrefix = authority.slice(closeBracketIndex + 1);
-    if (!portPrefix.startsWith(":")) return url;
-    if (!rawAuthorityPortIsMalformed(portPrefix.slice(1))) return url;
-    return replaceRawUrlAuthority(
-      url,
-      bounds,
-      authority.slice(0, closeBracketIndex + 1)
-    );
-  }
-  const portSeparator = authority.lastIndexOf(":");
-  if (portSeparator === -1) return url;
-  if (authority.indexOf(":") !== portSeparator) return url;
-  if (!rawAuthorityPortIsMalformed(authority.slice(portSeparator + 1))) {
-    return url;
-  }
-  return replaceRawUrlAuthority(url, bounds, authority.slice(0, portSeparator));
-}
-function rawBaseForDecisionMatch(rawBase) {
-  if (stripUrlQueryAndFragment(rawBase).includes("\\")) return null;
-  return stripRawUrlMalformedPort(stripRawUrlUserinfo(rawBase));
-}
-function rawPathFromUrl(url) {
-  const urlWithoutQuery = stripUrlQueryAndFragment(url);
-  const schemeEnd = urlWithoutQuery.indexOf("://");
-  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
-  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
-  return pathStart === -1 ? "/" : urlWithoutQuery.slice(pathStart);
-}
-function rawBasePathFromUrl(url) {
-  const urlWithoutQuery = stripUrlQueryAndFragment(url);
-  const schemeEnd = urlWithoutQuery.indexOf("://");
-  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
-  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
-  return pathStart === -1 ? "" : urlWithoutQuery.slice(pathStart);
-}
-function rawAuthorityFromUrl(url) {
-  const urlWithoutQuery = stripUrlQueryAndFragment(url);
-  const schemeEnd = urlWithoutQuery.indexOf("://");
-  if (schemeEnd === -1) return null;
-  const authorityStart = schemeEnd + 3;
-  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
-  const authority = pathStart === -1 ? urlWithoutQuery.slice(authorityStart) : urlWithoutQuery.slice(authorityStart, pathStart);
-  return authority === "" ? null : authority;
-}
-function hasNonAscii(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    if (value.charCodeAt(index) > 127) return true;
-  }
-  return false;
-}
-function rawHostFromAuthority(authority) {
-  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
-  if (withoutUserinfo.startsWith("[")) {
-    const closeBracket = withoutUserinfo.indexOf("]");
-    return closeBracket === -1 ? withoutUserinfo : withoutUserinfo.slice(0, closeBracket + 1);
-  }
-  const portSeparator = withoutUserinfo.lastIndexOf(":");
-  return portSeparator === -1 ? withoutUserinfo : withoutUserinfo.slice(0, portSeparator);
-}
-function authorityHasEmptyPort(authority) {
-  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
-  if (withoutUserinfo.startsWith("[")) {
-    const closeBracket = withoutUserinfo.indexOf("]");
-    if (closeBracket === -1) return false;
-    return withoutUserinfo.slice(closeBracket + 1) === ":";
-  }
-  const portSeparator = withoutUserinfo.lastIndexOf(":");
-  if (portSeparator === -1) return false;
-  return withoutUserinfo.indexOf(":") === portSeparator && portSeparator === withoutUserinfo.length - 1;
-}
-function rawAuthorityHostStartsWithDigit(authority) {
-  const firstChar = rawHostFromAuthority(authority)[0];
-  return firstChar !== void 0 && firstChar >= "0" && firstChar <= "9";
-}
-function runtimeAuthorityOriginForHostValidation(url) {
-  const authority = rawAuthorityFromUrl(url);
-  if (authority === null) return null;
-  if (!authority.includes("%") && !hasNonAscii(authority) && !rawAuthorityHostStartsWithDigit(authority)) {
-    return null;
-  }
-  const schemeEnd = url.indexOf("://");
-  if (schemeEnd === -1) return null;
-  return `${url.slice(0, schemeEnd)}://${authority}`;
-}
-function hasPercentEncodedAuthoritySyntax(value) {
-  let index = value.indexOf("%");
-  while (index !== -1) {
-    let runEnd = index;
-    while (runEnd < value.length && value[runEnd] === "%") {
-      const firstHexDigit = value[runEnd + 1];
-      const secondHexDigit = value[runEnd + 2];
-      if (!firstHexDigit || !secondHexDigit || !HEX_DIGITS.has(firstHexDigit) || !HEX_DIGITS.has(secondHexDigit)) {
-        return true;
-      }
-      runEnd += PERCENT_ESCAPE_LENGTH;
-    }
-    let decodedRun;
-    try {
-      decodedRun = decodeURIComponent(value.slice(index, runEnd));
-    } catch {
-      return true;
-    }
-    for (const char of decodedRun) {
-      if (PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS.has(char)) {
-        return true;
-      }
-    }
-    index = value.indexOf("%", runEnd);
-  }
-  return false;
-}
-function hasMalformedRuntimeAuthoritySyntax(url) {
-  const authority = rawAuthorityFromUrl(url);
-  if (authority === null) return false;
-  return authority.includes("\\") || authorityHasEmptyPort(authority) || hasPercentEncodedAuthoritySyntax(authority);
-}
-function scoreLiteralSegment(segment) {
-  return LITERAL_SEGMENT_SCORE + codePointLength(segment);
-}
-function scoreParsedPatternSegment(parsed) {
-  if (parsed.kind === "literal") {
-    return scoreLiteralSegment(parsed.value);
-  }
-  const literalChars = codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
-  if (parsed.prefix !== "" || parsed.suffix !== "") {
-    return MIXED_PARAM_SEGMENT_SCORE + literalChars;
-  }
-  if (parsed.greedy === "+") return PLUS_GREEDY_SEGMENT_SCORE;
-  if (parsed.greedy === "*") return 0;
-  return PLAIN_PARAM_SEGMENT_SCORE;
-}
-function scoreStaticSegments(segments) {
-  return segments.reduce((score, segment) => {
-    return score + scoreLiteralSegment(segment);
-  }, 0);
-}
-function scorePatternSegmentsWithParser(segments, parsePatternSegment) {
-  const lastPatternIndex = segments.length - 1;
-  let score = 0;
-  for (let index = 0; index < segments.length; index += 1) {
-    const segment = segments[index];
-    const parsed = parsePatternSegment(segment, index, lastPatternIndex);
-    if (parsed !== null) {
-      score += scoreParsedPatternSegment(parsed);
-    }
-  }
-  return score;
-}
-function scorePathPattern(path, parsePatternSegment) {
-  if (path === "") return 0;
-  if (path === "/") return ROOT_PATH_SCORE;
-  const segments = splitPathSegments(path);
-  return parsePatternSegment === null ? scoreStaticSegments(segments) : scorePatternSegmentsWithParser(segments, parsePatternSegment);
-}
-function splitAuthoritySegments(authority) {
-  if (authority.startsWith("[")) return [authority];
-  const normalized = authority.endsWith(".") ? authority.slice(0, -1) : authority;
-  return normalized === "" ? [] : normalized.split(".");
-}
-function baseUrlSpecificityScore({
-  authority,
-  path,
-  hasParams,
-  tolerateMalformedBaseParams = false
-}) {
-  const patternParser = hasParams ? tolerateMalformedBaseParams ? parseMalformedTolerantBaseSegment : parseStrictMatchSegment : null;
-  const authoritySegments = splitAuthoritySegments(authority);
-  const authorityScore = patternParser === null ? scoreStaticSegments(authoritySegments) : scorePatternSegmentsWithParser(
-    [...authoritySegments].reverse(),
-    patternParser
-  );
-  const pathScore = scorePathPattern(path, patternParser);
-  return pathScore * PATH_SCORE_MULTIPLIER + authorityScore * AUTHORITY_SCORE_MULTIPLIER + (hasParams ? 0 : STATIC_BASE_SCORE_BONUS);
-}
-function matchStaticBasePathPrefix(path, pattern) {
-  if (pattern === "") {
-    return path === "" ? "/" : path;
-  }
-  if (pattern === "/") {
-    if (!path.startsWith(pattern)) return null;
-    const relativePath2 = path.slice(pattern.length);
-    if (relativePath2 !== "" && !relativePath2.startsWith("/")) return null;
-    return relativePath2 === "" ? "/" : relativePath2;
-  }
-  if (!path.startsWith(pattern)) return null;
-  const relativePath = path.slice(pattern.length);
-  if (relativePath !== "" && !relativePath.startsWith("/")) return null;
-  return relativePath === "" ? "/" : relativePath;
-}
-function normalizeUrlHostname(hostname, options = {}) {
-  let normalized = hostname.toLowerCase();
-  if (normalized.endsWith(".")) {
-    normalized = normalized.slice(0, -1);
-    if (normalized === "" || normalized.endsWith(".")) {
-      return null;
-    }
-  }
-  if (normalized.split(".").some((label) => {
-    return label === "";
-  })) {
-    return null;
-  }
-  const forbiddenChars = options.allowHostParams === true ? FORBIDDEN_BASE_PATTERN_HOST_CHARS : FORBIDDEN_RUNTIME_HOST_CHARS;
-  if (!normalized.startsWith("[") && [...normalized].some((char) => {
-    return forbiddenChars.has(char);
-  })) {
-    return null;
-  }
-  return normalized;
-}
-function normalizedUrlAuthority(parsed, options = {}) {
-  if (parsed.username !== "" || parsed.password !== "") {
-    return null;
-  }
-  const hostname = normalizeUrlHostname(parsed.hostname, options);
-  if (hostname === null || hostname === "") {
-    return null;
-  }
-  return parsed.port === "" ? hostname : `${hostname}:${parsed.port}`;
-}
-function matchStaticFirewallBaseUrl(url, rawBase, options = {}) {
-  const parsedUrl = new URL(url);
-  const parsedBase = new URL(rawBase);
-  if (parsedUrl.protocol.toLowerCase() !== parsedBase.protocol.toLowerCase()) {
-    return null;
-  }
-  const baseHasParams = hasBaseUrlParams(rawBase);
-  const baseForMatch = stripTrailingSlash(rawBase);
-  const urlAuthority = normalizedUrlAuthority(parsedUrl);
-  const baseAuthority = normalizedUrlAuthority(parsedBase, {
-    allowHostParams: baseHasParams
-  });
-  if (urlAuthority === null || baseAuthority === null) return null;
-  if (baseHasParams) {
-    const hostParams = options.tolerateMalformedBaseParams === true ? matchFirewallHostForMalformedBaseDecision(urlAuthority, baseAuthority) : matchFirewallHost(urlAuthority, baseAuthority);
-    if (hostParams === null) return null;
-  } else if (urlAuthority !== baseAuthority) {
-    return null;
-  }
-  const basePath = rawBasePathFromUrl(baseForMatch);
-  const relativePath = baseHasParams ? options.tolerateMalformedBaseParams === true ? matchFirewallPathPrefixForMalformedBaseDecision(
-    rawPathFromUrl(url),
-    basePath
-  ) : matchFirewallPathPrefix(rawPathFromUrl(url), basePath) : matchStaticBasePathPrefix(rawPathFromUrl(url), basePath);
-  if (relativePath === null) return null;
-  const displayBase = stripTrailingSlash(rawBase);
-  return {
-    displayBase,
-    relativePath,
-    score: baseUrlSpecificityScore({
-      authority: baseAuthority,
-      path: basePath,
-      hasParams: baseHasParams,
-      tolerateMalformedBaseParams: options.tolerateMalformedBaseParams === true
-    })
-  };
-}
-function runtimeUrlCanMatchFirewallBase(url) {
-  if (hasUnsafeUrlCodepoint(url) || hasRawWhitespace(url) || !url.includes("://") || hasMalformedRuntimeAuthoritySyntax(url)) {
-    return false;
-  }
-  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
-  if (runtimeAuthorityOrigin === null) return true;
-  try {
-    validateBaseUrl(runtimeAuthorityOrigin, "runtime");
-    return true;
-  } catch {
-    return false;
-  }
-}
-function matchFirewallBaseUrlForDecision(url, rawBase) {
-  if (!runtimeUrlCanMatchFirewallBase(url)) return null;
-  const baseForMatch = rawBaseForDecisionMatch(rawBase);
-  if (baseForMatch === null) return null;
-  try {
-    const match = matchStaticFirewallBaseUrl(url, baseForMatch, {
-      tolerateMalformedBaseParams: true
-    });
-    if (match === null) return null;
-    return { ...match, displayBase: stripTrailingSlash(rawBase) };
-  } catch {
-    return null;
-  }
-}
-function createDecisionState() {
-  return {
-    bestBaseScore: null,
-    bestRuleSpecificity: null,
-    baseMatch: null,
-    allowedMatch: null,
-    deniedMatch: null,
-    deniedPermissionNames: [],
-    malformedConfigMatch: null,
-    malformedPolicyMatch: null
-  };
-}
-function acceptDecisionBaseMatch(state, match, score) {
-  if (state.bestBaseScore === null || score > state.bestBaseScore) {
-    state.bestBaseScore = score;
-    state.bestRuleSpecificity = null;
-    state.baseMatch = null;
-    state.allowedMatch = null;
-    state.deniedMatch = null;
-    state.deniedPermissionNames = [];
-    state.malformedConfigMatch = null;
-    state.malformedPolicyMatch = null;
-  } else if (score < state.bestBaseScore) {
-    return false;
-  }
-  state.baseMatch ??= match;
-  return true;
-}
-function canRuleSpecificityAffectDecision(state, specificity) {
-  if (state.bestRuleSpecificity === null) return true;
-  const comparison = comparePathSpecificity(
-    specificity,
-    state.bestRuleSpecificity
-  );
-  if (comparison > 0) return true;
-  if (comparison < 0) return false;
-  return state.allowedMatch === null;
-}
-function acceptRuleSpecificity(state, specificity) {
-  if (state.bestRuleSpecificity === null) {
-    state.bestRuleSpecificity = specificity;
-    return true;
-  }
-  const comparison = comparePathSpecificity(
-    specificity,
-    state.bestRuleSpecificity
-  );
-  if (comparison > 0) {
-    state.bestRuleSpecificity = specificity;
-    state.allowedMatch = null;
-    state.deniedMatch = null;
-    state.deniedPermissionNames = [];
-    return true;
-  }
-  return comparison === 0;
-}
-function recordDeniedRule(state, match, permission) {
-  if (!state.deniedPermissionNames.includes(permission)) {
-    state.deniedPermissionNames.push(permission);
-  }
-  state.deniedMatch ??= match;
-}
-function resolveFirewallDecision(state, networkPolicies) {
-  const baseMatch = state.baseMatch;
-  if (baseMatch === null) {
-    return { kind: "no_match" };
-  }
-  if (state.allowedMatch !== null) {
-    return {
-      kind: "allow",
-      firewallName: state.allowedMatch.firewallName,
-      base: state.allowedMatch.base,
-      relativePath: state.allowedMatch.relativePath,
-      permission: state.allowedMatch.permission,
-      rule: state.allowedMatch.rule
-    };
-  }
-  if (state.deniedMatch !== null) {
-    return {
-      kind: "block",
-      firewallName: state.deniedMatch.firewallName,
-      base: state.deniedMatch.base,
-      relativePath: state.deniedMatch.relativePath,
-      reason: "permission_denied",
-      permissions: state.deniedPermissionNames
-    };
-  }
-  if (state.malformedPolicyMatch !== null) {
-    return {
-      kind: "block",
-      firewallName: state.malformedPolicyMatch.firewallName,
-      base: state.malformedPolicyMatch.base,
-      relativePath: state.malformedPolicyMatch.relativePath,
-      reason: "malformed_network_policy",
-      permissions: []
-    };
-  }
-  if (state.malformedConfigMatch !== null) {
-    return {
-      kind: "block",
-      firewallName: state.malformedConfigMatch.firewallName,
-      base: state.malformedConfigMatch.base,
-      relativePath: state.malformedConfigMatch.relativePath,
-      reason: "malformed_firewall_config",
-      permissions: []
-    };
-  }
-  const policy = networkPolicies.policies.get(baseMatch.firewallName);
-  if (policy === void 0) {
-    return {
-      kind: "allow",
-      firewallName: baseMatch.firewallName,
-      base: baseMatch.allowBase,
-      relativePath: baseMatch.relativePath
-    };
-  }
-  if (policy.unknownPolicyMalformed) {
-    return {
-      kind: "block",
-      firewallName: baseMatch.firewallName,
-      base: baseMatch.base,
-      relativePath: baseMatch.relativePath,
-      reason: "malformed_network_policy",
-      permissions: []
-    };
-  }
-  if (policy.unknownPolicy === "allow") {
-    return {
-      kind: "allow",
-      firewallName: baseMatch.firewallName,
-      base: baseMatch.allowBase,
-      relativePath: baseMatch.relativePath
-    };
-  }
-  return {
-    kind: "block",
-    firewallName: baseMatch.firewallName,
-    base: baseMatch.base,
-    relativePath: baseMatch.relativePath,
-    reason: "unknown_endpoint",
-    permissions: []
-  };
-}
-function unsafePathBlockDecision(firewall, baseMatch) {
-  return {
-    kind: "block",
-    firewallName: firewall.name,
-    base: baseMatch.displayBase,
-    relativePath: baseMatch.relativePath,
-    reason: "unsafe_path",
-    permissions: []
-  };
-}
-function recordMalformedDecisionState(state, api, blockMatch) {
-  if (api.baseMalformed || api.authMalformed || api.hasMalformedRules) {
-    state.malformedConfigMatch ??= blockMatch;
-  }
-}
-function apiCannotEvaluateRules(firewall, api) {
-  return firewall.nameMalformed || api.baseMalformed || api.authMalformed;
-}
-function policyCannotEvaluateRules(networkPolicies, policy) {
-  return networkPolicies.topLevelMalformed || policy !== void 0 && policy.permissionMalformed;
-}
-function evaluateDecisionRule({
-  state,
-  rule,
-  policy,
-  blockMatch,
-  baseMatch,
-  upperMethod
-}) {
-  if (rule.method !== "ANY" && rule.method !== upperMethod) return;
-  if (!canRuleSpecificityAffectDecision(state, rule.specificity)) return;
-  const permissionBlocked = policy !== void 0 && policy.blockedPermissions.has(rule.permission);
-  if (matchFirewallPath(baseMatch.relativePath, rule.path) === null) return;
-  if (!acceptRuleSpecificity(state, rule.specificity)) return;
-  if (permissionBlocked) {
-    recordDeniedRule(state, blockMatch, rule.permission);
-    return;
-  }
-  state.allowedMatch ??= {
-    firewallName: baseMatch.firewallName,
-    base: baseMatch.allowBase,
-    relativePath: baseMatch.relativePath,
-    permission: rule.permission,
-    rule: rule.raw
-  };
-}
-function evaluateDecisionRules({
-  state,
-  api,
-  policy,
-  blockMatch,
-  baseMatch,
-  upperMethod
-}) {
-  for (const rule of api.rules) {
-    evaluateDecisionRule({
-      state,
-      rule,
-      policy,
-      blockMatch,
-      baseMatch,
-      upperMethod
-    });
-  }
-}
-function evaluateDecisionApi({
-  state,
-  firewall,
-  api,
-  url,
-  unsafePath,
-  networkPolicies,
-  upperMethod
-}) {
-  const policy = networkPolicies.policies.get(firewall.name);
-  const baseMatch = matchFirewallBaseUrlForDecision(url, api.rawBase);
-  if (baseMatch === null) return null;
-  if (unsafePath) return unsafePathBlockDecision(firewall, baseMatch);
-  const decisionBaseMatch = {
-    firewallName: firewall.name,
-    base: baseMatch.displayBase,
-    allowBase: api.rawBase,
-    relativePath: baseMatch.relativePath
-  };
-  const blockMatch = {
-    firewallName: decisionBaseMatch.firewallName,
-    base: decisionBaseMatch.base,
-    relativePath: decisionBaseMatch.relativePath
-  };
-  if (!acceptDecisionBaseMatch(state, decisionBaseMatch, baseMatch.score)) {
-    return null;
-  }
-  recordMalformedDecisionState(state, api, blockMatch);
-  if (apiCannotEvaluateRules(firewall, api)) return null;
-  if (policyCannotEvaluateRules(networkPolicies, policy)) {
-    state.malformedPolicyMatch ??= blockMatch;
-    return null;
-  }
-  evaluateDecisionRules({
-    state,
-    api,
-    policy,
-    blockMatch,
-    baseMatch: decisionBaseMatch,
-    upperMethod
-  });
-  return null;
-}
-function matchFirewallBaseUrl(url, rawBase) {
-  if (hasUnsafeRuntimeUrlSyntax(url) || hasMalformedRuntimeAuthoritySyntax(url)) {
-    return null;
-  }
-  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
-  try {
-    if (runtimeAuthorityOrigin !== null) {
-      validateBaseUrl(runtimeAuthorityOrigin, "runtime");
-    }
-    validateBaseUrl(rawBase, "firewall");
-    return matchStaticFirewallBaseUrl(url, rawBase);
-  } catch {
-    return null;
-  }
-}
-function matchFirewallRequestDecision(firewalls, method, url, networkPolicies = void 0) {
-  const decisionFirewalls = compileDecisionFirewalls(firewalls);
-  if (decisionFirewalls.length === 0) return { kind: "no_match" };
-  const compiledNetworkPolicies = compileNetworkPolicies(networkPolicies);
-  const upperMethod = method.toUpperCase();
-  const state = createDecisionState();
-  const unsafePath = url.includes("\\") || hasUnsafeFirewallPath(rawPathFromUrl(url));
-  for (const firewall of decisionFirewalls) {
-    for (const api of firewall.apis) {
-      const immediateDecision = evaluateDecisionApi({
-        state,
-        firewall,
-        api,
-        url,
-        unsafePath,
-        networkPolicies: compiledNetworkPolicies,
-        upperMethod
-      });
-      if (immediateDecision !== null) {
-        return immediateDecision;
-      }
-    }
-  }
-  return resolveFirewallDecision(state, compiledNetworkPolicies);
-}
-function matchFirewallHostWithParser(host, pattern, parsePatternSegment) {
-  const hostSegsOrig = host.split(".");
-  const hostSegsLower = hostSegsOrig.map((segment) => {
-    return segment.toLowerCase();
-  });
-  const patternSegs = pattern.split(".").reverse();
-  hostSegsOrig.reverse();
-  hostSegsLower.reverse();
-  const params = {};
-  let hi = 0;
-  const lastPatternIndex = patternSegs.length - 1;
-  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
-    const seg = patternSegs[patternIndex];
-    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
-    if (parsed === null) return null;
-    if (parsed.kind === "literal") {
-      if (hi >= hostSegsLower.length || hostSegsLower[hi] !== parsed.value.toLowerCase()) {
-        return null;
-      }
-      hi += 1;
-      continue;
-    }
-    const { name, prefix, suffix, greedy } = parsed;
-    if (greedy === "+") {
-      if (hi >= hostSegsOrig.length) return null;
-      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
-      return params;
-    }
-    if (greedy === "*") {
-      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
-      return params;
-    }
-    if (hi >= hostSegsOrig.length) return null;
-    if (prefix === "" && suffix === "") {
-      params[name] = hostSegsLower[hi];
-    } else {
-      const captured = matchMixedSegment(
-        hostSegsLower[hi],
-        prefix.toLowerCase(),
-        suffix.toLowerCase()
-      );
-      if (captured === null) return null;
-      params[name] = captured;
-    }
-    hi += 1;
-  }
-  return hi === hostSegsOrig.length ? params : null;
-}
-function matchFirewallHost(host, pattern) {
-  return matchFirewallHostWithParser(host, pattern, parseStrictMatchSegment);
-}
-function parseMalformedTolerantBaseSegment(segment, patternIndex, lastPatternIndex) {
-  const parsed = parseSegment(segment);
-  if (parsed.kind === "error") {
-    return {
-      kind: "param",
-      prefix: "",
-      name: `__malformed_base_segment_${patternIndex}`,
-      suffix: "",
-      greedy: ""
-    };
-  }
-  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
-    patternIndex,
-    lastPatternIndex,
-    parsed.prefix,
-    parsed.suffix
-  )) {
-    return { ...parsed, greedy: "" };
-  }
-  return parsed;
-}
-function matchFirewallHostForMalformedBaseDecision(host, pattern) {
-  return matchFirewallHostWithParser(
-    host,
-    pattern,
-    parseMalformedTolerantBaseSegment
-  );
-}
-function matchFirewallPathPrefixWithParser(path, pattern, parsePatternSegment) {
-  const pathSegs = splitPathSegments(path);
-  const patternSegs = splitPathSegments(pattern);
-  let pi = 0;
-  const lastPatternIndex = patternSegs.length - 1;
-  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
-    const seg = patternSegs[patternIndex];
-    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
-    if (parsed === null) return null;
-    if (parsed.kind === "literal") {
-      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
-      pi += 1;
-      continue;
-    }
-    const { prefix, suffix, greedy } = parsed;
-    if (greedy === "+") {
-      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
-        return null;
-      }
-      return "/";
-    }
-    if (greedy === "*") {
-      return "/";
-    }
-    if (pi >= pathSegs.length) return null;
-    const runtime = pathSegs[pi];
-    if (prefix === "" && suffix === "") {
-      if (runtime === "") return null;
-    } else if (matchMixedSegment(runtime, prefix, suffix) === null) {
-      return null;
-    }
-    pi += 1;
-  }
-  return relativePathFromSegments(pathSegs, pi);
-}
-function matchFirewallPathPrefix(path, pattern) {
-  return matchFirewallPathPrefixWithParser(
-    path,
-    pattern,
-    parseStrictMatchSegment
-  );
-}
-function matchFirewallPathPrefixForMalformedBaseDecision(path, pattern) {
-  return matchFirewallPathPrefixWithParser(
-    path,
-    pattern,
-    parseMalformedTolerantBaseSegment
-  );
-}
-function matchFirewallPath(path, pattern) {
-  const pathSegs = splitPathSegments(path);
-  const patternSegs = splitPathSegments(pattern);
-  const params = {};
-  let pi = 0;
-  const lastPatternIndex = patternSegs.length - 1;
-  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
-    const seg = patternSegs[patternIndex];
-    const parsed = parseSegment(seg);
-    if (parsed.kind === "error") return null;
-    if (parsed.kind === "literal") {
-      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
-      pi++;
-      continue;
-    }
-    const { name, prefix, suffix, greedy } = parsed;
-    if (greedy === "+") {
-      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
-        return null;
-      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
-        return null;
-      }
-      params[name] = pathSegs.slice(pi).join("/");
-      return params;
-    }
-    if (greedy === "*") {
-      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
-        return null;
-      params[name] = pathSegs.slice(pi).join("/");
-      return params;
-    }
-    if (pi >= pathSegs.length) return null;
-    const runtime = pathSegs[pi];
-    if (prefix === "" && suffix === "") {
-      if (runtime === "") return null;
-      params[name] = runtime;
-    } else {
-      const captured = matchMixedSegment(runtime, prefix, suffix);
-      if (captured === null) return null;
-      params[name] = captured;
-    }
-    pi++;
-  }
-  if (pi !== pathSegs.length) return null;
-  return params;
-}
-
-export {
-  matchFirewallBaseUrl,
-  matchFirewallRequestDecision
-};
-//# sourceMappingURL=chunk-YYANCEBQ.js.map