@vm0/cli 9.238.2 → 9.238.4

package/{chunk-5IL2HDF6.js → chunk-GA7UX3FL.js}

@@ -1,9 +1,19 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
+import {
+  hasBaseUrlParams,
+  hasRawWhitespace,
+  hasUnsafeFirewallPath,
+  hasUnsafeUrlCodepoint,
+  parseSegment,
+  splitPathSegments,
+  validateAuthBaseUrl,
+  validateBaseUrl
+} from "./chunk-XVW5RA46.js";
 import {
   external_exports
-} from "./chunk-LSV2VNTU.js";
+} from "./chunk-CYF7PHDS.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -547,6 +557,63 @@ var googleCalendar = {
   }
 };
 
+// ../../packages/connectors/src/connectors/google-contacts.ts
+init_esm_shims();
+var googleContacts = {
+  "google-contacts": {
+    label: "Google Contacts",
+    category: "communication-collaboration",
+    tags: ["contacts", "address-book", "people"],
+    helpText: "Connect your Google account to access and manage contacts and contact groups",
+    authMethods: {
+      oauth: {
+        featureFlag: "googleContactsConnector" /* GoogleContactsConnector */,
+        label: "OAuth (Recommended)",
+        helpText: "Sign in with Google to grant Google Contacts access.",
+        client: {
+          clientRegistration: "static",
+          clientType: "confidential",
+          clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+          clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+        },
+        storage: {
+          secrets: [
+            "GOOGLE_CONTACTS_ACCESS_TOKEN",
+            "GOOGLE_CONTACTS_REFRESH_TOKEN"
+          ],
+          variables: []
+        },
+        grant: {
+          kind: "auth-code",
+          scopes: [
+            "https://www.googleapis.com/auth/contacts",
+            "https://www.googleapis.com/auth/userinfo.email"
+          ],
+          outputs: {
+            accessToken: "$secrets.GOOGLE_CONTACTS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_CONTACTS_REFRESH_TOKEN"
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            refreshToken: "$secrets.GOOGLE_CONTACTS_REFRESH_TOKEN"
+          },
+          outputs: {
+            accessToken: "$secrets.GOOGLE_CONTACTS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_CONTACTS_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["GOOGLE_CONTACTS_ACCESS_TOKEN"],
+          envBindings: {
+            GOOGLE_CONTACTS_TOKEN: "$secrets.GOOGLE_CONTACTS_ACCESS_TOKEN"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/google-docs.ts
 init_esm_shims();
 var googleDocs = {
@@ -599,6 +666,61 @@ var googleDocs = {
   }
 };
 
+// ../../packages/connectors/src/connectors/google-forms.ts
+init_esm_shims();
+var googleForms = {
+  "google-forms": {
+    label: "Google Forms",
+    category: "docs-files-knowledge",
+    tags: ["forms", "surveys", "questionnaires", "responses"],
+    helpText: "Connect your Google account to create and manage forms and read responses",
+    authMethods: {
+      oauth: {
+        featureFlag: "googleFormsConnector" /* GoogleFormsConnector */,
+        label: "OAuth (Recommended)",
+        helpText: "Sign in with Google to grant Google Forms access.",
+        client: {
+          clientRegistration: "static",
+          clientType: "confidential",
+          clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+          clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+        },
+        storage: {
+          secrets: ["GOOGLE_FORMS_ACCESS_TOKEN", "GOOGLE_FORMS_REFRESH_TOKEN"],
+          variables: []
+        },
+        grant: {
+          kind: "auth-code",
+          scopes: [
+            "https://www.googleapis.com/auth/forms.body",
+            "https://www.googleapis.com/auth/forms.responses.readonly",
+            "https://www.googleapis.com/auth/userinfo.email"
+          ],
+          outputs: {
+            accessToken: "$secrets.GOOGLE_FORMS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_FORMS_REFRESH_TOKEN"
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            refreshToken: "$secrets.GOOGLE_FORMS_REFRESH_TOKEN"
+          },
+          outputs: {
+            accessToken: "$secrets.GOOGLE_FORMS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_FORMS_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["GOOGLE_FORMS_ACCESS_TOKEN"],
+          envBindings: {
+            GOOGLE_FORMS_TOKEN: "$secrets.GOOGLE_FORMS_ACCESS_TOKEN"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/google-cloud.ts
 init_esm_shims();
 var googleCloud = {
@@ -14143,7 +14265,9 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...slock,
   ...googleSheets,
   ...googleCalendar,
+  ...googleContacts,
   ...googleDocs,
+  ...googleForms,
   ...linear,
   ...intervalsIcu,
   ...vercel,
@@ -14495,9 +14619,6 @@ function connectorRuntimeEnvBindings(envBindings) {
     })
   );
 }
-function connectorAuthMethodOwnedSecretNames(method) {
-  return method ? [...method.storage.secrets] : [];
-}
 function getConnectorAuthMethodEnvBindings(type, authMethod) {
   const method = getConnectorAuthMethod(type, authMethod);
   return method ? connectorAccessRuntimeEnvBindings(method.access) : {};
@@ -14512,31 +14633,6 @@ function getConnectorEnvBindingEntries(type) {
   }
   return entries;
 }
-function getConnectorStoredSecretDisplayInfo(secretName) {
-  const allTypes = CONNECTOR_TYPE_KEYS;
-  for (const type of allTypes) {
-    const config = CONNECTOR_TYPES[type];
-    const found = Object.values(config.authMethods).some((method) => {
-      return connectorAuthMethodOwnedSecretNames(method).includes(secretName);
-    });
-    if (!found) {
-      continue;
-    }
-    const envNames = [
-      ...new Set(
-        getConnectorEnvBindingEntries(type).filter(({ valueRef }) => {
-          return valueRef === `$secrets.${secretName}`;
-        }).map(({ envName }) => {
-          return envName;
-        })
-      )
-    ];
-    if (envNames.length > 0) {
-      return { connectorLabel: config.label, envNames };
-    }
-  }
-  return null;
-}
 function getDiagnosticConnectorTypeForRuntimeEnvName(envName) {
   for (const type of CONNECTOR_TYPE_KEYS) {
     const hasEnvName = getConnectorEnvBindingEntries(type).some((entry) => {
@@ -14549,10 +14645,1290 @@ function getDiagnosticConnectorTypeForRuntimeEnvName(envName) {
   return null;
 }
 
+// ../../packages/connectors/src/firewall-rule-matcher.ts
+init_esm_shims();
+var VALID_RULE_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "ANY"
+]);
+var FORBIDDEN_RUNTIME_HOST_CHARS = new Set("#%*,/<>?@\\^|{}".split(""));
+var FORBIDDEN_BASE_PATTERN_HOST_CHARS = new Set("#%,/<>?@\\^|".split(""));
+var PERCENT_ESCAPE_LENGTH = 3;
+var HEX_DIGITS = new Set("0123456789abcdefABCDEF".split(""));
+var PATH_SCORE_MULTIPLIER = 1e6;
+var AUTHORITY_SCORE_MULTIPLIER = 100;
+var LITERAL_SEGMENT_SCORE = 1e3;
+var MIXED_PARAM_SEGMENT_SCORE = 100;
+var PLAIN_PARAM_SEGMENT_SCORE = 10;
+var PLUS_GREEDY_SEGMENT_SCORE = 1;
+var ROOT_PATH_SCORE = 1;
+var STATIC_BASE_SCORE_BONUS = 1;
+var PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS = /* @__PURE__ */ new Set([
+  "{",
+  "}",
+  "*",
+  ".",
+  "\u3002",
+  "\uFF0E",
+  "\uFF61",
+  ":"
+]);
+function matchMixedSegment(runtime2, prefix, suffix) {
+  if (!runtime2.startsWith(prefix)) return null;
+  if (!runtime2.endsWith(suffix)) return null;
+  if (runtime2.length <= prefix.length + suffix.length) return null;
+  return runtime2.slice(prefix.length, runtime2.length - suffix.length);
+}
+function hasNonEmptySegment(segments, start) {
+  for (let i = start; i < segments.length; i++) {
+    if (segments[i] !== "") return true;
+  }
+  return false;
+}
+function codePointLength(value) {
+  return [...value].length;
+}
+function hasUnsafeRuntimeUrlSyntax(value) {
+  return hasUnsafeUrlCodepoint(value) || hasRawWhitespace(value) || value.includes("\\") || !value.includes("://");
+}
+function stripTrailingSlash(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix) {
+  return patternIndex !== lastPatternIndex || prefix !== "" || suffix !== "";
+}
+function parseStrictMatchSegment(segment2, patternIndex, lastPatternIndex) {
+  const parsed = parseSegment(segment2);
+  if (parsed.kind === "error") return null;
+  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
+    patternIndex,
+    lastPatternIndex,
+    parsed.prefix,
+    parsed.suffix
+  )) {
+    return null;
+  }
+  return parsed;
+}
+function pathSpecificity(pattern) {
+  if (!pattern.startsWith("/") || pattern.includes("?") || pattern.includes("#") || pattern.includes("\\") || hasRawWhitespace(pattern) || hasUnsafeUrlCodepoint(pattern)) {
+    return null;
+  }
+  let literalSegments = 0;
+  let mixedParamSegments = 0;
+  let plainParamSegments = 0;
+  let plusGreedySegments = 0;
+  let starGreedySegments = 0;
+  let literalChars = 0;
+  const segments = splitPathSegments(pattern);
+  const paramNames = /* @__PURE__ */ new Set();
+  const lastSegmentIndex = segments.length - 1;
+  for (let index = 0; index < segments.length; index += 1) {
+    const seg = segments[index];
+    const parsed = parseSegment(seg);
+    if (parsed.kind === "error") return null;
+    if (parsed.kind === "literal") {
+      literalSegments += 1;
+      literalChars += codePointLength(parsed.value);
+      continue;
+    }
+    if (paramNames.has(parsed.name)) return null;
+    paramNames.add(parsed.name);
+    if (parsed.greedy !== "" && isInvalidGreedyParam(
+      index,
+      lastSegmentIndex,
+      parsed.prefix,
+      parsed.suffix
+    )) {
+      return null;
+    }
+    literalChars += codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
+    if (parsed.prefix !== "" || parsed.suffix !== "") {
+      mixedParamSegments += 1;
+    } else if (parsed.greedy === "+") {
+      plusGreedySegments += 1;
+    } else if (parsed.greedy === "*") {
+      starGreedySegments += 1;
+    } else {
+      plainParamSegments += 1;
+    }
+  }
+  return [
+    literalSegments,
+    mixedParamSegments,
+    plainParamSegments,
+    plusGreedySegments,
+    -starGreedySegments,
+    literalChars,
+    segments.length
+  ];
+}
+function comparePathSpecificity(left, right) {
+  for (let i = 0; i < left.length; i++) {
+    const difference = left[i] - right[i];
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+function compileDecisionRule(permission, rule) {
+  const spaceIdx = rule.indexOf(" ");
+  if (spaceIdx === -1) return null;
+  const method = rule.slice(0, spaceIdx);
+  if (!VALID_RULE_METHODS.has(method)) return null;
+  const path = rule.slice(spaceIdx + 1);
+  const specificity = pathSpecificity(path);
+  if (specificity === null) return null;
+  return { permission, raw: rule, method, path, specificity };
+}
+function isValidPermissionName(permissionName) {
+  return permissionName !== "" && permissionName !== "all";
+}
+function isObjectRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function isStringRecord(value) {
+  if (!isObjectRecord(value)) return false;
+  return Object.values(value).every((entry) => {
+    return typeof entry === "string";
+  });
+}
+function hasEntries(value) {
+  return value !== void 0 && Object.keys(value).length > 0;
+}
+function isValidAwsSigv4AuthConfig(value) {
+  if (!isObjectRecord(value)) return false;
+  const allowedKeys = /* @__PURE__ */ new Set([
+    "accessKeyId",
+    "secretAccessKey",
+    "sessionToken"
+  ]);
+  if (Object.keys(value).some((key) => {
+    return !allowedKeys.has(key);
+  })) {
+    return false;
+  }
+  if (typeof value.accessKeyId !== "string" || value.accessKeyId === "") {
+    return false;
+  }
+  if (typeof value.secretAccessKey !== "string" || value.secretAccessKey === "") {
+    return false;
+  }
+  const optionalValue = value.sessionToken;
+  if (optionalValue !== void 0 && (typeof optionalValue !== "string" || optionalValue === "")) {
+    return false;
+  }
+  return true;
+}
+function isValidAuthConfig(auth, serviceName) {
+  if (!isObjectRecord(auth)) return false;
+  if (auth.headers !== void 0 && !isStringRecord(auth.headers)) return false;
+  if (auth.query !== void 0 && !isStringRecord(auth.query)) return false;
+  if (auth.awsSigv4 !== void 0 && !isValidAwsSigv4AuthConfig(auth.awsSigv4)) {
+    return false;
+  }
+  if (auth.awsSigv4 !== void 0) {
+    if (hasEntries(auth.headers)) {
+      return false;
+    }
+    if (hasEntries(auth.query)) {
+      return false;
+    }
+  }
+  if (auth.base !== void 0) {
+    if (typeof auth.base !== "string") return false;
+    validateAuthBaseUrl(auth.base, serviceName);
+    if (auth.awsSigv4 !== void 0) return false;
+  }
+  return true;
+}
+function rawObjectHasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function isValidAuthConfigForDecision(auth, serviceName) {
+  try {
+    return isValidAuthConfig(auth, serviceName);
+  } catch {
+    return false;
+  }
+}
+function canonicalJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? JSON.stringify(value) : void 0;
+  }
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const item of value) {
+      const encoded = canonicalJson(item);
+      if (encoded === void 0) return void 0;
+      items.push(encoded);
+    }
+    return `[${items.join(",")}]`;
+  }
+  if (!isObjectRecord(value)) return void 0;
+  const entries = [];
+  for (const key of Object.keys(value).sort()) {
+    const item = value[key];
+    if (item === void 0) continue;
+    const encoded = canonicalJson(item);
+    if (encoded === void 0) return void 0;
+    entries.push(`${JSON.stringify(key)}:${encoded}`);
+  }
+  return `{${entries.join(",")}}`;
+}
+function decisionApiRoutingIdentity(api) {
+  return canonicalJson({
+    base: api.base,
+    hostPolicy: api.hostPolicy,
+    auth: api.auth
+  }) ?? null;
+}
+function compileDecisionApi(api, serviceName, nameMalformed) {
+  if (typeof api.base !== "string") return null;
+  let baseMalformed = false;
+  try {
+    validateBaseUrl(api.base, serviceName);
+  } catch {
+    baseMalformed = true;
+  }
+  const authMalformed = !isValidAuthConfigForDecision(api.auth, serviceName);
+  const routingIdentity = decisionApiRoutingIdentity(api);
+  const rules = [];
+  const seenPermissionNames = /* @__PURE__ */ new Set();
+  let hasMalformedRules = nameMalformed;
+  const rawPermissions = api.permissions;
+  if (Array.isArray(rawPermissions)) {
+    for (const rawPermission of rawPermissions) {
+      if (!isObjectRecord(rawPermission)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      const permissionName = rawPermission.name;
+      if (typeof permissionName !== "string" || !isValidPermissionName(permissionName)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      if (seenPermissionNames.has(permissionName)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      seenPermissionNames.add(permissionName);
+      const rawRules = rawPermission.rules;
+      if (!Array.isArray(rawRules)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      if (rawRules.length === 0) {
+        hasMalformedRules = true;
+      }
+      for (const rawRule of rawRules) {
+        if (typeof rawRule !== "string") {
+          hasMalformedRules = true;
+          continue;
+        }
+        const compiledRule = compileDecisionRule(permissionName, rawRule);
+        if (compiledRule === null) {
+          hasMalformedRules = true;
+          continue;
+        }
+        rules.push(compiledRule);
+      }
+    }
+  } else if (rawObjectHasOwn(api, "permissions")) {
+    hasMalformedRules = true;
+  }
+  return {
+    rawBase: api.base,
+    baseMalformed,
+    authMalformed,
+    hasMalformedRules,
+    routingIdentity,
+    rules
+  };
+}
+function compileDecisionFirewall(rawFirewall) {
+  if (!isObjectRecord(rawFirewall)) return null;
+  const rawName = rawFirewall.name;
+  const nameMalformed = typeof rawName !== "string" || rawName === "";
+  const name = typeof rawName === "string" ? rawName : "";
+  const rawApis = rawFirewall.apis;
+  if (!Array.isArray(rawApis)) return null;
+  const apis = [];
+  for (const rawApi of rawApis) {
+    if (!isObjectRecord(rawApi)) continue;
+    const api = compileDecisionApi(rawApi, name, nameMalformed);
+    if (api !== null) {
+      apis.push(api);
+    }
+  }
+  if (apis.length === 0) return null;
+  return { name, nameMalformed, apis };
+}
+function compileDecisionFirewalls(rawFirewalls) {
+  if (!Array.isArray(rawFirewalls) || rawFirewalls.length === 0) return [];
+  const firewalls = [];
+  for (const rawFirewall of rawFirewalls) {
+    const firewall = compileDecisionFirewall(rawFirewall);
+    if (firewall !== null) {
+      firewalls.push(firewall);
+    }
+  }
+  return firewalls;
+}
+function compilePermissionSet(rawValue) {
+  if (rawValue === void 0 || rawValue === null) {
+    return { values: /* @__PURE__ */ new Set(), malformed: false };
+  }
+  if (!Array.isArray(rawValue) || rawValue.some((item) => {
+    return typeof item !== "string";
+  })) {
+    return { values: /* @__PURE__ */ new Set(), malformed: true };
+  }
+  return { values: new Set(rawValue), malformed: false };
+}
+function compileNetworkPolicies(rawNetworkPolicies) {
+  if (rawNetworkPolicies === void 0 || rawNetworkPolicies === null) {
+    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: false };
+  }
+  if (!isObjectRecord(rawNetworkPolicies)) {
+    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: true };
+  }
+  const policies = /* @__PURE__ */ new Map();
+  for (const [firewallName, grant] of Object.entries(rawNetworkPolicies)) {
+    if (!isObjectRecord(grant)) {
+      policies.set(firewallName, {
+        blockedPermissions: /* @__PURE__ */ new Set(),
+        unknownPolicy: "allow",
+        permissionMalformed: true,
+        unknownPolicyMalformed: false
+      });
+      continue;
+    }
+    const allow = compilePermissionSet(grant.allow);
+    const deny = compilePermissionSet(grant.deny);
+    const ask = compilePermissionSet(grant.ask);
+    const blockedPermissions = /* @__PURE__ */ new Set([...deny.values, ...ask.values]);
+    let unknownPolicy = "allow";
+    let unknownPolicyMalformed = false;
+    const rawUnknownPolicy = grant.unknownPolicy;
+    if (rawUnknownPolicy === "allow" || rawUnknownPolicy === "deny" || rawUnknownPolicy === "ask") {
+      unknownPolicy = rawUnknownPolicy;
+    } else if (rawUnknownPolicy !== void 0 && rawUnknownPolicy !== null) {
+      unknownPolicyMalformed = true;
+    }
+    policies.set(firewallName, {
+      blockedPermissions,
+      unknownPolicy,
+      permissionMalformed: allow.malformed || deny.malformed || ask.malformed,
+      unknownPolicyMalformed
+    });
+  }
+  return { policies, topLevelMalformed: false };
+}
+function relativePathFromSegments(segments, consumed) {
+  const rest = segments.slice(consumed).join("/");
+  return rest === "" ? "/" : `/${rest}`;
+}
+function stripUrlQueryAndFragment(url) {
+  const queryIndex = url.indexOf("?");
+  const fragmentIndex = url.indexOf("#");
+  let end = url.length;
+  if (queryIndex !== -1) end = Math.min(end, queryIndex);
+  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);
+  return url.slice(0, end);
+}
+function rawUrlAuthorityBounds(url) {
+  const schemeEnd = url.indexOf("://");
+  if (schemeEnd === -1) return null;
+  const authorityStart = schemeEnd + 3;
+  let authorityEnd = url.length;
+  for (const delimiter of ["/", "?", "#"]) {
+    const delimiterIndex = url.indexOf(delimiter, authorityStart);
+    if (delimiterIndex !== -1)
+      authorityEnd = Math.min(authorityEnd, delimiterIndex);
+  }
+  return { authorityStart, authorityEnd };
+}
+function replaceRawUrlAuthority(url, bounds, authority) {
+  return `${url.slice(0, bounds.authorityStart)}${authority}${url.slice(bounds.authorityEnd)}`;
+}
+function stripRawUrlUserinfo(url) {
+  const bounds = rawUrlAuthorityBounds(url);
+  if (bounds === null) return url;
+  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
+  const userinfoEnd = authority.lastIndexOf("@");
+  if (userinfoEnd === -1) return url;
+  return replaceRawUrlAuthority(url, bounds, authority.slice(userinfoEnd + 1));
+}
+function rawAuthorityPortIsMalformed(port) {
+  if (port === "") return true;
+  if (![...port].every((char) => {
+    return char >= "0" && char <= "9";
+  })) {
+    return true;
+  }
+  return Number(port) > 65535;
+}
+function stripRawUrlMalformedPort(url) {
+  const bounds = rawUrlAuthorityBounds(url);
+  if (bounds === null) return url;
+  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
+  if (authority.startsWith("[")) {
+    const closeBracketIndex = authority.indexOf("]");
+    if (closeBracketIndex === -1) return url;
+    const portPrefix = authority.slice(closeBracketIndex + 1);
+    if (!portPrefix.startsWith(":")) return url;
+    if (!rawAuthorityPortIsMalformed(portPrefix.slice(1))) return url;
+    return replaceRawUrlAuthority(
+      url,
+      bounds,
+      authority.slice(0, closeBracketIndex + 1)
+    );
+  }
+  const portSeparator = authority.lastIndexOf(":");
+  if (portSeparator === -1) return url;
+  if (authority.indexOf(":") !== portSeparator) return url;
+  if (!rawAuthorityPortIsMalformed(authority.slice(portSeparator + 1))) {
+    return url;
+  }
+  return replaceRawUrlAuthority(url, bounds, authority.slice(0, portSeparator));
+}
+function rawBaseForDecisionMatch(rawBase) {
+  if (stripUrlQueryAndFragment(rawBase).includes("\\")) return null;
+  return stripRawUrlMalformedPort(stripRawUrlUserinfo(rawBase));
+}
+function rawPathFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  return pathStart === -1 ? "/" : urlWithoutQuery.slice(pathStart);
+}
+function rawBasePathFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  return pathStart === -1 ? "" : urlWithoutQuery.slice(pathStart);
+}
+function rawAuthorityFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  if (schemeEnd === -1) return null;
+  const authorityStart = schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  const authority = pathStart === -1 ? urlWithoutQuery.slice(authorityStart) : urlWithoutQuery.slice(authorityStart, pathStart);
+  return authority === "" ? null : authority;
+}
+function hasNonAscii(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) > 127) return true;
+  }
+  return false;
+}
+function rawHostFromAuthority(authority) {
+  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (withoutUserinfo.startsWith("[")) {
+    const closeBracket = withoutUserinfo.indexOf("]");
+    return closeBracket === -1 ? withoutUserinfo : withoutUserinfo.slice(0, closeBracket + 1);
+  }
+  const portSeparator = withoutUserinfo.lastIndexOf(":");
+  return portSeparator === -1 ? withoutUserinfo : withoutUserinfo.slice(0, portSeparator);
+}
+function authorityHasEmptyPort(authority) {
+  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (withoutUserinfo.startsWith("[")) {
+    const closeBracket = withoutUserinfo.indexOf("]");
+    if (closeBracket === -1) return false;
+    return withoutUserinfo.slice(closeBracket + 1) === ":";
+  }
+  const portSeparator = withoutUserinfo.lastIndexOf(":");
+  if (portSeparator === -1) return false;
+  return withoutUserinfo.indexOf(":") === portSeparator && portSeparator === withoutUserinfo.length - 1;
+}
+function rawAuthorityHostStartsWithDigit(authority) {
+  const firstChar = rawHostFromAuthority(authority)[0];
+  return firstChar !== void 0 && firstChar >= "0" && firstChar <= "9";
+}
+function runtimeAuthorityOriginForHostValidation(url) {
+  const authority = rawAuthorityFromUrl(url);
+  if (authority === null) return null;
+  if (!authority.includes("%") && !hasNonAscii(authority) && !rawAuthorityHostStartsWithDigit(authority)) {
+    return null;
+  }
+  const schemeEnd = url.indexOf("://");
+  if (schemeEnd === -1) return null;
+  return `${url.slice(0, schemeEnd)}://${authority}`;
+}
+function hasPercentEncodedAuthoritySyntax(value) {
+  let index = value.indexOf("%");
+  while (index !== -1) {
+    let runEnd = index;
+    while (runEnd < value.length && value[runEnd] === "%") {
+      const firstHexDigit = value[runEnd + 1];
+      const secondHexDigit = value[runEnd + 2];
+      if (!firstHexDigit || !secondHexDigit || !HEX_DIGITS.has(firstHexDigit) || !HEX_DIGITS.has(secondHexDigit)) {
+        return true;
+      }
+      runEnd += PERCENT_ESCAPE_LENGTH;
+    }
+    let decodedRun;
+    try {
+      decodedRun = decodeURIComponent(value.slice(index, runEnd));
+    } catch {
+      return true;
+    }
+    for (const char of decodedRun) {
+      if (PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS.has(char)) {
+        return true;
+      }
+    }
+    index = value.indexOf("%", runEnd);
+  }
+  return false;
+}
+function hasMalformedRuntimeAuthoritySyntax(url) {
+  const authority = rawAuthorityFromUrl(url);
+  if (authority === null) return false;
+  return authority.includes("\\") || authorityHasEmptyPort(authority) || hasPercentEncodedAuthoritySyntax(authority);
+}
+function scoreLiteralSegment(segment2) {
+  return LITERAL_SEGMENT_SCORE + codePointLength(segment2);
+}
+function scoreParsedPatternSegment(parsed) {
+  if (parsed.kind === "literal") {
+    return scoreLiteralSegment(parsed.value);
+  }
+  const literalChars = codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
+  if (parsed.prefix !== "" || parsed.suffix !== "") {
+    return MIXED_PARAM_SEGMENT_SCORE + literalChars;
+  }
+  if (parsed.greedy === "+") return PLUS_GREEDY_SEGMENT_SCORE;
+  if (parsed.greedy === "*") return 0;
+  return PLAIN_PARAM_SEGMENT_SCORE;
+}
+function scoreStaticSegments(segments) {
+  return segments.reduce((score, segment2) => {
+    return score + scoreLiteralSegment(segment2);
+  }, 0);
+}
+function scorePatternSegmentsWithParser(segments, parsePatternSegment) {
+  const lastPatternIndex = segments.length - 1;
+  let score = 0;
+  for (let index = 0; index < segments.length; index += 1) {
+    const segment2 = segments[index];
+    const parsed = parsePatternSegment(segment2, index, lastPatternIndex);
+    if (parsed !== null) {
+      score += scoreParsedPatternSegment(parsed);
+    }
+  }
+  return score;
+}
+function scorePathPattern(path, parsePatternSegment) {
+  if (path === "") return 0;
+  if (path === "/") return ROOT_PATH_SCORE;
+  const segments = splitPathSegments(path);
+  return parsePatternSegment === null ? scoreStaticSegments(segments) : scorePatternSegmentsWithParser(segments, parsePatternSegment);
+}
+function splitAuthoritySegments(authority) {
+  if (authority.startsWith("[")) return [authority];
+  const normalized = authority.endsWith(".") ? authority.slice(0, -1) : authority;
+  return normalized === "" ? [] : normalized.split(".");
+}
+function baseUrlSpecificityScore({
+  authority,
+  path,
+  hasParams,
+  tolerateMalformedBaseParams = false
+}) {
+  const patternParser = hasParams ? tolerateMalformedBaseParams ? parseMalformedTolerantBaseSegment : parseStrictMatchSegment : null;
+  const authoritySegments = splitAuthoritySegments(authority);
+  const authorityScore = patternParser === null ? scoreStaticSegments(authoritySegments) : scorePatternSegmentsWithParser(
+    [...authoritySegments].reverse(),
+    patternParser
+  );
+  const pathScore = scorePathPattern(path, patternParser);
+  return pathScore * PATH_SCORE_MULTIPLIER + authorityScore * AUTHORITY_SCORE_MULTIPLIER + (hasParams ? 0 : STATIC_BASE_SCORE_BONUS);
+}
+function matchStaticBasePathPrefix(path, pattern) {
+  if (pattern === "") {
+    return path === "" ? "/" : path;
+  }
+  if (pattern === "/") {
+    if (!path.startsWith(pattern)) return null;
+    const relativePath2 = path.slice(pattern.length);
+    if (relativePath2 !== "" && !relativePath2.startsWith("/")) return null;
+    return relativePath2 === "" ? "/" : relativePath2;
+  }
+  if (!path.startsWith(pattern)) return null;
+  const relativePath = path.slice(pattern.length);
+  if (relativePath !== "" && !relativePath.startsWith("/")) return null;
+  return relativePath === "" ? "/" : relativePath;
+}
+function normalizeUrlHostname(hostname, options = {}) {
+  let normalized = hostname.toLowerCase();
+  if (normalized.endsWith(".")) {
+    normalized = normalized.slice(0, -1);
+    if (normalized === "" || normalized.endsWith(".")) {
+      return null;
+    }
+  }
+  if (normalized.split(".").some((label) => {
+    return label === "";
+  })) {
+    return null;
+  }
+  const forbiddenChars = options.allowHostParams === true ? FORBIDDEN_BASE_PATTERN_HOST_CHARS : FORBIDDEN_RUNTIME_HOST_CHARS;
+  if (!normalized.startsWith("[") && [...normalized].some((char) => {
+    return forbiddenChars.has(char);
+  })) {
+    return null;
+  }
+  return normalized;
+}
+function normalizedUrlAuthority(parsed, options = {}) {
+  if (parsed.username !== "" || parsed.password !== "") {
+    return null;
+  }
+  const hostname = normalizeUrlHostname(parsed.hostname, options);
+  if (hostname === null || hostname === "") {
+    return null;
+  }
+  return parsed.port === "" ? hostname : `${hostname}:${parsed.port}`;
+}
+function matchStaticFirewallBaseUrl(url, rawBase, options = {}) {
+  const parsedUrl = new URL(url);
+  const parsedBase = new URL(rawBase);
+  if (parsedUrl.protocol.toLowerCase() !== parsedBase.protocol.toLowerCase()) {
+    return null;
+  }
+  const baseHasParams = hasBaseUrlParams(rawBase);
+  const baseForMatch = stripTrailingSlash(rawBase);
+  const urlAuthority = normalizedUrlAuthority(parsedUrl);
+  const baseAuthority = normalizedUrlAuthority(parsedBase, {
+    allowHostParams: baseHasParams
+  });
+  if (urlAuthority === null || baseAuthority === null) return null;
+  if (baseHasParams) {
+    const hostParams = options.tolerateMalformedBaseParams === true ? matchFirewallHostForMalformedBaseDecision(urlAuthority, baseAuthority) : matchFirewallHost(urlAuthority, baseAuthority);
+    if (hostParams === null) return null;
+  } else if (urlAuthority !== baseAuthority) {
+    return null;
+  }
+  const basePath = rawBasePathFromUrl(baseForMatch);
+  const relativePath = baseHasParams ? options.tolerateMalformedBaseParams === true ? matchFirewallPathPrefixForMalformedBaseDecision(
+    rawPathFromUrl(url),
+    basePath
+  ) : matchFirewallPathPrefix(rawPathFromUrl(url), basePath) : matchStaticBasePathPrefix(rawPathFromUrl(url), basePath);
+  if (relativePath === null) return null;
+  const displayBase = stripTrailingSlash(rawBase);
+  return {
+    displayBase,
+    relativePath,
+    score: baseUrlSpecificityScore({
+      authority: baseAuthority,
+      path: basePath,
+      hasParams: baseHasParams,
+      tolerateMalformedBaseParams: options.tolerateMalformedBaseParams === true
+    })
+  };
+}
+function runtimeUrlCanMatchFirewallBase(url) {
+  if (hasUnsafeUrlCodepoint(url) || hasRawWhitespace(url) || !url.includes("://") || hasMalformedRuntimeAuthoritySyntax(url)) {
+    return false;
+  }
+  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
+  if (runtimeAuthorityOrigin === null) return true;
+  try {
+    validateBaseUrl(runtimeAuthorityOrigin, "runtime");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function matchFirewallBaseUrlForDecision(url, rawBase) {
+  if (!runtimeUrlCanMatchFirewallBase(url)) return null;
+  const baseForMatch = rawBaseForDecisionMatch(rawBase);
+  if (baseForMatch === null) return null;
+  try {
+    const match = matchStaticFirewallBaseUrl(url, baseForMatch, {
+      tolerateMalformedBaseParams: true
+    });
+    if (match === null) return null;
+    return { ...match, displayBase: stripTrailingSlash(rawBase) };
+  } catch {
+    return null;
+  }
+}
+function createDecisionState() {
+  return {
+    bestBaseScore: null,
+    bestRuleSpecificity: null,
+    baseMatch: null,
+    allowedMatch: null,
+    deniedMatch: null,
+    deniedPermissionNames: [],
+    malformedConfigMatch: null,
+    malformedPolicyMatch: null
+  };
+}
+function acceptDecisionBaseMatch(state, match, score) {
+  if (state.bestBaseScore === null || score > state.bestBaseScore) {
+    state.bestBaseScore = score;
+    state.bestRuleSpecificity = null;
+    state.baseMatch = null;
+    state.allowedMatch = null;
+    state.deniedMatch = null;
+    state.deniedPermissionNames = [];
+    state.malformedConfigMatch = null;
+    state.malformedPolicyMatch = null;
+  } else if (score < state.bestBaseScore) {
+    return false;
+  }
+  state.baseMatch ??= match;
+  return true;
+}
+function acceptRuleSpecificity(state, specificity) {
+  if (state.bestRuleSpecificity === null) {
+    state.bestRuleSpecificity = specificity;
+    return true;
+  }
+  const comparison = comparePathSpecificity(
+    specificity,
+    state.bestRuleSpecificity
+  );
+  if (comparison > 0) {
+    state.bestRuleSpecificity = specificity;
+    state.allowedMatch = null;
+    state.deniedMatch = null;
+    state.deniedPermissionNames = [];
+    return true;
+  }
+  return comparison === 0;
+}
+function recordDeniedRule(state, match, permission) {
+  if (!state.deniedPermissionNames.includes(permission)) {
+    state.deniedPermissionNames.push(permission);
+  }
+  state.deniedMatch ??= match;
+}
+function resolveFirewallDecision(state, networkPolicies) {
+  const baseMatch = state.baseMatch;
+  if (baseMatch === null) {
+    return { kind: "no_match" };
+  }
+  if (state.allowedMatch !== null) {
+    return {
+      kind: "allow",
+      firewallName: state.allowedMatch.firewallName,
+      base: state.allowedMatch.base,
+      relativePath: state.allowedMatch.relativePath,
+      permission: state.allowedMatch.permission,
+      rule: state.allowedMatch.rule
+    };
+  }
+  if (state.deniedMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.deniedMatch.firewallName,
+      base: state.deniedMatch.base,
+      relativePath: state.deniedMatch.relativePath,
+      reason: "permission_denied",
+      permissions: state.deniedPermissionNames
+    };
+  }
+  if (state.malformedPolicyMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.malformedPolicyMatch.firewallName,
+      base: state.malformedPolicyMatch.base,
+      relativePath: state.malformedPolicyMatch.relativePath,
+      reason: "malformed_network_policy",
+      permissions: []
+    };
+  }
+  if (state.malformedConfigMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.malformedConfigMatch.firewallName,
+      base: state.malformedConfigMatch.base,
+      relativePath: state.malformedConfigMatch.relativePath,
+      reason: "malformed_firewall_config",
+      permissions: []
+    };
+  }
+  const policy = networkPolicies.policies.get(baseMatch.firewallName);
+  if (policy === void 0) {
+    return {
+      kind: "allow",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.allowBase,
+      relativePath: baseMatch.relativePath
+    };
+  }
+  if (policy.unknownPolicyMalformed) {
+    return {
+      kind: "block",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.base,
+      relativePath: baseMatch.relativePath,
+      reason: "malformed_network_policy",
+      permissions: []
+    };
+  }
+  if (policy.unknownPolicy === "allow") {
+    return {
+      kind: "allow",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.allowBase,
+      relativePath: baseMatch.relativePath
+    };
+  }
+  return {
+    kind: "block",
+    firewallName: baseMatch.firewallName,
+    base: baseMatch.base,
+    relativePath: baseMatch.relativePath,
+    reason: "unknown_endpoint",
+    permissions: []
+  };
+}
+function unsafePathBlockDecision(firewall, baseMatch) {
+  return {
+    kind: "block",
+    firewallName: firewall.name,
+    base: baseMatch.displayBase,
+    relativePath: baseMatch.relativePath,
+    reason: "unsafe_path",
+    permissions: []
+  };
+}
+function recordMalformedDecisionState(state, api, blockMatch) {
+  if (api.baseMalformed || api.authMalformed || api.hasMalformedRules || api.routingIdentity === null) {
+    state.malformedConfigMatch ??= blockMatch;
+  }
+}
+function apiCannotEvaluateRules(firewall, api) {
+  return firewall.nameMalformed || api.baseMalformed || api.authMalformed || api.routingIdentity === null;
+}
+function policyCannotEvaluateRules(networkPolicies, policy) {
+  return networkPolicies.topLevelMalformed || policy !== void 0 && policy.permissionMalformed;
+}
+function createMatchCollection() {
+  return {
+    bestBaseScore: null,
+    bestRuleSpecificity: null,
+    apiMatches: [],
+    ruleMatches: []
+  };
+}
+function acceptCollectedApi(collection, match) {
+  if (collection.bestBaseScore === null || match.score > collection.bestBaseScore) {
+    collection.bestBaseScore = match.score;
+    collection.bestRuleSpecificity = null;
+    collection.apiMatches = [];
+    collection.ruleMatches = [];
+  } else if (match.score < collection.bestBaseScore) {
+    return false;
+  }
+  collection.apiMatches.push(match);
+  return true;
+}
+function canRuleAffectCollection(collection, specificity) {
+  if (collection.bestRuleSpecificity === null) return true;
+  return comparePathSpecificity(specificity, collection.bestRuleSpecificity) >= 0;
+}
+function recordCollectedRule(collection, match) {
+  const bestSpecificity = collection.bestRuleSpecificity;
+  if (bestSpecificity === null || comparePathSpecificity(match.rule.specificity, bestSpecificity) > 0) {
+    collection.bestRuleSpecificity = match.rule.specificity;
+    collection.ruleMatches = [];
+  } else if (comparePathSpecificity(match.rule.specificity, bestSpecificity) < 0) {
+    return;
+  }
+  collection.ruleMatches.push(match);
+}
+function collectDecisionRules(collection, apiMatch, upperMethod) {
+  for (const rule of apiMatch.api.rules) {
+    if (rule.method !== "ANY" && rule.method !== upperMethod) continue;
+    if (!canRuleAffectCollection(collection, rule.specificity)) continue;
+    if (matchFirewallPath(apiMatch.baseMatch.relativePath, rule.path) === null) {
+      continue;
+    }
+    recordCollectedRule(collection, { apiMatch, rule });
+  }
+}
+function winningApiMatches(collection) {
+  if (collection.ruleMatches.length === 0) {
+    return collection.apiMatches;
+  }
+  const matches = [];
+  const seenOrders = /* @__PURE__ */ new Set();
+  for (const ruleMatch of collection.ruleMatches) {
+    if (seenOrders.has(ruleMatch.apiMatch.order)) continue;
+    seenOrders.add(ruleMatch.apiMatch.order);
+    matches.push(ruleMatch.apiMatch);
+  }
+  return matches;
+}
+function winningOwnerNames(collection) {
+  const names = /* @__PURE__ */ new Set();
+  for (const apiMatch of winningApiMatches(collection)) {
+    if (!apiMatch.firewall.nameMalformed) {
+      names.add(apiMatch.firewall.name);
+    }
+  }
+  return [...names].sort();
+}
+function connectorAmbiguityReason(intent) {
+  if (intent.status === "absent") return "connector_intent_required";
+  if (intent.status === "malformed") return "malformed_connector_intent";
+  return "connector_intent_not_candidate";
+}
+function selectOwner(collection, intent, upperMethod, path) {
+  const [owner, ...otherOwners] = winningOwnerNames(collection);
+  if (owner === void 0) return { kind: "selected", name: null };
+  if (otherOwners.length === 0) {
+    return { kind: "selected", name: owner };
+  }
+  const owners = [owner, ...otherOwners];
+  if (intent.status === "present" && owners.includes(intent.value)) {
+    return { kind: "selected", name: intent.value };
+  }
+  return {
+    kind: "ambiguous",
+    decision: {
+      kind: "ambiguous",
+      method: upperMethod,
+      path,
+      candidates: owners,
+      reason: connectorAmbiguityReason(intent)
+    }
+  };
+}
+function conflictingSelectedApiDecision(collection, selectedName) {
+  const [first, ...otherMatches] = winningApiMatches(collection).filter(
+    (match) => {
+      return match.firewall.name === selectedName && !match.firewall.nameMalformed && !match.api.baseMalformed && !match.api.authMalformed && match.api.routingIdentity !== null;
+    }
+  );
+  if (first === void 0 || otherMatches.length === 0) return null;
+  if (otherMatches.every((match) => {
+    return match.api.routingIdentity === first.api.routingIdentity;
+  })) {
+    return null;
+  }
+  return {
+    kind: "block",
+    firewallName: selectedName,
+    base: first.blockMatch.base,
+    relativePath: first.blockMatch.relativePath,
+    reason: "malformed_firewall_config",
+    permissions: []
+  };
+}
+function reduceSelectedOwner(collection, selectedName, networkPolicies) {
+  if (selectedName !== null) {
+    const conflict = conflictingSelectedApiDecision(collection, selectedName);
+    if (conflict !== null) return conflict;
+  }
+  const state = createDecisionState();
+  const evaluableApiOrders = /* @__PURE__ */ new Set();
+  for (const apiMatch of collection.apiMatches) {
+    const { firewall, api, baseMatch, blockMatch } = apiMatch;
+    if (selectedName !== null && firewall.name !== selectedName && !firewall.nameMalformed) {
+      continue;
+    }
+    const policy = networkPolicies.policies.get(firewall.name);
+    acceptDecisionBaseMatch(state, baseMatch, apiMatch.score);
+    recordMalformedDecisionState(state, api, blockMatch);
+    if (apiCannotEvaluateRules(firewall, api)) continue;
+    if (policyCannotEvaluateRules(networkPolicies, policy)) {
+      state.malformedPolicyMatch ??= blockMatch;
+      continue;
+    }
+    evaluableApiOrders.add(apiMatch.order);
+  }
+  for (const ruleMatch of collection.ruleMatches) {
+    const { apiMatch, rule } = ruleMatch;
+    if (!evaluableApiOrders.has(apiMatch.order)) continue;
+    if (selectedName !== null && apiMatch.firewall.name !== selectedName) {
+      continue;
+    }
+    const policy = networkPolicies.policies.get(apiMatch.firewall.name);
+    if (!acceptRuleSpecificity(state, rule.specificity)) continue;
+    if (policy !== void 0 && policy.blockedPermissions.has(rule.permission)) {
+      recordDeniedRule(state, apiMatch.blockMatch, rule.permission);
+      continue;
+    }
+    state.allowedMatch ??= {
+      firewallName: apiMatch.baseMatch.firewallName,
+      base: apiMatch.baseMatch.allowBase,
+      relativePath: apiMatch.baseMatch.relativePath,
+      permission: rule.permission,
+      rule: rule.raw
+    };
+  }
+  return resolveFirewallDecision(state, networkPolicies);
+}
+function matchFirewallBaseUrl(url, rawBase) {
+  if (hasUnsafeRuntimeUrlSyntax(url) || hasMalformedRuntimeAuthoritySyntax(url)) {
+    return null;
+  }
+  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
+  try {
+    if (runtimeAuthorityOrigin !== null) {
+      validateBaseUrl(runtimeAuthorityOrigin, "runtime");
+    }
+    validateBaseUrl(rawBase, "firewall");
+    return matchStaticFirewallBaseUrl(url, rawBase);
+  } catch {
+    return null;
+  }
+}
+function matchFirewallRequestDecision(firewalls, method, url, networkPolicies = void 0, connectorIntent = { status: "absent" }) {
+  const decisionFirewalls = compileDecisionFirewalls(firewalls);
+  if (decisionFirewalls.length === 0) return { kind: "no_match" };
+  const compiledNetworkPolicies = compileNetworkPolicies(networkPolicies);
+  const upperMethod = method.toUpperCase();
+  const collection = createMatchCollection();
+  const unsafePath = url.includes("\\") || hasUnsafeFirewallPath(rawPathFromUrl(url));
+  let apiOrder = 0;
+  for (const firewall of decisionFirewalls) {
+    for (const api of firewall.apis) {
+      const order = apiOrder;
+      apiOrder += 1;
+      const baseMatch = matchFirewallBaseUrlForDecision(url, api.rawBase);
+      if (baseMatch === null) continue;
+      if (unsafePath) return unsafePathBlockDecision(firewall, baseMatch);
+      const decisionBaseMatch = {
+        firewallName: firewall.name,
+        base: baseMatch.displayBase,
+        allowBase: api.rawBase,
+        relativePath: baseMatch.relativePath
+      };
+      const apiMatch = {
+        order,
+        firewall,
+        api,
+        baseMatch: decisionBaseMatch,
+        blockMatch: {
+          firewallName: decisionBaseMatch.firewallName,
+          base: decisionBaseMatch.base,
+          relativePath: decisionBaseMatch.relativePath
+        },
+        score: baseMatch.score
+      };
+      if (!acceptCollectedApi(collection, apiMatch)) continue;
+      collectDecisionRules(collection, apiMatch, upperMethod);
+    }
+  }
+  const selection = selectOwner(
+    collection,
+    connectorIntent,
+    upperMethod,
+    rawPathFromUrl(url)
+  );
+  if (selection.kind === "ambiguous") return selection.decision;
+  return reduceSelectedOwner(
+    collection,
+    selection.name,
+    compiledNetworkPolicies
+  );
+}
+function matchFirewallHostWithParser(host, pattern, parsePatternSegment) {
+  const hostSegsOrig = host.split(".");
+  const hostSegsLower = hostSegsOrig.map((segment2) => {
+    return segment2.toLowerCase();
+  });
+  const patternSegs = pattern.split(".").reverse();
+  hostSegsOrig.reverse();
+  hostSegsLower.reverse();
+  const params = {};
+  let hi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
+    if (parsed === null) return null;
+    if (parsed.kind === "literal") {
+      if (hi >= hostSegsLower.length || hostSegsLower[hi] !== parsed.value.toLowerCase()) {
+        return null;
+      }
+      hi += 1;
+      continue;
+    }
+    const { name, prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (hi >= hostSegsOrig.length) return null;
+      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
+      return params;
+    }
+    if (greedy === "*") {
+      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
+      return params;
+    }
+    if (hi >= hostSegsOrig.length) return null;
+    if (prefix === "" && suffix === "") {
+      params[name] = hostSegsLower[hi];
+    } else {
+      const captured = matchMixedSegment(
+        hostSegsLower[hi],
+        prefix.toLowerCase(),
+        suffix.toLowerCase()
+      );
+      if (captured === null) return null;
+      params[name] = captured;
+    }
+    hi += 1;
+  }
+  return hi === hostSegsOrig.length ? params : null;
+}
+function matchFirewallHost(host, pattern) {
+  return matchFirewallHostWithParser(host, pattern, parseStrictMatchSegment);
+}
+function parseMalformedTolerantBaseSegment(segment2, patternIndex, lastPatternIndex) {
+  const parsed = parseSegment(segment2);
+  if (parsed.kind === "error") {
+    return {
+      kind: "param",
+      prefix: "",
+      name: `__malformed_base_segment_${patternIndex}`,
+      suffix: "",
+      greedy: ""
+    };
+  }
+  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
+    patternIndex,
+    lastPatternIndex,
+    parsed.prefix,
+    parsed.suffix
+  )) {
+    return { ...parsed, greedy: "" };
+  }
+  return parsed;
+}
+function matchFirewallHostForMalformedBaseDecision(host, pattern) {
+  return matchFirewallHostWithParser(
+    host,
+    pattern,
+    parseMalformedTolerantBaseSegment
+  );
+}
+function matchFirewallPathPrefixWithParser(path, pattern, parsePatternSegment) {
+  const pathSegs = splitPathSegments(path);
+  const patternSegs = splitPathSegments(pattern);
+  let pi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
+    if (parsed === null) return null;
+    if (parsed.kind === "literal") {
+      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
+      pi += 1;
+      continue;
+    }
+    const { prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
+        return null;
+      }
+      return "/";
+    }
+    if (greedy === "*") {
+      return "/";
+    }
+    if (pi >= pathSegs.length) return null;
+    const runtime2 = pathSegs[pi];
+    if (prefix === "" && suffix === "") {
+      if (runtime2 === "") return null;
+    } else if (matchMixedSegment(runtime2, prefix, suffix) === null) {
+      return null;
+    }
+    pi += 1;
+  }
+  return relativePathFromSegments(pathSegs, pi);
+}
+function matchFirewallPathPrefix(path, pattern) {
+  return matchFirewallPathPrefixWithParser(
+    path,
+    pattern,
+    parseStrictMatchSegment
+  );
+}
+function matchFirewallPathPrefixForMalformedBaseDecision(path, pattern) {
+  return matchFirewallPathPrefixWithParser(
+    path,
+    pattern,
+    parseMalformedTolerantBaseSegment
+  );
+}
+function matchFirewallPath(path, pattern) {
+  const pathSegs = splitPathSegments(path);
+  const patternSegs = splitPathSegments(pattern);
+  const params = {};
+  let pi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parseSegment(seg);
+    if (parsed.kind === "error") return null;
+    if (parsed.kind === "literal") {
+      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
+      pi++;
+      continue;
+    }
+    const { name, prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
+        return null;
+      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
+        return null;
+      }
+      params[name] = pathSegs.slice(pi).join("/");
+      return params;
+    }
+    if (greedy === "*") {
+      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
+        return null;
+      params[name] = pathSegs.slice(pi).join("/");
+      return params;
+    }
+    if (pi >= pathSegs.length) return null;
+    const runtime2 = pathSegs[pi];
+    if (prefix === "" && suffix === "") {
+      if (runtime2 === "") return null;
+      params[name] = runtime2;
+    } else {
+      const captured = matchMixedSegment(runtime2, prefix, suffix);
+      if (captured === null) return null;
+      params[name] = captured;
+    }
+    pi++;
+  }
+  if (pi !== pathSegs.length) return null;
+  return params;
+}
+
 export {
   CONNECTOR_TYPES,
   getConnectorEnvBindingEntries,
-  getConnectorStoredSecretDisplayInfo,
-  getDiagnosticConnectorTypeForRuntimeEnvName
+  getDiagnosticConnectorTypeForRuntimeEnvName,
+  matchFirewallBaseUrl,
+  matchFirewallRequestDecision
 };
-//# sourceMappingURL=chunk-5IL2HDF6.js.map
+//# sourceMappingURL=chunk-GA7UX3FL.js.map