@vm0/cli 9.238.3 → 9.238.5

package/{chunk-ADBNTM34.js → chunk-H4Y7JDZB.js}

@@ -1,9 +1,19 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
+import {
+  hasBaseUrlParams,
+  hasRawWhitespace,
+  hasUnsafeFirewallPath,
+  hasUnsafeUrlCodepoint,
+  parseSegment,
+  splitPathSegments,
+  validateAuthBaseUrl,
+  validateBaseUrl
+} from "./chunk-GIACTMOF.js";
 import {
   external_exports
-} from "./chunk-22VWTDX6.js";
+} from "./chunk-VC7E6IA7.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -547,6 +557,63 @@ var googleCalendar = {
   }
 };
 
+// ../../packages/connectors/src/connectors/google-contacts.ts
+init_esm_shims();
+var googleContacts = {
+  "google-contacts": {
+    label: "Google Contacts",
+    category: "communication-collaboration",
+    tags: ["contacts", "address-book", "people"],
+    helpText: "Connect your Google account to access and manage contacts and contact groups",
+    authMethods: {
+      oauth: {
+        featureFlag: "googleContactsConnector" /* GoogleContactsConnector */,
+        label: "OAuth (Recommended)",
+        helpText: "Sign in with Google to grant Google Contacts access.",
+        client: {
+          clientRegistration: "static",
+          clientType: "confidential",
+          clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+          clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+        },
+        storage: {
+          secrets: [
+            "GOOGLE_CONTACTS_ACCESS_TOKEN",
+            "GOOGLE_CONTACTS_REFRESH_TOKEN"
+          ],
+          variables: []
+        },
+        grant: {
+          kind: "auth-code",
+          scopes: [
+            "https://www.googleapis.com/auth/contacts",
+            "https://www.googleapis.com/auth/userinfo.email"
+          ],
+          outputs: {
+            accessToken: "$secrets.GOOGLE_CONTACTS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_CONTACTS_REFRESH_TOKEN"
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            refreshToken: "$secrets.GOOGLE_CONTACTS_REFRESH_TOKEN"
+          },
+          outputs: {
+            accessToken: "$secrets.GOOGLE_CONTACTS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_CONTACTS_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["GOOGLE_CONTACTS_ACCESS_TOKEN"],
+          envBindings: {
+            GOOGLE_CONTACTS_TOKEN: "$secrets.GOOGLE_CONTACTS_ACCESS_TOKEN"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/google-docs.ts
 init_esm_shims();
 var googleDocs = {
@@ -599,6 +666,61 @@ var googleDocs = {
   }
 };
 
+// ../../packages/connectors/src/connectors/google-forms.ts
+init_esm_shims();
+var googleForms = {
+  "google-forms": {
+    label: "Google Forms",
+    category: "docs-files-knowledge",
+    tags: ["forms", "surveys", "questionnaires", "responses"],
+    helpText: "Connect your Google account to create and manage forms and read responses",
+    authMethods: {
+      oauth: {
+        featureFlag: "googleFormsConnector" /* GoogleFormsConnector */,
+        label: "OAuth (Recommended)",
+        helpText: "Sign in with Google to grant Google Forms access.",
+        client: {
+          clientRegistration: "static",
+          clientType: "confidential",
+          clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+          clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+        },
+        storage: {
+          secrets: ["GOOGLE_FORMS_ACCESS_TOKEN", "GOOGLE_FORMS_REFRESH_TOKEN"],
+          variables: []
+        },
+        grant: {
+          kind: "auth-code",
+          scopes: [
+            "https://www.googleapis.com/auth/forms.body",
+            "https://www.googleapis.com/auth/forms.responses.readonly",
+            "https://www.googleapis.com/auth/userinfo.email"
+          ],
+          outputs: {
+            accessToken: "$secrets.GOOGLE_FORMS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_FORMS_REFRESH_TOKEN"
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            refreshToken: "$secrets.GOOGLE_FORMS_REFRESH_TOKEN"
+          },
+          outputs: {
+            accessToken: "$secrets.GOOGLE_FORMS_ACCESS_TOKEN",
+            refreshToken: "$secrets.GOOGLE_FORMS_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["GOOGLE_FORMS_ACCESS_TOKEN"],
+          envBindings: {
+            GOOGLE_FORMS_TOKEN: "$secrets.GOOGLE_FORMS_ACCESS_TOKEN"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/google-cloud.ts
 init_esm_shims();
 var googleCloud = {
@@ -4096,6 +4218,41 @@ var bfl = {
   }
 };
 
+// ../../packages/connectors/src/connectors/bill.ts
+init_esm_shims();
+var bill = {
+  bill: {
+    label: "BILL",
+    category: "sales-crm-business-operations",
+    tags: ["bill.com", "accounts payable", "expenses", "budgets"],
+    helpText: "Connect BILL to manage Spend & Expense budgets, users, cards, transactions, and reimbursements",
+    authMethods: {
+      "api-token": {
+        featureFlag: "billConnector" /* BillConnector */,
+        label: "Spend & Expense API Token",
+        helpText: "1. Sign in to BILL\n2. Open **Settings** and select **API & Webhooks**\n3. Create a Spend & Expense API token\n4. Copy the token",
+        storage: { secrets: ["BILL_TOKEN"], variables: [] },
+        grant: {
+          kind: "manual",
+          fields: {
+            BILL_TOKEN: {
+              label: "API Token",
+              publicId: "apiToken",
+              required: true,
+              placeholder: "CoffeeSafeLocalCoffeeSafeLocal"
+            }
+          }
+        },
+        access: {
+          kind: "static",
+          envBindings: { BILL_TOKEN: "$secrets.BILL_TOKEN" }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/bitrefill.ts
 init_esm_shims();
 var bitrefill = {
@@ -4701,7 +4858,53 @@ var calCom = {
     category: "meetings-scheduling",
     helpText: "Connect your Cal.com account to manage scheduling, bookings, and calendar events",
     authMethods: {
+      oauth: {
+        featureFlag: "calComConnector" /* CalComConnector */,
+        label: "OAuth (Recommended)",
+        helpText: "Sign in with Cal.com to grant scheduling access.",
+        client: {
+          clientRegistration: "static",
+          clientType: "confidential",
+          clientIdEnv: "CALCOM_OAUTH_CLIENT_ID",
+          clientSecretEnv: "CALCOM_OAUTH_CLIENT_SECRET"
+        },
+        storage: {
+          secrets: ["CALCOM_ACCESS_TOKEN", "CALCOM_REFRESH_TOKEN"],
+          variables: []
+        },
+        grant: {
+          kind: "auth-code",
+          scopes: [
+            "BOOKING_READ",
+            "BOOKING_WRITE",
+            "EVENT_TYPE_READ",
+            "EVENT_TYPE_WRITE",
+            "PROFILE_READ",
+            "SCHEDULE_READ"
+          ],
+          outputs: {
+            accessToken: "$secrets.CALCOM_ACCESS_TOKEN",
+            refreshToken: "$secrets.CALCOM_REFRESH_TOKEN"
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            refreshToken: "$secrets.CALCOM_REFRESH_TOKEN"
+          },
+          outputs: {
+            accessToken: "$secrets.CALCOM_ACCESS_TOKEN",
+            refreshToken: "$secrets.CALCOM_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["CALCOM_ACCESS_TOKEN"],
+          envBindings: {
+            CALCOM_TOKEN: "$secrets.CALCOM_ACCESS_TOKEN"
+          }
+        },
+        revoke: { kind: "none" }
+      },
       "api-token": {
+        featureFlag: "calComConnector" /* CalComConnector */,
         label: "API Token",
         helpText: "1. Log in to [Cal.com](https://app.cal.com)\n2. Go to **Settings** \u2192 **Developer** \u2192 **API Keys**\n3. Click **Create API Key**\n4. Copy the generated key",
         storage: {
@@ -5679,6 +5882,41 @@ var coingecko = {
   }
 };
 
+// ../../packages/connectors/src/connectors/copper.ts
+init_esm_shims();
+var copper = {
+  copper: {
+    label: "Copper",
+    category: "sales-crm-business-operations",
+    tags: ["crm", "sales", "leads", "opportunities", "companies"],
+    helpText: "Connect Copper CRM to search and manage people, companies, leads, opportunities, projects, tasks, and activities",
+    authMethods: {
+      oauth: {
+        featureFlag: "copperConnector" /* CopperConnector */,
+        label: "OAuth (Recommended)",
+        helpText: "Sign in with Copper to grant CRM access.",
+        client: {
+          clientRegistration: "static",
+          clientType: "confidential",
+          clientIdEnv: "COPPER_OAUTH_CLIENT_ID",
+          clientSecretEnv: "COPPER_OAUTH_CLIENT_SECRET"
+        },
+        storage: { secrets: ["COPPER_ACCESS_TOKEN"], variables: [] },
+        grant: {
+          kind: "auth-code",
+          scopes: ["developer/v1/all"],
+          outputs: { accessToken: "$secrets.COPPER_ACCESS_TOKEN" }
+        },
+        access: {
+          kind: "static",
+          envBindings: { COPPER_TOKEN: "$secrets.COPPER_ACCESS_TOKEN" }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/coresignal.ts
 init_esm_shims();
 var coresignal = {
@@ -5873,6 +6111,68 @@ var customerIo = {
   }
 };
 
+// ../../packages/connectors/src/connectors/datadog.ts
+init_esm_shims();
+var datadog = {
+  datadog: {
+    label: "Datadog",
+    category: "data-automation-infrastructure",
+    tags: ["observability", "logs", "metrics", "traces", "monitors"],
+    helpText: "Connect Datadog to investigate logs, metrics, traces, dashboards, monitors, incidents, and service health",
+    authMethods: {
+      oauth: {
+        featureFlag: "datadogConnector" /* DatadogConnector */,
+        label: "OAuth (Recommended)",
+        helpText: "Sign in with Datadog and select your Datadog site.",
+        client: {
+          clientRegistration: "static",
+          clientType: "confidential",
+          clientIdEnv: "DATADOG_OAUTH_CLIENT_ID",
+          clientSecretEnv: "DATADOG_OAUTH_CLIENT_SECRET"
+        },
+        storage: {
+          secrets: ["DATADOG_ACCESS_TOKEN", "DATADOG_REFRESH_TOKEN"],
+          variables: ["DATADOG_DOMAIN"]
+        },
+        grant: {
+          kind: "auth-code",
+          scopes: [
+            "dashboards_read",
+            "events_read",
+            "incident_read",
+            "logs_read_index_data",
+            "metrics_read",
+            "monitors_read",
+            "slos_read"
+          ],
+          outputs: {
+            accessToken: "$secrets.DATADOG_ACCESS_TOKEN",
+            refreshToken: "$secrets.DATADOG_REFRESH_TOKEN",
+            domain: "$vars.DATADOG_DOMAIN"
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            refreshToken: "$secrets.DATADOG_REFRESH_TOKEN",
+            domain: "$vars.DATADOG_DOMAIN"
+          },
+          outputs: {
+            accessToken: "$secrets.DATADOG_ACCESS_TOKEN",
+            refreshToken: "$secrets.DATADOG_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["DATADOG_ACCESS_TOKEN"],
+          envBindings: {
+            DATADOG_TOKEN: "$secrets.DATADOG_ACCESS_TOKEN",
+            DATADOG_DOMAIN: "$vars.DATADOG_DOMAIN"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/daytona.ts
 init_esm_shims();
 var daytona = {
@@ -6764,6 +7064,52 @@ var exa = {
   }
 };
 
+// ../../packages/connectors/src/connectors/expensify.ts
+init_esm_shims();
+var expensify = {
+  expensify: {
+    label: "Expensify",
+    category: "sales-crm-business-operations",
+    tags: ["expenses", "reports", "reconciliation", "accounting"],
+    helpText: "Connect Expensify Integration Server to export expense reports, reconcile transactions, and manage reports",
+    authMethods: {
+      "api-token": {
+        featureFlag: "expensifyConnector" /* ExpensifyConnector */,
+        label: "Partner Credentials",
+        helpText: "1. Sign in to Expensify\n2. Open [Integration Server credentials](https://www.expensify.com/tools/integrations/)\n3. Generate and copy the partner user ID and partner user secret",
+        storage: {
+          secrets: ["EXPENSIFY_PARTNER_USER_SECRET"],
+          variables: ["EXPENSIFY_PARTNER_USER_ID"]
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            EXPENSIFY_PARTNER_USER_ID: {
+              label: "Partner User ID",
+              publicId: "partnerUserId",
+              required: true,
+              storage: "variable"
+            },
+            EXPENSIFY_PARTNER_USER_SECRET: {
+              label: "Partner User Secret",
+              publicId: "partnerUserSecret",
+              required: true
+            }
+          }
+        },
+        access: {
+          kind: "static",
+          envBindings: {
+            EXPENSIFY_PARTNER_USER_ID: "$vars.EXPENSIFY_PARTNER_USER_ID",
+            EXPENSIFY_PARTNER_USER_SECRET: "$secrets.EXPENSIFY_PARTNER_USER_SECRET"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/explorium.ts
 init_esm_shims();
 var explorium = {
@@ -9823,6 +10169,79 @@ var netdata = {
   }
 };
 
+// ../../packages/connectors/src/connectors/netsuite.ts
+init_esm_shims();
+var netsuite = {
+  netsuite: {
+    label: "NetSuite",
+    category: "sales-crm-business-operations",
+    tags: ["erp", "accounting", "suiteql", "restlets", "oracle"],
+    helpText: "Connect a NetSuite integration record to access REST Web Services, SuiteQL, and RESTlets with automatically refreshed OAuth tokens",
+    authMethods: {
+      "api-token": {
+        featureFlag: "netSuiteConnector" /* NetSuiteConnector */,
+        label: "OAuth 2.0 Credentials",
+        helpText: "Create an OAuth 2.0 integration record in NetSuite, authorize it once, then provide the account ID, client credentials, and refresh token.",
+        storage: {
+          secrets: [
+            "NETSUITE_CLIENT_SECRET",
+            "NETSUITE_REFRESH_TOKEN",
+            "NETSUITE_ACCESS_TOKEN"
+          ],
+          variables: ["NETSUITE_ACCOUNT_SUBDOMAIN", "NETSUITE_CLIENT_ID"]
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            NETSUITE_ACCOUNT_SUBDOMAIN: {
+              label: "Account Domain Prefix",
+              publicId: "accountSubdomain",
+              required: true,
+              storage: "variable",
+              placeholder: "1234567-sb1"
+            },
+            NETSUITE_CLIENT_ID: {
+              label: "Client ID",
+              publicId: "clientId",
+              required: true,
+              storage: "variable"
+            },
+            NETSUITE_CLIENT_SECRET: {
+              label: "Client Secret",
+              publicId: "clientSecret",
+              required: true
+            },
+            NETSUITE_REFRESH_TOKEN: {
+              label: "Refresh Token",
+              publicId: "refreshToken",
+              required: true
+            }
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            accountSubdomain: "$vars.NETSUITE_ACCOUNT_SUBDOMAIN",
+            clientId: "$vars.NETSUITE_CLIENT_ID",
+            clientSecret: "$secrets.NETSUITE_CLIENT_SECRET",
+            refreshToken: "$secrets.NETSUITE_REFRESH_TOKEN"
+          },
+          outputs: {
+            accessToken: "$secrets.NETSUITE_ACCESS_TOKEN",
+            refreshToken: "$secrets.NETSUITE_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["NETSUITE_ACCESS_TOKEN"],
+          envBindings: {
+            NETSUITE_TOKEN: "$secrets.NETSUITE_ACCESS_TOKEN",
+            NETSUITE_ACCOUNT_SUBDOMAIN: "$vars.NETSUITE_ACCOUNT_SUBDOMAIN"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/novita.ts
 init_esm_shims();
 var novita = {
@@ -10243,14 +10662,63 @@ var parallel = {
   }
 };
 
-// ../../packages/connectors/src/connectors/pdf4me.ts
+// ../../packages/connectors/src/connectors/paypal.ts
 init_esm_shims();
-var pdf4me = {
-  pdf4me: {
-    label: "PDF4me",
-    category: "data-automation-infrastructure",
-    generation: ["document"],
-    helpText: "Connect your PDF4me account to convert, merge, split, compress, and manipulate PDF documents",
+var paypal = {
+  paypal: {
+    label: "PayPal",
+    category: "sales-crm-business-operations",
+    tags: ["payments", "orders", "invoices", "payouts", "transactions"],
+    helpText: "Connect a PayPal REST app to manage orders, payments, invoices, payouts, disputes, and transaction reporting",
+    authMethods: {
+      "api-token": {
+        featureFlag: "payPalConnector" /* PayPalConnector */,
+        label: "REST App Credentials",
+        helpText: "1. Open the [PayPal Developer Dashboard](https://developer.paypal.com/dashboard/applications/live)\n2. Create or select a live REST app\n3. Copy the client ID and client secret",
+        storage: {
+          secrets: ["PAYPAL_CLIENT_SECRET", "PAYPAL_ACCESS_TOKEN"],
+          variables: ["PAYPAL_CLIENT_ID"]
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            PAYPAL_CLIENT_ID: {
+              label: "Client ID",
+              publicId: "clientId",
+              required: true,
+              storage: "variable"
+            },
+            PAYPAL_CLIENT_SECRET: {
+              label: "Client Secret",
+              publicId: "clientSecret",
+              required: true
+            }
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            clientId: "$vars.PAYPAL_CLIENT_ID",
+            clientSecret: "$secrets.PAYPAL_CLIENT_SECRET"
+          },
+          outputs: { accessToken: "$secrets.PAYPAL_ACCESS_TOKEN" },
+          refreshableSecrets: ["PAYPAL_ACCESS_TOKEN"],
+          envBindings: { PAYPAL_TOKEN: "$secrets.PAYPAL_ACCESS_TOKEN" }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
+// ../../packages/connectors/src/connectors/pdf4me.ts
+init_esm_shims();
+var pdf4me = {
+  pdf4me: {
+    label: "PDF4me",
+    category: "data-automation-infrastructure",
+    generation: ["document"],
+    helpText: "Connect your PDF4me account to convert, merge, split, compress, and manipulate PDF documents",
     authMethods: {
       "api-token": {
         label: "API Key",
@@ -11131,6 +11599,44 @@ var qdrant = {
   }
 };
 
+// ../../packages/connectors/src/connectors/qiita.ts
+init_esm_shims();
+var qiita = {
+  qiita: {
+    label: "Qiita",
+    category: "marketing-content-growth",
+    helpText: "Connect your Qiita account to search, read, and publish technical articles",
+    authMethods: {
+      "api-token": {
+        label: "Access Token",
+        helpText: "1. Log in to [Qiita](https://qiita.com)\n2. Go to **Settings > Applications**\n3. Create a new access token with the desired scopes (e.g., `read_qiita`, `write_qiita`)\n4. Copy the generated token\n5. Use it in API requests with the header `Authorization: Bearer [your_token]`",
+        storage: {
+          secrets: ["QIITA_TOKEN"],
+          variables: []
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            QIITA_TOKEN: {
+              label: "Access Token",
+              publicId: "accessToken",
+              required: true,
+              placeholder: "your-qiita-access-token"
+            }
+          }
+        },
+        access: {
+          kind: "static",
+          envBindings: {
+            QIITA_TOKEN: "$secrets.QIITA_TOKEN"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/quickbooks.ts
 init_esm_shims();
 var quickbooks = {
@@ -11189,44 +11695,6 @@ var quickbooks = {
   }
 };
 
-// ../../packages/connectors/src/connectors/qiita.ts
-init_esm_shims();
-var qiita = {
-  qiita: {
-    label: "Qiita",
-    category: "marketing-content-growth",
-    helpText: "Connect your Qiita account to search, read, and publish technical articles",
-    authMethods: {
-      "api-token": {
-        label: "Access Token",
-        helpText: "1. Log in to [Qiita](https://qiita.com)\n2. Go to **Settings > Applications**\n3. Create a new access token with the desired scopes (e.g., `read_qiita`, `write_qiita`)\n4. Copy the generated token\n5. Use it in API requests with the header `Authorization: Bearer [your_token]`",
-        storage: {
-          secrets: ["QIITA_TOKEN"],
-          variables: []
-        },
-        grant: {
-          kind: "manual",
-          fields: {
-            QIITA_TOKEN: {
-              label: "Access Token",
-              publicId: "accessToken",
-              required: true,
-              placeholder: "your-qiita-access-token"
-            }
-          }
-        },
-        access: {
-          kind: "static",
-          envBindings: {
-            QIITA_TOKEN: "$secrets.QIITA_TOKEN"
-          }
-        },
-        revoke: { kind: "none" }
-      }
-    }
-  }
-};
-
 // ../../packages/connectors/src/connectors/railway.ts
 init_esm_shims();
 var railway = {
@@ -11303,6 +11771,63 @@ var railwayProject = {
   }
 };
 
+// ../../packages/connectors/src/connectors/ramp.ts
+init_esm_shims();
+var ramp = {
+  ramp: {
+    label: "Ramp",
+    category: "sales-crm-business-operations",
+    tags: ["expenses", "cards", "receipts", "limits", "accounting"],
+    helpText: "Connect a Ramp developer app to access cards, receipts, transactions, reimbursements, users, and spending limits",
+    authMethods: {
+      "api-token": {
+        featureFlag: "rampConnector" /* RampConnector */,
+        label: "Client Credentials",
+        helpText: "1. Open the Ramp Developer Console\n2. Create an app with the Client Credentials grant enabled\n3. Copy the client ID and client secret",
+        storage: {
+          secrets: ["RAMP_CLIENT_SECRET", "RAMP_ACCESS_TOKEN"],
+          variables: ["RAMP_CLIENT_ID", "RAMP_SCOPE"]
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            RAMP_CLIENT_ID: {
+              label: "Client ID",
+              publicId: "clientId",
+              required: true,
+              storage: "variable"
+            },
+            RAMP_CLIENT_SECRET: {
+              label: "Client Secret",
+              publicId: "clientSecret",
+              required: true
+            },
+            RAMP_SCOPE: {
+              label: "OAuth Scopes",
+              publicId: "scope",
+              required: true,
+              storage: "variable",
+              placeholder: "transactions:read users:read"
+            }
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            clientId: "$vars.RAMP_CLIENT_ID",
+            clientSecret: "$secrets.RAMP_CLIENT_SECRET",
+            scope: "$vars.RAMP_SCOPE"
+          },
+          outputs: { accessToken: "$secrets.RAMP_ACCESS_TOKEN" },
+          refreshableSecrets: ["RAMP_ACCESS_TOKEN"],
+          envBindings: { RAMP_TOKEN: "$secrets.RAMP_ACCESS_TOKEN" }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/reap.ts
 init_esm_shims();
 var reap = {
@@ -13712,6 +14237,88 @@ var wix = {
   }
 };
 
+// ../../packages/connectors/src/connectors/workday.ts
+init_esm_shims();
+var workday = {
+  workday: {
+    label: "Workday",
+    category: "sales-crm-business-operations",
+    tags: ["hr", "hcm", "workers", "recruiting", "finance"],
+    helpText: "Connect a Workday API client for integrations to access tenant REST APIs with automatically refreshed OAuth tokens",
+    authMethods: {
+      "api-token": {
+        featureFlag: "workdayConnector" /* WorkdayConnector */,
+        label: "Integration OAuth Credentials",
+        helpText: "Register an API Client for Integrations in Workday, generate a refresh token for the integration user, then provide the tenant connection details.",
+        storage: {
+          secrets: [
+            "WORKDAY_CLIENT_SECRET",
+            "WORKDAY_REFRESH_TOKEN",
+            "WORKDAY_ACCESS_TOKEN"
+          ],
+          variables: ["WORKDAY_HOST", "WORKDAY_TENANT", "WORKDAY_CLIENT_ID"]
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            WORKDAY_HOST: {
+              label: "Tenant Host",
+              publicId: "tenantHost",
+              required: true,
+              storage: "variable",
+              normalize: "host",
+              placeholder: "tenant.myworkday.com"
+            },
+            WORKDAY_TENANT: {
+              label: "Tenant Alias",
+              publicId: "tenant",
+              required: true,
+              storage: "variable"
+            },
+            WORKDAY_CLIENT_ID: {
+              label: "Client ID",
+              publicId: "clientId",
+              required: true,
+              storage: "variable"
+            },
+            WORKDAY_CLIENT_SECRET: {
+              label: "Client Secret",
+              publicId: "clientSecret",
+              required: true
+            },
+            WORKDAY_REFRESH_TOKEN: {
+              label: "Refresh Token",
+              publicId: "refreshToken",
+              required: true
+            }
+          }
+        },
+        access: {
+          kind: "refresh-token",
+          inputs: {
+            host: "$vars.WORKDAY_HOST",
+            tenant: "$vars.WORKDAY_TENANT",
+            clientId: "$vars.WORKDAY_CLIENT_ID",
+            clientSecret: "$secrets.WORKDAY_CLIENT_SECRET",
+            refreshToken: "$secrets.WORKDAY_REFRESH_TOKEN"
+          },
+          outputs: {
+            accessToken: "$secrets.WORKDAY_ACCESS_TOKEN",
+            refreshToken: "$secrets.WORKDAY_REFRESH_TOKEN"
+          },
+          refreshableSecrets: ["WORKDAY_ACCESS_TOKEN"],
+          envBindings: {
+            WORKDAY_TOKEN: "$secrets.WORKDAY_ACCESS_TOKEN",
+            WORKDAY_HOST: "$vars.WORKDAY_HOST",
+            WORKDAY_TENANT: "$vars.WORKDAY_TENANT"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/workos.ts
 init_esm_shims();
 var workos = {
@@ -14143,7 +14750,9 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...slock,
   ...googleSheets,
   ...googleCalendar,
+  ...googleContacts,
   ...googleDocs,
+  ...googleForms,
   ...linear,
   ...intervalsIcu,
   ...vercel,
@@ -14218,6 +14827,7 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...base44,
   ...bentoml,
   ...bfl,
+  ...bill,
   ...bitrefill,
   ...bitrix,
   ...bland,
@@ -14247,11 +14857,13 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...cloudinary,
   ...coda,
   ...coingecko,
+  ...copper,
   ...coresignal,
   ...cronlytic,
   ...crustdata,
   ...cursor,
   ...customerIo,
+  ...datadog,
   ...daytona,
   ...db9,
   ...deel,
@@ -14273,6 +14885,7 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...etsy,
   ...etherscan,
   ...exa,
+  ...expensify,
   ...explorium,
   ...faire,
   ...fal,
@@ -14341,6 +14954,7 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...n8n,
   ...neon,
   ...netdata,
+  ...netsuite,
   ...novita,
   ...nyne,
   ...onyx,
@@ -14351,6 +14965,7 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...outlookMail,
   ...pandadoc,
   ...parallel,
+  ...paypal,
   ...pdf4me,
   ...pdfco,
   ...pdforge,
@@ -14372,10 +14987,11 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...productlane,
   ...pushinator,
   ...qdrant,
-  ...quickbooks,
   ...qiita,
+  ...quickbooks,
   ...railway,
   ...railwayProject,
+  ...ramp,
   ...reap,
   ...reddit,
   ...reducto,
@@ -14427,6 +15043,7 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...weread,
   ...whaleAlert,
   ...wix,
+  ...workday,
   ...workos,
   ...wrike,
   ...youtube,
@@ -14495,9 +15112,6 @@ function connectorRuntimeEnvBindings(envBindings) {
     })
   );
 }
-function connectorAuthMethodOwnedSecretNames(method) {
-  return method ? [...method.storage.secrets] : [];
-}
 function getConnectorAuthMethodEnvBindings(type, authMethod) {
   const method = getConnectorAuthMethod(type, authMethod);
   return method ? connectorAccessRuntimeEnvBindings(method.access) : {};
@@ -14512,31 +15126,6 @@ function getConnectorEnvBindingEntries(type) {
   }
   return entries;
 }
-function getConnectorStoredSecretDisplayInfo(secretName) {
-  const allTypes = CONNECTOR_TYPE_KEYS;
-  for (const type of allTypes) {
-    const config = CONNECTOR_TYPES[type];
-    const found = Object.values(config.authMethods).some((method) => {
-      return connectorAuthMethodOwnedSecretNames(method).includes(secretName);
-    });
-    if (!found) {
-      continue;
-    }
-    const envNames = [
-      ...new Set(
-        getConnectorEnvBindingEntries(type).filter(({ valueRef }) => {
-          return valueRef === `$secrets.${secretName}`;
-        }).map(({ envName }) => {
-          return envName;
-        })
-      )
-    ];
-    if (envNames.length > 0) {
-      return { connectorLabel: config.label, envNames };
-    }
-  }
-  return null;
-}
 function getDiagnosticConnectorTypeForRuntimeEnvName(envName) {
   for (const type of CONNECTOR_TYPE_KEYS) {
     const hasEnvName = getConnectorEnvBindingEntries(type).some((entry) => {
@@ -14549,10 +15138,1290 @@ function getDiagnosticConnectorTypeForRuntimeEnvName(envName) {
   return null;
 }
 
+// ../../packages/connectors/src/firewall-rule-matcher.ts
+init_esm_shims();
+var VALID_RULE_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "ANY"
+]);
+var FORBIDDEN_RUNTIME_HOST_CHARS = new Set("#%*,/<>?@\\^|{}".split(""));
+var FORBIDDEN_BASE_PATTERN_HOST_CHARS = new Set("#%,/<>?@\\^|".split(""));
+var PERCENT_ESCAPE_LENGTH = 3;
+var HEX_DIGITS = new Set("0123456789abcdefABCDEF".split(""));
+var PATH_SCORE_MULTIPLIER = 1e6;
+var AUTHORITY_SCORE_MULTIPLIER = 100;
+var LITERAL_SEGMENT_SCORE = 1e3;
+var MIXED_PARAM_SEGMENT_SCORE = 100;
+var PLAIN_PARAM_SEGMENT_SCORE = 10;
+var PLUS_GREEDY_SEGMENT_SCORE = 1;
+var ROOT_PATH_SCORE = 1;
+var STATIC_BASE_SCORE_BONUS = 1;
+var PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS = /* @__PURE__ */ new Set([
+  "{",
+  "}",
+  "*",
+  ".",
+  "\u3002",
+  "\uFF0E",
+  "\uFF61",
+  ":"
+]);
+function matchMixedSegment(runtime2, prefix, suffix) {
+  if (!runtime2.startsWith(prefix)) return null;
+  if (!runtime2.endsWith(suffix)) return null;
+  if (runtime2.length <= prefix.length + suffix.length) return null;
+  return runtime2.slice(prefix.length, runtime2.length - suffix.length);
+}
+function hasNonEmptySegment(segments, start) {
+  for (let i = start; i < segments.length; i++) {
+    if (segments[i] !== "") return true;
+  }
+  return false;
+}
+function codePointLength(value) {
+  return [...value].length;
+}
+function hasUnsafeRuntimeUrlSyntax(value) {
+  return hasUnsafeUrlCodepoint(value) || hasRawWhitespace(value) || value.includes("\\") || !value.includes("://");
+}
+function stripTrailingSlash(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix) {
+  return patternIndex !== lastPatternIndex || prefix !== "" || suffix !== "";
+}
+function parseStrictMatchSegment(segment2, patternIndex, lastPatternIndex) {
+  const parsed = parseSegment(segment2);
+  if (parsed.kind === "error") return null;
+  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
+    patternIndex,
+    lastPatternIndex,
+    parsed.prefix,
+    parsed.suffix
+  )) {
+    return null;
+  }
+  return parsed;
+}
+function pathSpecificity(pattern) {
+  if (!pattern.startsWith("/") || pattern.includes("?") || pattern.includes("#") || pattern.includes("\\") || hasRawWhitespace(pattern) || hasUnsafeUrlCodepoint(pattern)) {
+    return null;
+  }
+  let literalSegments = 0;
+  let mixedParamSegments = 0;
+  let plainParamSegments = 0;
+  let plusGreedySegments = 0;
+  let starGreedySegments = 0;
+  let literalChars = 0;
+  const segments = splitPathSegments(pattern);
+  const paramNames = /* @__PURE__ */ new Set();
+  const lastSegmentIndex = segments.length - 1;
+  for (let index = 0; index < segments.length; index += 1) {
+    const seg = segments[index];
+    const parsed = parseSegment(seg);
+    if (parsed.kind === "error") return null;
+    if (parsed.kind === "literal") {
+      literalSegments += 1;
+      literalChars += codePointLength(parsed.value);
+      continue;
+    }
+    if (paramNames.has(parsed.name)) return null;
+    paramNames.add(parsed.name);
+    if (parsed.greedy !== "" && isInvalidGreedyParam(
+      index,
+      lastSegmentIndex,
+      parsed.prefix,
+      parsed.suffix
+    )) {
+      return null;
+    }
+    literalChars += codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
+    if (parsed.prefix !== "" || parsed.suffix !== "") {
+      mixedParamSegments += 1;
+    } else if (parsed.greedy === "+") {
+      plusGreedySegments += 1;
+    } else if (parsed.greedy === "*") {
+      starGreedySegments += 1;
+    } else {
+      plainParamSegments += 1;
+    }
+  }
+  return [
+    literalSegments,
+    mixedParamSegments,
+    plainParamSegments,
+    plusGreedySegments,
+    -starGreedySegments,
+    literalChars,
+    segments.length
+  ];
+}
+function comparePathSpecificity(left, right) {
+  for (let i = 0; i < left.length; i++) {
+    const difference = left[i] - right[i];
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+function compileDecisionRule(permission, rule) {
+  const spaceIdx = rule.indexOf(" ");
+  if (spaceIdx === -1) return null;
+  const method = rule.slice(0, spaceIdx);
+  if (!VALID_RULE_METHODS.has(method)) return null;
+  const path = rule.slice(spaceIdx + 1);
+  const specificity = pathSpecificity(path);
+  if (specificity === null) return null;
+  return { permission, raw: rule, method, path, specificity };
+}
+function isValidPermissionName(permissionName) {
+  return permissionName !== "" && permissionName !== "all";
+}
+function isObjectRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function isStringRecord(value) {
+  if (!isObjectRecord(value)) return false;
+  return Object.values(value).every((entry) => {
+    return typeof entry === "string";
+  });
+}
+function hasEntries(value) {
+  return value !== void 0 && Object.keys(value).length > 0;
+}
+function isValidAwsSigv4AuthConfig(value) {
+  if (!isObjectRecord(value)) return false;
+  const allowedKeys = /* @__PURE__ */ new Set([
+    "accessKeyId",
+    "secretAccessKey",
+    "sessionToken"
+  ]);
+  if (Object.keys(value).some((key) => {
+    return !allowedKeys.has(key);
+  })) {
+    return false;
+  }
+  if (typeof value.accessKeyId !== "string" || value.accessKeyId === "") {
+    return false;
+  }
+  if (typeof value.secretAccessKey !== "string" || value.secretAccessKey === "") {
+    return false;
+  }
+  const optionalValue = value.sessionToken;
+  if (optionalValue !== void 0 && (typeof optionalValue !== "string" || optionalValue === "")) {
+    return false;
+  }
+  return true;
+}
+function isValidAuthConfig(auth, serviceName) {
+  if (!isObjectRecord(auth)) return false;
+  if (auth.headers !== void 0 && !isStringRecord(auth.headers)) return false;
+  if (auth.query !== void 0 && !isStringRecord(auth.query)) return false;
+  if (auth.awsSigv4 !== void 0 && !isValidAwsSigv4AuthConfig(auth.awsSigv4)) {
+    return false;
+  }
+  if (auth.awsSigv4 !== void 0) {
+    if (hasEntries(auth.headers)) {
+      return false;
+    }
+    if (hasEntries(auth.query)) {
+      return false;
+    }
+  }
+  if (auth.base !== void 0) {
+    if (typeof auth.base !== "string") return false;
+    validateAuthBaseUrl(auth.base, serviceName);
+    if (auth.awsSigv4 !== void 0) return false;
+  }
+  return true;
+}
+function rawObjectHasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function isValidAuthConfigForDecision(auth, serviceName) {
+  try {
+    return isValidAuthConfig(auth, serviceName);
+  } catch {
+    return false;
+  }
+}
+function canonicalJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? JSON.stringify(value) : void 0;
+  }
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const item of value) {
+      const encoded = canonicalJson(item);
+      if (encoded === void 0) return void 0;
+      items.push(encoded);
+    }
+    return `[${items.join(",")}]`;
+  }
+  if (!isObjectRecord(value)) return void 0;
+  const entries = [];
+  for (const key of Object.keys(value).sort()) {
+    const item = value[key];
+    if (item === void 0) continue;
+    const encoded = canonicalJson(item);
+    if (encoded === void 0) return void 0;
+    entries.push(`${JSON.stringify(key)}:${encoded}`);
+  }
+  return `{${entries.join(",")}}`;
+}
+function decisionApiRoutingIdentity(api) {
+  return canonicalJson({
+    base: api.base,
+    hostPolicy: api.hostPolicy,
+    auth: api.auth
+  }) ?? null;
+}
+function compileDecisionApi(api, serviceName, nameMalformed) {
+  if (typeof api.base !== "string") return null;
+  let baseMalformed = false;
+  try {
+    validateBaseUrl(api.base, serviceName);
+  } catch {
+    baseMalformed = true;
+  }
+  const authMalformed = !isValidAuthConfigForDecision(api.auth, serviceName);
+  const routingIdentity = decisionApiRoutingIdentity(api);
+  const rules = [];
+  const seenPermissionNames = /* @__PURE__ */ new Set();
+  let hasMalformedRules = nameMalformed;
+  const rawPermissions = api.permissions;
+  if (Array.isArray(rawPermissions)) {
+    for (const rawPermission of rawPermissions) {
+      if (!isObjectRecord(rawPermission)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      const permissionName = rawPermission.name;
+      if (typeof permissionName !== "string" || !isValidPermissionName(permissionName)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      if (seenPermissionNames.has(permissionName)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      seenPermissionNames.add(permissionName);
+      const rawRules = rawPermission.rules;
+      if (!Array.isArray(rawRules)) {
+        hasMalformedRules = true;
+        continue;
+      }
+      if (rawRules.length === 0) {
+        hasMalformedRules = true;
+      }
+      for (const rawRule of rawRules) {
+        if (typeof rawRule !== "string") {
+          hasMalformedRules = true;
+          continue;
+        }
+        const compiledRule = compileDecisionRule(permissionName, rawRule);
+        if (compiledRule === null) {
+          hasMalformedRules = true;
+          continue;
+        }
+        rules.push(compiledRule);
+      }
+    }
+  } else if (rawObjectHasOwn(api, "permissions")) {
+    hasMalformedRules = true;
+  }
+  return {
+    rawBase: api.base,
+    baseMalformed,
+    authMalformed,
+    hasMalformedRules,
+    routingIdentity,
+    rules
+  };
+}
+function compileDecisionFirewall(rawFirewall) {
+  if (!isObjectRecord(rawFirewall)) return null;
+  const rawName = rawFirewall.name;
+  const nameMalformed = typeof rawName !== "string" || rawName === "";
+  const name = typeof rawName === "string" ? rawName : "";
+  const rawApis = rawFirewall.apis;
+  if (!Array.isArray(rawApis)) return null;
+  const apis = [];
+  for (const rawApi of rawApis) {
+    if (!isObjectRecord(rawApi)) continue;
+    const api = compileDecisionApi(rawApi, name, nameMalformed);
+    if (api !== null) {
+      apis.push(api);
+    }
+  }
+  if (apis.length === 0) return null;
+  return { name, nameMalformed, apis };
+}
+function compileDecisionFirewalls(rawFirewalls) {
+  if (!Array.isArray(rawFirewalls) || rawFirewalls.length === 0) return [];
+  const firewalls = [];
+  for (const rawFirewall of rawFirewalls) {
+    const firewall = compileDecisionFirewall(rawFirewall);
+    if (firewall !== null) {
+      firewalls.push(firewall);
+    }
+  }
+  return firewalls;
+}
+function compilePermissionSet(rawValue) {
+  if (rawValue === void 0 || rawValue === null) {
+    return { values: /* @__PURE__ */ new Set(), malformed: false };
+  }
+  if (!Array.isArray(rawValue) || rawValue.some((item) => {
+    return typeof item !== "string";
+  })) {
+    return { values: /* @__PURE__ */ new Set(), malformed: true };
+  }
+  return { values: new Set(rawValue), malformed: false };
+}
+function compileNetworkPolicies(rawNetworkPolicies) {
+  if (rawNetworkPolicies === void 0 || rawNetworkPolicies === null) {
+    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: false };
+  }
+  if (!isObjectRecord(rawNetworkPolicies)) {
+    return { policies: /* @__PURE__ */ new Map(), topLevelMalformed: true };
+  }
+  const policies = /* @__PURE__ */ new Map();
+  for (const [firewallName, grant] of Object.entries(rawNetworkPolicies)) {
+    if (!isObjectRecord(grant)) {
+      policies.set(firewallName, {
+        blockedPermissions: /* @__PURE__ */ new Set(),
+        unknownPolicy: "allow",
+        permissionMalformed: true,
+        unknownPolicyMalformed: false
+      });
+      continue;
+    }
+    const allow = compilePermissionSet(grant.allow);
+    const deny = compilePermissionSet(grant.deny);
+    const ask = compilePermissionSet(grant.ask);
+    const blockedPermissions = /* @__PURE__ */ new Set([...deny.values, ...ask.values]);
+    let unknownPolicy = "allow";
+    let unknownPolicyMalformed = false;
+    const rawUnknownPolicy = grant.unknownPolicy;
+    if (rawUnknownPolicy === "allow" || rawUnknownPolicy === "deny" || rawUnknownPolicy === "ask") {
+      unknownPolicy = rawUnknownPolicy;
+    } else if (rawUnknownPolicy !== void 0 && rawUnknownPolicy !== null) {
+      unknownPolicyMalformed = true;
+    }
+    policies.set(firewallName, {
+      blockedPermissions,
+      unknownPolicy,
+      permissionMalformed: allow.malformed || deny.malformed || ask.malformed,
+      unknownPolicyMalformed
+    });
+  }
+  return { policies, topLevelMalformed: false };
+}
+function relativePathFromSegments(segments, consumed) {
+  const rest = segments.slice(consumed).join("/");
+  return rest === "" ? "/" : `/${rest}`;
+}
+function stripUrlQueryAndFragment(url) {
+  const queryIndex = url.indexOf("?");
+  const fragmentIndex = url.indexOf("#");
+  let end = url.length;
+  if (queryIndex !== -1) end = Math.min(end, queryIndex);
+  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);
+  return url.slice(0, end);
+}
+function rawUrlAuthorityBounds(url) {
+  const schemeEnd = url.indexOf("://");
+  if (schemeEnd === -1) return null;
+  const authorityStart = schemeEnd + 3;
+  let authorityEnd = url.length;
+  for (const delimiter of ["/", "?", "#"]) {
+    const delimiterIndex = url.indexOf(delimiter, authorityStart);
+    if (delimiterIndex !== -1)
+      authorityEnd = Math.min(authorityEnd, delimiterIndex);
+  }
+  return { authorityStart, authorityEnd };
+}
+function replaceRawUrlAuthority(url, bounds, authority) {
+  return `${url.slice(0, bounds.authorityStart)}${authority}${url.slice(bounds.authorityEnd)}`;
+}
+function stripRawUrlUserinfo(url) {
+  const bounds = rawUrlAuthorityBounds(url);
+  if (bounds === null) return url;
+  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
+  const userinfoEnd = authority.lastIndexOf("@");
+  if (userinfoEnd === -1) return url;
+  return replaceRawUrlAuthority(url, bounds, authority.slice(userinfoEnd + 1));
+}
+function rawAuthorityPortIsMalformed(port) {
+  if (port === "") return true;
+  if (![...port].every((char) => {
+    return char >= "0" && char <= "9";
+  })) {
+    return true;
+  }
+  return Number(port) > 65535;
+}
+function stripRawUrlMalformedPort(url) {
+  const bounds = rawUrlAuthorityBounds(url);
+  if (bounds === null) return url;
+  const authority = url.slice(bounds.authorityStart, bounds.authorityEnd);
+  if (authority.startsWith("[")) {
+    const closeBracketIndex = authority.indexOf("]");
+    if (closeBracketIndex === -1) return url;
+    const portPrefix = authority.slice(closeBracketIndex + 1);
+    if (!portPrefix.startsWith(":")) return url;
+    if (!rawAuthorityPortIsMalformed(portPrefix.slice(1))) return url;
+    return replaceRawUrlAuthority(
+      url,
+      bounds,
+      authority.slice(0, closeBracketIndex + 1)
+    );
+  }
+  const portSeparator = authority.lastIndexOf(":");
+  if (portSeparator === -1) return url;
+  if (authority.indexOf(":") !== portSeparator) return url;
+  if (!rawAuthorityPortIsMalformed(authority.slice(portSeparator + 1))) {
+    return url;
+  }
+  return replaceRawUrlAuthority(url, bounds, authority.slice(0, portSeparator));
+}
+function rawBaseForDecisionMatch(rawBase) {
+  if (stripUrlQueryAndFragment(rawBase).includes("\\")) return null;
+  return stripRawUrlMalformedPort(stripRawUrlUserinfo(rawBase));
+}
+function rawPathFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  return pathStart === -1 ? "/" : urlWithoutQuery.slice(pathStart);
+}
+function rawBasePathFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  return pathStart === -1 ? "" : urlWithoutQuery.slice(pathStart);
+}
+function rawAuthorityFromUrl(url) {
+  const urlWithoutQuery = stripUrlQueryAndFragment(url);
+  const schemeEnd = urlWithoutQuery.indexOf("://");
+  if (schemeEnd === -1) return null;
+  const authorityStart = schemeEnd + 3;
+  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
+  const authority = pathStart === -1 ? urlWithoutQuery.slice(authorityStart) : urlWithoutQuery.slice(authorityStart, pathStart);
+  return authority === "" ? null : authority;
+}
+function hasNonAscii(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) > 127) return true;
+  }
+  return false;
+}
+function rawHostFromAuthority(authority) {
+  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (withoutUserinfo.startsWith("[")) {
+    const closeBracket = withoutUserinfo.indexOf("]");
+    return closeBracket === -1 ? withoutUserinfo : withoutUserinfo.slice(0, closeBracket + 1);
+  }
+  const portSeparator = withoutUserinfo.lastIndexOf(":");
+  return portSeparator === -1 ? withoutUserinfo : withoutUserinfo.slice(0, portSeparator);
+}
+function authorityHasEmptyPort(authority) {
+  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (withoutUserinfo.startsWith("[")) {
+    const closeBracket = withoutUserinfo.indexOf("]");
+    if (closeBracket === -1) return false;
+    return withoutUserinfo.slice(closeBracket + 1) === ":";
+  }
+  const portSeparator = withoutUserinfo.lastIndexOf(":");
+  if (portSeparator === -1) return false;
+  return withoutUserinfo.indexOf(":") === portSeparator && portSeparator === withoutUserinfo.length - 1;
+}
+function rawAuthorityHostStartsWithDigit(authority) {
+  const firstChar = rawHostFromAuthority(authority)[0];
+  return firstChar !== void 0 && firstChar >= "0" && firstChar <= "9";
+}
+function runtimeAuthorityOriginForHostValidation(url) {
+  const authority = rawAuthorityFromUrl(url);
+  if (authority === null) return null;
+  if (!authority.includes("%") && !hasNonAscii(authority) && !rawAuthorityHostStartsWithDigit(authority)) {
+    return null;
+  }
+  const schemeEnd = url.indexOf("://");
+  if (schemeEnd === -1) return null;
+  return `${url.slice(0, schemeEnd)}://${authority}`;
+}
+function hasPercentEncodedAuthoritySyntax(value) {
+  let index = value.indexOf("%");
+  while (index !== -1) {
+    let runEnd = index;
+    while (runEnd < value.length && value[runEnd] === "%") {
+      const firstHexDigit = value[runEnd + 1];
+      const secondHexDigit = value[runEnd + 2];
+      if (!firstHexDigit || !secondHexDigit || !HEX_DIGITS.has(firstHexDigit) || !HEX_DIGITS.has(secondHexDigit)) {
+        return true;
+      }
+      runEnd += PERCENT_ESCAPE_LENGTH;
+    }
+    let decodedRun;
+    try {
+      decodedRun = decodeURIComponent(value.slice(index, runEnd));
+    } catch {
+      return true;
+    }
+    for (const char of decodedRun) {
+      if (PERCENT_DECODED_AUTHORITY_SYNTAX_CHARS.has(char)) {
+        return true;
+      }
+    }
+    index = value.indexOf("%", runEnd);
+  }
+  return false;
+}
+function hasMalformedRuntimeAuthoritySyntax(url) {
+  const authority = rawAuthorityFromUrl(url);
+  if (authority === null) return false;
+  return authority.includes("\\") || authorityHasEmptyPort(authority) || hasPercentEncodedAuthoritySyntax(authority);
+}
+function scoreLiteralSegment(segment2) {
+  return LITERAL_SEGMENT_SCORE + codePointLength(segment2);
+}
+function scoreParsedPatternSegment(parsed) {
+  if (parsed.kind === "literal") {
+    return scoreLiteralSegment(parsed.value);
+  }
+  const literalChars = codePointLength(parsed.prefix) + codePointLength(parsed.suffix);
+  if (parsed.prefix !== "" || parsed.suffix !== "") {
+    return MIXED_PARAM_SEGMENT_SCORE + literalChars;
+  }
+  if (parsed.greedy === "+") return PLUS_GREEDY_SEGMENT_SCORE;
+  if (parsed.greedy === "*") return 0;
+  return PLAIN_PARAM_SEGMENT_SCORE;
+}
+function scoreStaticSegments(segments) {
+  return segments.reduce((score, segment2) => {
+    return score + scoreLiteralSegment(segment2);
+  }, 0);
+}
+function scorePatternSegmentsWithParser(segments, parsePatternSegment) {
+  const lastPatternIndex = segments.length - 1;
+  let score = 0;
+  for (let index = 0; index < segments.length; index += 1) {
+    const segment2 = segments[index];
+    const parsed = parsePatternSegment(segment2, index, lastPatternIndex);
+    if (parsed !== null) {
+      score += scoreParsedPatternSegment(parsed);
+    }
+  }
+  return score;
+}
+function scorePathPattern(path, parsePatternSegment) {
+  if (path === "") return 0;
+  if (path === "/") return ROOT_PATH_SCORE;
+  const segments = splitPathSegments(path);
+  return parsePatternSegment === null ? scoreStaticSegments(segments) : scorePatternSegmentsWithParser(segments, parsePatternSegment);
+}
+function splitAuthoritySegments(authority) {
+  if (authority.startsWith("[")) return [authority];
+  const normalized = authority.endsWith(".") ? authority.slice(0, -1) : authority;
+  return normalized === "" ? [] : normalized.split(".");
+}
+function baseUrlSpecificityScore({
+  authority,
+  path,
+  hasParams,
+  tolerateMalformedBaseParams = false
+}) {
+  const patternParser = hasParams ? tolerateMalformedBaseParams ? parseMalformedTolerantBaseSegment : parseStrictMatchSegment : null;
+  const authoritySegments = splitAuthoritySegments(authority);
+  const authorityScore = patternParser === null ? scoreStaticSegments(authoritySegments) : scorePatternSegmentsWithParser(
+    [...authoritySegments].reverse(),
+    patternParser
+  );
+  const pathScore = scorePathPattern(path, patternParser);
+  return pathScore * PATH_SCORE_MULTIPLIER + authorityScore * AUTHORITY_SCORE_MULTIPLIER + (hasParams ? 0 : STATIC_BASE_SCORE_BONUS);
+}
+function matchStaticBasePathPrefix(path, pattern) {
+  if (pattern === "") {
+    return path === "" ? "/" : path;
+  }
+  if (pattern === "/") {
+    if (!path.startsWith(pattern)) return null;
+    const relativePath2 = path.slice(pattern.length);
+    if (relativePath2 !== "" && !relativePath2.startsWith("/")) return null;
+    return relativePath2 === "" ? "/" : relativePath2;
+  }
+  if (!path.startsWith(pattern)) return null;
+  const relativePath = path.slice(pattern.length);
+  if (relativePath !== "" && !relativePath.startsWith("/")) return null;
+  return relativePath === "" ? "/" : relativePath;
+}
+function normalizeUrlHostname(hostname, options = {}) {
+  let normalized = hostname.toLowerCase();
+  if (normalized.endsWith(".")) {
+    normalized = normalized.slice(0, -1);
+    if (normalized === "" || normalized.endsWith(".")) {
+      return null;
+    }
+  }
+  if (normalized.split(".").some((label) => {
+    return label === "";
+  })) {
+    return null;
+  }
+  const forbiddenChars = options.allowHostParams === true ? FORBIDDEN_BASE_PATTERN_HOST_CHARS : FORBIDDEN_RUNTIME_HOST_CHARS;
+  if (!normalized.startsWith("[") && [...normalized].some((char) => {
+    return forbiddenChars.has(char);
+  })) {
+    return null;
+  }
+  return normalized;
+}
+function normalizedUrlAuthority(parsed, options = {}) {
+  if (parsed.username !== "" || parsed.password !== "") {
+    return null;
+  }
+  const hostname = normalizeUrlHostname(parsed.hostname, options);
+  if (hostname === null || hostname === "") {
+    return null;
+  }
+  return parsed.port === "" ? hostname : `${hostname}:${parsed.port}`;
+}
+function matchStaticFirewallBaseUrl(url, rawBase, options = {}) {
+  const parsedUrl = new URL(url);
+  const parsedBase = new URL(rawBase);
+  if (parsedUrl.protocol.toLowerCase() !== parsedBase.protocol.toLowerCase()) {
+    return null;
+  }
+  const baseHasParams = hasBaseUrlParams(rawBase);
+  const baseForMatch = stripTrailingSlash(rawBase);
+  const urlAuthority = normalizedUrlAuthority(parsedUrl);
+  const baseAuthority = normalizedUrlAuthority(parsedBase, {
+    allowHostParams: baseHasParams
+  });
+  if (urlAuthority === null || baseAuthority === null) return null;
+  if (baseHasParams) {
+    const hostParams = options.tolerateMalformedBaseParams === true ? matchFirewallHostForMalformedBaseDecision(urlAuthority, baseAuthority) : matchFirewallHost(urlAuthority, baseAuthority);
+    if (hostParams === null) return null;
+  } else if (urlAuthority !== baseAuthority) {
+    return null;
+  }
+  const basePath = rawBasePathFromUrl(baseForMatch);
+  const relativePath = baseHasParams ? options.tolerateMalformedBaseParams === true ? matchFirewallPathPrefixForMalformedBaseDecision(
+    rawPathFromUrl(url),
+    basePath
+  ) : matchFirewallPathPrefix(rawPathFromUrl(url), basePath) : matchStaticBasePathPrefix(rawPathFromUrl(url), basePath);
+  if (relativePath === null) return null;
+  const displayBase = stripTrailingSlash(rawBase);
+  return {
+    displayBase,
+    relativePath,
+    score: baseUrlSpecificityScore({
+      authority: baseAuthority,
+      path: basePath,
+      hasParams: baseHasParams,
+      tolerateMalformedBaseParams: options.tolerateMalformedBaseParams === true
+    })
+  };
+}
+function runtimeUrlCanMatchFirewallBase(url) {
+  if (hasUnsafeUrlCodepoint(url) || hasRawWhitespace(url) || !url.includes("://") || hasMalformedRuntimeAuthoritySyntax(url)) {
+    return false;
+  }
+  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
+  if (runtimeAuthorityOrigin === null) return true;
+  try {
+    validateBaseUrl(runtimeAuthorityOrigin, "runtime");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function matchFirewallBaseUrlForDecision(url, rawBase) {
+  if (!runtimeUrlCanMatchFirewallBase(url)) return null;
+  const baseForMatch = rawBaseForDecisionMatch(rawBase);
+  if (baseForMatch === null) return null;
+  try {
+    const match = matchStaticFirewallBaseUrl(url, baseForMatch, {
+      tolerateMalformedBaseParams: true
+    });
+    if (match === null) return null;
+    return { ...match, displayBase: stripTrailingSlash(rawBase) };
+  } catch {
+    return null;
+  }
+}
+function createDecisionState() {
+  return {
+    bestBaseScore: null,
+    bestRuleSpecificity: null,
+    baseMatch: null,
+    allowedMatch: null,
+    deniedMatch: null,
+    deniedPermissionNames: [],
+    malformedConfigMatch: null,
+    malformedPolicyMatch: null
+  };
+}
+function acceptDecisionBaseMatch(state, match, score) {
+  if (state.bestBaseScore === null || score > state.bestBaseScore) {
+    state.bestBaseScore = score;
+    state.bestRuleSpecificity = null;
+    state.baseMatch = null;
+    state.allowedMatch = null;
+    state.deniedMatch = null;
+    state.deniedPermissionNames = [];
+    state.malformedConfigMatch = null;
+    state.malformedPolicyMatch = null;
+  } else if (score < state.bestBaseScore) {
+    return false;
+  }
+  state.baseMatch ??= match;
+  return true;
+}
+function acceptRuleSpecificity(state, specificity) {
+  if (state.bestRuleSpecificity === null) {
+    state.bestRuleSpecificity = specificity;
+    return true;
+  }
+  const comparison = comparePathSpecificity(
+    specificity,
+    state.bestRuleSpecificity
+  );
+  if (comparison > 0) {
+    state.bestRuleSpecificity = specificity;
+    state.allowedMatch = null;
+    state.deniedMatch = null;
+    state.deniedPermissionNames = [];
+    return true;
+  }
+  return comparison === 0;
+}
+function recordDeniedRule(state, match, permission) {
+  if (!state.deniedPermissionNames.includes(permission)) {
+    state.deniedPermissionNames.push(permission);
+  }
+  state.deniedMatch ??= match;
+}
+function resolveFirewallDecision(state, networkPolicies) {
+  const baseMatch = state.baseMatch;
+  if (baseMatch === null) {
+    return { kind: "no_match" };
+  }
+  if (state.allowedMatch !== null) {
+    return {
+      kind: "allow",
+      firewallName: state.allowedMatch.firewallName,
+      base: state.allowedMatch.base,
+      relativePath: state.allowedMatch.relativePath,
+      permission: state.allowedMatch.permission,
+      rule: state.allowedMatch.rule
+    };
+  }
+  if (state.deniedMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.deniedMatch.firewallName,
+      base: state.deniedMatch.base,
+      relativePath: state.deniedMatch.relativePath,
+      reason: "permission_denied",
+      permissions: state.deniedPermissionNames
+    };
+  }
+  if (state.malformedPolicyMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.malformedPolicyMatch.firewallName,
+      base: state.malformedPolicyMatch.base,
+      relativePath: state.malformedPolicyMatch.relativePath,
+      reason: "malformed_network_policy",
+      permissions: []
+    };
+  }
+  if (state.malformedConfigMatch !== null) {
+    return {
+      kind: "block",
+      firewallName: state.malformedConfigMatch.firewallName,
+      base: state.malformedConfigMatch.base,
+      relativePath: state.malformedConfigMatch.relativePath,
+      reason: "malformed_firewall_config",
+      permissions: []
+    };
+  }
+  const policy = networkPolicies.policies.get(baseMatch.firewallName);
+  if (policy === void 0) {
+    return {
+      kind: "allow",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.allowBase,
+      relativePath: baseMatch.relativePath
+    };
+  }
+  if (policy.unknownPolicyMalformed) {
+    return {
+      kind: "block",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.base,
+      relativePath: baseMatch.relativePath,
+      reason: "malformed_network_policy",
+      permissions: []
+    };
+  }
+  if (policy.unknownPolicy === "allow") {
+    return {
+      kind: "allow",
+      firewallName: baseMatch.firewallName,
+      base: baseMatch.allowBase,
+      relativePath: baseMatch.relativePath
+    };
+  }
+  return {
+    kind: "block",
+    firewallName: baseMatch.firewallName,
+    base: baseMatch.base,
+    relativePath: baseMatch.relativePath,
+    reason: "unknown_endpoint",
+    permissions: []
+  };
+}
+function unsafePathBlockDecision(firewall, baseMatch) {
+  return {
+    kind: "block",
+    firewallName: firewall.name,
+    base: baseMatch.displayBase,
+    relativePath: baseMatch.relativePath,
+    reason: "unsafe_path",
+    permissions: []
+  };
+}
+function recordMalformedDecisionState(state, api, blockMatch) {
+  if (api.baseMalformed || api.authMalformed || api.hasMalformedRules || api.routingIdentity === null) {
+    state.malformedConfigMatch ??= blockMatch;
+  }
+}
+function apiCannotEvaluateRules(firewall, api) {
+  return firewall.nameMalformed || api.baseMalformed || api.authMalformed || api.routingIdentity === null;
+}
+function policyCannotEvaluateRules(networkPolicies, policy) {
+  return networkPolicies.topLevelMalformed || policy !== void 0 && policy.permissionMalformed;
+}
+function createMatchCollection() {
+  return {
+    bestBaseScore: null,
+    bestRuleSpecificity: null,
+    apiMatches: [],
+    ruleMatches: []
+  };
+}
+function acceptCollectedApi(collection, match) {
+  if (collection.bestBaseScore === null || match.score > collection.bestBaseScore) {
+    collection.bestBaseScore = match.score;
+    collection.bestRuleSpecificity = null;
+    collection.apiMatches = [];
+    collection.ruleMatches = [];
+  } else if (match.score < collection.bestBaseScore) {
+    return false;
+  }
+  collection.apiMatches.push(match);
+  return true;
+}
+function canRuleAffectCollection(collection, specificity) {
+  if (collection.bestRuleSpecificity === null) return true;
+  return comparePathSpecificity(specificity, collection.bestRuleSpecificity) >= 0;
+}
+function recordCollectedRule(collection, match) {
+  const bestSpecificity = collection.bestRuleSpecificity;
+  if (bestSpecificity === null || comparePathSpecificity(match.rule.specificity, bestSpecificity) > 0) {
+    collection.bestRuleSpecificity = match.rule.specificity;
+    collection.ruleMatches = [];
+  } else if (comparePathSpecificity(match.rule.specificity, bestSpecificity) < 0) {
+    return;
+  }
+  collection.ruleMatches.push(match);
+}
+function collectDecisionRules(collection, apiMatch, upperMethod) {
+  for (const rule of apiMatch.api.rules) {
+    if (rule.method !== "ANY" && rule.method !== upperMethod) continue;
+    if (!canRuleAffectCollection(collection, rule.specificity)) continue;
+    if (matchFirewallPath(apiMatch.baseMatch.relativePath, rule.path) === null) {
+      continue;
+    }
+    recordCollectedRule(collection, { apiMatch, rule });
+  }
+}
+function winningApiMatches(collection) {
+  if (collection.ruleMatches.length === 0) {
+    return collection.apiMatches;
+  }
+  const matches = [];
+  const seenOrders = /* @__PURE__ */ new Set();
+  for (const ruleMatch of collection.ruleMatches) {
+    if (seenOrders.has(ruleMatch.apiMatch.order)) continue;
+    seenOrders.add(ruleMatch.apiMatch.order);
+    matches.push(ruleMatch.apiMatch);
+  }
+  return matches;
+}
+function winningOwnerNames(collection) {
+  const names = /* @__PURE__ */ new Set();
+  for (const apiMatch of winningApiMatches(collection)) {
+    if (!apiMatch.firewall.nameMalformed) {
+      names.add(apiMatch.firewall.name);
+    }
+  }
+  return [...names].sort();
+}
+function connectorAmbiguityReason(intent) {
+  if (intent.status === "absent") return "connector_intent_required";
+  if (intent.status === "malformed") return "malformed_connector_intent";
+  return "connector_intent_not_candidate";
+}
+function selectOwner(collection, intent, upperMethod, path) {
+  const [owner, ...otherOwners] = winningOwnerNames(collection);
+  if (owner === void 0) return { kind: "selected", name: null };
+  if (otherOwners.length === 0) {
+    return { kind: "selected", name: owner };
+  }
+  const owners = [owner, ...otherOwners];
+  if (intent.status === "present" && owners.includes(intent.value)) {
+    return { kind: "selected", name: intent.value };
+  }
+  return {
+    kind: "ambiguous",
+    decision: {
+      kind: "ambiguous",
+      method: upperMethod,
+      path,
+      candidates: owners,
+      reason: connectorAmbiguityReason(intent)
+    }
+  };
+}
+function conflictingSelectedApiDecision(collection, selectedName) {
+  const [first, ...otherMatches] = winningApiMatches(collection).filter(
+    (match) => {
+      return match.firewall.name === selectedName && !match.firewall.nameMalformed && !match.api.baseMalformed && !match.api.authMalformed && match.api.routingIdentity !== null;
+    }
+  );
+  if (first === void 0 || otherMatches.length === 0) return null;
+  if (otherMatches.every((match) => {
+    return match.api.routingIdentity === first.api.routingIdentity;
+  })) {
+    return null;
+  }
+  return {
+    kind: "block",
+    firewallName: selectedName,
+    base: first.blockMatch.base,
+    relativePath: first.blockMatch.relativePath,
+    reason: "malformed_firewall_config",
+    permissions: []
+  };
+}
+function reduceSelectedOwner(collection, selectedName, networkPolicies) {
+  if (selectedName !== null) {
+    const conflict = conflictingSelectedApiDecision(collection, selectedName);
+    if (conflict !== null) return conflict;
+  }
+  const state = createDecisionState();
+  const evaluableApiOrders = /* @__PURE__ */ new Set();
+  for (const apiMatch of collection.apiMatches) {
+    const { firewall, api, baseMatch, blockMatch } = apiMatch;
+    if (selectedName !== null && firewall.name !== selectedName && !firewall.nameMalformed) {
+      continue;
+    }
+    const policy = networkPolicies.policies.get(firewall.name);
+    acceptDecisionBaseMatch(state, baseMatch, apiMatch.score);
+    recordMalformedDecisionState(state, api, blockMatch);
+    if (apiCannotEvaluateRules(firewall, api)) continue;
+    if (policyCannotEvaluateRules(networkPolicies, policy)) {
+      state.malformedPolicyMatch ??= blockMatch;
+      continue;
+    }
+    evaluableApiOrders.add(apiMatch.order);
+  }
+  for (const ruleMatch of collection.ruleMatches) {
+    const { apiMatch, rule } = ruleMatch;
+    if (!evaluableApiOrders.has(apiMatch.order)) continue;
+    if (selectedName !== null && apiMatch.firewall.name !== selectedName) {
+      continue;
+    }
+    const policy = networkPolicies.policies.get(apiMatch.firewall.name);
+    if (!acceptRuleSpecificity(state, rule.specificity)) continue;
+    if (policy !== void 0 && policy.blockedPermissions.has(rule.permission)) {
+      recordDeniedRule(state, apiMatch.blockMatch, rule.permission);
+      continue;
+    }
+    state.allowedMatch ??= {
+      firewallName: apiMatch.baseMatch.firewallName,
+      base: apiMatch.baseMatch.allowBase,
+      relativePath: apiMatch.baseMatch.relativePath,
+      permission: rule.permission,
+      rule: rule.raw
+    };
+  }
+  return resolveFirewallDecision(state, networkPolicies);
+}
+function matchFirewallBaseUrl(url, rawBase) {
+  if (hasUnsafeRuntimeUrlSyntax(url) || hasMalformedRuntimeAuthoritySyntax(url)) {
+    return null;
+  }
+  const runtimeAuthorityOrigin = runtimeAuthorityOriginForHostValidation(url);
+  try {
+    if (runtimeAuthorityOrigin !== null) {
+      validateBaseUrl(runtimeAuthorityOrigin, "runtime");
+    }
+    validateBaseUrl(rawBase, "firewall");
+    return matchStaticFirewallBaseUrl(url, rawBase);
+  } catch {
+    return null;
+  }
+}
+function matchFirewallRequestDecision(firewalls, method, url, networkPolicies = void 0, connectorIntent = { status: "absent" }) {
+  const decisionFirewalls = compileDecisionFirewalls(firewalls);
+  if (decisionFirewalls.length === 0) return { kind: "no_match" };
+  const compiledNetworkPolicies = compileNetworkPolicies(networkPolicies);
+  const upperMethod = method.toUpperCase();
+  const collection = createMatchCollection();
+  const unsafePath = url.includes("\\") || hasUnsafeFirewallPath(rawPathFromUrl(url));
+  let apiOrder = 0;
+  for (const firewall of decisionFirewalls) {
+    for (const api of firewall.apis) {
+      const order = apiOrder;
+      apiOrder += 1;
+      const baseMatch = matchFirewallBaseUrlForDecision(url, api.rawBase);
+      if (baseMatch === null) continue;
+      if (unsafePath) return unsafePathBlockDecision(firewall, baseMatch);
+      const decisionBaseMatch = {
+        firewallName: firewall.name,
+        base: baseMatch.displayBase,
+        allowBase: api.rawBase,
+        relativePath: baseMatch.relativePath
+      };
+      const apiMatch = {
+        order,
+        firewall,
+        api,
+        baseMatch: decisionBaseMatch,
+        blockMatch: {
+          firewallName: decisionBaseMatch.firewallName,
+          base: decisionBaseMatch.base,
+          relativePath: decisionBaseMatch.relativePath
+        },
+        score: baseMatch.score
+      };
+      if (!acceptCollectedApi(collection, apiMatch)) continue;
+      collectDecisionRules(collection, apiMatch, upperMethod);
+    }
+  }
+  const selection = selectOwner(
+    collection,
+    connectorIntent,
+    upperMethod,
+    rawPathFromUrl(url)
+  );
+  if (selection.kind === "ambiguous") return selection.decision;
+  return reduceSelectedOwner(
+    collection,
+    selection.name,
+    compiledNetworkPolicies
+  );
+}
+function matchFirewallHostWithParser(host, pattern, parsePatternSegment) {
+  const hostSegsOrig = host.split(".");
+  const hostSegsLower = hostSegsOrig.map((segment2) => {
+    return segment2.toLowerCase();
+  });
+  const patternSegs = pattern.split(".").reverse();
+  hostSegsOrig.reverse();
+  hostSegsLower.reverse();
+  const params = {};
+  let hi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
+    if (parsed === null) return null;
+    if (parsed.kind === "literal") {
+      if (hi >= hostSegsLower.length || hostSegsLower[hi] !== parsed.value.toLowerCase()) {
+        return null;
+      }
+      hi += 1;
+      continue;
+    }
+    const { name, prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (hi >= hostSegsOrig.length) return null;
+      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
+      return params;
+    }
+    if (greedy === "*") {
+      params[name] = hostSegsOrig.slice(hi).reverse().join(".");
+      return params;
+    }
+    if (hi >= hostSegsOrig.length) return null;
+    if (prefix === "" && suffix === "") {
+      params[name] = hostSegsLower[hi];
+    } else {
+      const captured = matchMixedSegment(
+        hostSegsLower[hi],
+        prefix.toLowerCase(),
+        suffix.toLowerCase()
+      );
+      if (captured === null) return null;
+      params[name] = captured;
+    }
+    hi += 1;
+  }
+  return hi === hostSegsOrig.length ? params : null;
+}
+function matchFirewallHost(host, pattern) {
+  return matchFirewallHostWithParser(host, pattern, parseStrictMatchSegment);
+}
+function parseMalformedTolerantBaseSegment(segment2, patternIndex, lastPatternIndex) {
+  const parsed = parseSegment(segment2);
+  if (parsed.kind === "error") {
+    return {
+      kind: "param",
+      prefix: "",
+      name: `__malformed_base_segment_${patternIndex}`,
+      suffix: "",
+      greedy: ""
+    };
+  }
+  if (parsed.kind === "param" && parsed.greedy !== "" && isInvalidGreedyParam(
+    patternIndex,
+    lastPatternIndex,
+    parsed.prefix,
+    parsed.suffix
+  )) {
+    return { ...parsed, greedy: "" };
+  }
+  return parsed;
+}
+function matchFirewallHostForMalformedBaseDecision(host, pattern) {
+  return matchFirewallHostWithParser(
+    host,
+    pattern,
+    parseMalformedTolerantBaseSegment
+  );
+}
+function matchFirewallPathPrefixWithParser(path, pattern, parsePatternSegment) {
+  const pathSegs = splitPathSegments(path);
+  const patternSegs = splitPathSegments(pattern);
+  let pi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parsePatternSegment(seg, patternIndex, lastPatternIndex);
+    if (parsed === null) return null;
+    if (parsed.kind === "literal") {
+      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
+      pi += 1;
+      continue;
+    }
+    const { prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
+        return null;
+      }
+      return "/";
+    }
+    if (greedy === "*") {
+      return "/";
+    }
+    if (pi >= pathSegs.length) return null;
+    const runtime2 = pathSegs[pi];
+    if (prefix === "" && suffix === "") {
+      if (runtime2 === "") return null;
+    } else if (matchMixedSegment(runtime2, prefix, suffix) === null) {
+      return null;
+    }
+    pi += 1;
+  }
+  return relativePathFromSegments(pathSegs, pi);
+}
+function matchFirewallPathPrefix(path, pattern) {
+  return matchFirewallPathPrefixWithParser(
+    path,
+    pattern,
+    parseStrictMatchSegment
+  );
+}
+function matchFirewallPathPrefixForMalformedBaseDecision(path, pattern) {
+  return matchFirewallPathPrefixWithParser(
+    path,
+    pattern,
+    parseMalformedTolerantBaseSegment
+  );
+}
+function matchFirewallPath(path, pattern) {
+  const pathSegs = splitPathSegments(path);
+  const patternSegs = splitPathSegments(pattern);
+  const params = {};
+  let pi = 0;
+  const lastPatternIndex = patternSegs.length - 1;
+  for (let patternIndex = 0; patternIndex < patternSegs.length; patternIndex++) {
+    const seg = patternSegs[patternIndex];
+    const parsed = parseSegment(seg);
+    if (parsed.kind === "error") return null;
+    if (parsed.kind === "literal") {
+      if (pi >= pathSegs.length || pathSegs[pi] !== parsed.value) return null;
+      pi++;
+      continue;
+    }
+    const { name, prefix, suffix, greedy } = parsed;
+    if (greedy === "+") {
+      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
+        return null;
+      if (pi >= pathSegs.length || !hasNonEmptySegment(pathSegs, pi)) {
+        return null;
+      }
+      params[name] = pathSegs.slice(pi).join("/");
+      return params;
+    }
+    if (greedy === "*") {
+      if (isInvalidGreedyParam(patternIndex, lastPatternIndex, prefix, suffix))
+        return null;
+      params[name] = pathSegs.slice(pi).join("/");
+      return params;
+    }
+    if (pi >= pathSegs.length) return null;
+    const runtime2 = pathSegs[pi];
+    if (prefix === "" && suffix === "") {
+      if (runtime2 === "") return null;
+      params[name] = runtime2;
+    } else {
+      const captured = matchMixedSegment(runtime2, prefix, suffix);
+      if (captured === null) return null;
+      params[name] = captured;
+    }
+    pi++;
+  }
+  if (pi !== pathSegs.length) return null;
+  return params;
+}
+
 export {
   CONNECTOR_TYPES,
   getConnectorEnvBindingEntries,
-  getConnectorStoredSecretDisplayInfo,
-  getDiagnosticConnectorTypeForRuntimeEnvName
+  getDiagnosticConnectorTypeForRuntimeEnvName,
+  matchFirewallBaseUrl,
+  matchFirewallRequestDecision
 };
-//# sourceMappingURL=chunk-ADBNTM34.js.map
+//# sourceMappingURL=chunk-H4Y7JDZB.js.map