target_policy.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/target_policy.h"
 
#include <curl/curl.h>
 
#include <algorithm>
#include <array>
#include <cstddef>
#include <cstdint>
#include <limits>
#include <string>
 
#include "proto_fuzzer/option_model.h"
#include "proto_fuzzer/scenario_limits.h"
#include "proto_fuzzer/telnet_scenario.h"
 
namespace proto_fuzzer {
 
namespace {
 
// Linux raises smaller socket-buffer requests to an implementation minimum,
// so 2048 is both cheap and reliably small enough to exercise short writes.
constexpr std::uint32_t kDefaultBackpressureBufferBytes = 2048;
 
// Values outside these ranges do not create useful new socket behavior for
// the harness's bounded 4-16 KiB writes. Keeping them small also prevents a
// mutated uint32 recv size from overflowing the int accepted by setsockopt.
constexpr std::uint32_t kMinBackpressureBufferBytes = 2048;
constexpr std::uint32_t kMaxBackpressureBufferBytes = 4096;
constexpr std::uint32_t kMaxDrainBytesPerIteration = 1024;
constexpr std::uint32_t kHaproxyConnectBufferBytes = 2048;
constexpr std::uint32_t kHaproxyConnectDrainBytes = 48;
constexpr std::uint32_t kMqttProbeBufferBytes = 2048;
constexpr std::uint32_t kMqttProbeDrainBytes = 1024;
constexpr std::uint32_t kSmtpProbeBufferBytes = 2048;
constexpr std::uint32_t kSmtpProbeDrainBytes = 1024;
 
// CURLOPT_LOCALPORTRANGE performs one synchronous bind attempt per selected
// port. Retain a useful retry window without letting one mutation request tens
// of thousands of syscalls from a single transfer.
constexpr std::uint64_t kMaxLocalPortRange = 16;
constexpr std::size_t kGopherTlsPeerKeyHostBytes = 10163;
 
// A default, bounded identifier keeps newly generated inputs on the gateway's
// /ipfs/ or /ipns/ namespace. The path, query, and fragment after it stay
// mutation-controlled.
constexpr char kDefaultIpfsCid[] = "bafybeigdyrzt5sfp7udm7hu76uh7y26nf3efuylqabf3oclgtqy55fbzdi";
constexpr char kDefaultIpnsName[] = "k51qzi5uqu5dlvj2baxnqndepeb86cbk3ng7n3i46uzyxzyqj2xjonzllnv0v8";

template <typename RepeatedField>
void TrimRepeated(RepeatedField* field, std::size_t limit) {
  const std::size_t size = static_cast<std::size_t>(field->size());
  if (size > limit) {
    field->DeleteSubrange(static_cast<int>(limit), static_cast<int>(size - limit));
  }
}

void TrimMetadata(std::string* value) {
  if (value->size() > scenario_limits::kMaxMetadataBytes) {
    value->resize(scenario_limits::kMaxMetadataBytes);
  }
}

void CanonicalizeTlsAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("tls.test/");
    return;
  }
  scenario->set_host_path("tls.test" + host_path.substr(suffix_start));
}

void CanonicalizeHttp3Authority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  if (!scenario->http3_plan().use_h1_connect_udp_proxy() || host_path.empty() || host_path.front() != '[') {
    CanonicalizeTlsAuthority(scenario);
    return;
  }
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  scenario->set_host_path(std::string("[::1]") +
                          (suffix_start == std::string::npos ? "/" : host_path.substr(suffix_start)));
}

void CanonicalizeAltSvcAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("altsvc-origin.test/");
    return;
  }
  scenario->set_host_path("altsvc-origin.test" + host_path.substr(suffix_start));
}

void CanonicalizeTlsCertificateChain(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->tls_certificate_chain()) {
    case curl::fuzzer::proto::TLS_CERTIFICATE_CHAIN_DEFAULT_EC:
    case curl::fuzzer::proto::TLS_CERTIFICATE_CHAIN_ALL_KEY_TYPES:
      return;
    default:
      scenario->clear_tls_certificate_chain();
      return;
  }
}

void CanonicalizeTlsGroupProfile(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->tls_group_profile()) {
    case curl::fuzzer::proto::TLS_GROUP_X25519:
    case curl::fuzzer::proto::TLS_GROUP_PROVIDER_DEFAULT:
      return;
    default:
      scenario->clear_tls_group_profile();
      return;
  }
}

void CanonicalizeTlsClientCredentialProfile(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->tls_client_credential_profile()) {
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_NONE:
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_MALFORMED_PKCS12:
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_ENGINE_DEV_NULL:
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_DEFAULT_PROVIDER_DEV_NULL:
    case curl::fuzzer::proto::TLS_CLIENT_CREDENTIAL_UNLOADED_PROVIDER_DEV_NULL:
      return;
    default:
      scenario->clear_tls_client_credential_profile();
      return;
  }
}

void CanonicalizeTlsHandshakeProfile(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->tls_handshake_profile()) {
    case curl::fuzzer::proto::TLS_HANDSHAKE_DEFAULT:
    case curl::fuzzer::proto::TLS_HANDSHAKE_OPENSSL_CLOSE_NOTIFY:
    case curl::fuzzer::proto::TLS_HANDSHAKE_OPENSSL_HELLO_REQUEST:
      return;
    default:
      scenario->clear_tls_handshake_profile();
      return;
  }
}

void CanonicalizeGopherProbeMode(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->gopher_probe_mode()) {
    case curl::fuzzer::proto::GOPHER_PROBE_DEFAULT:
    case curl::fuzzer::proto::GOPHER_PROBE_PARTIAL_WRITE_NO_TIMEOUT:
    case curl::fuzzer::proto::GOPHER_PROBE_SEND_TIMEOUT:
    case curl::fuzzer::proto::GOPHER_PROBE_TLS_SESSION_KEY_LIMIT:
      return;
    default:
      scenario->clear_gopher_probe_mode();
      return;
  }
}

void CanonicalizeRtspProbeMode(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->rtsp_probe_mode()) {
    case curl::fuzzer::proto::RTSP_PROBE_DEFAULT:
    case curl::fuzzer::proto::RTSP_PROBE_CROSS_ORIGIN_REUSE:
    case curl::fuzzer::proto::RTSP_PROBE_SPLIT_INVALID_RTP_WRITE_FAILURE:
      return;
    default:
      scenario->clear_rtsp_probe_mode();
      return;
  }
}

void CanonicalizeMqttProbeMode(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->mqtt_probe_mode()) {
    case curl::fuzzer::proto::MQTT_PROBE_DEFAULT:
    case curl::fuzzer::proto::MQTT_PROBE_SEND_BACKPRESSURE:
    case curl::fuzzer::proto::MQTT_PROBE_OVERSIZED_USERNAME:
    case curl::fuzzer::proto::MQTT_PROBE_OVERSIZED_PASSWORD:
      return;
    default:
      scenario->clear_mqtt_probe_mode();
      return;
  }
}

void CanonicalizeSmtpProbeMode(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->smtp_probe_mode()) {
    case curl::fuzzer::proto::SMTP_PROBE_DEFAULT:
    case curl::fuzzer::proto::SMTP_PROBE_STARTTLS_TRY:
    case curl::fuzzer::proto::SMTP_PROBE_STARTTLS_REQUIRE:
    case curl::fuzzer::proto::SMTP_PROBE_STARTTLS_FILTER_ALLOCATION_FAILURE:
    case curl::fuzzer::proto::SMTP_PROBE_SEND_BACKPRESSURE:
      return;
    default:
      scenario->clear_smtp_probe_mode();
      return;
  }
}

void CanonicalizeH2ProxyOriginAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("origin.test/");
    return;
  }
  scenario->set_host_path("origin.test" + host_path.substr(suffix_start));
}

void CanonicalizeSocksAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const auto mode = scenario->socks_proxy_mode();
  const bool resolve_at_proxy =
      mode == curl::fuzzer::proto::SOCKS_PROXY_SOCKS4A || mode == curl::fuzzer::proto::SOCKS_PROXY_SOCKS5_HOSTNAME;
  const char* host = resolve_at_proxy ? "socks.test" : "localhost";
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(std::string(host) + "/");
    return;
  }
  scenario->set_host_path(std::string(host) + host_path.substr(suffix_start));
}

void CanonicalizeHttpTransportAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("transport.test/");
    return;
  }
  scenario->set_host_path("transport.test" + host_path.substr(suffix_start));
}

void CanonicalizeProxySocketOptionAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const char* host;
  switch (scenario->proxy_socket_option_mode()) {
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_NOPROXY_HOSTNAME:
      host = "service.proxy.test";
      break;
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_NOPROXY_IPV4_CIDR:
      host = "127.0.0.2";
      break;
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_NOPROXY_IPV6_CIDR:
      host = "[::1]";
      break;
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_ENV_HTTP_PROXY:
      host = "proxy-origin.test";
      break;
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_LOOPBACK_INTERFACE_KEEPALIVE:
      host = "resolve.test";
      break;
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_DEFAULT:
    default:
      return;
  }
 
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  scenario->set_host_path(std::string(host) +
                          (suffix_start == std::string::npos ? "/" : host_path.substr(suffix_start)));
}

void CanonicalizeResolverAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const char* host = "localhost";
  switch (scenario->resolver_mode()) {
    case curl::fuzzer::proto::RESOLVER_MODE_THREADED_POSITIVE:
      host = "resolver-positive.test";
      break;
    case curl::fuzzer::proto::RESOLVER_MODE_THREADED_NEGATIVE:
      host = "resolver-negative.test";
      break;
    case curl::fuzzer::proto::RESOLVER_MODE_THREADED_LINK_LOCAL:
      host = "resolver-link-local.test";
      break;
    case curl::fuzzer::proto::RESOLVER_MODE_THREADED_PARTIAL:
      host = "resolver-partial.test";
      break;
    case curl::fuzzer::proto::RESOLVER_MODE_THREADED_QUEUED_CANCEL:
      host = "resolver-queued-cancel.test";
      break;
    case curl::fuzzer::proto::RESOLVER_MODE_UNIX_SOCKET:
      host = "resolver-unix.test";
      break;
    case curl::fuzzer::proto::RESOLVER_MODE_GLOBAL_LIFECYCLE:
      host = "localhost";
      break;
    case curl::fuzzer::proto::RESOLVER_MODE_DEFAULT:
    default:
      host =
          scenario->has_doh()
              ? "tls.test"
              : ((scenario->happy_eyeballs() || !scenario->resolve_entries().empty()) ? "resolve.test" : "localhost");
      break;
  }
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(std::string(host) + "/");
    return;
  }
  scenario->set_host_path(std::string(host) + host_path.substr(suffix_start));
}
 
bool IsThreadedResolverMode(curl::fuzzer::proto::ResolverMode mode) {
  return mode == curl::fuzzer::proto::RESOLVER_MODE_THREADED_POSITIVE ||
         mode == curl::fuzzer::proto::RESOLVER_MODE_THREADED_NEGATIVE ||
         mode == curl::fuzzer::proto::RESOLVER_MODE_THREADED_LINK_LOCAL ||
         mode == curl::fuzzer::proto::RESOLVER_MODE_THREADED_PARTIAL ||
         mode == curl::fuzzer::proto::RESOLVER_MODE_THREADED_QUEUED_CANCEL;
}

void CanonicalizeTftpAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("tftp.test/file");
    return;
  }
  scenario->set_host_path("tftp.test" + host_path.substr(suffix_start));
}

void CanonicalizeFtpAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const char* host = scenario->scheme() == curl::fuzzer::proto::SCHEME_FTPS ? "tls.test" : "ftp.test";
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(std::string(host) + "/file");
    return;
  }
  scenario->set_host_path(std::string(host) + host_path.substr(suffix_start));
}

void CanonicalizeSmtpAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const char* host = scenario->scheme() == curl::fuzzer::proto::SCHEME_SMTPS ? "tls.test" : "smtp.test";
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(std::string(host) + "/client.test");
    return;
  }
  scenario->set_host_path(std::string(host) + host_path.substr(suffix_start));
}

void CanonicalizeImapAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const char* host = scenario->scheme() == curl::fuzzer::proto::SCHEME_IMAPS ? "tls.test" : "imap.test";
  const std::size_t authority_end = suffix_start == std::string::npos ? host_path.size() : suffix_start;
  const bool retain_default_port = scenario->scheme() == curl::fuzzer::proto::SCHEME_IMAP && authority_end >= 3 &&
                                   host_path.compare(authority_end - 3, 3, ":80") == 0;
  const std::string authority = std::string(host) + (retain_default_port ? ":80" : "");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(authority + "/INBOX");
    return;
  }
  scenario->set_host_path(authority + host_path.substr(suffix_start));
}

void CanonicalizePop3Authority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const char* host = scenario->scheme() == curl::fuzzer::proto::SCHEME_POP3S ? "tls.test" : "pop3.test";
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(std::string(host) + "/1");
    return;
  }
  scenario->set_host_path(std::string(host) + host_path.substr(suffix_start));
}

void CanonicalizeMqttAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const char* host = scenario->scheme() == curl::fuzzer::proto::SCHEME_MQTTS ? "tls.test" : "mqtt.test";
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(std::string(host) + "/topic");
    return;
  }
  scenario->set_host_path(std::string(host) + host_path.substr(suffix_start));
}

void CanonicalizeDictAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("dict.test/d:word");
    return;
  }
  std::string canonical = "dict.test" + host_path.substr(suffix_start);
  if (canonical.size() > scenario_limits::kMaxDictHostPathBytes) {
    canonical.resize(scenario_limits::kMaxDictHostPathBytes);
  }
  scenario->set_host_path(canonical);
}

void CanonicalizeLdapAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  const char* host = scenario->scheme() == curl::fuzzer::proto::SCHEME_LDAPS ? "tls.test" : "ldap.test";
  if (suffix_start == std::string::npos) {
    scenario->set_host_path(std::string(host) + "/dc=example,dc=com");
    return;
  }
  scenario->set_host_path(std::string(host) + host_path.substr(suffix_start));
}

void CanonicalizeRtspAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("rtsp.test/stream");
    return;
  }
  scenario->set_host_path("rtsp.test" + host_path.substr(suffix_start));
}

void CanonicalizeIpfsAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  std::string canonical = scenario->scheme() == curl::fuzzer::proto::SCHEME_IPNS ? kDefaultIpnsName : kDefaultIpfsCid;
  if (suffix_start != std::string::npos) {
    canonical += host_path.substr(suffix_start);
  }
  if (canonical.size() > scenario_limits::kMaxIpfsHostPathBytes) {
    canonical.resize(scenario_limits::kMaxIpfsHostPathBytes);
  }
  scenario->set_host_path(canonical);
}

void CanonicalizeMultiAuthority(curl::fuzzer::proto::Scenario* scenario) {
  const std::string& host_path = scenario->host_path();
  const std::size_t suffix_start = host_path.find_first_of("/?#");
  if (suffix_start == std::string::npos) {
    scenario->set_host_path("multi.test/");
    return;
  }
  scenario->set_host_path("multi.test" + host_path.substr(suffix_start));
}
 
template <typename RepeatedBytes>
void BoundStringValues(RepeatedBytes* values, std::size_t count_limit, std::size_t value_limit) {
  TrimRepeated(values, count_limit);
  for (std::string& value : *values) {
    if (value.size() > value_limit) {
      value.resize(value_limit);
    }
  }
}
 
template <typename RepeatedBytes>
void BoundHeaderValues(RepeatedBytes* headers, std::size_t limit) {
  BoundStringValues(headers, limit, scenario_limits::kMaxMetadataBytes);
}

void BoundConnectionShape(curl::fuzzer::proto::Connection* connection) {
  TrimRepeated(connection->mutable_on_readable(), scenario_limits::kMaxResponseChunks);
  const std::size_t raw_count = static_cast<std::size_t>(connection->on_readable_size());
  TrimRepeated(connection->mutable_server_frames(), scenario_limits::kMaxResponseChunks - raw_count);
}

void BoundFileInput(std::string* input, std::size_t* remaining_bytes) {
  const std::size_t limit = std::min(scenario_limits::kMaxFileInputBytes, *remaining_bytes);
  if (input->size() > limit) {
    input->resize(limit);
  }
  *remaining_bytes -= input->size();
}
 
void BoundFileInputs(curl::fuzzer::proto::Scenario* scenario) {
  std::size_t remaining_bytes = scenario_limits::kMaxFileInputTotalBytes;
  BoundFileInput(scenario->mutable_cookie_file(), &remaining_bytes);
  BoundFileInput(scenario->mutable_altsvc_file(), &remaining_bytes);
  BoundFileInput(scenario->mutable_hsts_file(), &remaining_bytes);
  BoundFileInput(scenario->mutable_netrc_file(), &remaining_bytes);
  BoundFileInput(scenario->mutable_crl_file(), &remaining_bytes);
  BoundFileInput(scenario->mutable_pinned_public_key_file(), &remaining_bytes);
}

template <typename Part>
void BoundMimePartMetadata(Part* part) {
  TrimMetadata(part->mutable_name());
  TrimMetadata(part->mutable_filename());
  TrimMetadata(part->mutable_content_type());
  BoundHeaderValues(part->mutable_headers(), scenario_limits::kMaxMimeHeadersPerPart);
}
 
void BoundGeneratedMimeData(curl::fuzzer::proto::GeneratedBytes* generated, std::size_t* remaining_bytes) {
  if (generated->pattern().size() > scenario_limits::kMaxGeneratedMimePatternBytes) {
    generated->mutable_pattern()->resize(scenario_limits::kMaxGeneratedMimePatternBytes);
  }
 
  const std::size_t pattern_size = generated->pattern().size();
  if (pattern_size == 0 || *remaining_bytes == 0) {
    generated->clear_repeat_count();
    return;
  }
 
  // Keep every exact in-range size, including 16/32/64 KiB and their +/-1
  // neighborhoods. Counts beyond the shared budget all have identical runtime
  // behavior, so fold them onto the largest observable repetition count.
  const std::size_t max_repeat_count = *remaining_bytes / pattern_size;
  const std::size_t repeat_count =
      std::min<std::size_t>(static_cast<std::size_t>(generated->repeat_count()), max_repeat_count);
  generated->set_repeat_count(static_cast<std::uint32_t>(repeat_count));
  *remaining_bytes -= repeat_count * pattern_size;
}
 
void BoundMimeLeaf(curl::fuzzer::proto::MimeDataPart* part, std::size_t* remaining_generated_bytes) {
  BoundMimePartMetadata(part);
  if (part->content_case() == curl::fuzzer::proto::MimeDataPart::kGeneratedData) {
    BoundGeneratedMimeData(part->mutable_generated_data(), remaining_generated_bytes);
  } else if (part->data().size() > scenario_limits::kMaxMimeDataBytes) {
    part->mutable_data()->resize(scenario_limits::kMaxMimeDataBytes);
  }
}

void BoundMimeShape(curl::fuzzer::proto::MimePost* post) {
  TrimRepeated(post->mutable_parts(), scenario_limits::kMaxTopLevelMimeParts);
  std::size_t remaining = scenario_limits::kMaxTotalMimeParts;
  std::size_t remaining_generated_bytes = scenario_limits::kMaxGeneratedMimeDataBytes;
  std::size_t retained_top_parts = 0;
 
  while (retained_top_parts < static_cast<std::size_t>(post->parts_size()) && remaining != 0) {
    auto* part = post->mutable_parts(static_cast<int>(retained_top_parts));
    ++retained_top_parts;
    --remaining;
    BoundMimePartMetadata(part);
 
    if (part->content_case() == curl::fuzzer::proto::MimePart::kData) {
      if (part->data().size() > scenario_limits::kMaxMimeDataBytes) {
        part->mutable_data()->resize(scenario_limits::kMaxMimeDataBytes);
      }
      continue;
    }
    if (part->content_case() == curl::fuzzer::proto::MimePart::kGeneratedData) {
      BoundGeneratedMimeData(part->mutable_generated_data(), &remaining_generated_bytes);
      continue;
    }
    if (part->content_case() != curl::fuzzer::proto::MimePart::kSubparts) {
      continue;
    }
 
    auto* children = part->mutable_subparts()->mutable_parts();
    TrimRepeated(children, std::min(scenario_limits::kMaxNestedMimeParts, remaining));
    for (auto& child : *children) {
      BoundMimeLeaf(&child, &remaining_generated_bytes);
      --remaining;
    }
  }
 
  TrimRepeated(post->mutable_parts(), retained_top_parts);
}

void BoundUploadShape(curl::fuzzer::proto::UploadScript* upload, std::size_t data_limit, std::size_t read_step_limit,
                      std::size_t read_size_limit) {
  if (upload->data().size() > data_limit) {
    upload->mutable_data()->resize(data_limit);
  }
  // RepeatedField<uint32_t> lacks RepeatedPtrField's DeleteSubrange helper;
  // removing the ignored suffix from the end is constant-time per element and
  // preserves the mutation-significant prefix exactly.
  while (static_cast<std::size_t>(upload->read_sizes_size()) > read_step_limit) {
    upload->mutable_read_sizes()->RemoveLast();
  }
  for (int i = 0; i < upload->read_sizes_size(); ++i) {
    if (upload->read_sizes(i) > read_size_limit) {
      upload->set_read_sizes(i, static_cast<std::uint32_t>(read_size_limit));
    }
  }
}

template <typename RepeatedScalar>
void TrimRepeatedScalar(RepeatedScalar* values, std::size_t limit) {
  while (static_cast<std::size_t>(values->size()) > limit) {
    values->RemoveLast();
  }
}

void CanonicalizeAllocationFailures(curl::fuzzer::proto::Scenario* scenario) {
  std::array<std::uint32_t, scenario_limits::kMaxAllocationFailures> retained{};
  std::size_t retained_count = 0;
  const std::uint32_t maximum = static_cast<std::uint32_t>(scenario_limits::kMaxAllocationOrdinal);
 
  for (const std::uint32_t raw : scenario->fail_allocations()) {
    if (raw == 0) {
      continue;
    }
    const std::uint32_t ordinal = 1U + ((raw - 1U) % maximum);
    const auto begin = retained.begin();
    const auto end = begin + static_cast<std::ptrdiff_t>(retained_count);
    const auto position = std::lower_bound(begin, end, ordinal);
    if (position != end && *position == ordinal) {
      continue;
    }
    const std::size_t index = static_cast<std::size_t>(position - begin);
    if (index >= retained.size()) {
      continue;
    }
    if (retained_count < retained.size()) {
      ++retained_count;
    }
    for (std::size_t destination = retained_count - 1; destination > index; --destination) {
      retained[destination] = retained[destination - 1];
    }
    retained[index] = ordinal;
  }
 
  auto* values = scenario->mutable_fail_allocations();
  values->Clear();
  for (std::size_t index = 0; index < retained_count; ++index) {
    values->Add(retained[index]);
  }
}

void CanonicalizeAllocationFailureDrive(curl::fuzzer::proto::Scenario* scenario) {
  if (!scenario->fail_allocations().empty() && scenario->has_api_plan() &&
      scenario->api_plan().drive_mode() == curl::fuzzer::proto::API_DRIVE_EASY_EVENTS) {
    scenario->mutable_api_plan()->set_drive_mode(curl::fuzzer::proto::API_DRIVE_EASY_PERFORM);
  }
}

void CanonicalizeApiDriveMode(curl::fuzzer::proto::ApiPlan* plan) {
  switch (plan->drive_mode()) {
    case curl::fuzzer::proto::API_DRIVE_MULTI_PERFORM:
    case curl::fuzzer::proto::API_DRIVE_MULTI_SOCKET:
    case curl::fuzzer::proto::API_DRIVE_EASY_PERFORM:
    case curl::fuzzer::proto::API_DRIVE_EASY_EVENTS:
    case curl::fuzzer::proto::API_DRIVE_CONNECT_ONLY:
      return;
    default:
      plan->set_drive_mode(curl::fuzzer::proto::API_DRIVE_MULTI_PERFORM);
      return;
  }
}

void BoundApiPlanShape(curl::fuzzer::proto::ApiPlan* plan) {
  TrimRepeatedScalar(plan->mutable_share_data_selectors(), scenario_limits::kMaxApiShareDataSelectors);
  TrimRepeatedScalar(plan->mutable_easy_info_selectors(), scenario_limits::kMaxApiInfoSelectors);
  TrimRepeatedScalar(plan->mutable_reentrant_probe_selectors(), scenario_limits::kMaxApiReentrantSelectors);
 
  CanonicalizeApiDriveMode(plan);
  switch (plan->drive_mode()) {
    case curl::fuzzer::proto::API_DRIVE_MULTI_PERFORM:
    case curl::fuzzer::proto::API_DRIVE_MULTI_SOCKET:
      break;
    case curl::fuzzer::proto::API_DRIVE_EASY_PERFORM:
    case curl::fuzzer::proto::API_DRIVE_EASY_EVENTS:
    case curl::fuzzer::proto::API_DRIVE_CONNECT_ONLY:
      // Wakeup is a multi-handle API and has no live object in easy mode.
      // Likewise, a body callback cannot be resumed while one of these
      // blocking entrypoints owns the thread. Clearing both mutations keeps
      // every retained API-plan value observable and bounded.
      plan->set_wake_multi(false);
      plan->set_pause_response_once(false);
      break;
    default:
      break;
  }
}

void CanonicalizeApiMimeRepeat(curl::fuzzer::proto::Scenario* scenario) {
  if (!scenario->has_api_plan() || !scenario->api_plan().repeat_mime_post()) {
    return;
  }
 
  bool has_callback_part = false;
  if (scenario->has_mime_post()) {
    for (const auto& part : scenario->mime_post().parts()) {
      if (part.content_case() == curl::fuzzer::proto::MimePart::kUploadCallback) {
        has_callback_part = true;
        break;
      }
    }
  }
  if (!scenario->has_upload() || !has_callback_part) {
    scenario->mutable_api_plan()->clear_repeat_mime_post();
    return;
  }
 
  auto* plan = scenario->mutable_api_plan();
  plan->set_drive_mode(curl::fuzzer::proto::API_DRIVE_MULTI_PERFORM);
  plan->set_wake_multi(false);
  plan->set_pause_response_once(false);
}

void BoundMultiPlanShape(curl::fuzzer::proto::MultiPlan* plan) {
  const std::uint32_t minimum = static_cast<std::uint32_t>(scenario_limits::kMinMultiTransfers);
  const std::uint32_t maximum = static_cast<std::uint32_t>(scenario_limits::kMaxMultiTransfers);
  const std::uint32_t transfer_count = std::max(minimum, std::min(plan->transfer_count(), maximum));
  plan->set_transfer_count(transfer_count);
  plan->set_max_host_connections(std::min(plan->max_host_connections(), transfer_count));
  plan->set_max_total_connections(std::min(plan->max_total_connections(), transfer_count));
  plan->set_connection_cache_size(std::min(plan->connection_cache_size(), maximum * 2U));
  TrimRepeated(plan->mutable_actions(), scenario_limits::kMaxMultiActions);
 
  switch (plan->drive_mode()) {
    case curl::fuzzer::proto::MULTI_DRIVE_PERFORM:
    case curl::fuzzer::proto::MULTI_DRIVE_SOCKET:
      break;
    default:
      plan->set_drive_mode(curl::fuzzer::proto::MULTI_DRIVE_PERFORM);
      break;
  }
 
  switch (plan->state_probe_profile()) {
    case curl::fuzzer::proto::MULTI_STATE_PROBE_NONE:
    case curl::fuzzer::proto::MULTI_STATE_PROBE_PROGRESS_RATE_LIMIT:
      break;
    default:
      plan->set_state_probe_profile(curl::fuzzer::proto::MULTI_STATE_PROBE_NONE);
      break;
  }
 
  for (auto& action : *plan->mutable_actions()) {
    action.set_transfer_selector(action.transfer_selector() % transfer_count);
    switch (action.kind()) {
      case curl::fuzzer::proto::MULTI_ACTION_NONE:
      case curl::fuzzer::proto::MULTI_ACTION_PAUSE_RECV:
      case curl::fuzzer::proto::MULTI_ACTION_PAUSE_SEND:
      case curl::fuzzer::proto::MULTI_ACTION_PAUSE_ALL:
      case curl::fuzzer::proto::MULTI_ACTION_RESUME:
      case curl::fuzzer::proto::MULTI_ACTION_REMOVE:
      case curl::fuzzer::proto::MULTI_ACTION_READD:
        break;
      default:
        action.set_kind(curl::fuzzer::proto::MULTI_ACTION_NONE);
        break;
    }
  }
}

void CanonicalizeHttp3HeaderName(std::string* name) {
  if (name->size() > scenario_limits::kMaxHttp3HeaderNameBytes) {
    name->resize(scenario_limits::kMaxHttp3HeaderNameBytes);
  }
  if (name->empty()) {
    *name = "x-fuzz";
    return;
  }
 
  for (char& byte : *name) {
    const unsigned char value = static_cast<unsigned char>(byte);
    const bool alpha = (value >= 'A' && value <= 'Z') || (value >= 'a' && value <= 'z');
    const bool digit = value >= '0' && value <= '9';
    const bool punctuation = value == '!' || value == '#' || value == '$' || value == '%' || value == '&' ||
                             value == '\'' || value == '*' || value == '+' || value == '-' || value == '.' ||
                             value == '^' || value == '_' || value == '`' || value == '|' || value == '~';
    if (value >= 'A' && value <= 'Z') {
      byte = static_cast<char>(value - 'A' + 'a');
    } else if (!alpha && !digit && !punctuation) {
      byte = '-';
    }
  }
}

void CanonicalizeHttp3HeaderValue(std::string* value) {
  if (value->size() > scenario_limits::kMaxHttp3HeaderValueBytes) {
    value->resize(scenario_limits::kMaxHttp3HeaderValueBytes);
  }
  for (char& byte : *value) {
    const unsigned char character = static_cast<unsigned char>(byte);
    if ((character < 0x20U && character != '\t') || character == 0x7fU) {
      byte = ' ';
    }
  }
}

template <typename RepeatedHeaders>
void BoundHttp3Headers(RepeatedHeaders* headers, std::size_t count_limit, std::size_t* remaining_bytes) {
  TrimRepeated(headers, count_limit);
  std::size_t retained = 0;
  while (retained < static_cast<std::size_t>(headers->size()) && *remaining_bytes != 0) {
    auto* header = headers->Mutable(static_cast<int>(retained));
    CanonicalizeHttp3HeaderName(header->mutable_name());
    CanonicalizeHttp3HeaderValue(header->mutable_value());
 
    if (header->name().size() > *remaining_bytes) {
      header->mutable_name()->resize(*remaining_bytes);
      header->clear_value();
    } else if (header->value().size() > *remaining_bytes - header->name().size()) {
      header->mutable_value()->resize(*remaining_bytes - header->name().size());
    }
    *remaining_bytes -= header->name().size() + header->value().size();
    ++retained;
  }
  TrimRepeated(headers, retained);
}
 
void CanonicalizeHttp3StreamRole(curl::fuzzer::proto::Http3StreamRole* role) {
  switch (*role) {
    case curl::fuzzer::proto::HTTP3_STREAM_RESPONSE:
    case curl::fuzzer::proto::HTTP3_STREAM_CONTROL:
    case curl::fuzzer::proto::HTTP3_STREAM_QPACK_ENCODER:
    case curl::fuzzer::proto::HTTP3_STREAM_QPACK_DECODER:
      return;
    default:
      *role = curl::fuzzer::proto::HTTP3_STREAM_RESPONSE;
      return;
  }
}
 
void BoundHttp3RawData(std::string* data, std::size_t* remaining_raw_bytes) {
  const std::size_t limit = std::min(scenario_limits::kMaxHttp3RawWriteBytes, *remaining_raw_bytes);
  if (data->size() > limit) {
    data->resize(limit);
  }
  *remaining_raw_bytes -= data->size();
}
 
void BoundHttp2StreamRef(curl::fuzzer::proto::Http2StreamRef* stream) {
  switch (stream->target_case()) {
    case curl::fuzzer::proto::Http2StreamRef::kRequestIndex:
      stream->set_request_index(stream->request_index() % 16U);
      break;
    case curl::fuzzer::proto::Http2StreamRef::kPushIndex:
      stream->set_push_index(stream->push_index() % 16U);
      break;
    case curl::fuzzer::proto::Http2StreamRef::kExplicitId:
      stream->set_explicit_id(stream->explicit_id() & 0x7fffffffU);
      break;
    case curl::fuzzer::proto::Http2StreamRef::kConnection:
    case curl::fuzzer::proto::Http2StreamRef::kLatestRequest:
    case curl::fuzzer::proto::Http2StreamRef::TARGET_NOT_SET:
    default:
      break;
  }
}
 
void BoundHttp2Settings(curl::fuzzer::proto::Http2Settings* settings) {
  TrimRepeated(settings->mutable_entries(), scenario_limits::kMaxHttp2Settings);
  for (auto& entry : *settings->mutable_entries()) {
    // SETTINGS identifiers occupy 16 bits. Preserve unknown extensions,
    // which receivers ignore when they do not understand them.
    entry.set_identifier(entry.identifier() & 0xffffU);
    switch (entry.identifier()) {
      case 2U:  // SETTINGS_ENABLE_PUSH
      case 8U:  // SETTINGS_ENABLE_CONNECT_PROTOCOL
      case 9U:  // SETTINGS_NO_RFC7540_PRIORITIES
        entry.set_value(entry.value() & 1U);
        break;
      case 4U:  // SETTINGS_INITIAL_WINDOW_SIZE
        entry.set_value(entry.value() & 0x7fffffffU);
        break;
      case 5U:  // SETTINGS_MAX_FRAME_SIZE
        if (entry.value() < 16384U || entry.value() > 0x00ffffffU) {
          entry.set_value(16384U + entry.value() % (0x00ffffffU - 16384U + 1U));
        }
        break;
      case 1U:  // SETTINGS_HEADER_TABLE_SIZE
      case 3U:  // SETTINGS_MAX_CONCURRENT_STREAMS
      case 6U:  // SETTINGS_MAX_HEADER_LIST_SIZE
      default:
        break;
    }
  }
}
 
void BoundHttp2RawData(std::string* data, std::size_t* remaining_raw_bytes) {
  const std::size_t limit = std::min(scenario_limits::kMaxHttp2RawFrameBytes, *remaining_raw_bytes);
  if (data->size() > limit) {
    data->resize(limit);
  }
  *remaining_raw_bytes -= data->size();
}

void BoundHttp2PlanShape(curl::fuzzer::proto::Http2Plan* plan) {
  TrimRepeated(plan->mutable_actions(), scenario_limits::kMaxHttp2Actions);
  BoundHttp2Settings(plan->mutable_initial_settings());
  plan->mutable_initial_settings()->set_ack(false);
  if (plan->stream_weight_after_headers() > 256U) {
    plan->set_stream_weight_after_headers(1U + (plan->stream_weight_after_headers() - 1U) % 256U);
  }
  if (plan->actions().empty()) {
    auto* response = plan->add_actions()->mutable_headers();
    response->set_status_code(200);
    response->set_end_stream(true);
  }
 
  std::size_t remaining_header_bytes = scenario_limits::kMaxHttp2HeaderBytes;
  std::size_t remaining_data_bytes = scenario_limits::kMaxHttp2DataBytes;
  std::size_t remaining_raw_bytes = scenario_limits::kMaxHttp2RawBytes;
  for (auto& action : *plan->mutable_actions()) {
    switch (action.action_case()) {
      case curl::fuzzer::proto::Http2Action::kSettings:
        BoundHttp2Settings(action.mutable_settings());
        break;
      case curl::fuzzer::proto::Http2Action::kHeaders: {
        auto* headers = action.mutable_headers();
        BoundHttp2StreamRef(headers->mutable_stream());
        if (!headers->trailers()) {
          if (headers->status_code() == 0U) {
            headers->set_status_code(200U);
          } else if (headers->status_code() < 100U || headers->status_code() > 599U) {
            headers->set_status_code(100U + headers->status_code() % 500U);
          }
        }
        BoundHttp3Headers(headers->mutable_fields(), scenario_limits::kMaxHttp2Headers, &remaining_header_bytes);
        break;
      }
      case curl::fuzzer::proto::Http2Action::kData: {
        auto* data = action.mutable_data();
        BoundHttp2StreamRef(data->mutable_stream());
        if (data->data().size() > remaining_data_bytes) {
          data->mutable_data()->resize(remaining_data_bytes);
        }
        remaining_data_bytes -= data->data().size();
        break;
      }
      case curl::fuzzer::proto::Http2Action::kWindowUpdate: {
        auto* update = action.mutable_window_update();
        BoundHttp2StreamRef(update->mutable_stream());
        update->set_increment(std::max(1U, update->increment() & 0x7fffffffU));
        break;
      }
      case curl::fuzzer::proto::Http2Action::kRstStream:
        BoundHttp2StreamRef(action.mutable_rst_stream()->mutable_stream());
        break;
      case curl::fuzzer::proto::Http2Action::kPing:
        if (action.ping().opaque_data().size() > 8U) {
          action.mutable_ping()->mutable_opaque_data()->resize(8U);
        }
        break;
      case curl::fuzzer::proto::Http2Action::kGoaway:
        BoundHttp2StreamRef(action.mutable_goaway()->mutable_last_stream());
        BoundHttp2RawData(action.mutable_goaway()->mutable_debug_data(), &remaining_raw_bytes);
        break;
      case curl::fuzzer::proto::Http2Action::kPushPromise:
        BoundHttp2StreamRef(action.mutable_push_promise()->mutable_parent_stream());
        BoundHttp2StreamRef(action.mutable_push_promise()->mutable_promised_stream());
        BoundHttp3Headers(action.mutable_push_promise()->mutable_request_headers(), scenario_limits::kMaxHttp2Headers,
                          &remaining_header_bytes);
        break;
      case curl::fuzzer::proto::Http2Action::kWait: {
        auto* wait = action.mutable_wait();
        BoundHttp2StreamRef(wait->mutable_stream());
        if (wait->event() < curl::fuzzer::proto::HTTP2_CLIENT_EVENT_SETTINGS ||
            wait->event() > curl::fuzzer::proto::HTTP2_CLIENT_EVENT_END_STREAM) {
          wait->set_event(curl::fuzzer::proto::HTTP2_CLIENT_EVENT_SETTINGS);
        }
        wait->set_count(std::max(1U, std::min(wait->count(), 16U)));
        break;
      }
      case curl::fuzzer::proto::Http2Action::kYieldTurns:
        action.set_yield_turns(std::min<std::uint32_t>(action.yield_turns(), scenario_limits::kMaxHttp2YieldTurns));
        break;
      case curl::fuzzer::proto::Http2Action::kWireFrame:
        action.mutable_wire_frame()->set_type(action.wire_frame().type() & 0xffU);
        action.mutable_wire_frame()->set_flags(action.wire_frame().flags() & 0xffU);
        action.mutable_wire_frame()->set_stream_id(action.wire_frame().stream_id() & 0x7fffffffU);
        action.mutable_wire_frame()->set_declared_length(action.wire_frame().declared_length() & 0x00ffffffU);
        BoundHttp2RawData(action.mutable_wire_frame()->mutable_payload(), &remaining_raw_bytes);
        break;
      case curl::fuzzer::proto::Http2Action::kRawBytes:
        BoundHttp2RawData(action.mutable_raw_bytes(), &remaining_raw_bytes);
        break;
      case curl::fuzzer::proto::Http2Action::ACTION_NOT_SET: {
        auto* response = action.mutable_headers();
        response->set_status_code(200);
        response->set_end_stream(true);
        break;
      }
    }
  }
}

void BoundHttp3PlanShape(curl::fuzzer::proto::Http3Plan* plan) {
  if (plan->use_h1_connect_udp_proxy()) {
    plan->clear_actions();
    return;
  }
  TrimRepeated(plan->mutable_actions(), scenario_limits::kMaxHttp3Actions);
  if (plan->actions().empty()) {
    auto* response = plan->add_actions()->mutable_structured_response();
    response->set_status_code(200);
    response->set_finish_stream(true);
  }
 
  std::size_t remaining_header_bytes = scenario_limits::kMaxHttp3HeaderBytes;
  std::size_t remaining_body_bytes = scenario_limits::kMaxHttp3BodyBytes;
  std::size_t remaining_raw_bytes = scenario_limits::kMaxHttp3RawBytes;
  std::size_t retained_actions = 0;
  bool connection_closed = false;
  for (auto& action : *plan->mutable_actions()) {
    if (connection_closed) {
      break;
    }
    ++retained_actions;
    switch (action.action_case()) {
      case curl::fuzzer::proto::Http3Action::kStructuredResponse: {
        auto* response = action.mutable_structured_response();
        if (response->status_code() == 0U) {
          response->set_status_code(200U);
        } else if (response->status_code() < 100U || response->status_code() > 599U) {
          response->set_status_code(100U + response->status_code() % 500U);
        }
        BoundHttp3Headers(response->mutable_response_headers(), scenario_limits::kMaxHttp3Headers,
                          &remaining_header_bytes);
        BoundHttp3Headers(response->mutable_response_trailers(), scenario_limits::kMaxHttp3Trailers,
                          &remaining_header_bytes);
        TrimRepeated(response->mutable_body_chunks(), scenario_limits::kMaxHttp3BodyChunks);
        for (std::string& chunk : *response->mutable_body_chunks()) {
          if (chunk.size() > remaining_body_bytes) {
            chunk.resize(remaining_body_bytes);
          }
          remaining_body_bytes -= chunk.size();
        }
        break;
      }
 
      case curl::fuzzer::proto::Http3Action::kStreamWrite: {
        auto* write = action.mutable_stream_write();
        auto role = write->role();
        CanonicalizeHttp3StreamRole(&role);
        write->set_role(role);
        BoundHttp3RawData(write->mutable_data(), &remaining_raw_bytes);
        break;
      }
 
      case curl::fuzzer::proto::Http3Action::kOpenUnidirectionalStream: {
        auto* stream = action.mutable_open_unidirectional_stream();
        BoundHttp3RawData(stream->mutable_data(), &remaining_raw_bytes);
        break;
      }
 
      case curl::fuzzer::proto::Http3Action::kStreamReset: {
        auto* reset = action.mutable_stream_reset();
        auto role = reset->role();
        CanonicalizeHttp3StreamRole(&role);
        reset->set_role(role);
        reset->set_application_error_code(reset->application_error_code() & scenario_limits::kMaxQuicVarint);
        break;
      }
 
      case curl::fuzzer::proto::Http3Action::kGoaway:
        action.mutable_goaway()->set_id(action.goaway().id() & scenario_limits::kMaxQuicVarint & ~std::uint64_t{3});
        break;
 
      case curl::fuzzer::proto::Http3Action::kConnectionClose:
        action.mutable_connection_close()->set_application_error_code(
            action.connection_close().application_error_code() & scenario_limits::kMaxQuicVarint);
        connection_closed = true;
        break;
 
      case curl::fuzzer::proto::Http3Action::ACTION_NOT_SET: {
        auto* response = action.mutable_structured_response();
        response->set_status_code(200);
        response->set_finish_stream(true);
        break;
      }
    }
  }
  TrimRepeated(plan->mutable_actions(), retained_actions);
}

void BoundScenarioShape(curl::fuzzer::proto::Scenario* scenario) {
  TrimRepeated(scenario->mutable_options(), scenario_limits::kMaxOptions);
 
  BoundHeaderValues(scenario->mutable_request_headers(), scenario_limits::kMaxRequestHeaders);
  BoundStringValues(scenario->mutable_telnet_options(), scenario_limits::kMaxTelnetOptions,
                    scenario_limits::kMaxTelnetOptionBytes);
  if (scenario->has_mime_post()) {
    BoundMimeShape(scenario->mutable_mime_post());
  }
  if (scenario->has_upload()) {
    const bool telnet = scenario->scheme() == curl::fuzzer::proto::SCHEME_TELNET;
    const std::size_t data_limit = telnet ? scenario_limits::kMaxTelnetUploadBytes : scenario_limits::kMaxUploadBytes;
    const std::size_t read_step_limit =
        telnet ? scenario_limits::kMaxTelnetUploadReadSteps : scenario_limits::kMaxUploadReadSteps;
    const std::size_t read_size_limit =
        telnet ? scenario_limits::kMaxTelnetUploadReadSize : scenario_limits::kMaxUploadReadSize;
    BoundUploadShape(scenario->mutable_upload(), data_limit, read_step_limit, read_size_limit);
  }
 
  BoundConnectionShape(scenario->mutable_connection());
  TrimRepeated(scenario->mutable_subsequent_connections(), scenario_limits::kMaxConnections - 1);
  for (auto& connection : *scenario->mutable_subsequent_connections()) {
    BoundConnectionShape(&connection);
  }
  BoundStringValues(scenario->mutable_mail_rcpt(), scenario_limits::kMaxMailRecipients,
                    scenario_limits::kMaxMailRecipientBytes);
  BoundFileInputs(scenario);
}

void PruneAndBoundScenarioShape(curl::fuzzer::proto::Scenario* scenario, TargetProfile profile,
                                ConditionalEligibilityPruner prune_conditional_eligibility) {
  if (prune_conditional_eligibility != nullptr) {
    prune_conditional_eligibility(scenario, profile);
  }
  BoundScenarioShape(scenario);
}

void CanonicalizeDeepHttpSelectors(curl::fuzzer::proto::Scenario* scenario) {
  switch (scenario->http_transport_mode()) {
    case curl::fuzzer::proto::HTTP_TRANSPORT_DIRECT:
    case curl::fuzzer::proto::HTTP_TRANSPORT_FORWARD_PROXY:
    case curl::fuzzer::proto::HTTP_TRANSPORT_CONNECT_PROXY:
    case curl::fuzzer::proto::HTTP_TRANSPORT_UNIX_SOCKET:
      break;
    default:
      scenario->clear_http_transport_mode();
      break;
  }
  switch (scenario->proxy_socket_option_mode()) {
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_DEFAULT:
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_NOPROXY_HOSTNAME:
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_NOPROXY_IPV4_CIDR:
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_NOPROXY_IPV6_CIDR:
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_ENV_HTTP_PROXY:
    case curl::fuzzer::proto::PROXY_SOCKET_OPTION_LOOPBACK_INTERFACE_KEEPALIVE:
      break;
    default:
      scenario->clear_proxy_socket_option_mode();
      break;
  }
}

std::uint64_t IntegralMutationValue(const curl::fuzzer::proto::SetOption& option) {
  switch (option.value_case()) {
    case curl::fuzzer::proto::SetOption::kUintValue:
      return option.uint_value();
    case curl::fuzzer::proto::SetOption::kBoolValue:
      return option.bool_value() ? 1U : 0U;
    case curl::fuzzer::proto::SetOption::kStringValue:
    case curl::fuzzer::proto::SetOption::VALUE_NOT_SET:
      return 0;
  }
  return 0;
}

void CanonicalizeLocalPortRange(curl::fuzzer::proto::Scenario* scenario) {
  for (auto& option : *scenario->mutable_options()) {
    if (option.option_id() == curl::fuzzer::proto::CURLOPT_LOCALPORTRANGE) {
      option.set_uint_value(std::min<std::uint64_t>(IntegralMutationValue(option), kMaxLocalPortRange));
    }
  }
}

void CanonicalizeFastHttpVersion(curl::fuzzer::proto::Scenario* scenario) {
  for (auto& option : *scenario->mutable_options()) {
    if (option.option_id() != curl::fuzzer::proto::CURLOPT_HTTP_VERSION) {
      continue;
    }
    const std::uint64_t version = IntegralMutationValue(option);
    // 2TLS remains HTTP/1.1 because this target fixes the scheme to HTTP.
    if (version <= CURL_HTTP_VERSION_2TLS) {
      option.set_uint_value(version);
    } else {
      option.set_uint_value(CURL_HTTP_VERSION_NONE);
    }
  }
}

void CanonicalizeFtpOptionModes(curl::fuzzer::proto::Scenario* scenario) {
  for (auto& option : *scenario->mutable_options()) {
    switch (option.option_id()) {
      case curl::fuzzer::proto::CURLOPT_FTP_CREATE_MISSING_DIRS:
        option.set_uint_value(IntegralMutationValue(option) % 3U);
        break;
      case curl::fuzzer::proto::CURLOPT_FTP_FILEMETHOD:
        option.set_uint_value(IntegralMutationValue(option) % 4U);
        break;
      case curl::fuzzer::proto::CURLOPT_FTPPORT:
        // Never let a mutated active-mode address resolve or bind outside the
        // process. Empty remains reachable only by omitting the option.
        option.set_string_value("127.0.0.1");
        break;
      case curl::fuzzer::proto::CURLOPT_FTP_USE_EPRT:
        option.set_bool_value(IntegralMutationValue(option) != 0U);
        break;
      default:
        break;
    }
  }
}

void CanonicalizeTftpOptionModes(curl::fuzzer::proto::Scenario* scenario) {
  for (auto& option : *scenario->mutable_options()) {
    if (option.option_id() != curl::fuzzer::proto::CURLOPT_TFTP_BLKSIZE) {
      continue;
    }
    std::uint64_t value = IntegralMutationValue(option);
    if (value == 0) {
      value = 512;
    }
    option.set_uint_value(std::max<std::uint64_t>(8, std::min<std::uint64_t>(value, 65464)));
  }
}

void CanonicalizeRtspOptionModes(curl::fuzzer::proto::Scenario* scenario) {
  for (auto& option : *scenario->mutable_options()) {
    switch (option.option_id()) {
      case curl::fuzzer::proto::CURLOPT_RTSP_REQUEST: {
        const std::uint64_t value = IntegralMutationValue(option);
        // RECEIVE sends no request and instead waits for server-initiated
        // stream data, which the request-aligned peer never emits. Fold it
        // onto the default OPTIONS like zero and out-of-range values so every
        // retained request still issues a scripted exchange.
        const bool supported =
            value >= CURL_RTSPREQ_OPTIONS && value < CURL_RTSPREQ_LAST && value != CURL_RTSPREQ_RECEIVE;
        option.set_uint_value(supported ? value : CURL_RTSPREQ_OPTIONS);
        break;
      }
      case curl::fuzzer::proto::CURLOPT_RTSP_CLIENT_CSEQ:
      case curl::fuzzer::proto::CURLOPT_RTSP_SERVER_CSEQ:
        option.set_uint_value(std::min<std::uint64_t>(IntegralMutationValue(option),
                                                      static_cast<std::uint64_t>(std::numeric_limits<int>::max())));
        break;
      default:
        break;
    }
  }
}

void RemoveDeepHttpShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_mime_post();
  scenario->clear_upload();
  scenario->clear_subsequent_connections();
 
  auto* connection = scenario->mutable_connection();
  connection->clear_server_frames();
  connection->clear_manual_probes();
  connection->clear_backpressure();
}

void RemoveIgnoredH2ProxyShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  auto* connection = scenario->mutable_connection();
  connection->clear_server_frames();
  connection->clear_manual_probes();
  connection->clear_backpressure();
}

void RemoveIgnoredWebSocketShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_mime_post();
}

void RemoveNonTelnetShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
 
  auto* connection = scenario->mutable_connection();
  connection->clear_server_frames();
  connection->clear_manual_probes();
  connection->clear_backpressure();
}

void RemoveTelnetOnlyShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_telnet_options();
  if (scenario->has_upload() && scenario->upload().terminal() == curl::fuzzer::proto::UPLOAD_TERMINAL_PAUSE) {
    scenario->mutable_upload()->set_terminal(curl::fuzzer::proto::UPLOAD_TERMINAL_EOF);
  }
}

void RemoveApiOnlyShape(curl::fuzzer::proto::Scenario* scenario) { scenario->clear_api_plan(); }

void RemoveMultiOnlyShape(curl::fuzzer::proto::Scenario* scenario) { scenario->clear_multi_plan(); }

void RemoveIgnoredHttp3Shape(curl::fuzzer::proto::Scenario* scenario) {
  if (!scenario->http3_plan().use_h1_connect_udp_proxy()) {
    scenario->clear_connection();
  }
  scenario->clear_subsequent_connections();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
}

void RemoveUnusedFileTransferConnectionShape(curl::fuzzer::proto::Connection* connection,
                                             bool retain_backpressure = false) {
  connection->clear_server_frames();
  connection->clear_manual_probes();
  if (!retain_backpressure) {
    connection->clear_backpressure();
  }
}

void RemoveIgnoredFtpShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
 
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection());
  TrimRepeated(scenario->mutable_subsequent_connections(), scenario_limits::kMaxConnections - 1);
  for (auto& connection : *scenario->mutable_subsequent_connections()) {
    RemoveUnusedFileTransferConnectionShape(&connection);
  }
}

void RemoveIgnoredTftpShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection());
}

void RemoveIgnoredSmtpShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection());
}

void RemoveIgnoredImapShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection(), true);
}

void RemoveIgnoredPop3Shape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  scenario->clear_upload();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection(), true);
}
 
void RemoveIgnoredGopherShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  scenario->clear_upload();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection());
}

void RemoveIgnoredDictShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  scenario->clear_upload();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection());
  // curl writes CLIENT, one lookup command, and QUIT in a single send, then
  // reads an EOF-framed body. The peer consumes only the first non-CLIENT
  // reply chunk and half-closes, so any later chunk is permanently dead work
  // the mutator keeps rediscovering.
  TrimRepeated(scenario->mutable_connection()->mutable_on_readable(), 1);
}

void RemoveIgnoredMqttShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  scenario->clear_upload();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection());
}

void RemoveIgnoredFileShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_connection();
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
}

void RemoveIgnoredLdapShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_request_headers();
  scenario->clear_mime_post();
  scenario->clear_upload();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveUnusedFileTransferConnectionShape(scenario->mutable_connection());
}

void RemoveIgnoredRtspShape(curl::fuzzer::proto::Scenario* scenario) {
  scenario->clear_subsequent_connections();
  scenario->clear_mime_post();
  RemoveTelnetOnlyShape(scenario);
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
 
  auto* connection = scenario->mutable_connection();
  connection->clear_initial_response();
  RemoveUnusedFileTransferConnectionShape(connection);
}

void RemoveIgnoredIpfsShape(curl::fuzzer::proto::Scenario* scenario) {
  RemoveApiOnlyShape(scenario);
  RemoveMultiOnlyShape(scenario);
  RemoveTelnetOnlyShape(scenario);
  RemoveDeepHttpShape(scenario);
}

std::uint32_t CanonicalizeNonZero(std::uint32_t value, std::uint32_t minimum, std::uint32_t maximum) {
  if (value == 0) {
    return 0;
  }
  return std::max(minimum, std::min(value, maximum));
}

curl::fuzzer::proto::Scheme PlaintextScheme(curl::fuzzer::proto::Scheme scheme) {
  switch (scheme) {
    case curl::fuzzer::proto::SCHEME_WS:
    case curl::fuzzer::proto::SCHEME_WSS:
      return curl::fuzzer::proto::SCHEME_WS;
    case curl::fuzzer::proto::SCHEME_HTTP:
    case curl::fuzzer::proto::SCHEME_HTTPS:
    case curl::fuzzer::proto::SCHEME_TELNET:
    case curl::fuzzer::proto::SCHEME_FTP:
    case curl::fuzzer::proto::SCHEME_TFTP:
    case curl::fuzzer::proto::SCHEME_DICT:
    case curl::fuzzer::proto::SCHEME_FILE:
    case curl::fuzzer::proto::SCHEME_UNSPECIFIED:
    default:
      return curl::fuzzer::proto::SCHEME_HTTP;
  }
}

void ClearAllBackpressure(curl::fuzzer::proto::Scenario* scenario) {
  if (scenario->has_connection()) {
    scenario->mutable_connection()->clear_backpressure();
  }
  for (auto& connection : *scenario->mutable_subsequent_connections()) {
    connection.clear_backpressure();
  }
}

void CanonicalizeOptionalBackpressure(curl::fuzzer::proto::Connection* connection) {
  if (!connection->has_backpressure()) {
    return;
  }
  auto* backpressure = connection->mutable_backpressure();
  if (backpressure->recv_buf_bytes() == 0 && backpressure->drain_limit() != 0) {
    backpressure->set_recv_buf_bytes(kDefaultBackpressureBufferBytes);
  } else {
    backpressure->set_recv_buf_bytes(
        CanonicalizeNonZero(backpressure->recv_buf_bytes(), kMinBackpressureBufferBytes, kMaxBackpressureBufferBytes));
  }
  backpressure->set_drain_limit(CanonicalizeNonZero(backpressure->drain_limit(), 1, kMaxDrainBytesPerIteration));
}

void CanonicalizeMailBackpressure(curl::fuzzer::proto::Connection* connection) {
  if (!connection->has_backpressure()) {
    return;
  }
  auto* backpressure = connection->mutable_backpressure();
  if (backpressure->recv_buf_bytes() == 0) {
    connection->clear_backpressure();
    return;
  }
  backpressure->set_recv_buf_bytes(
      CanonicalizeNonZero(backpressure->recv_buf_bytes(), kMinBackpressureBufferBytes, kMaxBackpressureBufferBytes));
  backpressure->clear_drain_limit();
}

void ApplyLanePolicy(curl::fuzzer::proto::Scenario* scenario, TargetProfile profile,
                     ConditionalEligibilityPruner prune_conditional_eligibility) {
  if (scenario == nullptr) {
    return;
  }
 
  if (profile == TargetProfile::kCompatibility) {
    // The original target's existing corpus predates profile splitting. A
    // no-op here makes the type safe to pass around while its binary continues
    // to omit postprocessor registration altogether. The append-only FTP/FTPS
    // and TFTP scheme values do not justify rewriting historical mixed-lane
    // inputs.
    return;
  }
 
  // Only FastFile may turn protobuf bytes into a local descriptor. Generated
  // profiles already enforce this ownership; repeat it for direct callers of
  // the full runtime Scenario before any generic bounds inspect the field.
  if (profile != TargetProfile::kFastFile) {
    scenario->clear_file_source();
  }
 
  // The nested selector belongs exclusively to the HTTPS CONNECT proxy lane.
  // Compatibility returned above and therefore preserves accumulated inputs;
  // every unrelated fixed lane drops work its peer cannot observe.
  if (profile != TargetProfile::kH2Proxy) {
    scenario->mutable_connection()->clear_proxy_protocol();
    for (auto& connection : *scenario->mutable_subsequent_connections()) {
      connection.clear_proxy_protocol();
    }
  }
 
  // MQTT is append-only as well. No other fixed lane may reinterpret one of
  // its packet scripts, so clear the selector before the lane-specific early
  // paths install their own scheme. Compatibility returned above and keeps
  // historical unknown-field semantics.
  if (profile != TargetProfile::kFastMqtt && scenario->scheme() == curl::fuzzer::proto::SCHEME_MQTT) {
    scenario->clear_scheme();
  }
 
  // DICT is append-only too. Only the dedicated lane may reinterpret a lookup
  // script; every other fixed lane clears the selector before installing its
  // own scheme.
  if (profile != TargetProfile::kFastDict && scenario->scheme() == curl::fuzzer::proto::SCHEME_DICT) {
    scenario->clear_scheme();
  }
 
  // FILE is append-only as well. Other fixed lanes must not inherit a local
  // filesystem selector from a corpus input; only the dedicated lane may run
  // the peerless file:// path.
  if (profile != TargetProfile::kFastFile && scenario->scheme() == curl::fuzzer::proto::SCHEME_FILE) {
    scenario->clear_scheme();
  }
 
  // LDAP and LDAPS are append-only too. Only the fixed BER lane may turn one
  // of their scripted bind/search exchanges into a live OpenLDAP session.
  if (profile != TargetProfile::kFastLdap && (scenario->scheme() == curl::fuzzer::proto::SCHEME_LDAP ||
                                              scenario->scheme() == curl::fuzzer::proto::SCHEME_LDAPS)) {
    scenario->clear_scheme();
  }
 
  // RTSP is append-only too. Keep its selector away from every fixed lane
  // that cannot service a request-aligned RTSP exchange. Static option
  // membership is carried by each generated profile descriptor.
  if (profile != TargetProfile::kFastRtsp && scenario->scheme() == curl::fuzzer::proto::SCHEME_RTSP) {
    scenario->clear_scheme();
  }
  // FTPS is append-only too. Only the fixed FTP lane may turn one of its
  // scenarios into a TLS-wrapped control/data exchange.
  if (profile != TargetProfile::kFastFtp && scenario->scheme() == curl::fuzzer::proto::SCHEME_FTPS) {
    scenario->clear_scheme();
  }
 
  // IPFS/IPNS are append-only as well. Their identifiers and gateway paths
  // would be inert in every other fixed lane, so clear the selector before
  // the lane-specific early paths install their own scheme.
  if (profile != TargetProfile::kFastIpfs && (scenario->scheme() == curl::fuzzer::proto::SCHEME_IPFS ||
                                              scenario->scheme() == curl::fuzzer::proto::SCHEME_IPNS)) {
    scenario->clear_scheme();
  }
 
  // Accepted server push adds a harness-owned easy handle and therefore
  // belongs only in the fixed H2 origin lanes. Compatibility remains a no-op
  // above so accumulated mixed corpus entries keep their wire meaning.
  if (profile != TargetProfile::kHttpsH2 && profile != TargetProfile::kFastHttp2) {
    scenario->clear_accept_h2_push();
  }
 
  // Only the dedicated TLS and QUIC peers consume a certificate-chain
  // selector. Remove it before protocol-specific early returns so other fixed
  // targets do not spend mutations on inert TLS server state.
  if (profile != TargetProfile::kFastHttps && profile != TargetProfile::kHttpsH2 &&
      profile != TargetProfile::kFastHttp3 && profile != TargetProfile::kFastSecureWebSocket) {
    scenario->clear_tls_certificate_chain();
  }
 
  // Only the dedicated TLS HTTP/2 origin consumes the group selector. The
  // compatibility profile returned above so unknown fields remain stable.
  if (profile != TargetProfile::kHttpsH2) {
    scenario->clear_tls_group_profile();
  }
 
  // Field 13 is append-only so the compatibility target can round-trip it,
  // but every other fixed lane must discard work its peer cannot consume.
  if (profile != TargetProfile::kFastHttp3) {
    scenario->clear_http3_plan();
  }
 
  const bool resolver_uses_doh = profile == TargetProfile::kResolver && scenario->has_doh();
  if (profile != TargetProfile::kHttpsH2 && profile != TargetProfile::kFastHttp2 && !resolver_uses_doh) {
    scenario->clear_http2_plan();
  }
 
  const bool deep_http_haproxy = profile == TargetProfile::kDeepHttp &&
                                 scenario->http_transport_mode() == curl::fuzzer::proto::HTTP_TRANSPORT_CONNECT_PROXY;
  if (profile != TargetProfile::kProxyTransport) {
    scenario->clear_socks_proxy_mode();
    if (!deep_http_haproxy) {
      scenario->clear_haproxy_protocol();
    }
  }
 
  // StartTLS is a correlated LDAP transport mode rather than a transferable
  // scalar option. Other fixed lanes discard it before their early returns.
  if (profile != TargetProfile::kFastLdap) {
    scenario->clear_ldap_starttls();
  }
 
  if (profile != TargetProfile::kFastPop3) {
    scenario->clear_pop3_starttls_filter_allocation_failure();
  }
 
  if (profile != TargetProfile::kFastFtp) {
    scenario->clear_ftp_auth_tls_filter_allocation_failure();
  }
 
  if (profile != TargetProfile::kFastGopher) {
    scenario->clear_gopher_probe_mode();
  }
 
  if (profile != TargetProfile::kFastRtsp) {
    scenario->clear_rtsp_probe_mode();
  }
 
  if (profile != TargetProfile::kFastMqtt) {
    scenario->clear_mqtt_probe_mode();
  }
 
  if (profile != TargetProfile::kFastSmtp) {
    scenario->clear_smtp_probe_mode();
  }
 
  if (profile != TargetProfile::kFastHttp2) {
    scenario->clear_http2_connect_flush_probe();
  }
 
  if (profile != TargetProfile::kDeepHttp) {
    scenario->clear_http_transport_mode();
    scenario->clear_proxy_socket_option_mode();
  }
 
  if (profile != TargetProfile::kResolver) {
    scenario->clear_resolve_entries();
    scenario->clear_happy_eyeballs();
    scenario->clear_doh();
    scenario->clear_resolver_mode();
  }
 
  // SMTP's schema-native recipient list has no meaning in another protocol's
  // exchange. Clearing it before early returns keeps other fixed lanes from
  // carrying inert envelope work.
  if (profile != TargetProfile::kFastSmtp) {
    scenario->clear_mail_rcpt();
  }
 
  // Only these protocol peers currently interleave zero-timeout public multi
  // polling with immediate service of their live connection.
  // Keep the opt-in out of fixed lanes whose driver cannot honor that timing
  // contract; compatibility returned above and preserves its wire input.
  if (profile != TargetProfile::kFastSmtp && profile != TargetProfile::kFastImap &&
      profile != TargetProfile::kFastPop3 && profile != TargetProfile::kFastFtp &&
      profile != TargetProfile::kFastMqtt && profile != TargetProfile::kProxyTransport &&
      profile != TargetProfile::kDeepHttp) {
    scenario->clear_probe_multi_pollset();
  }
 
  // Direct forwarding changes the H2 proxy stream from CONNECT authority-form
  // to an absolute-form origin request. No other peer implements that shape.
  if (profile != TargetProfile::kH2Proxy) {
    scenario->clear_h2_forward_proxy();
  }
 
  // Anonymous parser files add syscalls and line parsing that belong only in
  // the deep HTTP lane. Clear them before every protocol-specific early path
  // so fast targets never pay to normalize content they cannot consume.
  if (profile != TargetProfile::kDeepHttp) {
    scenario->clear_cookie_file();
    scenario->clear_altsvc_file();
    scenario->clear_hsts_file();
    scenario->clear_netrc_file();
  }
 
  // CRLs and public-key pin files are useful only when the target completes a
  // real origin TLS setup. Keep malformed or oversized inputs from turning
  // every other lane into an early TLS-option failure.
  if (profile != TargetProfile::kFastHttps) {
    scenario->clear_crl_file();
    scenario->clear_pinned_public_key_file();
    scenario->clear_tls_client_credential_profile();
    scenario->clear_tls_handshake_profile();
  }
 
  if (profile == TargetProfile::kFastHttp3) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTPS);
    RemoveIgnoredHttp3Shape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    // The ordinary QUIC peer consumes Http3Plan and has no use for a stream
    // response. CONNECT-UDP proxy mode instead feeds the retained Connection
    // bytes to curl's HTTP/1.1 proxy state machine and capsule filter.
    if (!scenario->http3_plan().use_h1_connect_udp_proxy()) {
      scenario->clear_connection();
    }
    BoundHttp3PlanShape(scenario->mutable_http3_plan());
    CanonicalizeHttp3Authority(scenario);
    CanonicalizeTlsCertificateChain(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastTelnet) {
    // Set the scheme before general bounds so the TELNET-specific upload and
    // PAUSE budgets are selected rather than event-driven compatibility ones.
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_TELNET);
    RemoveApiOnlyShape(scenario);
    RemoveMultiOnlyShape(scenario);
    RemoveNonTelnetShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    BoundTelnetResponse(scenario->mutable_connection());
    return;
  }
 
  if (profile == TargetProfile::kFastHttp) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);
    RemoveApiOnlyShape(scenario);
    RemoveMultiOnlyShape(scenario);
    RemoveTelnetOnlyShape(scenario);
    RemoveDeepHttpShape(scenario);
    CanonicalizeFastHttpVersion(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    return;
  }
 
  if (profile == TargetProfile::kH2Proxy) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);
    RemoveApiOnlyShape(scenario);
    RemoveMultiOnlyShape(scenario);
    RemoveTelnetOnlyShape(scenario);
    RemoveIgnoredH2ProxyShape(scenario);
    switch (scenario->connection().proxy_protocol()) {
      case curl::fuzzer::proto::PROXY_PROTOCOL_HTTP2:
      case curl::fuzzer::proto::PROXY_PROTOCOL_HTTP1:
        break;
      default:
        scenario->mutable_connection()->set_proxy_protocol(curl::fuzzer::proto::PROXY_PROTOCOL_HTTP2);
        break;
    }
    if (scenario->connection().proxy_protocol() == curl::fuzzer::proto::PROXY_PROTOCOL_HTTP1) {
      scenario->clear_h2_forward_proxy();
    }
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeH2ProxyOriginAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kHttpsH2 || profile == TargetProfile::kFastHttp2) {
    scenario->set_scheme(profile == TargetProfile::kHttpsH2 ? curl::fuzzer::proto::SCHEME_HTTPS
                                                            : curl::fuzzer::proto::SCHEME_HTTP);
    RemoveApiOnlyShape(scenario);
    RemoveMultiOnlyShape(scenario);
    RemoveTelnetOnlyShape(scenario);
    RemoveIgnoredH2ProxyShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    if (scenario->http2_connect_flush_probe()) {
      // CONNECT_ONLY supplies no HTTP response plan. Clear competing peer
      // bytes so mutations stay focused on the connection-filter lifecycle.
      scenario->clear_http2_plan();
      scenario->clear_connection();
      scenario->clear_subsequent_connections();
    }
    if (scenario->has_http2_plan()) {
      auto* connection = scenario->mutable_connection();
      connection->clear_initial_response();
      connection->clear_on_readable();
      connection->clear_server_frames();
      BoundHttp2PlanShape(scenario->mutable_http2_plan());
    }
    CanonicalizeTlsAuthority(scenario);
    if (profile == TargetProfile::kHttpsH2) {
      CanonicalizeTlsCertificateChain(scenario);
      CanonicalizeTlsGroupProfile(scenario);
    }
    return;
  }
 
  if (profile == TargetProfile::kProxyTransport) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);
    switch (scenario->socks_proxy_mode()) {
      case curl::fuzzer::proto::SOCKS_PROXY_SOCKS4:
      case curl::fuzzer::proto::SOCKS_PROXY_SOCKS4A:
      case curl::fuzzer::proto::SOCKS_PROXY_SOCKS5:
      case curl::fuzzer::proto::SOCKS_PROXY_SOCKS5_HOSTNAME:
        break;
      default:
        scenario->set_socks_proxy_mode(curl::fuzzer::proto::SOCKS_PROXY_SOCKS4);
        break;
    }
    RemoveApiOnlyShape(scenario);
    RemoveMultiOnlyShape(scenario);
    RemoveTelnetOnlyShape(scenario);
    RemoveDeepHttpShape(scenario);
    scenario->mutable_connection()->clear_initial_response();
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeSocksAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kResolver) {
    // The DoH variant owns the outer HTTPS exchange through a verified
    // TLS/ALPN h2 peer, so its response is an Http2Plan rather than a raw
    // stream script. The ordinary resolver lanes keep plaintext HTTP.
    switch (scenario->resolver_mode()) {
      case curl::fuzzer::proto::RESOLVER_MODE_DEFAULT:
      case curl::fuzzer::proto::RESOLVER_MODE_THREADED_POSITIVE:
      case curl::fuzzer::proto::RESOLVER_MODE_THREADED_NEGATIVE:
      case curl::fuzzer::proto::RESOLVER_MODE_THREADED_LINK_LOCAL:
      case curl::fuzzer::proto::RESOLVER_MODE_UNIX_SOCKET:
      case curl::fuzzer::proto::RESOLVER_MODE_THREADED_PARTIAL:
      case curl::fuzzer::proto::RESOLVER_MODE_GLOBAL_LIFECYCLE:
      case curl::fuzzer::proto::RESOLVER_MODE_THREADED_QUEUED_CANCEL:
        break;
      default:
        scenario->clear_resolver_mode();
        break;
    }
    if (scenario->has_doh()) {
      if (!curl::fuzzer::proto::DohResponseMode_IsValid(scenario->doh().response_mode())) {
        scenario->mutable_doh()->set_response_mode(curl::fuzzer::proto::DOH_RESPONSE_MODE_NORMAL);
      }
      if (!curl::fuzzer::proto::DohTransportMode_IsValid(scenario->doh().transport_mode())) {
        scenario->mutable_doh()->set_transport_mode(curl::fuzzer::proto::DOH_TRANSPORT_HTTP);
      }
      if (!curl::fuzzer::proto::DohOptionProbeMode_IsValid(scenario->doh().option_probe_mode())) {
        scenario->mutable_doh()->set_option_probe_mode(curl::fuzzer::proto::DOH_OPTION_PROBE_DEFAULT);
      }
      if (scenario->doh().option_probe_mode() != curl::fuzzer::proto::DOH_OPTION_PROBE_DEFAULT) {
        scenario->mutable_doh()->set_transport_mode(curl::fuzzer::proto::DOH_TRANSPORT_HTTPS);
      }
    }
    const bool fixed_resolver_mode = scenario->resolver_mode() != curl::fuzzer::proto::RESOLVER_MODE_DEFAULT;
    if (fixed_resolver_mode) {
      scenario->clear_resolve_entries();
      scenario->clear_happy_eyeballs();
      scenario->clear_doh();
    }
    const bool uses_doh = scenario->has_doh();
    scenario->set_scheme(uses_doh ? curl::fuzzer::proto::SCHEME_HTTPS : curl::fuzzer::proto::SCHEME_HTTP);
    RemoveApiOnlyShape(scenario);
    RemoveMultiOnlyShape(scenario);
    RemoveTelnetOnlyShape(scenario);
    RemoveDeepHttpShape(scenario);
    // The generic fast-lane pruning above removes fuzz-controlled timing
    // knobs. Threaded resolver modes add back one fixed marker so their
    // bounded drive performs a pollset probe and short fdset waits while the
    // target-local resolver work is outstanding.
    if (IsThreadedResolverMode(scenario->resolver_mode())) {
      scenario->mutable_connection()->mutable_backpressure()->set_drain_limit(1);
    }
    if (scenario->resolver_mode() == curl::fuzzer::proto::RESOLVER_MODE_THREADED_QUEUED_CANCEL) {
      // The runner observes the pool's public THREADS trace after releasing
      // its lookup gate. Seeing an idle worker proves it entered the configured
      // timed condition wait; mutated trace controls must not remove that
      // lifecycle contract.
      scenario->set_trace_config("+THREADS");
    }
    if (uses_doh) {
      // CURLOPT_RESOLVE cannot carry an HTTPS record, and the responder owns
      // both the address and HTTPS answers. Clearing the address entries keeps
      // the DoH query on the only path that can reach the ALPN selector.
      scenario->clear_resolve_entries();
      scenario->clear_happy_eyeballs();
      if (scenario->has_http2_plan()) {
        auto* connection = scenario->mutable_connection();
        connection->clear_initial_response();
        connection->clear_on_readable();
        connection->clear_server_frames();
        BoundHttp2PlanShape(scenario->mutable_http2_plan());
      }
    } else {
      scenario->clear_http2_plan();
      BoundStringValues(scenario->mutable_resolve_entries(), scenario_limits::kMaxResolveEntries,
                        scenario_limits::kMaxResolveEntryBytes);
    }
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeResolverAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastFtp) {
    // The same lane services plaintext FTP and implicit-TLS FTPS through one
    // command/data parser. Preserve an explicitly supplied FTPS scheme so the
    // seed and mutations can select the TLS peer; every other scheme falls
    // back to the historical plaintext lane.
    const auto scheme = scenario->scheme();
    const bool implicit_tls = scheme == curl::fuzzer::proto::SCHEME_FTPS;
    scenario->set_scheme(implicit_tls ? curl::fuzzer::proto::SCHEME_FTPS : curl::fuzzer::proto::SCHEME_FTP);
    if (implicit_tls) {
      scenario->clear_ftp_auth_tls_filter_allocation_failure();
    }
    if (scenario->ftp_auth_tls_filter_allocation_failure()) {
      scenario->clear_fail_allocations();
    }
    RemoveIgnoredFtpShape(scenario);
    CanonicalizeFtpOptionModes(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeFtpAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastTftp) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_TFTP);
    RemoveIgnoredTftpShape(scenario);
    CanonicalizeTftpOptionModes(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeTftpAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastSmtp) {
    // One command/reply parser services plaintext SMTP and implicit-TLS SMTPS.
    // Preserve an explicitly supplied SMTPS scheme so the seed and mutations
    // can select the TLS peer; every other scheme falls back to the historical
    // plaintext lane.
    const auto scheme = scenario->scheme();
    scenario->set_scheme(scheme == curl::fuzzer::proto::SCHEME_SMTPS ? curl::fuzzer::proto::SCHEME_SMTPS
                                                                     : curl::fuzzer::proto::SCHEME_SMTP);
    CanonicalizeSmtpProbeMode(scenario);
    if (scenario->scheme() == curl::fuzzer::proto::SCHEME_SMTPS) {
      scenario->clear_smtp_probe_mode();
    }
    if (scenario->smtp_probe_mode() == curl::fuzzer::proto::SMTP_PROBE_STARTTLS_FILTER_ALLOCATION_FAILURE) {
      scenario->clear_fail_allocations();
    }
    if (scenario->smtp_probe_mode() == curl::fuzzer::proto::SMTP_PROBE_SEND_BACKPRESSURE) {
      scenario->clear_mail_rcpt();
      scenario->clear_upload();
      scenario->clear_mime_post();
    }
    RemoveIgnoredSmtpShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    if (scenario->smtp_probe_mode() == curl::fuzzer::proto::SMTP_PROBE_SEND_BACKPRESSURE) {
      scenario->set_probe_multi_pollset(true);
      auto* backpressure = scenario->mutable_connection()->mutable_backpressure();
      backpressure->set_recv_buf_bytes(kSmtpProbeBufferBytes);
      backpressure->set_drain_limit(kSmtpProbeDrainBytes);
    }
    CanonicalizeSmtpAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastImap) {
    // Preserve an explicitly supplied IMAPS scheme so seeds and mutations can
    // select the implicit-TLS peer; every other scheme falls back to the
    // historical plaintext lane. Both values reuse this tag-aware parser.
    const auto scheme = scenario->scheme();
    scenario->set_scheme(scheme == curl::fuzzer::proto::SCHEME_IMAPS ? curl::fuzzer::proto::SCHEME_IMAPS
                                                                     : curl::fuzzer::proto::SCHEME_IMAP);
    RemoveIgnoredImapShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeMailBackpressure(scenario->mutable_connection());
    CanonicalizeImapAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastPop3) {
    // Preserve an explicitly supplied POP3S scheme so seeds and mutations can
    // select the implicit-TLS peer; every other scheme falls back to the
    // historical plaintext lane. Both values reuse this status-line parser.
    const auto scheme = scenario->scheme();
    scenario->set_scheme(scheme == curl::fuzzer::proto::SCHEME_POP3S ? curl::fuzzer::proto::SCHEME_POP3S
                                                                     : curl::fuzzer::proto::SCHEME_POP3);
    if (scenario->scheme() == curl::fuzzer::proto::SCHEME_POP3S) {
      scenario->clear_pop3_starttls_filter_allocation_failure();
    }
    if (scenario->pop3_starttls_filter_allocation_failure()) {
      scenario->clear_fail_allocations();
    }
    RemoveIgnoredPop3Shape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeMailBackpressure(scenario->mutable_connection());
    CanonicalizePop3Authority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastMqtt) {
    // The dedicated MQTT lane services both the plaintext and implicit-TLS
    // variants through one packet-aware parser. Preserve an explicitly
    // supplied MQTTS scheme so the seed and mutations can select the TLS peer;
    // every other scheme falls back to the historical plaintext lane.
    CanonicalizeMqttProbeMode(scenario);
    const auto probe = scenario->mqtt_probe_mode();
    const auto scheme = scenario->scheme();
    scenario->set_scheme(probe == curl::fuzzer::proto::MQTT_PROBE_DEFAULT && scheme == curl::fuzzer::proto::SCHEME_MQTTS
                             ? curl::fuzzer::proto::SCHEME_MQTTS
                             : curl::fuzzer::proto::SCHEME_MQTT);
    RemoveIgnoredMqttShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    if (probe == curl::fuzzer::proto::MQTT_PROBE_SEND_BACKPRESSURE) {
      auto* backpressure = scenario->mutable_connection()->mutable_backpressure();
      backpressure->set_recv_buf_bytes(kMqttProbeBufferBytes);
      backpressure->set_drain_limit(kMqttProbeDrainBytes);
      scenario->set_probe_multi_pollset(true);
    }
    CanonicalizeMqttAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastDict) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_DICT);
    RemoveIgnoredDictShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeDictAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastGopher) {
    CanonicalizeGopherProbeMode(scenario);
    const auto probe = scenario->gopher_probe_mode();
    if (probe == curl::fuzzer::proto::GOPHER_PROBE_TLS_SESSION_KEY_LIMIT) {
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_GOPHERS);
    } else if (probe != curl::fuzzer::proto::GOPHER_PROBE_DEFAULT) {
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_GOPHER);
    } else {
      scenario->set_scheme(scenario->scheme() == curl::fuzzer::proto::SCHEME_GOPHERS
                               ? curl::fuzzer::proto::SCHEME_GOPHERS
                               : curl::fuzzer::proto::SCHEME_GOPHER);
    }
    RemoveIgnoredGopherShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    if (probe == curl::fuzzer::proto::GOPHER_PROBE_TLS_SESSION_KEY_LIMIT) {
      scenario->set_host_path(std::string(kGopherTlsPeerKeyHostBytes, 'g') + "/1/session-key-limit");
    } else {
      CanonicalizeTlsAuthority(scenario);
    }
    return;
  }
 
  if (profile == TargetProfile::kFastFile) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_FILE);
    scenario->clear_host_path();
    RemoveIgnoredFileShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    if (scenario->file_source().size() > scenario_limits::kMaxFileInputBytes) {
      scenario->mutable_file_source()->resize(scenario_limits::kMaxFileInputBytes);
    }
    return;
  }
 
  if (profile == TargetProfile::kFastLdap) {
    // The single LDAP target services plaintext LDAP and implicit-TLS LDAPS
    // through one BER parser. Preserve an explicitly supplied LDAPS scheme so
    // the seed and mutations can select the TLS peer; every other scheme falls
    // back to the historical plaintext lane.
    const auto scheme = scenario->scheme();
    scenario->set_scheme(scheme == curl::fuzzer::proto::SCHEME_LDAPS ? curl::fuzzer::proto::SCHEME_LDAPS
                                                                     : curl::fuzzer::proto::SCHEME_LDAP);
    if (scenario->scheme() == curl::fuzzer::proto::SCHEME_LDAPS) {
      scenario->clear_ldap_starttls();
    }
    RemoveIgnoredLdapShape(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeLdapAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastRtsp) {
    scenario->set_scheme(curl::fuzzer::proto::SCHEME_RTSP);
    RemoveIgnoredRtspShape(scenario);
    CanonicalizeRtspOptionModes(scenario);
    CanonicalizeRtspProbeMode(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeRtspAuthority(scenario);
    return;
  }
 
  if (profile == TargetProfile::kFastIpfs) {
    // Preserve an explicitly selected IPNS name; every other pre-policy value
    // falls back to the historical IPFS lane so one binary covers both.
    scenario->set_scheme(scenario->scheme() == curl::fuzzer::proto::SCHEME_IPNS ? curl::fuzzer::proto::SCHEME_IPNS
                                                                                : curl::fuzzer::proto::SCHEME_IPFS);
    RemoveIgnoredIpfsShape(scenario);
    CanonicalizeFastHttpVersion(scenario);
    PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
    CanonicalizeIpfsAuthority(scenario);
    return;
  }
 
  // Select the lane's scheme before applying scheme-sensitive upload bounds.
  // The scheme field is itself mutable, so bounding first could accidentally
  // give an HTTP/WS case TELNET's smaller payload budget merely because that
  // was the input's pre-policy value.
  switch (profile) {
    case TargetProfile::kCompatibility:
      return;
    case TargetProfile::kDeepHttp:
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);
      break;
    case TargetProfile::kApi:
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);
      break;
    case TargetProfile::kMulti:
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);
      break;
    case TargetProfile::kFastHttps:
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTPS);
      break;
    case TargetProfile::kHttpsH2:
      // The protocol-specific early path fixes ALPN and prunes incompatible
      // response shapes while retaining the raw frame script.
      return;
    case TargetProfile::kFastHttp2:
      // The protocol-specific early path fixes prior-knowledge H2 and prunes
      // incompatible response shapes while retaining its frame script.
      return;
    case TargetProfile::kFastHttp3:
      // The protocol-specific early path owns the QUIC response plan.
      return;
    case TargetProfile::kH2Proxy:
      // The early path removes proxy-incompatible fields before general
      // bounds, keeping raw frame mutation dense.
      return;
    case TargetProfile::kProxyTransport:
      // The early path fixes proxy routing and request-triggered replies.
      return;
    case TargetProfile::kResolver:
      // The early path fixes safe DNS/cache routing and bounds its slist.
      return;
    case TargetProfile::kFastWebSocket:
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_WS);
      break;
    case TargetProfile::kFastSecureWebSocket:
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_WSS);
      break;
    case TargetProfile::kTiming:
      scenario->set_scheme(PlaintextScheme(scenario->scheme()));
      break;
    case TargetProfile::kFastHttp:
    case TargetProfile::kFastTelnet:
    case TargetProfile::kFastFtp:
    case TargetProfile::kFastTftp:
    case TargetProfile::kFastSmtp:
    case TargetProfile::kFastImap:
    case TargetProfile::kFastPop3:
    case TargetProfile::kFastMqtt:
    case TargetProfile::kFastDict:
    case TargetProfile::kFastGopher:
    case TargetProfile::kFastFile:
    case TargetProfile::kFastLdap:
    case TargetProfile::kFastRtsp:
    case TargetProfile::kFastIpfs:
      // Protocol-specific early-return paths selected their scheme above.
      return;
  }
 
  // TELNET's retained slist and synchronous pause have no observable, safe
  // meaning in the fixed event-driven lanes. Clear them before walking the
  // general shape so only the compatibility and TELNET targets can retain
  // those values.
  RemoveTelnetOnlyShape(scenario);
  if (profile != TargetProfile::kApi) {
    RemoveApiOnlyShape(scenario);
  }
  if (profile != TargetProfile::kMulti) {
    RemoveMultiOnlyShape(scenario);
  }
  if (profile == TargetProfile::kDeepHttp) {
    CanonicalizeDeepHttpSelectors(scenario);
  }
  if (profile == TargetProfile::kApi && scenario->has_api_plan()) {
    CanonicalizeApiDriveMode(scenario->mutable_api_plan());
  }
  PruneAndBoundScenarioShape(scenario, profile, prune_conditional_eligibility);
 
  switch (profile) {
    case TargetProfile::kCompatibility:
      return;
    case TargetProfile::kFastHttp:
      // Handled before the general bounds so discarded deep shapes are never
      // traversed on the fast path.
      return;
 
    case TargetProfile::kDeepHttp:
      if (scenario->proxy_socket_option_mode() != curl::fuzzer::proto::PROXY_SOCKET_OPTION_DEFAULT) {
        // A scenario describes one owned route. Prefer the closed socket-option
        // profile when a mutation selects both independent fields.
        scenario->clear_http_transport_mode();
        CanonicalizeProxySocketOptionAuthority(scenario);
        // Alt-Svc or HSTS can replace this mode's fixed plaintext authority
        // before its option path runs. Keep the focused route authoritative.
        scenario->clear_altsvc_file();
        scenario->clear_hsts_file();
      } else if (scenario->http_transport_mode() != curl::fuzzer::proto::HTTP_TRANSPORT_DIRECT) {
        CanonicalizeHttpTransportAuthority(scenario);
        // The selected transport owns the route. Alt-Svc and HSTS can rewrite
        // its fixed plaintext authority into a different proxy or TLS path,
        // defeating the mode the scenario is meant to exercise.
        scenario->clear_altsvc_file();
        scenario->clear_hsts_file();
      } else if (!scenario->altsvc_file().empty()) {
        CanonicalizeAltSvcAuthority(scenario);
      }
      if (scenario->http_transport_mode() == curl::fuzzer::proto::HTTP_TRANSPORT_CONNECT_PROXY &&
          scenario->haproxy_protocol()) {
        // This closed combination makes the pending HAProxy setup state
        // reachable after CONNECT. A large checked-in request fills the
        // tightened socket, while bounded peer drains and repeated public
        // multi polling expose the filter's write-only pollset.
        auto* backpressure = scenario->mutable_connection()->mutable_backpressure();
        backpressure->set_recv_buf_bytes(kHaproxyConnectBufferBytes);
        backpressure->set_drain_limit(kHaproxyConnectDrainBytes);
        for (auto& connection : *scenario->mutable_subsequent_connections()) {
          connection.clear_backpressure();
        }
      } else {
        scenario->clear_haproxy_protocol();
        ClearAllBackpressure(scenario);
      }
      if (scenario->http_transport_mode() != curl::fuzzer::proto::HTTP_TRANSPORT_CONNECT_PROXY) {
        scenario->clear_probe_multi_pollset();
      }
      return;
 
    case TargetProfile::kApi:
      ClearAllBackpressure(scenario);
      if (scenario->host_path().size() > scenario_limits::kMaxApiStringBytes) {
        scenario->mutable_host_path()->resize(scenario_limits::kMaxApiStringBytes);
      }
      if (scenario->has_api_plan()) {
        BoundApiPlanShape(scenario->mutable_api_plan());
        CanonicalizeApiMimeRepeat(scenario);
      }
      return;
 
    case TargetProfile::kMulti: {
      ClearAllBackpressure(scenario);
      CanonicalizeMultiAuthority(scenario);
      // The multi runner is HTTP-only (it drives every handle through one
      // plaintext HTTP peer), so pin the scheme instead of letting a mutation
      // select a protocol the runner cannot service.
      scenario->set_scheme(curl::fuzzer::proto::SCHEME_HTTP);
      auto* plan = scenario->mutable_multi_plan();
      BoundMultiPlanShape(plan);
      TrimRepeated(scenario->mutable_subsequent_connections(), plan->transfer_count() - 1U);
      return;
    }
 
    case TargetProfile::kFastHttps:
      ClearAllBackpressure(scenario);
      CanonicalizeTlsAuthority(scenario);
      CanonicalizeTlsCertificateChain(scenario);
      CanonicalizeTlsClientCredentialProfile(scenario);
      CanonicalizeTlsHandshakeProfile(scenario);
      return;
 
    case TargetProfile::kHttpsH2:
      // Handled by the raw HTTP/2 protocol-specific early path above.
      return;
 
    case TargetProfile::kFastHttp2:
      // Handled by the plaintext HTTP/2 protocol-specific early path above.
      return;
 
    case TargetProfile::kFastHttp3:
      // Handled before generic connection bounding because Http3Plan replaces
      // the stream-socket response script.
      return;
 
    case TargetProfile::kH2Proxy:
      // Handled by the protocol-specific early path above.
      return;
 
    case TargetProfile::kProxyTransport:
      // Handled by the protocol-specific early path above.
      return;
 
    case TargetProfile::kResolver:
      // Handled by the resolver-specific early path above.
      return;
 
    case TargetProfile::kFastWebSocket:
      ClearAllBackpressure(scenario);
      RemoveIgnoredWebSocketShape(scenario);
      return;
 
    case TargetProfile::kFastSecureWebSocket:
      ClearAllBackpressure(scenario);
      RemoveIgnoredWebSocketShape(scenario);
      CanonicalizeTlsAuthority(scenario);
      CanonicalizeTlsCertificateChain(scenario);
      return;
 
    case TargetProfile::kFastTelnet:
      // Handled before the general bounds so its protocol-specific limits are
      // selected from the start.
      return;
 
    case TargetProfile::kFastFtp:
    case TargetProfile::kFastTftp:
    case TargetProfile::kFastSmtp:
    case TargetProfile::kFastImap:
    case TargetProfile::kFastPop3:
    case TargetProfile::kFastMqtt:
    case TargetProfile::kFastDict:
    case TargetProfile::kFastGopher:
    case TargetProfile::kFastFile:
    case TargetProfile::kFastLdap:
    case TargetProfile::kFastRtsp:
    case TargetProfile::kFastIpfs:
      // Their peers consume narrower raw-script shapes, pruned before general
      // bounds so ignored fields never tax these fast paths.
      return;
 
    case TargetProfile::kTiming: {
      if (scenario->scheme() == curl::fuzzer::proto::SCHEME_WS) {
        RemoveIgnoredWebSocketShape(scenario);
      }
      auto* backpressure = scenario->mutable_connection()->mutable_backpressure();
      if (backpressure->recv_buf_bytes() == 0) {
        // A drain limit alone cannot fill the default AF_UNIX buffer with the
        // harness's bounded upload. Always tighten the socket so this lane
        // represents real pressure, not merely selection of the timed loop.
        backpressure->set_recv_buf_bytes(kDefaultBackpressureBufferBytes);
      } else {
        backpressure->set_recv_buf_bytes(CanonicalizeNonZero(backpressure->recv_buf_bytes(),
                                                             kMinBackpressureBufferBytes, kMaxBackpressureBufferBytes));
      }
      backpressure->set_drain_limit(CanonicalizeNonZero(backpressure->drain_limit(), 1, kMaxDrainBytesPerIteration));
      for (auto& connection : *scenario->mutable_subsequent_connections()) {
        CanonicalizeOptionalBackpressure(&connection);
      }
      return;
    }
  }
}
 
}  // namespace

void NormalizeScenarioForExecution(curl::fuzzer::proto::Scenario* scenario) {
  if (scenario == nullptr) {
    return;
  }
  CanonicalizeAllocationFailures(scenario);
  CanonicalizeAllocationFailureDrive(scenario);
  CanonicalizeLocalPortRange(scenario);
}

void NormalizeScenarioForTarget(curl::fuzzer::proto::Scenario* scenario, TargetProfile profile,
                                ConditionalEligibilityPruner prune_conditional_eligibility) {
  // Compatibility has no LPM postprocessor. Preserve the complete wire input,
  // including mismatched option oneofs and newly added, otherwise inert fields.
  if (scenario == nullptr || profile == TargetProfile::kCompatibility) {
    return;
  }
 
  ApplyLanePolicy(scenario, profile, prune_conditional_eligibility);
  NormalizeScenarioForExecution(scenario);
  CanonicalizeOptionValueCases(scenario);
  // Canonicalization can materialize string values or prepend pin syntax.
  // Charge the final representation so normalization remains a fixed point.
  for (auto& option : *scenario->mutable_options()) {
    if (option.value_case() == curl::fuzzer::proto::SetOption::kStringValue) {
      TrimMetadata(option.mutable_string_value());
    }
  }
}
 
}  // namespace proto_fuzzer