The URL policy needs to compare parsed origins rather than matching hostnames as text fragments. Implement the decision so scheme, host and effective port follow the allowlist contract.
Build the implementation in TypeScript under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has allowed origins and urls. Parse absolute http/https URLs, lowercase scheme and hostname, and normalize omitted ports to 80/443. Reject credentials, whitespace, invalid ports or missing host. Allowed entries must have no path except optional /, query or fragment; invalid policy must be rejected. Return one boolean per URL; malformed candidate URLs are false. Compare exact (scheme,hostname,port), never hostname suffixes. Paths, queries and fragments on candidates do not affect origin. This is a parsing exercise, not DNS or network validation.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.