dsh-permission-rules 0.2.0

package/lib/types/config.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Config schema and resolution for `dsh-permission-rules`. Every tunable is
+ * a validated {@link Config} field changeable from cordis.yml; the
+ * resolution step validates the numeric bounds and compiles nothing — rule
+ * files are external documents resolved per session cwd at load time.
+ * @module dsh-permission-rules/config
+ */
+import z from '@deepseek-ai/schemastery';
+import type { PatternMode } from './rules.ts';
+import type { UiLanguage } from './prose.ts';
+/** What happens when a discovered rule file exists but cannot be parsed or compiled. */
+export type BadFilePolicy = 'fail' | 'ignore-with-warning';
+/** Which decisions are audit-logged: every call, or only rule hits. */
+export type AuditGranularity = 'all' | 'hits';
+/** Raw plugin config — every field optional; {@link Config} supplies the defaults. */
+export interface Config {
+    /**
+     * Rule file location. A relative value is resolved against the calling
+     * session's workspace cwd (so `<cwd>/.dsh/rules.yaml` by default); an
+     * absolute value is used as-is for every session.
+     */
+    rulesFile?: string;
+    /**
+     * Fallback rule file used when per-cwd discovery finds no rule file.
+     * Absolute, or relative to `process.cwd()`. Unset = an empty rule set.
+     */
+    fallbackPath?: string;
+    /**
+     * How an unreadable/invalid rule file is handled at load: `'fail'` throws
+     * (the pending tool call errors loudly; HMR reloads keep the previous
+     * rules and report the error), `'ignore-with-warning'` logs a warning and
+     * continues with an empty (initial) or previous (reload) rule set.
+     */
+    badFilePolicy?: BadFilePolicy;
+    /** Hard cap on the number of rules across the effective source chain; a larger chain fails the load. */
+    maxRules?: number;
+    /** Hard cap on cached per-workspace rule loads; the least-recently-used workspace is evicted beyond it. */
+    maxCachedWorkspaces?: number;
+    /** How `params`, `paths`, and `when.env` patterns are interpreted: `'glob'` (default) or `'regex'`. */
+    patternMode?: PatternMode;
+    /** Whether the loaded rule file is watched and reloaded on change. */
+    watch?: boolean;
+    /** Debounce window for watch-driven reloads, in milliseconds. */
+    watchStabilityThresholdMs?: number;
+    /** Language of the `/rules` command output: `'en'` (default), `'zh'`, `'es'`, `'pt'`, or `'hi'`. */
+    language?: UiLanguage;
+    /** Whether `paths` patterns (and workspace-root comparison) ignore ASCII case; defaults to `true` on Windows. */
+    caseInsensitivePaths?: boolean;
+    /** Audit granularity: `'all'` logs every hit AND passthrough; `'hits'` skips passthrough events. */
+    audit?: AuditGranularity;
+    /** Walk parent directories of the session cwd and merge every found rule file (nearest first). */
+    searchUp?: boolean;
+    /** Hard cap on unbounded `*`/`**` quantifiers per glob pattern (backtracking-degree bound). */
+    maxGlobStars?: number;
+}
+/** Config after {@link resolveConfig}: every optional field has its explicit default. */
+export interface ResolvedConfig {
+    readonly rulesFile: string;
+    readonly fallbackPath: string | undefined;
+    readonly badFilePolicy: BadFilePolicy;
+    readonly maxRules: number;
+    readonly maxCachedWorkspaces: number;
+    readonly patternMode: PatternMode;
+    readonly watch: boolean;
+    readonly watchStabilityThresholdMs: number;
+    readonly language: UiLanguage;
+    readonly caseInsensitivePaths: boolean;
+    readonly audit: AuditGranularity;
+    readonly searchUp: boolean;
+    readonly maxGlobStars: number;
+}
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+export declare const Config: z<Config>;
+/**
+ * Validate raw values and fill explicit defaults. A `maxRules`,
+ * `maxCachedWorkspaces`, or `maxGlobStars` that is not a positive safe
+ * integer, a non-positive stability window, or `searchUp` combined with an
+ * absolute `rulesFile` throws here — misconfiguration fails loud at mount.
+ * @param config - raw (possibly partial) plugin config.
+ * @returns the fully resolved config.
+ */
+export declare function resolveConfig(config?: Config): ResolvedConfig;
+//# sourceMappingURL=config.d.ts.map

package/lib/types/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,qBAAqB,CAAA;AAE1D,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAA;AAE7C,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2GAA2G;IAC3G,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uGAAuG;IACvG,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,iEAAiE;IACjE,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAA;IACrB,iHAAiH;IACjH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,oGAAoG;IACpG,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;IAC1C,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,kFAAkF;AAClF,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAc3B,CAAA;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,cAAc,CAqCjE"}

package/lib/types/config.js

@@ -0,0 +1,72 @@
+/**
+ * Config schema and resolution for `dsh-permission-rules`. Every tunable is
+ * a validated {@link Config} field changeable from cordis.yml; the
+ * resolution step validates the numeric bounds and compiles nothing — rule
+ * files are external documents resolved per session cwd at load time.
+ * @module dsh-permission-rules/config
+ */
+import { isAbsolute } from 'node:path';
+import z from '@deepseek-ai/schemastery';
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+export const Config = z.object({
+    rulesFile: z.string().default('.dsh/rules.yaml'),
+    fallbackPath: z.string(),
+    badFilePolicy: z.union(['fail', 'ignore-with-warning']).default('fail'),
+    maxRules: z.number().default(256),
+    maxCachedWorkspaces: z.number().default(512),
+    patternMode: z.union(['glob', 'regex']).default('glob'),
+    watch: z.boolean().default(true),
+    watchStabilityThresholdMs: z.number().default(200),
+    language: z.union(['en', 'zh', 'es', 'pt', 'hi']).default('en'),
+    caseInsensitivePaths: z.boolean().default(process.platform === 'win32'),
+    audit: z.union(['all', 'hits']).default('all'),
+    searchUp: z.boolean().default(false),
+    maxGlobStars: z.number().default(2),
+});
+/**
+ * Validate raw values and fill explicit defaults. A `maxRules`,
+ * `maxCachedWorkspaces`, or `maxGlobStars` that is not a positive safe
+ * integer, a non-positive stability window, or `searchUp` combined with an
+ * absolute `rulesFile` throws here — misconfiguration fails loud at mount.
+ * @param config - raw (possibly partial) plugin config.
+ * @returns the fully resolved config.
+ */
+export function resolveConfig(config = {}) {
+    const rulesFile = config.rulesFile ?? '.dsh/rules.yaml';
+    const searchUp = config.searchUp ?? false;
+    if (searchUp && isAbsolute(rulesFile)) {
+        throw new TypeError(`searchUp cannot be combined with an absolute rulesFile (${JSON.stringify(rulesFile)}): parent-directory walking needs a relative file name`);
+    }
+    const maxRules = config.maxRules ?? 256;
+    if (!Number.isSafeInteger(maxRules) || maxRules <= 0) {
+        throw new TypeError(`maxRules must be a positive safe integer, got ${String(config.maxRules)}`);
+    }
+    const watchStabilityThresholdMs = config.watchStabilityThresholdMs ?? 200;
+    if (!Number.isSafeInteger(watchStabilityThresholdMs) || watchStabilityThresholdMs < 0) {
+        throw new TypeError(`watchStabilityThresholdMs must be a non-negative safe integer, got ${String(config.watchStabilityThresholdMs)}`);
+    }
+    const maxCachedWorkspaces = config.maxCachedWorkspaces ?? 512;
+    if (!Number.isSafeInteger(maxCachedWorkspaces) || maxCachedWorkspaces <= 0) {
+        throw new TypeError(`maxCachedWorkspaces must be a positive safe integer, got ${String(config.maxCachedWorkspaces)}`);
+    }
+    const maxGlobStars = config.maxGlobStars ?? 2;
+    if (!Number.isSafeInteger(maxGlobStars) || maxGlobStars <= 0) {
+        throw new TypeError(`maxGlobStars must be a positive safe integer, got ${String(config.maxGlobStars)}`);
+    }
+    return {
+        rulesFile,
+        fallbackPath: config.fallbackPath,
+        badFilePolicy: config.badFilePolicy ?? 'fail',
+        maxRules,
+        maxCachedWorkspaces,
+        patternMode: config.patternMode ?? 'glob',
+        watch: config.watch ?? true,
+        watchStabilityThresholdMs,
+        language: config.language ?? 'en',
+        caseInsensitivePaths: config.caseInsensitivePaths ?? process.platform === 'win32',
+        audit: config.audit ?? 'all',
+        searchUp,
+        maxGlobStars,
+    };
+}
+//# sourceMappingURL=config.js.map

package/lib/types/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAqExC,kFAAkF;AAClF,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAU,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IACvE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,CAAU,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CACpC,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,iBAAiB,CAAA;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAA;IACzC,IAAI,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,2DAA2D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wDAAwD,CAAC,CAAA;IACnK,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,iDAAiD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,IAAI,GAAG,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,SAAS,CAAC,sEAAsE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAA;IACvI,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,IAAI,GAAG,CAAA;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,4DAA4D,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAA;IACvH,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,qDAAqD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,OAAO;QACL,SAAS;QACT,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM;QAC7C,QAAQ;QACR,mBAAmB;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,yBAAyB;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QACjC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjF,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;QAC5B,QAAQ;QACR,YAAY;KACb,CAAA;AACH,CAAC"}

package/lib/types/events.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Durable session vocabulary for `dsh-permission-rules`: the
+ * `permissionRules/decision` audit event, appended for every hit AND every
+ * passthrough. Log-only — it never enters the model transcript; the only
+ * model-visible plugin content is the deny/ask reason the tools registry
+ * materializes into the denied tool result, which carries the same
+ * `callId`, keeping model-visible ⟺ logged reconstructable.
+ *
+ * `outcome` records the FINAL pre-execute decision: on a deny/ask hit it
+ * equals `action` (the plugin short-circuits); on an allow hit or a
+ * passthrough it carries the downstream listeners' decision, so the audit
+ * never claims a call was allowed when a later listener denied it.
+ *
+ * The event is appended with the envelope's `ignorable: true` marker (see
+ * {@link AuditAppend}), so a harness build whose generated event vocabulary
+ * does not include this out-of-repo type still loads the log — it skips the
+ * audit record instead of refusing the whole session.
+ * @module dsh-permission-rules/events
+ */
+import type { CallId } from '@deepseek-ai/dsh-llm';
+import type { PreToolDecision } from '@deepseek-ai/dsh-tools';
+declare module '@deepseek-ai/dsh-session/types' {
+    interface SessionEventMap {
+        /**
+         * One permission-rules decision for a pending tool call — log-only
+         * audit (like `approval/asked`; NOT a surface event). `action` is
+         * `'allow' | 'deny' | 'ask' | 'passthrough'`; `ruleIndex` (0-based) and
+         * `reason` appear only on hits. `source` is the absolute rule file of
+         * the matched rule, or the nearest effective file on a passthrough, or
+         * `''` when no rule file was active. `outcome` is the final pre-execute
+         * decision the waterfall settled on.
+         */
+        'permissionRules/decision': {
+            toolName: string;
+            callId?: CallId;
+            source: string;
+            action: 'allow' | 'deny' | 'ask' | 'passthrough';
+            outcome?: 'allow' | 'deny' | 'ask';
+            ruleIndex?: number;
+            reason?: string;
+        };
+    }
+}
+/** Every action a decision event can carry. */
+export type DecisionAction = 'allow' | 'deny' | 'ask' | 'passthrough';
+/** The final pre-execute decision kinds a host can settle on. */
+export type DecisionOutcome = PreToolDecision['kind'];
+/** The payload of one `permissionRules/decision` audit record. */
+export interface AuditDecision {
+    toolName: string;
+    callId?: CallId;
+    source: string;
+    action: DecisionAction;
+    outcome?: DecisionOutcome;
+    ruleIndex?: number;
+    reason?: string;
+}
+/**
+ * `Session.append` narrowed to this plugin's audit event. The options bag
+ * exists only on host builds that expose the `ignorable` envelope-marker
+ * surface (post-rc.6 `@deepseek-ai/dsh-session`); an rc.6 host accepts and
+ * ignores the third argument, appending the identical event without the
+ * marker — no behavior change, no failure either way.
+ */
+export type AuditAppend = (type: 'permissionRules/decision', data: AuditDecision, options?: {
+    ignorable?: true;
+}) => unknown;
+//# sourceMappingURL=events.d.ts.map

package/lib/types/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,QAAQ,gCAAgC,CAAC;IAC9C,UAAU,eAAe;QACvB;;;;;;;;WAQG;QACH,0BAA0B,EAAE;YAC1B,QAAQ,EAAE,MAAM,CAAA;YAChB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,MAAM,EAAE,MAAM,CAAA;YACd,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,CAAA;YAChD,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;YAClC,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;KACF;CACF;AAED,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,CAAA;AAErE,iEAAiE;AACjE,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AAErD,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,cAAc,CAAA;IACtB,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,0BAA0B,EAChC,IAAI,EAAE,aAAa,EACnB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,IAAI,CAAA;CAAE,KAC3B,OAAO,CAAA"}

package/lib/types/events.js

@@ -0,0 +1,21 @@
+/**
+ * Durable session vocabulary for `dsh-permission-rules`: the
+ * `permissionRules/decision` audit event, appended for every hit AND every
+ * passthrough. Log-only — it never enters the model transcript; the only
+ * model-visible plugin content is the deny/ask reason the tools registry
+ * materializes into the denied tool result, which carries the same
+ * `callId`, keeping model-visible ⟺ logged reconstructable.
+ *
+ * `outcome` records the FINAL pre-execute decision: on a deny/ask hit it
+ * equals `action` (the plugin short-circuits); on an allow hit or a
+ * passthrough it carries the downstream listeners' decision, so the audit
+ * never claims a call was allowed when a later listener denied it.
+ *
+ * The event is appended with the envelope's `ignorable: true` marker (see
+ * {@link AuditAppend}), so a harness build whose generated event vocabulary
+ * does not include this out-of-repo type still loads the log — it skips the
+ * audit record instead of refusing the whole session.
+ * @module dsh-permission-rules/events
+ */
+export {};
+//# sourceMappingURL=events.js.map

package/lib/types/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/lib/types/glob.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Strict glob→RegExp compilation and regex-safety validation for rule
+ * patterns. A conservative, validated glob subset: `*` (within one path
+ * segment), `**` (any depth, including zero), `?` (one character),
+ * `[abc]` / `[!abc]` character classes, and `\x` escapes. Unbalanced
+ * brackets, empty classes, and trailing escapes throw at compile time — a
+ * bad glob must fail loudly at load, never silently match nothing at
+ * runtime.
+ *
+ * Catastrophic-backtracking defense, tuned per pattern flavor:
+ * - Glob output is fully machine-generated, so the backtracking degree is
+ *   exactly the number of star expansions: each `*`/`**` emits exactly one
+ *   unbounded quantifier and no group is ever emitted. {@link compileGlob}
+ *   therefore caps that count via `maxStars`.
+ * - User regexes (patternMode `regex`) are scanned structurally: a
+ *   quantifier applied to a group containing an unbounded quantifier, and a
+ *   quantified group whose literal alternation branches overlap, are
+ *   rejected at load. Chains of independent top-level quantifiers
+ *   (`\d+\.\d+\.\d+`) stay allowed — a documented, deliberate limitation:
+ *   regex mode is the escape hatch, glob mode is the guarded default.
+ * @module dsh-permission-rules/glob
+ */
+/** Raised by {@link compileGlob} on a syntactically invalid or over-quantified pattern. */
+export declare class GlobError extends TypeError {
+    constructor(message: string);
+}
+/** Compile options for {@link compileGlob}. */
+export interface GlobCompileOptions {
+    /** `true` keeps `*`/`?` inside one path segment (for `paths` patterns). */
+    readonly segments: boolean;
+    /** Compile with the `i` flag so matching ignores ASCII case. */
+    readonly caseInsensitive?: boolean;
+    /** Hard cap on unbounded star expansions; exceeding it throws. Unset = unlimited. */
+    readonly maxStars?: number;
+}
+/**
+ * Compile one glob pattern to an anchored regular expression.
+ * @param pattern - the glob source.
+ * @param options - segment semantics, case handling, and the star cap.
+ * @returns a RegExp matching the whole candidate string.
+ * @throws {@link GlobError} on unbalanced `[`, empty classes, a trailing
+ *   escape, or more star expansions than `options.maxStars` allows.
+ */
+export declare function compileGlob(pattern: string, options: GlobCompileOptions): RegExp;
+/**
+ * Compile one pattern as an unanchored regex, rejecting syntax errors and
+ * catastrophic-backtracking structures loudly.
+ * @param pattern - the regex source.
+ * @returns the compiled RegExp.
+ * @throws TypeError when the pattern is invalid, nests an unbounded
+ *   quantifier, or quantifies a group with overlapping literal alternation
+ *   branches.
+ */
+export declare function compilePatternRegex(pattern: string): RegExp;
+//# sourceMappingURL=glob.d.ts.map

package/lib/types/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2FAA2F;AAC3F,qBAAa,SAAU,SAAQ,SAAS;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAgEhF;AAOD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAS3D"}

package/lib/types/glob.js

@@ -0,0 +1,307 @@
+/**
+ * Strict glob→RegExp compilation and regex-safety validation for rule
+ * patterns. A conservative, validated glob subset: `*` (within one path
+ * segment), `**` (any depth, including zero), `?` (one character),
+ * `[abc]` / `[!abc]` character classes, and `\x` escapes. Unbalanced
+ * brackets, empty classes, and trailing escapes throw at compile time — a
+ * bad glob must fail loudly at load, never silently match nothing at
+ * runtime.
+ *
+ * Catastrophic-backtracking defense, tuned per pattern flavor:
+ * - Glob output is fully machine-generated, so the backtracking degree is
+ *   exactly the number of star expansions: each `*`/`**` emits exactly one
+ *   unbounded quantifier and no group is ever emitted. {@link compileGlob}
+ *   therefore caps that count via `maxStars`.
+ * - User regexes (patternMode `regex`) are scanned structurally: a
+ *   quantifier applied to a group containing an unbounded quantifier, and a
+ *   quantified group whose literal alternation branches overlap, are
+ *   rejected at load. Chains of independent top-level quantifiers
+ *   (`\d+\.\d+\.\d+`) stay allowed — a documented, deliberate limitation:
+ *   regex mode is the escape hatch, glob mode is the guarded default.
+ * @module dsh-permission-rules/glob
+ */
+/** Raised by {@link compileGlob} on a syntactically invalid or over-quantified pattern. */
+export class GlobError extends TypeError {
+    constructor(message) {
+        super(message);
+        this.name = 'GlobError';
+    }
+}
+/**
+ * Compile one glob pattern to an anchored regular expression.
+ * @param pattern - the glob source.
+ * @param options - segment semantics, case handling, and the star cap.
+ * @returns a RegExp matching the whole candidate string.
+ * @throws {@link GlobError} on unbalanced `[`, empty classes, a trailing
+ *   escape, or more star expansions than `options.maxStars` allows.
+ */
+export function compileGlob(pattern, options) {
+    let out = '';
+    let stars = 0;
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === '\\') {
+            const next = pattern[i + 1];
+            if (next === undefined)
+                throw new GlobError(`glob ${JSON.stringify(pattern)} ends with a dangling escape`);
+            out += escapeRegExpChar(next);
+            i += 2;
+            continue;
+        }
+        if (ch === '*') {
+            if (pattern[i + 1] === '*') {
+                // `**` crosses path segments. Collapse runs of `**` and any
+                // following separator into one zero-or-more-any-depth group, so
+                // `a/**/b`, `a/**b`, and `a/***/b` all behave the same.
+                out += '.*';
+                stars += 1;
+                i += 2;
+                while (pattern[i] === '*')
+                    i += 1;
+                if (pattern[i] === '/')
+                    i += 1;
+                continue;
+            }
+            // A single star never crosses a path separator.
+            out += options.segments ? '[^/]*' : '.*';
+            stars += 1;
+            i += 1;
+            continue;
+        }
+        if (ch === '?') {
+            out += options.segments ? '[^/]' : '.';
+            i += 1;
+            continue;
+        }
+        if (ch === '[') {
+            const end = pattern.indexOf(']', i + 1);
+            if (end < 0)
+                throw new GlobError(`glob ${JSON.stringify(pattern)} has an unbalanced "["`);
+            const body = pattern.slice(i + 1, end);
+            if (body.length === 0)
+                throw new GlobError(`glob ${JSON.stringify(pattern)} has an empty character class`);
+            let content = body;
+            let negate = false;
+            if (content.startsWith('!')) {
+                negate = true;
+                content = content.slice(1);
+            }
+            if (content.length === 0)
+                throw new GlobError(`glob ${JSON.stringify(pattern)} has an empty character class`);
+            out += `[${negate ? '^' : ''}${content.replaceAll('\\', '\\\\')}]`;
+            i = end + 1;
+            continue;
+        }
+        if (ch === ']')
+            throw new GlobError(`glob ${JSON.stringify(pattern)} has an unbalanced "]"`);
+        out += escapeRegExpChar(ch);
+        i += 1;
+    }
+    if (options.maxStars !== undefined && stars > options.maxStars) {
+        throw new GlobError(`glob ${JSON.stringify(pattern)} expands to ${stars} unbounded star quantifiers (max ${options.maxStars}); split it into several patterns`);
+    }
+    try {
+        return new RegExp(`^${out}$`, options.caseInsensitive === true ? 'iu' : 'u');
+    }
+    catch (error) {
+        throw new GlobError(`glob ${JSON.stringify(pattern)} compiles to an invalid regular expression: ${String(error)}`);
+    }
+}
+/** Escape one literal character for a RegExp source. */
+function escapeRegExpChar(ch) {
+    return /[.*+?^${}()|[\]\\/]/.test(ch) ? `\\${ch}` : ch;
+}
+/**
+ * Compile one pattern as an unanchored regex, rejecting syntax errors and
+ * catastrophic-backtracking structures loudly.
+ * @param pattern - the regex source.
+ * @returns the compiled RegExp.
+ * @throws TypeError when the pattern is invalid, nests an unbounded
+ *   quantifier, or quantifies a group with overlapping literal alternation
+ *   branches.
+ */
+export function compilePatternRegex(pattern) {
+    let compiled;
+    try {
+        compiled = new RegExp(pattern, 'u');
+    }
+    catch (error) {
+        throw new TypeError(`pattern ${JSON.stringify(pattern)} is not a valid regular expression: ${String(error)}`, { cause: error });
+    }
+    assertSafeRegexStructure(pattern);
+    return compiled;
+}
+/**
+ * Structural ReDoS scan. Rejects (a) an unbounded quantifier (`*`, `+`,
+ * `{m,}`) applied to a group whose body contains an unbounded quantifier,
+ * and (b) a quantified group whose fully-literal alternation branches
+ * overlap as prefixes. Everything else — including chains of independent
+ * top-level quantifiers — compiles untouched.
+ * @param pattern - the already-syntax-valid regex source.
+ * @throws TypeError on a rejected structure.
+ */
+function assertSafeRegexStructure(pattern) {
+    const stack = [];
+    let i = 0;
+    const markUnbounded = () => {
+        const top = stack[stack.length - 1];
+        if (top !== undefined)
+            top.unbounded = true;
+    };
+    const reject = (message) => {
+        throw new TypeError(`pattern ${JSON.stringify(pattern)} is rejected: ${message} risks catastrophic backtracking; restructure the pattern or use glob mode`);
+    };
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === '\\') {
+            i += 2;
+            continue;
+        }
+        if (ch === '[') {
+            i += 1;
+            while (i < pattern.length && pattern[i] !== ']') {
+                if (pattern[i] === '\\')
+                    i += 1;
+                i += 1;
+            }
+            i += 1;
+            continue;
+        }
+        if (ch === '(') {
+            stack.push({ start: i, unbounded: false });
+            i += 1;
+            continue;
+        }
+        if (ch === ')') {
+            const group = stack.pop();
+            // An unbalanced `)` is invalid syntax; the compile above already rejected it.
+            if (group === undefined) {
+                i += 1;
+                continue;
+            }
+            const quantifier = quantifierAt(pattern, i + 1);
+            if (quantifier !== undefined) {
+                if (quantifier.unbounded) {
+                    if (group.unbounded) {
+                        reject(`quantifier ${quantifier.text} applies to a group containing an unbounded quantifier`);
+                    }
+                    if (hasAmbiguousAlternation(pattern, group.start + 1, i)) {
+                        reject(`quantified group ${JSON.stringify(pattern.slice(group.start, quantifier.end + 1))} has overlapping alternation branches`);
+                    }
+                    markUnbounded();
+                }
+                i = quantifier.end + 1;
+                continue;
+            }
+            if (group.unbounded)
+                markUnbounded();
+            i += 1;
+            continue;
+        }
+        if (ch === '*' || ch === '+') {
+            markUnbounded();
+            i += 1;
+            continue;
+        }
+        if (ch === '{') {
+            const parsed = parseBraceQuantifier(pattern, i);
+            if (parsed !== undefined) {
+                if (parsed.unbounded)
+                    markUnbounded();
+                i = parsed.end + 1;
+                continue;
+            }
+            // Not a quantifier (a `\p{L}`-style body is reached after its escape
+            // was skipped above): an ordinary literal.
+            i += 1;
+            continue;
+        }
+        // `?` is always bounded; literals, `.`, `|`, `^`, `$` pass through.
+        i += 1;
+    }
+}
+/** One parsed quantifier token, when the character at `index` starts one. */
+function quantifierAt(pattern, index) {
+    const ch = pattern[index];
+    if (ch === '*' || ch === '+')
+        return { text: ch, end: index, unbounded: true };
+    if (ch === '?')
+        return { text: ch, end: index, unbounded: false };
+    if (ch === '{')
+        return parseBraceQuantifier(pattern, index);
+    return undefined;
+}
+/** Parse `{m}`, `{m,}`, or `{m,n}` at `start`; other braces are not quantifiers. */
+function parseBraceQuantifier(pattern, start) {
+    const close = pattern.indexOf('}', start + 1);
+    if (close < 0)
+        return undefined;
+    const body = pattern.slice(start + 1, close);
+    if (!/^\d+(,\d*)?$/.test(body))
+        return undefined;
+    const unbounded = body.includes(',') && body.endsWith(',');
+    return { text: pattern.slice(start, close + 1), end: close, unbounded };
+}
+/**
+ * Whether a group body (between the parens) contains a top-level
+ * alternation with two fully-literal branches where one is a prefix of the
+ * other — the `(a|aa)+` ambiguity that makes repetition exponential.
+ * @param pattern - the full pattern.
+ * @param start - index just after the group's `(`.
+ * @param end - index of the group's `)`.
+ * @returns true when such an overlap exists.
+ */
+function hasAmbiguousAlternation(pattern, start, end) {
+    const branches = [];
+    let depth = 0;
+    let branchStart = start;
+    let hasPipe = false;
+    for (let i = start; i < end; i += 1) {
+        const ch = pattern[i];
+        if (ch === '\\') {
+            i += 1;
+            continue;
+        }
+        if (ch === '[') {
+            while (i < end && pattern[i] !== ']') {
+                if (pattern[i] === '\\')
+                    i += 1;
+                i += 1;
+            }
+            continue;
+        }
+        if (ch === '(') {
+            depth += 1;
+            continue;
+        }
+        if (ch === ')') {
+            depth -= 1;
+            continue;
+        }
+        if (ch === '|' && depth === 0) {
+            hasPipe = true;
+            branches.push(pattern.slice(branchStart, i));
+            branchStart = i + 1;
+        }
+    }
+    if (!hasPipe)
+        return false;
+    branches.push(pattern.slice(branchStart, end));
+    for (let a = 0; a < branches.length; a += 1) {
+        for (let b = a + 1; b < branches.length; b += 1) {
+            if (literalPrefixOf(branches[a], branches[b]))
+                return true;
+        }
+    }
+    return false;
+}
+/** True when two fully-literal branches share their complete shorter text as a prefix. */
+function literalPrefixOf(x, y) {
+    const literal = /^[^*+?()|[\]{}^$.\\]+$/;
+    if (!literal.test(x) || !literal.test(y))
+        return false;
+    const min = Math.min(x.length, y.length);
+    return x.slice(0, min) === y.slice(0, min);
+}
+//# sourceMappingURL=glob.js.map

package/lib/types/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2FAA2F;AAC3F,MAAM,OAAO,SAAU,SAAQ,SAAS;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAA2B;IACtE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAW,CAAA;QAC/B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAA;YAC1G,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAA;YAC7B,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,4DAA4D;gBAC5D,gEAAgE;gBAChE,wDAAwD;gBACxD,GAAG,IAAI,IAAI,CAAA;gBACX,KAAK,IAAI,CAAC,CAAA;gBACV,CAAC,IAAI,CAAC,CAAA;gBACN,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAA;gBACjC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAA;gBAC9B,SAAQ;YACV,CAAC;YACD,gDAAgD;YAChD,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;YACxC,KAAK,IAAI,CAAC,CAAA;YACV,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;YACtC,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACvC,IAAI,GAAG,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;YACzF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;YACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;YAC1G,IAAI,OAAO,GAAG,IAAI,CAAA;YAClB,IAAI,MAAM,GAAG,KAAK,CAAA;YAClB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,GAAG,IAAI,CAAA;gBACb,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;YAC7G,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA;YAClE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAA;YACX,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAC5F,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAC3B,CAAC,IAAI,CAAC,CAAA;IACR,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,KAAK,oCAAoC,OAAO,CAAC,QAAQ,mCAAmC,CAAC,CAAA;IACjK,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+CAA+C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACpH,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,uCAAuC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACjI,CAAC;IACD,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAA4C,EAAE,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAA;IAC7C,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE;QACxC,MAAM,IAAI,SAAS,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,OAAO,4EAA4E,CAAC,CAAA;IAC7J,CAAC,CAAA;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAW,CAAA;QAC/B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAA;YACN,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAChD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC,IAAI,CAAC,CAAA;YACR,CAAC;YACD,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;YAC1C,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;YACzB,8EAA8E;YAC9E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAA;gBACN,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;oBACzB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;wBACpB,MAAM,CAAC,cAAc,UAAU,CAAC,IAAI,wDAAwD,CAAC,CAAA;oBAC/F,CAAC;oBACD,IAAI,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;wBACzD,MAAM,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAA;oBACnI,CAAC;oBACD,aAAa,EAAE,CAAA;gBACjB,CAAC;gBACD,CAAC,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAA;gBACtB,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,SAAS;gBAAE,aAAa,EAAE,CAAA;YACpC,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,aAAa,EAAE,CAAA;YACf,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,SAAS;oBAAE,aAAa,EAAE,CAAA;gBACrC,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAA;gBAClB,SAAQ;YACV,CAAC;YACD,qEAAqE;YACrE,2CAA2C;YAC3C,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,oEAAoE;QACpE,CAAC,IAAI,CAAC,CAAA;IACR,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC9E,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACjE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC3D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,oFAAoF;AACpF,SAAS,oBAAoB,CAAC,OAAe,EAAE,KAAa;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;IAC7C,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,OAAe,EAAE,KAAa,EAAE,GAAW;IAC1E,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAW,CAAA;QAC/B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC,IAAI,CAAC,CAAA;YACR,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,IAAI,CAAC,CAAA;YACV,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,IAAI,CAAC,CAAA;YACV,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,IAAI,CAAA;YACd,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5C,WAAW,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAA;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAW,EAAE,QAAQ,CAAC,CAAC,CAAW,CAAC;gBAAE,OAAO,IAAI,CAAA;QAChF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,OAAO,GAAG,wBAAwB,CAAA;IACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC"}