dsh-permission-rules 0.2.0

package/lib/types/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,QAAQ,MAAM,UAAU,CAAA;AAI/B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3I,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAItD,MAAM,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAA;AAEtC,kDAAkD;AAClD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;AAe3C;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAWd;IACR;IAXX,0FAA0F;IACzE,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAA;IAEvD,mEAAmE;IAClD,QAAQ,GAAG,IAAI,GAAG,EAAsE,CAAA;IAEzG,0CAA0C;IACzB,MAAM,GAAG,IAAI,GAAG,EAAyC,CAAA;IAE1E,YACmB,GAAY,EACpB,MAAsB;QADd,QAAG,GAAH,GAAG,CAAS;QACpB,WAAM,GAAN,MAAM,CAAgB;IAC9B,CAAC;IAEJ,sDAAsD;IAC9C,cAAc;QACpB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;SACvD,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,GAAW;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,OAAO,GAAa,EAAE,CAAA;YAC5B,IAAI,GAAG,GAAG,GAAG,CAAA;YACb,SAAS,CAAC;gBACR,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBAClD,IAAI,UAAU,CAAC,SAAS,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC3B,IAAI,MAAM,KAAK,GAAG;oBAAE,MAAK;gBACzB,GAAG,GAAG,MAAM,CAAA;YACd,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QAChE,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAChH,IAAI,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QACjD,OAAO,IAAI,CAAC,eAAe,EAAE,CAAA;IAC/B,CAAC;IAED,8DAA8D;IACtD,eAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAA;QACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACxE,IAAI,UAAU,CAAC,YAAY,CAAC;gBAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,GAAW;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,CAAA;QACtI,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;YACjF,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;YACrE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;gBACxD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,mBAAmB,CAAC,CAAA;gBACrG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;YAC9H,CAAC;YACD,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAA;QAC3G,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAW;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,wBAAwB,GAAG,EAAE,CAAC,CAAA;YAC1E,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC7B,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;YACxC,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACxJ,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YACjC,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;YACxC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,QAAQ,GAAG,EAAE,CAAC,CAAA;QAC/J,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,GAAG,KAAK,OAAO,2BAA2B,CAAC,CAAA;YACvG,IAAI,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;;gBAC/E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACzL,CAAC;IACH,CAAC;IAED,4DAA4D;IACpD,YAAY;QAClB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;IACzD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,IAAmB,EAAE,IAAoC;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;QAC5F,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;YAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC5C,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,OAAO,GAAoB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAA;QAChD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAA;QACxE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAA;IACjD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,IAAmB,EAAE,MAAmB,EAAE,GAAwB,EAAE,OAAwB;QAChG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS;YAAE,OAAM;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAM;QAC/B,IAAI,CAAC;YACH,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,MAAiC,CAAC,0BAA0B,EAAE;gBAC5E,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBACpG,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM;gBAC3D,OAAO;gBACP,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;aAClF,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,UAA6B;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;QAChE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAA;YACjG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,QAAQ,EAAE,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAA;YAC7G,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAA;YAC5C,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAA;YACjG,IAAI,KAAK,GAAG,EAAE,CAAA;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC,EAAE,CAAA;gBAChI,KAAK,GAAG,MAAM,CAAA;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,CAAA;YAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YACtF,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;YACvB,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACjC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAA;YAC5F,IAAI,IAAa,CAAA;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAA;YAC7D,CAAC;YACD,IAAI,MAAmB,CAAA;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;YACxF,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YAC7E,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;aACzH,CAAA;QACH,CAAC;QACD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAA;QAC7F,IAAI,MAAmB,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;QACxF,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACrG,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YAChF,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3G,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QACvD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IACpD,CAAC;IAED,gFAAgF;IACxE,gBAAgB,CAAC,UAA6B,EAAE,KAAa,EAAE,KAAc;QACnF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAA;QAC5G,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAA;QAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QACrE,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAqB,CAAA;YACxC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACpG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IACpD,CAAC;IAED;;;;;;OAMG;IACH,uBAAuB;QACrB,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YACxH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,SAAS,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAA;YAClH,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,iBAAiB,CAAC,QAAgB;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;YAC9D,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,iCAAiC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IAED,+EAA+E;IACvE,WAAW,CAAC,GAAW,EAAE,MAAc;QAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,KAAK,EAAE;YAAE,OAAM;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QACjF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACvD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC1B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE;YACrC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACxF,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;YACxB,IAAI;YACJ,KAAK,EAAE,GAAG,EAAE;gBACV,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAClG,CAAC,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE;YACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAA;YAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,cAAc,CAAC,GAAW,EAAE,OAA0B;QAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAChC,KAAK,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7D,CAAC;IAED,8FAA8F;IACtF,aAAa;QACnB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;gBAAE,SAAQ;YACjC,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;QAC7C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAM;QAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,EAAE,CAAA;IACtB,CAAC;IAED,4DAA4D;IAC5D,kBAAkB;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;IAED,sEAAsE;IACtE,kBAAkB;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IACzB,CAAC;IAED,kEAAkE;IAC1D,cAAc,CAAC,MAAc;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxC,IAAI,QAAQ,KAAK,SAAS;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3E,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,IAAI,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACzD,OAAO,CAAC,uBAAuB,EAAE,CAAA;IACjC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;IAC9C,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC3E,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,iFAAiF;QAC9F,KAAK,EAAE,EAAE,IAAI,EAAE,oDAAoD,EAAE;QACrE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;KACnD,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,103 @@
+{
+  "name": "dsh-permission-rules",
+  "version": "0.2.0",
+  "description": "Declarative Claude Code-style permission rules for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), and workspace-path matching on the tools/pre-execute waterfall, full session-log audit, and HMR rule reload.",
+  "private": false,
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src",
+    "cordis.patch.yml",
+    "docs",
+    "scripts/repair-session-logs.mjs",
+    "README.md",
+    "README.zh.md",
+    "README.es.md",
+    "README.pt.md",
+    "README.hi.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "permission",
+    "policy",
+    "allow-deny-ask",
+    "approval",
+    "safety"
+  ],
+  "author": "dsh-permission-rules contributors",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PerryLink/dsh-permission-rules.git"
+  },
+  "homepage": "https://github.com/PerryLink/dsh-permission-rules#readme",
+  "bugs": {
+    "url": "https://github.com/PerryLink/dsh-permission-rules/issues"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/schemastery": "^3.18.0"
+  },
+  "dependencies": {
+    "chokidar": "^5.0.0",
+    "tsdown": "^0.22.14",
+    "typescript": "^5.9.0",
+    "yaml": "^2.8.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-subagent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-user-approval": "0.1.0-rc.6",
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.19.0",
+    "@vitest/coverage-v8": "^3.2.0",
+    "dsh-auto-review": "file:vendor/dsh-auto-review-0.3.0.tgz",
+    "eslint": "^10.8.1",
+    "globals": "^17.11.0",
+    "typescript-eslint": "^8.67.0",
+    "vitest": "^3.2.0"
+  },
+  "scripts": {
+    "build": "node scripts/prepare.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "lint": "eslint src test scripts",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "pack:check": "node scripts/prepare.mjs && pnpm pack",
+    "prepare": "node scripts/prepare.mjs"
+  },
+  "packageManager": "pnpm@11.7.0",
+  "license": "Apache-2.0"
+}

package/scripts/repair-session-logs.mjs

@@ -0,0 +1,327 @@
+/**
+ * Repair DSH JSONL session logs that were written before `Session.append`
+ * exposed the `ignorable` envelope marker. Out-of-repo plugin events
+ * (`permissionRules/decision`, `autoReview/verdict`, `autoReview/state`) were
+ * appended unmarked, so the persistence read path refuses those logs with
+ * `SessionFormatUnsupportedError` ("unknown to this harness and not marked
+ * ignorable").
+ *
+ * This script rewrites ONLY the targeted log-only audit rows, adding
+ * `ignorable: true` to their envelopes; every other byte is preserved. Each
+ * modified artifact is backed up to `<file>.bak-<epoch>` before replacement.
+ *
+ * It understands both physical encodings of the JSONL backend:
+ *   - `session.jsonl.zstd` — a concatenation of checksummed Zstandard frames
+ *     (frame 1 = header line, later frames = durable append batches); each
+ *     frame is decompressed, filtered, and recompressed independently so
+ *     frame boundaries survive.
+ *   - `session.jsonl` — plaintext JSONL lines.
+ *
+ * Usage:
+ *   node scripts/repair-session-logs.mjs scan [--home DIR]      # report foreign rows, change nothing
+ *   node scripts/repair-session-logs.mjs repair [--home DIR] [--dry-run]
+ *   node scripts/repair-session-logs.mjs repair --types a/b,c/d
+ *
+ * `--home` defaults to `$env:DSH_HOME/sessions` or `~/.dsh/sessions`.
+ * The default target set is the log-only audit vocabulary owned by the
+ * dsh-permission-rules / dsh-auto-review plugins; only types you understand
+ * to be reconstruction-safe may be added via `--types`.
+ */
+
+import { constants, zstdCompressSync, zstdDecompressSync } from 'node:zlib'
+import { existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+const ZSTD_MAGIC = 0xfd2fb528
+const CHECKSUM_OPTIONS = { params: { [constants.ZSTD_c_checksumFlag]: 1 } }
+
+const DEFAULT_TARGET_TYPES = [
+  'permissionRules/decision',
+  'autoReview/verdict',
+  'autoReview/state',
+]
+
+/** Row types that are storage records, never session events (leave untouched). */
+const STORAGE_ROW_TYPES = new Set([
+  'text-chunks',
+  'reasoning-chunks',
+  'tool-call-chunks',
+])
+
+/**
+ * The harness build's generated event vocabulary
+ * (`KNOWN_SESSION_EVENT_TYPES`, `packages/core/session/src/known-event-types.ts`).
+ * Rows whose type is outside this set are what the read path refuses when the
+ * envelope lacks `ignorable: true`; the scan reports them so nothing is missed.
+ * Regenerate this list from the harness checkout when it changes.
+ */
+const KNOWN_SESSION_EVENT_TYPES = new Set([
+  'agent-preset/selected',
+  'agent/inbox/spliced',
+  'approval/asked',
+  'approval/decided',
+  'approval/policy',
+  'assistant/chunk',
+  'assistant/message',
+  'command/done',
+  'command/run',
+  'compaction/end',
+  'compaction/prune',
+  'compaction/start',
+  'compaction/summary',
+  'feedback/record',
+  'goal/change',
+  'hook/invoked',
+  'hook/result',
+  'llm/retry',
+  'llm/retry-started',
+  'permission/preset',
+  'plan/mode',
+  'request/context',
+  'request/header',
+  'sandbox/mode',
+  'schedule/change',
+  'session/end-seed',
+  'session/title',
+  'session/title-llm-request',
+  'step/end',
+  'step/start',
+  'subagent/descriptor',
+  'todo/write',
+  'tool-workflow/agent-end',
+  'tool-workflow/agent-start',
+  'tool-workflow/run-end',
+  'tool-workflow/run-start',
+  'tool/call',
+  'tool/code-dispatch',
+  'tool/code-dispatch-start',
+  'tool/result',
+  'turn/end',
+  'turn/start',
+  'user/message',
+  'web/deepseek-search-llm-request',
+])
+
+/**
+ * Locate complete Zstandard frame ranges in a concatenated stream, mirroring
+ * the JSONL backend's structural scan. Throws on corrupt structure; a trailing
+ * incomplete frame is reported as `tornStart` and skipped.
+ * @param {Buffer} buffer - the raw artifact bytes.
+ * @returns {{ frames: {start:number,end:number}[], tornStart?: number }}
+ */
+function scanZstdFrames(buffer) {
+  const frames = []
+  let offset = 0
+  while (offset < buffer.length) {
+    const start = offset
+    if (buffer.length - offset < 4) return { frames, tornStart: start }
+    if (buffer.readUInt32LE(offset) !== ZSTD_MAGIC) {
+      throw new Error(`corrupt Zstandard stream: invalid frame magic at byte ${offset}`)
+    }
+    offset += 4
+    if (offset === buffer.length) return { frames, tornStart: start }
+    const descriptor = buffer.readUInt8(offset)
+    offset += 1
+    if ((descriptor & 0x18) !== 0) {
+      throw new Error(`corrupt Zstandard stream: reserved frame-header bit at byte ${offset - 1}`)
+    }
+    const contentSizeFlag = descriptor >>> 6
+    const singleSegment = (descriptor & 0x20) !== 0
+    const dictionaryFlag = descriptor & 0x03
+    const dictionaryBytes = dictionaryFlag === 3 ? 4 : dictionaryFlag
+    const contentSizeBytes = contentSizeFlag === 0 ? (singleSegment ? 1 : 0) : 1 << contentSizeFlag
+    const remainingHeaderBytes = (singleSegment ? 0 : 1) + dictionaryBytes + contentSizeBytes
+    if (buffer.length - offset < remainingHeaderBytes) return { frames, tornStart: start }
+    offset += remainingHeaderBytes
+    for (;;) {
+      if (buffer.length - offset < 3) return { frames, tornStart: start }
+      const blockHeader = buffer.readUIntLE(offset, 3)
+      offset += 3
+      const lastBlock = (blockHeader & 1) !== 0
+      const blockType = (blockHeader >>> 1) & 0x03
+      const blockSize = blockHeader >>> 3
+      if (blockType === 0x03) {
+        throw new Error(`corrupt Zstandard stream: reserved block type at byte ${offset - 3}`)
+      }
+      const payloadBytes = blockType === 0x01 ? 1 : blockSize
+      if (buffer.length - offset < payloadBytes) return { frames, tornStart: start }
+      offset += payloadBytes
+      if (lastBlock) break
+    }
+    if ((descriptor & 0x04) !== 0) {
+      if (buffer.length - offset < 4) return { frames, tornStart: start }
+      offset += 4
+    }
+    frames.push({ start, end: offset })
+  }
+  return { frames }
+}
+
+/** Split decompressed text into final-newline-terminated lines. */
+function splitLines(text) {
+  const lines = text.split('\n')
+  if (lines.at(-1) === '') lines.pop()
+  return lines
+}
+
+/**
+ * Apply the ignorable marker to targeted audit rows in one JSONL frame.
+ * @param {string} text - the frame plaintext.
+ * @param {Set<string>} targetTypes - event types to mark.
+ * @param {Map<string, number>} foreignSeen - scan accumulator: type -> row count.
+ * @returns {{ text: string, changed: number }}
+ */
+function filterFrame(text, targetTypes, foreignSeen) {
+  const lines = splitLines(text)
+  let changed = 0
+  const out = lines.map(line => {
+    if (line.length === 0) return line
+    let row
+    try {
+      row = JSON.parse(line)
+    } catch {
+      return line // preserve unparsable bytes exactly; the reader owns the refusal
+    }
+    if (typeof row !== 'object' || row === null) return line
+    const type = row.type
+    if (typeof type !== 'string' || STORAGE_ROW_TYPES.has(type)) return line
+    if (type === 'session') return line // header row: never an event
+    if (!KNOWN_SESSION_EVENT_TYPES.has(type)) {
+      foreignSeen.set(type, (foreignSeen.get(type) ?? 0) + 1)
+    }
+    if (targetTypes.has(type)) {
+      if (row.ignorable === true) return line
+      row.ignorable = true
+      changed += 1
+      return JSON.stringify(row)
+    }
+    return line
+  })
+  return { text: out.join('\n') + '\n', changed }
+}
+
+/** Find every session artifact under a sessions root. */
+function findLogs(root) {
+  const found = []
+  const walk = dir => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry)
+      const stat = statSync(full)
+      if (stat.isDirectory()) walk(full)
+      else if (entry === 'session.jsonl' || entry === 'session.jsonl.zstd') found.push(full)
+    }
+  }
+  walk(root)
+  return found
+}
+
+/** Read a log into { headerFrame, frames: [{text, start, end}] }. */
+function readLog(path) {
+  const buffer = readFileSync(path)
+  if (path.endsWith('.zstd')) {
+    const { frames, tornStart } = scanZstdFrames(buffer)
+    if (frames.length === 0) throw new Error(`${path}: no complete Zstandard frame`)
+    return {
+      compressed: true,
+      frames: frames.map(range => ({
+        ...range,
+        text: zstdDecompressSync(buffer.subarray(range.start, range.end)).toString('utf8'),
+      })),
+      tornStart,
+      buffer,
+    }
+  }
+  return {
+    compressed: false,
+    frames: [{ start: 0, end: buffer.length, text: buffer.toString('utf8') }],
+    tornStart: undefined,
+    buffer,
+  }
+}
+
+function parseArgs(argv) {
+  const args = { mode: undefined, home: undefined, dryRun: false, types: DEFAULT_TARGET_TYPES }
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === 'scan' || arg === 'repair') args.mode = arg
+    else if (arg === '--home') args.home = argv[++i]
+    else if (arg === '--dry-run') args.dryRun = true
+    else if (arg === '--types') args.types = argv[++i].split(',')
+  }
+  return args
+}
+
+function usage() {
+  console.error('usage: node repair-session-logs.mjs scan|repair [--home DIR] [--dry-run] [--types a/b,c/d]')
+  process.exit(2)
+}
+
+const args = parseArgs(process.argv.slice(2))
+if (args.mode === undefined) usage()
+const home = args.home ?? process.env.DSH_HOME
+const root = home !== undefined ? resolve(home, 'sessions') : join(homedir(), '.dsh', 'sessions')
+if (!existsSync(root)) {
+  console.error(`sessions root not found: ${root}`)
+  process.exit(1)
+}
+const targetTypes = new Set(args.types)
+
+const logs = findLogs(root)
+if (logs.length === 0) {
+  console.log(`no session logs found under ${root}`)
+  process.exit(0)
+}
+
+let scanned = 0
+let affectedFiles = 0
+let marked = 0
+const foreignSeen = new Map()
+const failures = []
+
+for (const path of logs) {
+  let log
+  try {
+    log = readLog(path)
+  } catch (error) {
+    failures.push(`${path}: ${error.message}`)
+    continue
+  }
+  if (log.tornStart !== undefined) {
+    console.warn(`warn: ${path} ends in a torn Zstandard frame at byte ${log.tornStart}; trailing bytes are left untouched`)
+  }
+  let fileChanged = 0
+  const newFrames = []
+  for (const frame of log.frames) {
+    const { text, changed } = filterFrame(frame.text, targetTypes, foreignSeen)
+    newFrames.push({ ...frame, text })
+    fileChanged += changed
+  }
+  scanned += 1
+  if (fileChanged > 0) {
+    affectedFiles += 1
+    marked += fileChanged
+    if (args.mode === 'repair' && !args.dryRun) {
+      const backup = `${path}.bak-${Date.now()}`
+      renameSync(path, backup)
+      const content = log.compressed
+        ? Buffer.concat(newFrames.map(frame => zstdCompressSync(frame.text, CHECKSUM_OPTIONS)))
+        : Buffer.from(newFrames[0].text, 'utf8')
+      writeFileSync(path, content)
+      console.log(`repaired ${path} (${fileChanged} row(s) marked ignorable; backup: ${backup})`)
+    } else {
+      console.log(`${args.dryRun ? '[dry-run] would repair' : 'would repair'} ${path}: ${fileChanged} row(s)`)
+    }
+  }
+}
+
+if (foreignSeen.size > 0) {
+  console.log('\nforeign (non-harness) event rows found by type:')
+  for (const [type, count] of [...foreignSeen.entries()].sort()) {
+    const action = targetTypes.has(type) ? 'targeted for ignorable repair' : 'NOT targeted — investigate before touching'
+    console.log(`  ${type}: ${count} rows (${action})`)
+  }
+}
+for (const failure of failures) console.error(`error: ${failure}`)
+console.log(`\n${scanned} log(s) scanned, ${affectedFiles} affected, ${marked} row(s) would be marked${args.mode === 'repair' && !args.dryRun ? ' (repaired)' : ''}`)
+process.exit(failures.length > 0 ? 1 : 0)

package/src/config.ts

@@ -0,0 +1,141 @@
+/**
+ * Config schema and resolution for `dsh-permission-rules`. Every tunable is
+ * a validated {@link Config} field changeable from cordis.yml; the
+ * resolution step validates the numeric bounds and compiles nothing — rule
+ * files are external documents resolved per session cwd at load time.
+ * @module dsh-permission-rules/config
+ */
+
+import { isAbsolute } from 'node:path'
+import z from '@deepseek-ai/schemastery'
+import type { PatternMode } from './rules.ts'
+import type { UiLanguage } from './prose.ts'
+
+/** What happens when a discovered rule file exists but cannot be parsed or compiled. */
+export type BadFilePolicy = 'fail' | 'ignore-with-warning'
+
+/** Which decisions are audit-logged: every call, or only rule hits. */
+export type AuditGranularity = 'all' | 'hits'
+
+/** Raw plugin config — every field optional; {@link Config} supplies the defaults. */
+export interface Config {
+  /**
+   * Rule file location. A relative value is resolved against the calling
+   * session's workspace cwd (so `<cwd>/.dsh/rules.yaml` by default); an
+   * absolute value is used as-is for every session.
+   */
+  rulesFile?: string
+  /**
+   * Fallback rule file used when per-cwd discovery finds no rule file.
+   * Absolute, or relative to `process.cwd()`. Unset = an empty rule set.
+   */
+  fallbackPath?: string
+  /**
+   * How an unreadable/invalid rule file is handled at load: `'fail'` throws
+   * (the pending tool call errors loudly; HMR reloads keep the previous
+   * rules and report the error), `'ignore-with-warning'` logs a warning and
+   * continues with an empty (initial) or previous (reload) rule set.
+   */
+  badFilePolicy?: BadFilePolicy
+  /** Hard cap on the number of rules across the effective source chain; a larger chain fails the load. */
+  maxRules?: number
+  /** Hard cap on cached per-workspace rule loads; the least-recently-used workspace is evicted beyond it. */
+  maxCachedWorkspaces?: number
+  /** How `params`, `paths`, and `when.env` patterns are interpreted: `'glob'` (default) or `'regex'`. */
+  patternMode?: PatternMode
+  /** Whether the loaded rule file is watched and reloaded on change. */
+  watch?: boolean
+  /** Debounce window for watch-driven reloads, in milliseconds. */
+  watchStabilityThresholdMs?: number
+  /** Language of the `/rules` command output: `'en'` (default), `'zh'`, `'es'`, `'pt'`, or `'hi'`. */
+  language?: UiLanguage
+  /** Whether `paths` patterns (and workspace-root comparison) ignore ASCII case; defaults to `true` on Windows. */
+  caseInsensitivePaths?: boolean
+  /** Audit granularity: `'all'` logs every hit AND passthrough; `'hits'` skips passthrough events. */
+  audit?: AuditGranularity
+  /** Walk parent directories of the session cwd and merge every found rule file (nearest first). */
+  searchUp?: boolean
+  /** Hard cap on unbounded `*`/`**` quantifiers per glob pattern (backtracking-degree bound). */
+  maxGlobStars?: number
+}
+
+/** Config after {@link resolveConfig}: every optional field has its explicit default. */
+export interface ResolvedConfig {
+  readonly rulesFile: string
+  readonly fallbackPath: string | undefined
+  readonly badFilePolicy: BadFilePolicy
+  readonly maxRules: number
+  readonly maxCachedWorkspaces: number
+  readonly patternMode: PatternMode
+  readonly watch: boolean
+  readonly watchStabilityThresholdMs: number
+  readonly language: UiLanguage
+  readonly caseInsensitivePaths: boolean
+  readonly audit: AuditGranularity
+  readonly searchUp: boolean
+  readonly maxGlobStars: number
+}
+
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+export const Config: z<Config> = z.object({
+  rulesFile: z.string().default('.dsh/rules.yaml'),
+  fallbackPath: z.string(),
+  badFilePolicy: z.union(['fail', 'ignore-with-warning'] as const).default('fail'),
+  maxRules: z.number().default(256),
+  maxCachedWorkspaces: z.number().default(512),
+  patternMode: z.union(['glob', 'regex'] as const).default('glob'),
+  watch: z.boolean().default(true),
+  watchStabilityThresholdMs: z.number().default(200),
+  language: z.union(['en', 'zh', 'es', 'pt', 'hi'] as const).default('en'),
+  caseInsensitivePaths: z.boolean().default(process.platform === 'win32'),
+  audit: z.union(['all', 'hits'] as const).default('all'),
+  searchUp: z.boolean().default(false),
+  maxGlobStars: z.number().default(2),
+})
+
+/**
+ * Validate raw values and fill explicit defaults. A `maxRules`,
+ * `maxCachedWorkspaces`, or `maxGlobStars` that is not a positive safe
+ * integer, a non-positive stability window, or `searchUp` combined with an
+ * absolute `rulesFile` throws here — misconfiguration fails loud at mount.
+ * @param config - raw (possibly partial) plugin config.
+ * @returns the fully resolved config.
+ */
+export function resolveConfig(config: Config = {}): ResolvedConfig {
+  const rulesFile = config.rulesFile ?? '.dsh/rules.yaml'
+  const searchUp = config.searchUp ?? false
+  if (searchUp && isAbsolute(rulesFile)) {
+    throw new TypeError(`searchUp cannot be combined with an absolute rulesFile (${JSON.stringify(rulesFile)}): parent-directory walking needs a relative file name`)
+  }
+  const maxRules = config.maxRules ?? 256
+  if (!Number.isSafeInteger(maxRules) || maxRules <= 0) {
+    throw new TypeError(`maxRules must be a positive safe integer, got ${String(config.maxRules)}`)
+  }
+  const watchStabilityThresholdMs = config.watchStabilityThresholdMs ?? 200
+  if (!Number.isSafeInteger(watchStabilityThresholdMs) || watchStabilityThresholdMs < 0) {
+    throw new TypeError(`watchStabilityThresholdMs must be a non-negative safe integer, got ${String(config.watchStabilityThresholdMs)}`)
+  }
+  const maxCachedWorkspaces = config.maxCachedWorkspaces ?? 512
+  if (!Number.isSafeInteger(maxCachedWorkspaces) || maxCachedWorkspaces <= 0) {
+    throw new TypeError(`maxCachedWorkspaces must be a positive safe integer, got ${String(config.maxCachedWorkspaces)}`)
+  }
+  const maxGlobStars = config.maxGlobStars ?? 2
+  if (!Number.isSafeInteger(maxGlobStars) || maxGlobStars <= 0) {
+    throw new TypeError(`maxGlobStars must be a positive safe integer, got ${String(config.maxGlobStars)}`)
+  }
+  return {
+    rulesFile,
+    fallbackPath: config.fallbackPath,
+    badFilePolicy: config.badFilePolicy ?? 'fail',
+    maxRules,
+    maxCachedWorkspaces,
+    patternMode: config.patternMode ?? 'glob',
+    watch: config.watch ?? true,
+    watchStabilityThresholdMs,
+    language: config.language ?? 'en',
+    caseInsensitivePaths: config.caseInsensitivePaths ?? process.platform === 'win32',
+    audit: config.audit ?? 'all',
+    searchUp,
+    maxGlobStars,
+  }
+}