dsh-permission-rules 0.6.21 → 0.7.0

package/lib/types/remote-service.d.ts

@@ -10,7 +10,7 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import type { PermissionRulesRuntime } from './runtime.js';
-import type { PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from './wire.js';
+import type { AllowHostRequest, AllowHostResult, PermissionRulesSnapshot, RulesReadResult, RulesReloadResult, RulesSaveResult } from './wire.js';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         /** Settings-page snapshot + rule-editor bridge (this package). */
@@ -40,6 +40,14 @@ export declare class PermissionRulesRemoteService extends TypertRemoteService {
     rulesSave(path: string, text: string): RulesSaveResult;
     /** Re-read every cached workspace chain (after an external edit). */
     reload(): RulesReloadResult;
+    /**
+     * Write one minimal allow rule for a blocked host into the nearest
+     * effective rule file (the settings page's per-block action). The runtime
+     * owns the whole decision — which file, index 0, the validation gate, the
+     * reload — and never throws; the try/catch is the same containment
+     * `reload()` uses so the page always receives a well-formed result.
+     */
+    allowHost(request: AllowHostRequest): AllowHostResult;
 }
 export default PermissionRulesRemoteService;
 //# sourceMappingURL=remote-service.d.ts.map

package/lib/types/remote-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-service.d.ts","sourceRoot":"","sources":["../../src/remote-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE7G,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,kEAAkE;QAClE,eAAe,EAAE,4BAA4B,CAAA;KAC9C;CACF;AAED,yEAAyE;AACzE,MAAM,WAAW,kCAAkC;IACjD,4EAA4E;IAC5E,OAAO,EAAE,sBAAsB,CAAA;CAChC;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,mBAAmB;IAGzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFjD,MAAM,CAAC,MAAM,EAAS,MAAM,EAAE,CAAA;gBAElB,GAAG,EAAE,OAAO,EAAmB,MAAM,EAAE,kCAAkC;IAIrF,gHAAgH;IAChH,aAAa,IAAI,uBAAuB;IAiCxC,+CAA+C;IAC/C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;IAUxC,uGAAuG;IACvG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe;IAStD,qEAAqE;IACrE,MAAM,IAAI,iBAAiB;CAQ5B;AAED,eAAe,4BAA4B,CAAA"}
+{"version":3,"file":"remote-service.d.ts","sourceRoot":"","sources":["../../src/remote-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhJ,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,kEAAkE;QAClE,eAAe,EAAE,4BAA4B,CAAA;KAC9C;CACF;AAED,yEAAyE;AACzE,MAAM,WAAW,kCAAkC;IACjD,4EAA4E;IAC5E,OAAO,EAAE,sBAAsB,CAAA;CAChC;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,mBAAmB;IAGzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFjD,MAAM,CAAC,MAAM,EAAS,MAAM,EAAE,CAAA;gBAElB,GAAG,EAAE,OAAO,EAAmB,MAAM,EAAE,kCAAkC;IAIrF,gHAAgH;IAChH,aAAa,IAAI,uBAAuB;IA0CxC,+CAA+C;IAC/C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;IAUxC,uGAAuG;IACvG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe;IAStD,qEAAqE;IACrE,MAAM,IAAI,iBAAiB;IAS3B;;;;;;OAMG;IACH,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe;CAetD;AAED,eAAe,4BAA4B,CAAA"}

package/lib/types/rules.d.ts

@@ -408,6 +408,17 @@ export declare function extractUrlCandidates(args: Record<string, unknown>): str
  * @returns the parsed target, or undefined.
  */
 export declare function parseUrlTarget(raw: string): NetworkTarget | undefined;
+/**
+ * Lowercase, strip IPv6 brackets, strip one trailing dot.
+ *
+ * Exported because the settings-page allow action must normalize a blocked
+ * host EXACTLY the way target parsing does, or a rule generated from a block
+ * record could name a different host than the connection that was blocked
+ * (`Example.COM.` and `example.com` are the same target).
+ * @param host - a host name or IP literal as it arrived on the wire.
+ * @returns the canonical spelling.
+ */
+export declare function normalizeHost(host: string): string;
 /** Whether a host string is an IP literal (IPv4 or IPv6). */
 export declare function isIpLiteral(host: string): boolean;
 /**

package/lib/types/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEjD,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAA;AAE3E,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAA;AAEzC,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,SAAS,UAAU,EAAsB,CAAA;AAE/D,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAc/C,CAAA;AAKD,wFAAwF;AACxF,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAkF,CAAA;AAQzH;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC,gGAAgG;IAChG,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAA;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAED,oCAAoC;AACpC,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kHAAkH;IAClH,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wHAAwH;IACxH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,0JAA0J;IAC1J,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,EAAE,CAAA;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;QACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,CAAA;IACD,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC9B;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC7F,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/F,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,GAAG,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAa7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAKxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,YAAY,EAAE,CAE7F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAW/G;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAI/I;AA+CD,kEAAkE;AAClE,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,YAAiB,GACzB,OAAO,GAAG,SAAS,CAerB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAYvE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAsChG;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAOD,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxE;AAoFD,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAW5E;AAgRD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAehD,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAuB7E;AAID,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CA0B5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYrE;AA6DD,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAqHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAgB7F;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,MAAM,CAiBtG"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEjD,yDAAyD;AACzD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAA;AAE3E,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAA;AAEzC,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,SAAS,UAAU,EAAsB,CAAA;AAE/D,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAc/C,CAAA;AAKD,wFAAwF;AACxF,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAkF,CAAA;AAQzH;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChC,gGAAgG;IAChG,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAA;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAED,oCAAoC;AACpC,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kHAAkH;IAClH,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wHAAwH;IACxH,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,0JAA0J;IAC1J,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,EAAE,CAAA;IACb;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;QACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,CAAA;IACD,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAC9B;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC7F,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/F,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,GAAG,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAa7D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAKxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,YAAY,EAAE,CAE7F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe,CAW/G;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAI/I;AA+CD,kEAAkE;AAClE,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,YAAiB,GACzB,OAAO,GAAG,SAAS,CAerB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAYvE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAsChG;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAOD,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxE;AAoFD,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAW5E;AAgRD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAehD,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAuB7E;AAID,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CA0B5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYrE;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AA6BD,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAqHD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAgB7F;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,MAAM,CAiBtG"}

package/lib/types/runtime.d.ts

@@ -14,6 +14,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands';
 import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools';
 import type { Config, ResolvedConfig } from './config.js';
+import type { AllowHostRequest, AllowHostResult } from './wire.js';
 import type { CompiledRuleset, RuleHit } from './rules.js';
 import type { NetworkMode } from './network.js';
 import type { NetworkBlockRecord } from './proxy.js';
@@ -53,10 +54,6 @@ export declare function isDvrfsPath(path: string): boolean;
  * @returns true when the kernel is Microsoft's.
  */
 export declare function isWslKernel(procVersion: string): boolean;
-/**
- * State and behavior. One instance per plugin mount; disposals are owned by
- * the watcher/timer/proxy effects registered in {@link apply}.
- */
 export declare class PermissionRulesRuntime {
     private readonly ctx;
     /** Loaded (or failed) rules per workspace cwd, least-recently-used first for eviction. */
@@ -77,6 +74,11 @@ export declare class PermissionRulesRuntime {
     private readonly inFlight;
     /** The network proxy, when the policy is enabled and mounted. */
     private networkProxy;
+    /** Ambient upstream candidates, captured ONCE before this plugin injects its own (see {@link captureAmbientUpstream}). */
+    private ambientUpstream;
+    private ambientCaptured;
+    private upstreamWarned;
+    private selfLoopWarned;
     /** Restores the injected proxy environment (set after a successful bind). */
     private envRestore;
     /** The authoritative config source: the composition entry, replaced by the settings scope while attached. */
@@ -306,6 +308,26 @@ export declare class PermissionRulesRuntime {
      * path read the config per call, so they need no rebind.
      */
     onNetworkConfigChanged(): Promise<void>;
+    /**
+     * Capture the launch environment's proxy names exactly ONCE, before this
+     * plugin injects its own. `onNetworkConfigChanged()` closes the old proxy and
+     * restores the environment around a rebind, so a second capture could read
+     * this plugin's own address back as if the operator had exported it — hence
+     * the memo. The launch snapshot is immutable and preferred; `process.env` is
+     * the fallback for hosts that expose no snapshot.
+     */
+    private captureAmbientUpstream;
+    /** The one-shot upstream diagnostics: a discarded ambient proxy, or an `inherit` with nothing to inherit. */
+    private warnAboutUpstream;
+    /**
+     * The upstream getter the proxy consults per connection. Undefined when the
+     * setting is `off`, when no candidate is usable, or when the candidate points
+     * back into this very proxy — a self-loop would recurse forever, so chaining
+     * is disabled for it and warned about once.
+     */
+    private upstreamFor;
+    /** The upstream block of the network snapshot, already redacted. */
+    private upstreamSnapshot;
     /** The network snapshot the settings page and `/rules network` render. */
     networkSnapshot(): {
         readonly enabled: boolean;
@@ -317,14 +339,23 @@ export declare class PermissionRulesRuntime {
         readonly denied: number;
         readonly askBlocked: number;
         readonly recent: readonly NetworkBlockRecord[];
+        readonly upstream: {
+            readonly mode: 'off' | 'inherit' | 'url';
+            readonly http: string | null;
+            readonly https: string | null;
+            readonly active: boolean;
+            readonly chained: number;
+        };
+        /** Whether the settings page may offer the per-block allow action. */
+        readonly allowHostAction: boolean;
     };
-    /**
-     * The rule-file paths the settings-page editor may read or write: every
-     * currently loaded source plus the per-workspace project files and the
-     * configured fallback (so a not-yet-existing project file can be
-     * created). The editor never touches arbitrary paths — and the built-in
-     * baseline is excluded entirely (it is a shipped, read-only baseline,
-     * shown via `/rules` attribution instead).
+    /** The rule-file paths the settings-page editor may read or write: every
+     * currently loaded source plus the per-workspace project files, the
+     * configured fallback, and the host-level project file the session-less
+     * chain resolves (so a not-yet-existing project file can be created). The
+     * editor never touches arbitrary paths — and the built-in baseline is
+     * excluded entirely (it is a shipped, read-only baseline, shown via
+     * `/rules` attribution instead).
      */
     knownRuleSources(): readonly string[];
     /** Read one known rule file for the editor: `{ exists, text, error }`. */
@@ -356,6 +387,40 @@ export declare class PermissionRulesRuntime {
         error?: string;
         reloaded?: number;
     };
+    /**
+     * The settings-page "allow this host" action (issue #19 item 3): write ONE
+     * minimal `match.network.domains` allow rule for a blocked target into the
+     * nearest effective rule file, at index 0, then report the decision the
+     * runtime makes for that target afterwards.
+     *
+     * Why index 0: rules are first-match-wins, so appending the rule after an
+     * existing `deny` would leave the connection blocked — the rule would be
+     * dead text the operator cannot see the reason for.
+     *
+     * Why `domains` only: that dimension is subdomain-inclusive and
+     * port/scheme-agnostic; narrowing the generated rule to the blocked port
+     * would re-block the same host on its next connection from another port.
+     * The rule can never widen TOOL permissions either — an allow hit on
+     * `tools/pre-execute` is delegated downstream, never claimed.
+     *
+     * Failure modes are fail-closed and leave the disk untouched: the action is
+     * disabled, the host is not a host name/IP literal, the request names an
+     * unknown workspace, the target resolves outside the known rule sources or
+     * onto the built-in baseline, the file cannot be read, the document does
+     * not parse / has no `rules` list, or the written text fails the same
+     * `parseRulesDocument` + `compileRules` gate every hand edit passes.
+     *
+     * The write goes through {@link saveRuleFile}, so the per-workspace chains
+     * AND the session-less host chain are re-read — no restart, no
+     * `/rules reload` — and the returned `outcome` is the REAL decision
+     * recomputed after the write (with the target as given, no DNS: an
+     * `ips`-scoped allow rule cannot be seen here). Cross-process concurrent
+     * writes to one rule file are out of scope: last writer wins.
+     *
+     * @param request - the blocked target plus the workspace it belongs to.
+     * @returns the action result, never a throw.
+     */
+    allowHost(request: AllowHostRequest): AllowHostResult;
     /** The installed `@deepseek-ai/dsh-session` version, or `null` when unresolvable (falls back to the append probe). */
     private peerVersion;
     /** One-time warning that session-log audit was disabled to keep session logs loadable. */

package/lib/types/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAG5E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,KAAK,EAAgC,eAAe,EAA+B,OAAO,EAAE,MAAM,YAAY,CAAA;AAIrH,OAAO,KAAK,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ9E,OAAO,KAAK,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAItE,OAAO,KAAK,EAAiD,eAAe,EAAE,MAAM,aAAa,CAAA;AAEjG,eAAO,MAAM,IAAI,qBAAqB,CAAA;AAEtC,kDAAkD;AAClD,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,iDAAiD;AACjD,UAAU,WAAW;IACnB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;CACvB;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAoBD;;;GAGG;AACH,qBAAa,sBAAsB;IAmC/B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAlCtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,uHAAuH;IACvH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6D;IAE1F,6GAA6G;IAC7G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D,8HAA8H;IAC9H,OAAO,CAAC,UAAU,CAAyB;IAE3C,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAQ;IAE/B,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAE1E,iIAAiI;IACjI,OAAO,CAAC,YAAY,CAAqD;IAEzE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,iEAAiE;IACjE,OAAO,CAAC,YAAY,CAA0B;IAE9C,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA0B;IAE5C,6GAA6G;IAC7G,OAAO,CAAC,YAAY,CAAsB;gBAGvB,GAAG,EAAE,OAAO,EAC7B,MAAM,EAAE,cAAc;IAKxB,gFAAgF;IAChF,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,+FAA+F;IAC/F,eAAe,CAAC,MAAM,EAAE,MAAM,cAAc,GAAG,IAAI;IAInD,sDAAsD;IACtD,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;IAMrC,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAIrB,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IAkB1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IASvB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAiB9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAezB,oIAAoI;IACpI,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BlC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAmCrG;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAgCvJ,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAWxB,wGAAwG;IACxG,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;IAS7F;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB,sEAAsE;IACtE,OAAO,CAAC,WAAW;IAYnB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAK3B,iFAAiF;IACjF,OAAO,CAAC,SAAS;IAIjB,gDAAgD;IAChD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAItC,mGAAmG;IACnG,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;;OAQG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCzC;;;;;OAKG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAW7C,0EAA0E;IAC1E,eAAe,IAAI;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAA;QAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;QACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;KAC/C;IAkBD;;;;;;;OAOG;IACH,gBAAgB,IAAI,SAAS,MAAM,EAAE;IAgBrC,0EAA0E;IAC1E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3F,0GAA0G;IAC1G,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7C;;;;;;OAMG;IACH,SAAS,IAAI,IAAI;IAKjB;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAgC5F,sHAAsH;IACtH,OAAO,CAAC,WAAW;IASnB,0FAA0F;IAC1F,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,aAAa;IA4DrD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,WAAW;IA0DnB,mHAAmH;IACnH,OAAO,CAAC,aAAa;IAMrB,gFAAgF;IAChF,OAAO,CAAC,gBAAgB;IAiBxB,8FAA8F;IAC9F,OAAO,CAAC,cAAc;IAmBtB;;;;;;OAMG;IACH,uBAAuB,IAAI,IAAI;IAmB/B,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAUzB;;;;;;;;;OASG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAoCnB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IAetB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IA0E5B,qHAAqH;IACrH,OAAO,CAAC,kBAAkB;IAU1B,8FAA8F;IAC9F,OAAO,CAAC,aAAa;IAarB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAYnB,4DAA4D;IAC5D,kBAAkB,IAAI,MAAM;IAI5B,2EAA2E;IAC3E,mBAAmB,IAAI,MAAM;IAI7B,sEAAsE;IACtE,kBAAkB,IAAI,MAAM;IAI5B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CAevB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAG5E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAElE,OAAO,KAAK,EAAgC,eAAe,EAA+B,OAAO,EAAE,MAAM,YAAY,CAAA;AAIrH,OAAO,KAAK,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ9E,OAAO,KAAK,EAAmB,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAIvF,OAAO,KAAK,EAAiD,eAAe,EAAE,MAAM,aAAa,CAAA;AAEjG,eAAO,MAAM,IAAI,qBAAqB,CAAA;AAEtC,kDAAkD;AAClD,eAAO,MAAM,MAAM,UAAwB,CAAA;AAE3C,iDAAiD;AACjD,UAAU,WAAW;IACnB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAA;CACvB;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAyCD,qBAAa,sBAAsB;IAwC/B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAvCtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,uHAAuH;IACvH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6D;IAE1F,6GAA6G;IAC7G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D,8HAA8H;IAC9H,OAAO,CAAC,UAAU,CAAyB;IAE3C,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAQ;IAE/B,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAE1E,iIAAiI;IACjI,OAAO,CAAC,YAAY,CAAqD;IAEzE,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,iEAAiE;IACjE,OAAO,CAAC,YAAY,CAA0B;IAC9C,0HAA0H;IAC1H,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,cAAc,CAAQ;IAE9B,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA0B;IAE5C,6GAA6G;IAC7G,OAAO,CAAC,YAAY,CAAsB;gBAGvB,GAAG,EAAE,OAAO,EAC7B,MAAM,EAAE,cAAc;IAKxB,gFAAgF;IAChF,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,+FAA+F;IAC/F,eAAe,CAAC,MAAM,EAAE,MAAM,cAAc,GAAG,IAAI;IAInD,sDAAsD;IACtD,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;IAMrC,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAIrB,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IAkB1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IASvB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IAiB9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAezB,oIAAoI;IACpI,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BlC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAmCrG;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAgCvJ,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAWxB,wGAAwG;IACxG,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;IAS7F;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB,sEAAsE;IACtE,OAAO,CAAC,WAAW;IAYnB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAK3B,iFAAiF;IACjF,OAAO,CAAC,SAAS;IAIjB,gDAAgD;IAChD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAItC,mGAAmG;IACnG,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;;;;;;;OAQG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqCzC;;;;;OAKG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAW7C;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAS9B,6GAA6G;IAC7G,OAAO,CAAC,iBAAiB;IAiBzB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAuBnB,oEAAoE;IACpE,OAAO,CAAC,gBAAgB;IAoBxB,0EAA0E;IAC1E,eAAe,IAAI;QACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,CAAA;QAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;QACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;QAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;QAC9C,QAAQ,CAAC,QAAQ,EAAE;YACjB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAA;YACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;YAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;YAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;YACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SACzB,CAAA;QACD,sEAAsE;QACtE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;KAClC;IAoBD;;;;;;;OAOG;IACH,gBAAgB,IAAI,SAAS,MAAM,EAAE;IAqBrC,0EAA0E;IAC1E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3F,0GAA0G;IAC1G,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO7C;;;;;;OAMG;IACH,SAAS,IAAI,IAAI;IAKjB;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAgC5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe;IAsErD,sHAAsH;IACtH,OAAO,CAAC,WAAW;IASnB,0FAA0F;IAC1F,OAAO,CAAC,qBAAqB;IAM7B;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,aAAa;IA4DrD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,WAAW;IA0DnB,mHAAmH;IACnH,OAAO,CAAC,aAAa;IAMrB,gFAAgF;IAChF,OAAO,CAAC,gBAAgB;IAiBxB,8FAA8F;IAC9F,OAAO,CAAC,cAAc;IAoBtB;;;;;;OAMG;IACH,uBAAuB,IAAI,IAAI;IAmB/B,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAUzB;;;;;;;;;OASG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAoCnB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IAetB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IA0E5B,qHAAqH;IACrH,OAAO,CAAC,kBAAkB;IAU1B,8FAA8F;IAC9F,OAAO,CAAC,aAAa;IAarB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAYnB,4DAA4D;IAC5D,kBAAkB,IAAI,MAAM;IAI5B,2EAA2E;IAC3E,mBAAmB,IAAI,MAAM;IAI7B,sEAAsE;IACtE,kBAAkB,IAAI,MAAM;IAI5B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CAevB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D"}

package/lib/types/typert.host.d.ts

@@ -47,12 +47,21 @@ export declare const TYPERT: Readonly<{
                     source: import("zod").ZodString;
                     ruleIndex: import("zod").ZodNullable<import("zod").ZodNumber>;
                     reason: import("zod").ZodNullable<import("zod").ZodString>;
+                    cwd: import("zod").ZodNullable<import("zod").ZodString>;
                 }, import("zod/v4/core").$strip>>;
                 sources: import("zod").ZodArray<import("zod").ZodObject<{
                     path: import("zod").ZodString;
                     exists: import("zod").ZodBoolean;
                     cwd: import("zod").ZodNullable<import("zod").ZodString>;
                 }, import("zod/v4/core").$strip>>;
+                allowHostAction: import("zod").ZodBoolean;
+                upstream: import("zod").ZodObject<{
+                    mode: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"off">, import("zod").ZodLiteral<"inherit">, import("zod").ZodLiteral<"url">]>;
+                    http: import("zod").ZodNullable<import("zod").ZodString>;
+                    https: import("zod").ZodNullable<import("zod").ZodString>;
+                    active: import("zod").ZodBoolean;
+                    chained: import("zod").ZodNumber;
+                }, import("zod/v4/core").$strip>;
             }, import("zod/v4/core").$strip>;
         }>;
         readonly sourceLocation: Readonly<{
@@ -156,6 +165,47 @@ export declare const TYPERT: Readonly<{
             line: 1;
             column: 1;
         }>;
+    }> | Readonly<{
+        readonly id: "dsh-permission-rules#permissionRules/allowHost";
+        readonly service: "permissionRules";
+        readonly namespace: "permissionRules";
+        readonly method: "allowHost";
+        readonly invocation: Readonly<{
+            kind: "direct";
+        }>;
+        readonly parameters: readonly Readonly<{
+            name: string;
+            wire: string;
+            source: "json";
+            codec: Readonly<{
+                mode: "strict";
+                typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+                schema: import("zod").ZodObject<{
+                    host: import("zod").ZodString;
+                    scheme: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"http">, import("zod").ZodLiteral<"https">, import("zod").ZodNull]>;
+                    port: import("zod").ZodNullable<import("zod").ZodNumber>;
+                    cwd: import("zod").ZodNullable<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>;
+            }>;
+        }>[];
+        readonly result: Readonly<{
+            mode: "strict";
+            typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+            schema: import("zod").ZodObject<{
+                ok: import("zod").ZodBoolean;
+                path: import("zod").ZodNullable<import("zod").ZodString>;
+                created: import("zod").ZodBoolean;
+                reloaded: import("zod").ZodNumber;
+                outcome: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<"allow">, import("zod").ZodLiteral<"deny">, import("zod").ZodLiteral<"ask">, import("zod").ZodNull]>;
+                alreadyAllowed: import("zod").ZodBoolean;
+                error: import("zod").ZodNullable<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+        }>;
+        readonly sourceLocation: Readonly<{
+            file: "src/wire.ts";
+            line: 1;
+            column: 1;
+        }>;
     }>)[];
     model: Readonly<{
         services: readonly never[];

package/lib/types/typert.host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typert.host.d.ts","sourceRoot":"","sources":["../../src/typert.host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,4EAA4E;AAC5E,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAA"}
+{"version":3,"file":"typert.host.d.ts","sourceRoot":"","sources":["../../src/typert.host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,4EAA4E;AAC5E,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAA"}

package/lib/types/wire.d.ts

@@ -29,6 +29,12 @@ export interface NetworkBlockView {
     source: string;
     ruleIndex: number | null;
     reason: string | null;
+    /**
+     * The workspace of the agent the block was attributed to, or null when the
+     * connection carried no session attribution (a host-level fetch). The
+     * allow-host action needs it to pick the rule file it writes.
+     */
+    cwd: string | null;
 }
 /** One rule file the editor may read/write (a known rule source only). */
 export interface RuleSourceView {
@@ -50,7 +56,20 @@ export interface PermissionRulesSnapshot {
     denied: number;
     askBlocked: number;
     recent: readonly NetworkBlockView[];
+    /** Upstream chaining state; any credential in a proxy URL is already masked. */
+    upstream: {
+        mode: 'off' | 'inherit' | 'url';
+        http: string | null;
+        https: string | null;
+        active: boolean;
+        chained: number;
+    };
     sources: readonly RuleSourceView[];
+    /**
+     * Whether the settings page may run its per-block "allow this host" action
+     * (`network.allowHostAction`); false hides the button.
+     */
+    allowHostAction: boolean;
 }
 /** Strict wire schema for {@link PermissionRulesSnapshot}. */
 export declare const PERMISSION_RULES_SNAPSHOT_SCHEMA: z.ZodObject<{
@@ -75,12 +94,21 @@ export declare const PERMISSION_RULES_SNAPSHOT_SCHEMA: z.ZodObject<{
         source: z.ZodString;
         ruleIndex: z.ZodNullable<z.ZodNumber>;
         reason: z.ZodNullable<z.ZodString>;
+        cwd: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
     sources: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
         exists: z.ZodBoolean;
         cwd: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    allowHostAction: z.ZodBoolean;
+    upstream: z.ZodObject<{
+        mode: z.ZodUnion<readonly [z.ZodLiteral<"off">, z.ZodLiteral<"inherit">, z.ZodLiteral<"url">]>;
+        http: z.ZodNullable<z.ZodString>;
+        https: z.ZodNullable<z.ZodString>;
+        active: z.ZodBoolean;
+        chained: z.ZodNumber;
+    }, z.core.$strip>;
 }, z.core.$strip>;
 /** Result of `permissionRules/rulesRead`. */
 export interface RulesReadResult {
@@ -118,6 +146,64 @@ export declare const RULES_RELOAD_SCHEMA: z.ZodObject<{
     ok: z.ZodBoolean;
     error: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * The `permissionRules/allowHost` request: the blocked target exactly as the
+ * block view reported it, plus the workspace the rule belongs in (`null` for
+ * a host-level block). The action never accepts a PATH — the runtime maps the
+ * cwd onto its own known rule sources, so the wire cannot widen the write set.
+ */
+export interface AllowHostRequest {
+    /** The blocked host (host name or IP literal). */
+    host: string;
+    /** The blocked scheme, or null when the block record had none. */
+    scheme: 'http' | 'https' | null;
+    /** The blocked port, or null when the block record had none. */
+    port: number | null;
+    /** The workspace whose rule file should receive the rule, or null. */
+    cwd: string | null;
+}
+/** Strict wire schema for {@link AllowHostRequest}. */
+export declare const ALLOW_HOST_REQUEST_SCHEMA: z.ZodObject<{
+    host: z.ZodString;
+    scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+    port: z.ZodNullable<z.ZodNumber>;
+    cwd: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The `permissionRules/allowHost` result. `ok` reports whether the WRITE
+ * succeeded; `outcome` is the decision recomputed after it, so a page can
+ * never claim success while the connection is still blocked.
+ */
+export interface AllowHostResult {
+    ok: boolean;
+    /** The rule file written, or null when nothing was written. */
+    path: string | null;
+    /** Whether the file did not exist before this action created it. */
+    created: boolean;
+    /**
+     * Rule chains that were re-read (the per-workspace chains, plus the
+     * session-less host chain when one was cached and had to be dropped).
+     */
+    reloaded: number;
+    /** The decision for the target AFTER the action, or null when nothing was written. */
+    outcome: 'allow' | 'deny' | 'ask' | null;
+    /**
+     * Nothing was written because the target was already allowed by the current
+     * decision, or because the file already leads with this exact allow rule.
+     */
+    alreadyAllowed: boolean;
+    error: string | null;
+}
+/** Strict wire schema for {@link AllowHostResult}. */
+export declare const ALLOW_HOST_RESULT_SCHEMA: z.ZodObject<{
+    ok: z.ZodBoolean;
+    path: z.ZodNullable<z.ZodString>;
+    created: z.ZodBoolean;
+    reloaded: z.ZodNumber;
+    outcome: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">, z.ZodNull]>;
+    alreadyAllowed: z.ZodBoolean;
+    error: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
 /** The `permissionRules/networkStatus` invocation descriptor (no parameters). */
 export declare const NETWORK_STATUS_DESCRIPTOR: Readonly<{
     readonly id: "dsh-permission-rules#permissionRules/networkStatus";
@@ -153,12 +239,21 @@ export declare const NETWORK_STATUS_DESCRIPTOR: Readonly<{
                 source: z.ZodString;
                 ruleIndex: z.ZodNullable<z.ZodNumber>;
                 reason: z.ZodNullable<z.ZodString>;
+                cwd: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
             sources: z.ZodArray<z.ZodObject<{
                 path: z.ZodString;
                 exists: z.ZodBoolean;
                 cwd: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
+            allowHostAction: z.ZodBoolean;
+            upstream: z.ZodObject<{
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"off">, z.ZodLiteral<"inherit">, z.ZodLiteral<"url">]>;
+                http: z.ZodNullable<z.ZodString>;
+                https: z.ZodNullable<z.ZodString>;
+                active: z.ZodBoolean;
+                chained: z.ZodNumber;
+            }, z.core.$strip>;
         }, z.core.$strip>;
     }>;
     readonly sourceLocation: Readonly<{
@@ -269,6 +364,52 @@ export declare const RULES_RELOAD_DESCRIPTOR: Readonly<{
         column: 1;
     }>;
 }>;
+/**
+ * The `permissionRules/allowHost` invocation descriptor: one request object in,
+ * one result object out.
+ */
+export declare const ALLOW_HOST_DESCRIPTOR: Readonly<{
+    readonly id: "dsh-permission-rules#permissionRules/allowHost";
+    readonly service: "permissionRules";
+    readonly namespace: "permissionRules";
+    readonly method: "allowHost";
+    readonly invocation: Readonly<{
+        kind: "direct";
+    }>;
+    readonly parameters: readonly Readonly<{
+        name: string;
+        wire: string;
+        source: "json";
+        codec: Readonly<{
+            mode: "strict";
+            typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+            schema: z.ZodObject<{
+                host: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
+        }>;
+    }>[];
+    readonly result: Readonly<{
+        mode: "strict";
+        typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+        schema: z.ZodObject<{
+            ok: z.ZodBoolean;
+            path: z.ZodNullable<z.ZodString>;
+            created: z.ZodBoolean;
+            reloaded: z.ZodNumber;
+            outcome: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">, z.ZodNull]>;
+            alreadyAllowed: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+    }>;
+    readonly sourceLocation: Readonly<{
+        file: "src/wire.ts";
+        line: 1;
+        column: 1;
+    }>;
+}>;
 /**
  * The canonical invocation list both Typert faces register — the host
  * manifest and the client contribution share these exact descriptor
@@ -308,12 +449,21 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
                 source: z.ZodString;
                 ruleIndex: z.ZodNullable<z.ZodNumber>;
                 reason: z.ZodNullable<z.ZodString>;
+                cwd: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
             sources: z.ZodArray<z.ZodObject<{
                 path: z.ZodString;
                 exists: z.ZodBoolean;
                 cwd: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
+            allowHostAction: z.ZodBoolean;
+            upstream: z.ZodObject<{
+                mode: z.ZodUnion<readonly [z.ZodLiteral<"off">, z.ZodLiteral<"inherit">, z.ZodLiteral<"url">]>;
+                http: z.ZodNullable<z.ZodString>;
+                https: z.ZodNullable<z.ZodString>;
+                active: z.ZodBoolean;
+                chained: z.ZodNumber;
+            }, z.core.$strip>;
         }, z.core.$strip>;
     }>;
     readonly sourceLocation: Readonly<{
@@ -417,5 +567,46 @@ export declare const PERMISSION_RULES_INVOCATIONS: readonly (Readonly<{
         line: 1;
         column: 1;
     }>;
+}> | Readonly<{
+    readonly id: "dsh-permission-rules#permissionRules/allowHost";
+    readonly service: "permissionRules";
+    readonly namespace: "permissionRules";
+    readonly method: "allowHost";
+    readonly invocation: Readonly<{
+        kind: "direct";
+    }>;
+    readonly parameters: readonly Readonly<{
+        name: string;
+        wire: string;
+        source: "json";
+        codec: Readonly<{
+            mode: "strict";
+            typeSymbol: "dsh-permission-rules/types#AllowHostRequest";
+            schema: z.ZodObject<{
+                host: z.ZodString;
+                scheme: z.ZodUnion<readonly [z.ZodLiteral<"http">, z.ZodLiteral<"https">, z.ZodNull]>;
+                port: z.ZodNullable<z.ZodNumber>;
+                cwd: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
+        }>;
+    }>[];
+    readonly result: Readonly<{
+        mode: "strict";
+        typeSymbol: "dsh-permission-rules/types#AllowHostResult";
+        schema: z.ZodObject<{
+            ok: z.ZodBoolean;
+            path: z.ZodNullable<z.ZodString>;
+            created: z.ZodBoolean;
+            reloaded: z.ZodNumber;
+            outcome: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">, z.ZodNull]>;
+            alreadyAllowed: z.ZodBoolean;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+    }>;
+    readonly sourceLocation: Readonly<{
+        file: "src/wire.ts";
+        line: 1;
+        column: 1;
+    }>;
 }>)[];
 //# sourceMappingURL=wire.d.ts.map

package/lib/types/wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAA;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IACtB,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,gFAAgF;IAChF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,eAAe,CAAA;IACrB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;CACnC;AAED,8DAA8D;AAC9D,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4B3C,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaI,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCQ,CAAA;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;EAaM,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAKvC,CAAA"}
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAA;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IACtB,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,gFAAgF;IAChF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,eAAe,CAAA;IACrB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,gFAAgF;IAChF,QAAQ,EAAE;QACR,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAA;QAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;IAClC;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,8DAA8D;AAC9D,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqC3C,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAA;AAEF,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,sEAAsE;IACtE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,uDAAuD;AACvD,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAA;IACxC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAA;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,sDAAsD;AACtD,eAAO,MAAM,wBAAwB;;;;;;;;iBAQnC,CAAA;AAEF,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaI,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCQ,CAAA;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;EAaM,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBQ,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAMvC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.6.21",
+  "version": "0.7.0",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",