approvalEntrySchema
constapprovalEntrySchema:ZodDiscriminatedUnion<[ZodDiscriminatedUnion<[ZodObject<{matcher:ZodLiteral<"exact">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;type:ZodLiteral<"shell">; },$strict>,ZodObject<{matcher:ZodLiteral<"glob">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;type:ZodLiteral<"shell">; },$strict>,ZodObject<{matcher:ZodLiteral<"regexp">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;type:ZodLiteral<"shell">; },$strict>],"matcher">,ZodDiscriminatedUnion<[ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"exact">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;type:ZodLiteral<"tool">; },$strict>,ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"glob">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;type:ZodLiteral<"tool">; },$strict>,ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"regexp">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;type:ZodLiteral<"tool">; },$strict>,ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"hint">;pattern:ZodObject<{destructiveHint:ZodOptional<ZodBoolean>;idempotentHint:ZodOptional<ZodBoolean>;openWorldHint:ZodOptional<ZodBoolean>;readOnlyHint:ZodOptional<ZodBoolean>; },$strict>;rate:ZodOptional<ZodBoolean>;type:ZodLiteral<"tool">; },$strict>],"matcher">,ZodDiscriminatedUnion<[ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"exact">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;server:ZodString;type:ZodLiteral<"mcpTool">; },$strict>,ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"glob">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;server:ZodString;type:ZodLiteral<"mcpTool">; },$strict>,ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"regexp">;pattern:ZodString;rate:ZodOptional<ZodBoolean>;server:ZodString;type:ZodLiteral<"mcpTool">; },$strict>,ZodObject<{host:ZodOptional<ZodString>;matcher:ZodLiteral<"hint">;pattern:ZodObject<{destructiveHint:ZodOptional<ZodBoolean>;idempotentHint:ZodOptional<ZodBoolean>;openWorldHint:ZodOptional<ZodBoolean>;readOnlyHint:ZodOptional<ZodBoolean>; },$strict>;rate:ZodOptional<ZodBoolean>;server:ZodString;type:ZodLiteral<"mcpTool">; },$strict>],"matcher">],"type">
Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/schema.ts:344
EXT-71 §3.1 — one entry in allow, deny or escalate. All three lists take the same
shape, so there is one schema and the list a rule sits in decides only what a match DOES.
type, matcher and pattern are required on every arm: no field is inferred, and no entry
reads two ways. Every arm is a strict object, so any field the grammar does not define — a typo,
a server on a shell entry, a host on a shell entry — is an unrecognized-key error rather
than a silently-ignored key that would widen what the entry matches.
The id is what makes the emitted JSON Schema hoist this union into $defs and reference it,
instead of inlining all eleven arms into each of the twenty-four places a rule list appears
(three lists × the root plus seven commands). That is the difference between a schema an editor loads
and one it chokes on, and $ref is the standard spelling every JSON Schema consumer already
understands.