The permission service needs a predictable decision when multiple exact-resource rules apply. Implement evaluation so an explicit deny cannot be overridden by a competing grant.
Build the implementation in TypeScript under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has rules with principal, resource, action and effect allow/deny, plus requests with the first three fields. In a rule, * matches any complete field; all other strings match exactly and are case sensitive. A request is allowed only when at least one matching allow exists and no matching deny exists. Return allowed booleans in request order. Reject any invalid rule effect even if the rule would not match.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.