@owlmeans/viable-sdk 0.1.18-rc.50 → 0.1.18-rc.52

package/README.md

@@ -111,7 +111,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.53
+npx @owlmeans/agent-skills@^0.1.18-rc.54
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/viable-sdk",
-  "version": "0.1.18-rc.50",
-  "generatedAt": "2026-10-09T13:45:44.332Z",
+  "version": "0.1.18-rc.52",
+  "generatedAt": "2026-10-16T18:05:18.997Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/viable-sdk/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/viable-sdk
 
 **Layer:** Tooling (Node/Bun; not a browser or React package)
-**Install:** `"@owlmeans/viable-sdk": "^0.1.18-rc.50"` in `dependencies`
+**Install:** `"@owlmeans/viable-sdk": "^0.1.18-rc.52"` in `dependencies`
 **Subpaths:** `.` · `./executor` · `./run` · `./tools` · `./task`
 **Contracts:** `@owlmeans/viable-common` (`./connect`, `./slot`, `./integrity`, and the planning
 vocabulary — story type and story flow) and `@owlmeans/planning` (the planning protocol tree
@@ -451,17 +451,39 @@ query, a write — a removal included — in its body.
   resources?, mode? }`**, **`manage_app_organization { action: rename | add-member | update-member |
   remove-member, entitySlug }`**, **`manage_app_group { action: create | update | delete | add-members |
   remove-members, entitySlug, group }`**.
+- **Grants restrict as well as grant.** Every subject (person or group) has its OWN blanket value per
+  binding: granted, restricted, or absent (inherits). A whole-permission revoke (`blanket`/`all`, or no
+  mode without `resources`) RESTRICTS a declared permission — the subject also loses what it inherits
+  from a default class, a group or a bundle; `mode: inherit` (revoke-only) takes back only the
+  subject's own value, so it holds what it inherits again; a `resources` revoke removes those ids only.
+  `iamToolHelper.renderRevoke` words the result by that mode. The tool descriptions and the `mode`
+  enum text say the same, and nothing here re-implements the IAM's evaluation.
+- `app_grants` prints what is HELD and what a subject's own restriction withholds (`restricted: true`
+  — listed, never held): the head counts them apart (`Grants (N held, M restricted)`), a restricted row
+  ends `· restricted`, and `IAM_RESTRICTED_NOTE` closes a listing that has any. Origins print as
+  given: `direct`, `default`, `group` (with `through`), `bundle` (a group's own listing: the names its
+  bundles select).
+- The platform's staff group (`IAM_MEMBERS_GROUP`, `managed: true`) keeps its members, bundles and
+  existence: `manage_app_group` writes to them are refused by the IAM; its PERMISSIONS are the owner's,
+  granted and restricted with `manage_app_grant { group }`. `renderGroup` and the `manage_app_group`
+  description say exactly that — never "read-only".
 - **Action-specific fields are checked BEFORE any call** (`iamToolHelper.missing`): an invite needs
   `email`, an update something to change, a grant exactly ONE subject (a person, or a group with its
-  organization's `entitySlug` — never both), a group's update `title` or the WHOLE `bundles` list, the
-  members' moves `profileIds`; **`remove` and `delete` need `confirm: true`**. A refusal is `isError`
-  with nothing called.
+  organization's `entitySlug` — never both), an `assign` no revoke-only mode (`REVOKE_ONLY_GRANT_MODES`:
+  `all`, `inherit`), a group's update `title` or the WHOLE `bundles` list, the members' moves
+  `profileIds`; **`remove` and `delete` need `confirm: true`**. A refusal is `isError` with nothing
+  called. The contract's schema admits every mode on both bodies; the IAM refuses the revoke-only
+  ones on a grant.
 - A listing answered `external: true` prints `IAM_EXTERNAL` (the app's sign-in is managed in a console
-  of its own), never "nobody". `iam-refused:` (a managed group or definition, the last owner) is phrased
-  by `refusalHelper`; every tool runs in `answering`. The writes map to their read for the handover
-  (`STATUS_TOOL_OF`). No staff-synchronization tool.
-- Specs: `tests/iam-tools.spec.ts` (hosts, annotations, every refused shape with no call, the calls
-  made), `remote.spec.ts` (scope placement, the account-base listing).
+  of its own), never "nobody". `refusalHelper` phrases `iam:group:managed:` (the staff group: members,
+  bundles and existence the platform's, its permissions editable — placed ABOVE `iam-refused:`) and
+  `iam-refused:` (a managed definition or member, the last owner, an empty organization); every tool
+  runs in `answering`. The writes map to their read for the handover (`STATUS_TOOL_OF`). No
+  staff-synchronization tool.
+- Specs: `tests/iam-tools.spec.ts` (hosts, annotations, every refused shape with no call — revoke-only
+  modes on assign included —, the calls made, `inherit` and records revokes, held/restricted counts and
+  the `bundle` origin, the staff group's line, the staff-group and generic refusals), `remote.spec.ts`
+  (scope placement, the account-base listing).
 
 ## What the browser streams is read by cursor
 
@@ -650,8 +672,9 @@ call carries them too.
 
 The integrations' refusals each have a sentence in `REFUSALS` as well: `github:not-connected`,
 `github:not-published`, `oauth:invalid-or-expired-state` (the GitHub authorization),
-`viable-domain:taken:` (a custom domain held by another project) and `iam-refused:` (the app's own
-sign-in refusing a console change on its terms).
+`viable-domain:taken:` (a custom domain held by another project), `iam:group:managed:` (the staff
+group's members, bundles or existence) and `iam-refused:` (the app's own sign-in refusing a console
+change on its terms).
 
 The same refusals also arrive where no class survives, and `REFUSALS` phrases them by marker:
 `viable-connect:consent-required:` (a stored run error; the URL and deadline parsed from the
@@ -782,7 +805,18 @@ project fault — escapes as an exception. Everything is resolved per call rathe
 because a re-initialization replaces the tree under a running connector. The integrity verdict is
 forgotten after every command that changes the tree.
 
-Five rules the local half adds, each learned from a defect:
+Rules for the local executor:
+
+- **The local browser environment defaults `APP_UNSECURE` to `true`** so its generated client
+  calls the HTTP web proxy. The web `.env` can override this default; root backend secrets never
+  enter the browser environment. The platform's local configure uses the web port for both
+  `FRONTEND_PORT` and `BACKEND_PORT`, with `/api` proxied to the backend port.
+
+- **`Bun` forwards `options.env` into the child process**, alongside `options.subproject` for
+  its working directory. The spawn helper merges these values over the inherited environment
+  without changing the parent process or the project's configuration files. Runtime probes carry
+  their input in these variables; dropping them prevents the runner from producing its report.
+  `executor-shell.spec.ts` exercises the public slot-command dispatcher with a real Bun child.
 
 - **`makeTargetEnvHelper(dir).backendEnv` reads the root `.env` and `.frontendEnv` the web package's own — the file split IS
   the leak boundary.** The publisher has an allow-list (`frontendEnvVars`/`frontendSecrets`); here
@@ -886,6 +920,8 @@ reader looking for a database that was never configured.
 
 ## Tests
 
+In the `@owlmeans/viable-sdk` package directory, `bun x tsc -p tests/tsconfig.json --noEmit` checks the SDK sources and all test typings.
+
 `bun test ./tests` — offline: the envelope and its parser, the tool catalogue and its extension seam,
 the `registerCatalogue` out-of-credits, consent and planning-refusal phrasing and `notify` wiring
 (`mcp-catalogue.spec.ts`; the consent marker, the bare 428/402 statuses and a consent inside a

package/build/executor/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,KAAG,eA4CjD,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,KAAG,eA6CjD,CAAA"}

package/build/executor/env.js

@@ -37,6 +37,7 @@ export const makeTargetEnvHelper = (dir) => {
     const frontendEnv = async () => {
         const values = await projectEnv.readEnvFile(projectEnv.webEnvFile());
         const env = {
+            APP_UNSECURE: 'true',
             FRONTEND_PORT: `${TARGET_WEB_PORT}`,
             BACKEND_HOST: 'localhost',
             BACKEND_PORT: `${TARGET_WEB_PORT}`,

package/build/executor/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EACtE,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAG1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAmB,EAAE;IAClE,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAE5C,MAAM,UAAU,GAAG,KAAK,IAAqC,EAAE;QAC7D,+FAA+F;QAC/F,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;QAE1D,OAAO;YACL,YAAY,EAAE,GAAG,eAAe,EAAE;YAClC,YAAY,EAAE,WAAW;YACzB,gBAAgB,EAAE,eAAe;YACjC,aAAa,EAAE,WAAW;YAC1B,aAAa,EAAE,GAAG,eAAe,EAAE;YACnC,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,GAAG,kBAAkB,EAAE;YACpC,6FAA6F;YAC7F,yEAAyE;YACzE,GAAG,MAAM;SACV,CAAA;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,IAAqC,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;QAEpE,MAAM,GAAG,GAA2B;YAClC,aAAa,EAAE,GAAG,eAAe,EAAE;YACnC,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,GAAG,eAAe,EAAE;YAClC,gBAAgB,EAAE,eAAe;YACjC,QAAQ,EAAE,GAAG;YACb,GAAG,MAAM;SACV,CAAA;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACrC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AACpC,CAAC,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EACtE,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAG1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAmB,EAAE;IAClE,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAE5C,MAAM,UAAU,GAAG,KAAK,IAAqC,EAAE;QAC7D,+FAA+F;QAC/F,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;QAE1D,OAAO;YACL,YAAY,EAAE,GAAG,eAAe,EAAE;YAClC,YAAY,EAAE,WAAW;YACzB,gBAAgB,EAAE,eAAe;YACjC,aAAa,EAAE,WAAW;YAC1B,aAAa,EAAE,GAAG,eAAe,EAAE;YACnC,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,GAAG,kBAAkB,EAAE;YACpC,6FAA6F;YAC7F,yEAAyE;YACzE,GAAG,MAAM;SACV,CAAA;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,IAAqC,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;QAEpE,MAAM,GAAG,GAA2B;YAClC,YAAY,EAAE,MAAM;YACpB,aAAa,EAAE,GAAG,eAAe,EAAE;YACnC,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,GAAG,eAAe,EAAE;YAClC,gBAAgB,EAAE,eAAe;YACjC,QAAQ,EAAE,GAAG;YACb,GAAG,MAAM;SACV,CAAA;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACrC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AACpC,CAAC,CAAA"}

package/build/executor/shell/types.d.ts

@@ -10,6 +10,7 @@ import type { BootCheckReport, BootCheckStatus } from '../types.js';
 export interface LocalShellHelper {
     bun: (args?: string, options?: {
         subproject?: SubProject;
+        env?: Record<string, string>;
     }) => Promise<string | null>;
     /**
      * Throw the lockfile away and install again.

package/build/executor/shell/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/executor/shell/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACrF;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACvC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACzC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACrE,oGAAoG;IACpG,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClD;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACnC,sFAAsF;IACtF,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC7C;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;IACzC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IACjG,eAAe,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;CAChD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/executor/shell/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,UAAU,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACnH;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACvC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACzC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACrE,oGAAoG;IACpG,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAClD;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACnC,sFAAsF;IACtF,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC7C;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;IACzC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IACjG,eAAe,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;CAChD"}

package/build/executor/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/executor/shell.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAwH,MAAM,yBAAyB,CAAA;AAQ1K,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAOxD;;;;;;GAMG;AAEH,qFAAqF;AACrF,eAAO,MAAM,cAAc,WAAY,MAAM,GAAG,IAAI,KAAG,OACG,CAAA;AAqB1D,eAAO,MAAM,sBAAsB,eAAgB,eAAe,eAAe,UAAU,KAAG,gBAqP7F,CAAA"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/executor/shell.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAwH,MAAM,yBAAyB,CAAA;AAQ1K,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAOxD;;;;;;GAMG;AAEH,qFAAqF;AACrF,eAAO,MAAM,cAAc,WAAY,MAAM,GAAG,IAAI,KAAG,OACG,CAAA;AAqB1D,eAAO,MAAM,sBAAsB,eAAgB,eAAe,eAAe,UAAU,KAAG,gBAwP7F,CAAA"}

package/build/executor/shell.js

@@ -122,7 +122,10 @@ export const createLocalShellHelper = (fileHelper, subproject) => {
             // refresh it for the initial install; this also prevents a stale development cache from
             // winning over the immutable package body named by the lockfile.
             const cmd = `bun ${args ?? 'install --force --backend=copyfile'}`;
-            return await spawnHelper.runCommand(cmd, { cwd: fileHelper.getRootPath(options?.subproject ?? subproject) });
+            return await spawnHelper.runCommand(cmd, {
+                cwd: fileHelper.getRootPath(options?.subproject ?? subproject),
+                env: options?.env,
+            });
         },
         reinstall: async () => {
             const refused = await refusal();

package/build/executor/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/executor/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAA;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,CAAC,MAAM,WAAW,CAAA;AAEzB,OAAO,EAAc,uBAAuB,EAAE,qBAAqB,EAAE,uBAAuB,EAAwB,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAE1K,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;;GAMG;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAW,EAAE,CAC/D,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;AAE7C,MAAM,MAAM,GAAG,CAAC,GAAW,EAAgB,EAAE;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAA;IAErC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAEnB,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAA2B,EAAE,UAAuB,EAAoB,EAAE;IAC/G,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAE7C;;;;;;;;;;OAUG;IACH,MAAM,OAAO,GAAG,KAAK,EAAE,MAAM,GAAG,SAAS,EAA0B,EAAE;QACnE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAEvD,OAAO,MAAM,CAAC,EAAE;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,MAAM,+DAA+D;kBACtE,qBAAqB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC,CAAA;IAED;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,KAAK,EAC3B,MAAc,EAAE,GAAW,EAAE,GAA4B,EACjC,EAAE;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,MAAM,gBAAgB,GAAG,kBAAkB;kBACjD,8DAA8D,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,GAAG,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAC5C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,CAAA;QAClD,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,OAAO,CAAA;QAEnC,OAAO,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACtD,CAAC,CAAA;IAED;;;;;;;;OAQG;IACH,MAAM,cAAc,GAAG,KAAK,IAA4B,EAAE;QACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,sFAAsF;gBACtF,wFAAwF;gBACxF,0FAA0F;gBAC1F,kFAAkF;gBAClF,OAAO,GAAG,KAAK,4BAA4B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAA;YAC/D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,IAA4B,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QAC/B,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YACvC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC,CAAA;IAED,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,KAAK,EAAE,IAAa,EAAE,OAAqC,EAA0B,EAAE;YAC1F,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,wFAAwF;YACxF,iEAAiE;YACjE,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,oCAAoC,EAAE,CAAA;YAEjE,OAAO,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;QAC9G,CAAC;QAED,SAAS,EAAE,KAAK,IAA4B,EAAE;YAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,0FAA0F;YAC5F,CAAC;YAED,OAAO,MAAM,WAAW,CAAC,UAAU,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9F,CAAC;QAED,WAAW,EAAE,KAAK,IAA4B,EAAE;YAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,OAAO,MAAM,cAAc,EAAE,CAAA;QAC/B,CAAC;QAED,QAAQ,EAAE,KAAK,EAAE,kBAA+B,EAA0B,EAAE;YAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,MAAM,SAAS,GAAG,MAAM,cAAc,EAAE,CAAA;YACxC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,qFAAqF;YACrF,2FAA2F;YAC3F,yFAAyF;YACzF,eAAe;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAA;YACpE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,wBAAwB,GAAG,8EAA8E,CAAA;YAClH,CAAC;YAED,2FAA2F;YAC3F,4FAA4F;YAC5F,uFAAuF;YACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YAE3F,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QAC/E,CAAC;QAED,oBAAoB,EAAE,KAAK,IAA4B,EAAE,CACvD,MAAM,cAAc,EAAE,IAAI,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QAE3G,KAAK,EAAE,KAAK,IAA4B,EAAE;YACxC,MAAM,SAAS,GAAG,MAAM,cAAc,EAAE,CAAA;YACxC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,MAAM,MAAM,GAAG;gBACb,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAChD,MAAM,WAAW,EAAE;gBACnB,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;aAChF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAA;YAEnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrD,CAAC;QAED,eAAe,EAAE,KAAK,IAA4B,EAAE,CAClD,MAAM,cAAc,EAAE,IAAI,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAE5E,MAAM,EAAE,KAAK,IAA4B,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;YAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAA;YACrC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBACf,OAAO,8BAA8B,aAAa,sCAAsC;sBACpF,4EAA4E,CAAA;YAClF,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACjD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,OAAO,mBAAmB,aAAa,yCAAyC,CAAA;YAClF,CAAC;YACD,IAAI,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,2BAA2B,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK;sBACjE,qEAAqE,CAAA;YAC3E,CAAC;YAED,OAAO,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAA;QACpD,CAAC;QAED,SAAS,EAAE,KAAK,IAA8B,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;YAEvD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,MAAM,CAAC;gBAC9E,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;aACzF,CAAA;QACH,CAAC;QAED,SAAS,EAAE,KAAK,EACd,OAAO,GAA4C,EAAE,EACpB,EAAE;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YAExB,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;gBACnB,2FAA2F;gBAC3F,sCAAsC;gBACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACnD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;oBACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;gBACtD,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;gBAC1D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;oBACvC,oFAAoF;oBACpF,yEAAyE;oBACzE,OAAO;wBACL,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ;wBAC1B,KAAK,EAAE,uBAAuB,aAAa,2BAA2B;qBACvE,CAAA;gBACH,CAAC;gBAED,OAAO,MAAM,YAAY,CAAC;oBACxB,IAAI,EAAE,qBAAqB;oBAC3B,MAAM,EAAE,uBAAuB;oBAC/B,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;oBACrB,GAAG,EAAE;wBACH,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE;wBAC/B,YAAY,EAAE,GAAG,qBAAqB,EAAE;wBACxC,eAAe,EAAE,uBAAuB;qBACzC;oBACD,MAAM,EAAE,UAAU,EAAE;oBACpB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI;wBAC5B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,cAAc,EAAE,IAAI,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;iBACvG,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEtC,OAAO,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAA;QACnD,CAAC;QAED,eAAe,EAAE,KAAK,IAA8B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;KAC7E,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/executor/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAA;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,CAAC,MAAM,WAAW,CAAA;AAEzB,OAAO,EAAc,uBAAuB,EAAE,qBAAqB,EAAE,uBAAuB,EAAwB,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAE1K,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;;GAMG;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAW,EAAE,CAC/D,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;AAE7C,MAAM,MAAM,GAAG,CAAC,GAAW,EAAgB,EAAE;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAA;IAErC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAEnB,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAA2B,EAAE,UAAuB,EAAoB,EAAE;IAC/G,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAE7C;;;;;;;;;;OAUG;IACH,MAAM,OAAO,GAAG,KAAK,EAAE,MAAM,GAAG,SAAS,EAA0B,EAAE;QACnE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAEvD,OAAO,MAAM,CAAC,EAAE;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,MAAM,+DAA+D;kBACtE,qBAAqB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC,CAAA;IAED;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,KAAK,EAC3B,MAAc,EAAE,GAAW,EAAE,GAA4B,EACjC,EAAE;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,MAAM,gBAAgB,GAAG,kBAAkB;kBACjD,8DAA8D,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,GAAG,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAC5C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,CAAA;QAClD,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,OAAO,CAAA;QAEnC,OAAO,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACtD,CAAC,CAAA;IAED;;;;;;;;OAQG;IACH,MAAM,cAAc,GAAG,KAAK,IAA4B,EAAE;QACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,sFAAsF;gBACtF,wFAAwF;gBACxF,0FAA0F;gBAC1F,kFAAkF;gBAClF,OAAO,GAAG,KAAK,4BAA4B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAA;YAC/D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,IAA4B,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QAC/B,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YACvC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC,CAAA;IAED,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAA0B,EAAE;YACnD,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,wFAAwF;YACxF,iEAAiE;YACjE,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,oCAAoC,EAAE,CAAA;YAEjE,OAAO,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE;gBACvC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC;gBAC9D,GAAG,EAAE,OAAO,EAAE,GAAG;aAClB,CAAC,CAAA;QACJ,CAAC;QAED,SAAS,EAAE,KAAK,IAA4B,EAAE;YAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,0FAA0F;YAC5F,CAAC;YAED,OAAO,MAAM,WAAW,CAAC,UAAU,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9F,CAAC;QAED,WAAW,EAAE,KAAK,IAA4B,EAAE;YAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,OAAO,MAAM,cAAc,EAAE,CAAA;QAC/B,CAAC;QAED,QAAQ,EAAE,KAAK,EAAE,kBAA+B,EAA0B,EAAE;YAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,OAAO,CAAA;YAEnC,MAAM,SAAS,GAAG,MAAM,cAAc,EAAE,CAAA;YACxC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,qFAAqF;YACrF,2FAA2F;YAC3F,yFAAyF;YACzF,eAAe;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAA;YACpE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,wBAAwB,GAAG,8EAA8E,CAAA;YAClH,CAAC;YAED,2FAA2F;YAC3F,4FAA4F;YAC5F,uFAAuF;YACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YAE3F,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QAC/E,CAAC;QAED,oBAAoB,EAAE,KAAK,IAA4B,EAAE,CACvD,MAAM,cAAc,EAAE,IAAI,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QAE3G,KAAK,EAAE,KAAK,IAA4B,EAAE;YACxC,MAAM,SAAS,GAAG,MAAM,cAAc,EAAE,CAAA;YACxC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,MAAM,MAAM,GAAG;gBACb,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAChD,MAAM,WAAW,EAAE;gBACnB,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;aAChF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAA;YAEnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrD,CAAC;QAED,eAAe,EAAE,KAAK,IAA4B,EAAE,CAClD,MAAM,cAAc,EAAE,IAAI,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAE5E,MAAM,EAAE,KAAK,IAA4B,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;YAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAA;YACrC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBACf,OAAO,8BAA8B,aAAa,sCAAsC;sBACpF,4EAA4E,CAAA;YAClF,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACjD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,OAAO,mBAAmB,aAAa,yCAAyC,CAAA;YAClF,CAAC;YACD,IAAI,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,2BAA2B,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK;sBACjE,qEAAqE,CAAA;YAC3E,CAAC;YAED,OAAO,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAA;QACpD,CAAC;QAED,SAAS,EAAE,KAAK,IAA8B,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;YAEvD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,MAAM,CAAC;gBAC9E,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;aACzF,CAAA;QACH,CAAC;QAED,SAAS,EAAE,KAAK,EACd,OAAO,GAA4C,EAAE,EACpB,EAAE;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YAExB,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;gBACnB,2FAA2F;gBAC3F,sCAAsC;gBACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACnD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;oBACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;gBACtD,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;gBAC1D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;oBACvC,oFAAoF;oBACpF,yEAAyE;oBACzE,OAAO;wBACL,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ;wBAC1B,KAAK,EAAE,uBAAuB,aAAa,2BAA2B;qBACvE,CAAA;gBACH,CAAC;gBAED,OAAO,MAAM,YAAY,CAAC;oBACxB,IAAI,EAAE,qBAAqB;oBAC3B,MAAM,EAAE,uBAAuB;oBAC/B,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;oBACrB,GAAG,EAAE;wBACH,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE;wBAC/B,YAAY,EAAE,GAAG,qBAAqB,EAAE;wBACxC,eAAe,EAAE,uBAAuB;qBACzC;oBACD,MAAM,EAAE,UAAU,EAAE;oBACpB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI;wBAC5B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,cAAc,EAAE,IAAI,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;iBACvG,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEtC,OAAO,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAA;QACnD,CAAC;QAED,eAAe,EAAE,KAAK,IAA8B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;KAC7E,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/tools/catalogue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalogue.d.ts","sourceRoot":"","sources":["../../src/tools/catalogue.ts"],"names":[],"mappings":"AAcA,OAAO,EAAsD,YAAY,EAAE,MAAM,aAAa,CAAA;AAY9F,OAAO,KAAK,EAAY,cAAc,EAAE,QAAQ,EAAc,MAAM,YAAY,CAAA;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAK3D,OAAO,EAAE,YAAY,EAAE,CAAA;AAibvB;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,cAAc,EAg2FrC,CAAA;AAED,eAAO,MAAM,qBAAqB,QAAO,eAQxC,CAAA;AAED,eAAO,MAAM,eAAe,iBAA0B,CAAA;AAEtD,kFAAkF;AAClF,eAAO,MAAM,YAAY,SAAU,QAAQ,KAAG,cAAc,EAAwC,CAAA"}
+{"version":3,"file":"catalogue.d.ts","sourceRoot":"","sources":["../../src/tools/catalogue.ts"],"names":[],"mappings":"AAcA,OAAO,EAAsD,YAAY,EAAE,MAAM,aAAa,CAAA;AAY9F,OAAO,KAAK,EAAY,cAAc,EAAE,QAAQ,EAAc,MAAM,YAAY,CAAA;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAK3D,OAAO,EAAE,YAAY,EAAE,CAAA;AAibvB;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,cAAc,EAs2FrC,CAAA;AAED,eAAO,MAAM,qBAAqB,QAAO,eAQxC,CAAA;AAED,eAAO,MAAM,eAAe,iBAA0B,CAAA;AAEtD,kFAAkF;AAClF,eAAO,MAAM,YAAY,SAAU,QAAQ,KAAG,cAAc,EAAwC,CAAA"}

package/build/tools/catalogue.js

@@ -2444,7 +2444,9 @@ export const catalogue = [
         title: 'Who holds which permission in the generated app',
         description: 'The grants of a project\'s generated application — every one, one user\'s (profileId; with'
             + ' entitySlug, only those bound to that organization) or one group\'s (group with its entitySlug) —'
-            + ' each with where it comes from: direct, a default, or through a group.',
+            + ' each with where it comes from: direct, a default, through a group, or a group\'s bundle. Also lists'
+            + ' what a subject\'s own restriction withholds from what it would inherit, marked restricted: true —'
+            + ' those are NOT held.',
         input: {
             projectId: z.string().optional(),
             scope: APP_SCOPE_INPUT,
@@ -2474,8 +2476,11 @@ export const catalogue = [
         title: 'Grant or revoke a permission in the generated app',
         description: 'Grant one of the generated application\'s permissions to exactly ONE subject — a user (profileId;'
             + ' entitySlug binds the grant to that organization when the permission is organization-bound) or a'
-            + ' group (group key with its entitySlug) — or revoke it. A per-record permission takes resources'
-            + ' (record ids) or covers every record; mode names which form when both exist.',
+            + ' group (group key with its entitySlug) — or revoke it. Revoking a whole permission RESTRICTS the'
+            + ' subject: it also loses what it inherits (a default, a group, a bundle) until a revoke with mode:'
+            + ' inherit takes back only its own grant or restriction, so it holds what it inherits again. A'
+            + ' per-record permission takes resources (record ids) or covers every record; mode names which form'
+            + ' when both exist.',
         input: {
             projectId: z.string().optional(),
             scope: APP_SCOPE_INPUT,
@@ -2486,7 +2491,8 @@ export const catalogue = [
             entitySlug: z.string().min(1).max(63).optional(),
             resources: z.array(z.string().min(1).max(128)).max(256).optional().describe('Record ids of a per-record permission.'),
             mode: z.enum(Object.values(IamGrantMode)).optional()
-                .describe('blanket (every record) or resources (only those listed).'),
+                .describe('blanket (every record) or resources (only those listed); revoke only: inherit (take back'
+                + ' the subject\'s own grant or restriction) or all (every form, a revoke\'s default).'),
         },
         availability: toolHostHelper.anyHost,
         annotations: DESTRUCTIVE,
@@ -2501,7 +2507,7 @@ export const catalogue = [
                 return ok(`Granted: ${iamToolHelper.renderGrant(grant)}`, { projectId: project, grant: grant });
             }
             await deps.api.iam.grants.revoke(project, body);
-            return ok(`Revoked ${body.permission}${body.resources != null ? ` (records ${body.resources.join(', ')})` : ''}.`, { projectId: project, revoked: body });
+            return ok(iamToolHelper.renderRevoke(body), { projectId: project, revoked: body });
         }),
     },
     {
@@ -2615,7 +2621,8 @@ export const catalogue = [
         description: 'Change a group of an organization of a project\'s generated application: create it (find-or-create'
             + ' by key), update its title or what it grants (bundles — the WHOLE list, it replaces the group\'s),'
             + ' delete it (the user agreed: confirm: true), or add and remove members by profileIds. The platform\'s'
-            + ' own staff group is read-only.',
+            + ' own staff group keeps its members, bundles and existence — those changes are refused; its permissions'
+            + ' are granted and restricted with manage_app_grant (group).',
         input: {
             projectId: z.string().optional(),
             scope: APP_SCOPE_INPUT,