@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/access/access-control.interface.d.ts

@@ -72,7 +72,33 @@ export type GrantPrincipal = {
  */
 export type ResolvedPrincipal = {
     name: string;
-    kind: 'role' | 'group';
+    kind: 'role' | 'group' | 'plugin';
+};
+/**
+ * The principals holding ONE verb at one path, in the shape every `eligible*`
+ * lookup answers in: the kinded collectives, the same names with their kind
+ * erased (for the name-only consumers), and the directly granted people.
+ */
+export type HolderList = {
+    principals?: ResolvedPrincipal[];
+    roles: string[];
+    users: {
+        name: string;
+        email: string;
+    }[];
+};
+/** Who can open and who can edit one path — the two verbs a move compares. */
+export type PathHolders = {
+    read: HolderList;
+    write: HolderList;
+};
+/**
+ * One file's holders where it is now and where a move would put it — see
+ * {@link IAccessControl.prospectiveHolders}.
+ */
+export type ProspectiveHolders = {
+    before: PathHolders;
+    after: PathHolders;
 };
 /**
  * Per-verb sources of a principal's access on a target. Only verbs the principal
@@ -81,19 +107,72 @@ export type ResolvedPrincipal = {
  * grant at all yields an empty map.
  */
 export type GrantSources = Partial<Record<'read' | 'write' | 'download' | 'owner', VerbSources>>;
+/**
+ * ONE place a principal is DENIED a verb — the mirror of {@link GrantSource},
+ * over the same two editable locations: `direct` is a `deny` written in the
+ * target's OWN access file (a restriction made HERE), `ancestor` one written in
+ * a parent folder's `access.md` at `path`.
+ *
+ * A denial is a first-class entry, not the absence of a grant: it is what
+ * "restrict just this folder" writes, and the share dialog has to render it —
+ * otherwise a principal whose only entry here is a denial reads as ungoverned
+ * by this target and drops out of its "on this folder" list.
+ */
+export type DenialSource = GrantSource;
+/**
+ * EVERY scope that DENIES a principal one verb, ordered **closest-first**, up
+ * to (but not including) a closer own GRANT — which beats a farther deny under
+ * closest-wins and makes it dead. `[0]` is the effective denial. Only verbs the
+ * principal is actually denied appear; a verb with no denial is omitted.
+ *
+ * Deliberately a SEPARATE map from {@link GrantSources} rather than extra
+ * entries in it: every existing reader of `GrantSources` means "where their
+ * access comes from" and filters on `direct` / `ancestor` with no polarity
+ * check, so a denial smuggled in there would be read as a grant.
+ */
+export type DenialSources = Partial<Record<'read' | 'write' | 'download' | 'owner', DenialSource[]>>;
+/**
+ * Where one verdict was decided, repo-relative: a folder's rules (its
+ * `access.md`; `''` is the repo root) or a file's own frontmatter.
+ * `inherited` is true when that place is not the target's own — an ancestor
+ * folder's rules — and false for the target's own frontmatter or, for a folder
+ * target, its own `access.md`.
+ */
+export type AccessDecisionSource = {
+    kind: 'folder' | 'frontmatter';
+    path: string;
+    inherited: boolean;
+};
+/**
+ * ONE caller's verdict on one verb, with its reason — what `canRead` /
+ * `canWrite` / `canDownload` / `canOwner` answer, explained. `source` is null
+ * when no access rule decided it: the admin rescue on `access.md` /
+ * `roles.yaml`, a machine-owned file, or default-deny (nothing grants it).
+ * `via` names the tier that matched and `principal` the display name of the
+ * group, role or plugin principal it matched on (the caller's own email for
+ * `person`, `everyone` for the built-in). `admin-floor` is Admin's write at
+ * the repository root, which no rule there can take away; its source is the
+ * root's rules, or null when the root has none.
+ */
+export interface AccessDecision {
+    allowed: boolean;
+    source: AccessDecisionSource | null;
+    via: 'person' | 'group' | 'role' | 'plugin' | 'everyone' | 'admin-rescue' | 'admin-floor' | 'machine-owned' | 'default-deny';
+    principal: string | null;
+}
 export interface IAccessControl {
     /** True iff `userEmail` has `write` on `relativePath` per the current access tree. */
     canWrite(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     /**
      * True iff `userEmail` may READ `relativePath` per the current access tree.
      *
-     * `read` is **default-deny**: a path with no effective `read:`, `write:`, or
-     * `owner:` grant is not readable. To make content public, declare the
-     * built-in role `everyone` under `read:`. Resolution is closeness-first then
-     * tier (email > role > everyone within a scope), folding `write:`/`owner:` in
-     * as implicit read grants (grant-only — a write/owner denial never strips a
-     * read grant). No admin rescue. The file viewer, embed surface, and the
-     * agent's read tools all gate on this.
+     * `read` is **default-deny**: a path with no effective `read:`, `write:`,
+     * `download:` or `owner:` grant is not readable. To make content public,
+     * declare the built-in role `everyone` under `read:`. Resolution is
+     * closeness-first then tier (email > role > everyone within a scope), folding
+     * `write:`/`download:`/`owner:` in as implicit read grants (grant-only — a
+     * write/download/owner denial never strips a read grant). No admin rescue.
+     * The file viewer, embed surface, and the agent's read tools all gate on this.
      */
     canRead(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     /**
@@ -106,6 +185,31 @@ export interface IAccessControl {
      * tree, matching what the content routes will enforce on open.
      */
     canReadBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
+    /**
+     * Batched read for a GROUP rather than a person: what being in `group`
+     * (a `groups.yaml` display name, or the active group source's) confers on
+     * each path, through the same closeness-first walk `canReadBatch` runs —
+     * the group's own key, every role that lists the group, every plugin
+     * principal whose roster the group is part of, and the public keys every
+     * caller holds. No person is involved, so nothing a member holds for a
+     * reason of their own (a direct `Name <email>` grant, another role,
+     * deployment ownership) counts, and no admin rescue applies.
+     *
+     * `null` when no such group exists — distinct from a map of `false`s,
+     * which is a real group that can read none of the paths.
+     */
+    canReadAsGroupBatch(workspaceId: string, group: string, relativePaths: string[]): Promise<Map<string, boolean> | null>;
+    /**
+     * Batched read for EVERYONE — what a signed-in person who is in no group
+     * and holds no role reads on each path, through the same walk. This is
+     * the built-in `everyone` principal's own verdict: a `read: everyone`
+     * grant (or a public plugin's) at the closest scope that says anything,
+     * a `deny everyone` there withholds. Nothing person-shaped counts — no
+     * email entry, no role, no admin rescue — so the answer is what the
+     * organisation as a whole can use, which is what the "Everyone" lens
+     * lists.
+     */
+    canReadAsEveryoneBatch(workspaceId: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     /**
      * Batched canWrite for PR diffs and commit-time gating. Returns a map keyed
      * by the input paths, with `true` / `false` for each. Reuses one config
@@ -119,7 +223,9 @@ export interface IAccessControl {
      * `access.md`'s `download:` list. Independent of `write` — granting
      * write does NOT imply download, mirroring the way the verbs are
      * separately listed in access.md. An `owner:` grant DOES imply download
-     * (owner is a superset of write + download).
+     * (owner is a superset of write + download). The reverse fold holds one
+     * level down: a `download:` grant confers `read` (see `canRead`), so a
+     * download-only grantee can open the file as well as save it.
      *
      * No admin override (unlike `canWrite` on `access.md` / `roles.yaml`,
      * which admin-rescues). Admins are only granted download if an
@@ -174,11 +280,14 @@ export interface IAccessControl {
     /**
      * Answers the file viewer's "who can see this?" affordance. `restricted` is
      * false only when `read: everyone` applies without an effective user-level
-     * denial — the node is readable by all signed-in users, and the role/user
-     * lists are empty because their content would be meaningless. When
-     * `restricted` is true the lists name the principals (roles + direct users)
-     * that may read, with owners folded in (an `owner:` grant confers read). The
-     * lists may be empty for a default-denied path with no grants.
+     * denial — the node is readable by all signed-in users. The lists name the
+     * principals (roles + direct users) granted read whether or not the node
+     * is public, with writers, downloaders and owners folded in (a `write:`,
+     * `download:` or `owner:` grant confers read); on a public node they
+     * include what makes it public. `publicVia` names the
+     * PUBLIC plugin principals granted read here — principals every signed-in
+     * user holds — so a caller can tell public-through-a-plugin from a literal
+     * `everyone` grant. The lists may be empty for a default-denied path.
      */
     eligibleReaders(workspaceId: string, relativePath: string): Promise<{
         restricted: boolean;
@@ -188,6 +297,7 @@ export interface IAccessControl {
             name: string;
             email: string;
         }[];
+        publicVia?: string[];
     }>;
     /**
      * The set of principals (roles + direct users) with `download` on this path.
@@ -205,6 +315,22 @@ export interface IAccessControl {
             email: string;
         }[];
     }>;
+    /**
+     * Who can open and who can edit one file where it IS, and where a move
+     * would put it. `toPath` names a path that does not exist yet — the point
+     * of the call is to answer before the move happens — so the resolution
+     * layers the file's OWN rules (its frontmatter, read from `fromPath`,
+     * which travels with the bytes) over the destination's folder chain.
+     *
+     * Writes nothing and moves nothing. The move confirmation diffs the two
+     * sides to name who loses and who gains access.
+     *
+     * A FILE question only: a `fromPath` that is a directory is refused with a
+     * 400. A folder's access is its own `access.md` — which moves with it and
+     * governs everything beneath it — so resolving it as a file would name the
+     * wrong principals with the same confidence as the right ones.
+     */
+    prospectiveHolders(workspaceId: string, fromPath: string, toPath: string): Promise<ProspectiveHolders>;
     /**
      * Finite expanded email set for configured users who could approve this path
      * — role members + direct user grants, minus anyone denied. The built-in
@@ -257,6 +383,55 @@ export interface IAccessControl {
     grantSources(workspaceId: string, kind: AccessTargetKind, relativePath: string, principal: GrantPrincipal, opts?: {
         tokenMatch?: 'exact' | 'name';
     }): Promise<GrantSources>;
+    /**
+     * The polarity twin of {@link grantSources}: per verb, WHERE the principal is
+     * DENIED — a `deny` line in the target's own access file (`direct`) or in a
+     * parent folder's (`ancestor`). Same closeness-first walk, same `tokenMatch`
+     * pinning, same omit-what-does-not-apply shape.
+     *
+     * The share dialog needs this to say WHY a verb is off. "Restricted here" is a
+     * fact about this target that only a denial entry carries; without it, a
+     * principal restricted here is indistinguishable from one never granted, and
+     * the dialog cannot offer to lift the restriction.
+     *
+     * Optional so existing test doubles stay valid; the real service implements it.
+     */
+    denialSources?(workspaceId: string, kind: AccessTargetKind, relativePath: string, principal: GrantPrincipal, opts?: {
+        tokenMatch?: 'exact' | 'name';
+    }): Promise<DenialSources>;
+    /**
+     * Every principal DENIED some verb by the target's OWN access file — the
+     * folder's `access.md`, or a file node's own frontmatter.
+     *
+     * The eligible lists cannot report these, by construction: a principal denied
+     * every verb here holds nothing and appears in none of them, yet the
+     * restriction IS an entry on this target and the row it belongs to has to stay
+     * listed. Shaped like an eligible list so the view can union it in without a
+     * second code path.
+     *
+     * Only the target's OWN scope counts. A denial inherited from a parent is
+     * reported per-verb by {@link denialSources} against a row that already
+     * exists; it does not, by itself, put a new row on this target.
+     *
+     * Optional so existing test doubles stay valid; the real service implements it.
+     */
+    locallyDeniedPrincipals?(workspaceId: string, kind: AccessTargetKind, relativePath: string): Promise<{
+        principals: ResolvedPrincipal[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    }>;
+    /**
+     * The caller's own verdict on each verb at a target, and what decided it —
+     * computed by the SAME walk `canRead` / `canWrite` / `canDownload` /
+     * `canOwner` run (their booleans are its `allowed`), so an explanation never
+     * disagrees with an operation. `kind` only decides which scope counts as the
+     * target's own (`inherited: false`).
+     *
+     * Optional so existing test doubles stay valid; the real service implements it.
+     */
+    explainAccess?(workspaceId: string, userEmail: string, kind: AccessTargetKind, relativePath: string): Promise<Record<'read' | 'write' | 'download' | 'owner', AccessDecision>>;
     /**
      * Drop a workspace's cached model. Call after operations that mutate
      * `roles.yaml` / `access.md` (commit, push, pull) or change which copy of
@@ -265,7 +440,7 @@ export interface IAccessControl {
     invalidate(workspaceId: string): void;
     /**
      * Validate a candidate `roles.yaml` text against the resolver's OWN loader,
-     * WITHOUT writing it. The single safety gate behind the admin Roles & Members
+     * WITHOUT writing it. The single safety gate behind the admin App roles
      * surface: `roles.yaml` has no admin-rescue and `loadModel` hard-throws on a
      * parse failure (which `isAdmin` swallows into `false` for everyone), so a
      * malformed write would be a permanent, app-wide, in-app-unrecoverable admin
@@ -295,6 +470,15 @@ export interface IAccessControl {
     kbPrincipals(workspaceId: string): Promise<{
         roles: string[];
         groups: string[];
+        /**
+         * Plugins whose `plugin/<Name>/<verb>` principals exist (personal folders
+         * excluded): the display name and the repo-relative folder, so a caller
+         * can apply the discoverability verdict (`canRead` on `<folder>/access.md`).
+         */
+        plugins: {
+            name: string;
+            folder: string;
+        }[];
         people: {
             name: string;
             email: string;
@@ -353,6 +537,38 @@ export interface IAccessControl {
             email: string;
         }[];
     } | null>;
+    /**
+     * Whether `userEmail` holds the Admin write floor at the repository root —
+     * a member of the Admin role or the deployment owner — in the working-tree
+     * model. The share dialog asks before restricting a PERSON's write at the
+     * root: the floor keeps it, so the deny could only be rolled back.
+     */
+    holdsAdminRootWrite(workspaceId: string, userEmail: string): Promise<boolean>;
+    /**
+     * Whether `userEmail` may put a misplaced platform file back at
+     * `destinationRelativePath` — the ONE write that is allowed to land on a
+     * destination whose own rules would refuse it.
+     *
+     * A repository whose `access.md` or `roles.yaml` was moved out of the root
+     * is one nobody can repair through the app: the root then resolves to
+     * default-deny and the move that would fix it is the move the gate refuses.
+     * So an admin (the `Admin` role or the deployment owner) may move a file
+     * named `roles.yaml`, `.bevelignore` or the agent guide into the repository
+     * root, and a file named `access.md` into a folder that has none.
+     *
+     * Only where the file is MISSING: a destination that already holds it is
+     * false, because a move is a rename on disk and landing on the file would
+     * replace the very rules the exception exists to bring back.
+     *
+     * Narrow on purpose, and the narrowness lives here rather than in the
+     * caller: false for any other path, for any other destination, for a
+     * destination spelled with `..`, and for anyone who is not an admin. It
+     * grants no write anywhere else, and it is asked only about where a move
+     * LANDS — never about what a move takes away, which is why a caller that
+     * could take one away (the move route, the lock gate) also checks the
+     * SOURCE with `isPlatformRestoreShape`.
+     */
+    canRestorePlatformFile(workspaceId: string, userEmail: string, destinationRelativePath: string): Promise<boolean>;
     /**
      * Batched: resolve eligible writers + expanded emails for a list of paths
      * at a specific ref in one model load. Returns null with the same

package/dist/modules/access/access-control.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;;;;OAYG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE7F;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}
+{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,GAAG,EACC,QAAQ,GACR,OAAO,GACP,MAAM,GACN,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,eAAe,GACf,cAAc,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;;;;;OASG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpG;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;;;OAcG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,CACtB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1F;;;;;;;;OAQG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5E;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB;;;;WAIG;QACH,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;OAKG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}

package/dist/modules/access/access-control.service.d.ts

@@ -1,13 +1,16 @@
+import { type ITreeWalker } from '../../shared/fs.contract.js';
+import { type IGitRunner } from '../../shared/git.contract.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import type { IAccessControl, AccessTargetKind, GrantPrincipal, GrantSources, ResolvedPrincipal } from './access-control.interface.js';
+import type { IAccessControl, AccessDecision, AccessTargetKind, DenialSources, GrantPrincipal, GrantSources, ProspectiveHolders, ResolvedPrincipal } from './access-control.interface.js';
 import { type GroupsIndex } from '../access-model/group-files.js';
+import { type Verb } from '../access-model/access-grammar.js';
 /**
  * Health of the ACTIVE groups source as of the last load. `ok: false` means
  * the source EXISTS but could not be read or parsed — groups contribute
  * nothing, bare grant tokens fall through to roles, and group-backed denies
  * drop (the owner's explicit degrade-loudly decision, NOT fail-closed). The
  * marker is carried on the loaded model and surfaced by the groups admin
- * endpoints so the Groups page can banner it.
+ * endpoints so the Groups & Members page can banner it.
  */
 export type GroupsHealth = {
     ok: true;
@@ -23,13 +26,13 @@ export type GroupsHealth = {
  * even when the synced file is empty or malformed — falling back would
  * resurrect retired manual groups); otherwise `groups.yaml` → manual mode.
  *
- * `read` returns null for a genuinely-absent file and may THROW for any other
- * failure. Only ENOENT/ENOTDIR count as absent (the caller may also whitelist
- * them into null); every other read error — notably a non-absence error on
- * `synced-groups.yaml` — is treated as a BROKEN source: no groups, no
- * fallback to the manual file (falling back would resurrect retired groups),
- * and an `ok: false` health marker. Structural parse failures degrade the
- * same way; this function never throws.
+ * `read` returns null for a genuinely-absent file — ENOENT/ENOTDIR, the
+ * reader's judgement through the fs probe — and THROWS for any other failure.
+ * Every thrown error — notably one on `synced-groups.yaml` — is treated as a
+ * BROKEN source: no groups, no fallback to the manual file (falling back
+ * would resurrect retired groups), and an `ok: false` health marker.
+ * Structural parse failures degrade the same way; this function never throws
+ * (except to let an `AccessUnreadableError` through — see below).
  */
 export declare function loadActiveGroups(read: (filename: string) => Promise<string | null>): Promise<{
     groups: GroupsIndex;
@@ -52,6 +55,14 @@ export type ScopeSource = {
 export declare class AccessControlService implements IAccessControl {
     private readonly workspaceService;
     private readonly kbDirName;
+    private readonly disk;
+    /**
+     * How git is run — see `shared/git.contract.ts`. The composition root
+     * passes the one runner; the default is the same runner on its default
+     * deadline, kept for the same reason as `deploymentOwners` above: a great
+     * many fixtures construct this service directly.
+     */
+    private readonly gitRunner;
     /**
      * Per-workspace cache: `model` is the resolved access tree and `loadedAt`
      * is when we computed it. We re-load on a TTL — the validator runs on
@@ -104,14 +115,21 @@ export declare class AccessControlService implements IAccessControl {
      * environment, not from the knowledge base.
      */
     private readonly deploymentOwners;
-    constructor(workspaceService: WorkspaceService, kbDirName: string, 
+    constructor(workspaceService: WorkspaceService, kbDirName: string, disk: ITreeWalker, 
     /**
      * Emails that count as Admin for the two hardcoded `write` rescues,
      * whatever `roles.yaml` says — in practice `ADMIN_EMAIL`. Optional so the
      * many test fixtures that construct this service directly keep their
      * current behaviour (no owner, roles.yaml is the only authority).
      */
-    deploymentOwners?: readonly string[]);
+    deploymentOwners?: readonly string[], 
+    /**
+     * How git is run — see `shared/git.contract.ts`. The composition root
+     * passes the one runner; the default is the same runner on its default
+     * deadline, kept for the same reason as `deploymentOwners` above: a great
+     * many fixtures construct this service directly.
+     */
+    gitRunner?: IGitRunner);
     /**
      * Drop a workspace's cached model + frontmatter memo. Call after operations
      * that mutate the working tree — commit, push, pull, branch switch. The
@@ -119,6 +137,27 @@ export declare class AccessControlService implements IAccessControl {
      * and nothing that happens in a working tree changes what a commit holds.
      */
     invalidate(workspaceId: string): void;
+    /**
+     * Bumped by every `invalidate()`, for any workspace. A model load reads the
+     * tree across many awaits, and an invalidation fires exactly when that tree
+     * changes underneath it: the load that started on the old tree would
+     * otherwise store its model AFTER the drop, and every read for the next TTL
+     * would resolve against a tree that is already gone. `loadModel` takes the
+     * generation before its first read and refuses to store a model fetched
+     * under an older one — the caller that started it still gets its answer,
+     * as old as the moment it started, and the next caller reloads.
+     *
+     * ONE counter, not one per workspace: a per-workspace map would keep an
+     * entry for every branch workspace the process ever loaded, with nothing to
+     * tell it when a workspace is gone. The price of sharing is that a drop on
+     * some other workspace, landing mid-load, costs this one a single reload —
+     * a load is tens of milliseconds and a drop is a commit, so that is rare
+     * and cheap, and it never stores a wrong model. (The own-entries memo needs
+     * no token: it is keyed by the map object a reader took BEFORE its disk
+     * read, and `invalidate()` replaces the map, so a late store lands in an
+     * orphan nobody consults.)
+     */
+    private generation;
     /** Memoized `readOwnEntries` for the batch paths; see `ownEntriesCache`. */
     private cachedOwnEntries;
     /**
@@ -138,6 +177,8 @@ export declare class AccessControlService implements IAccessControl {
     canWrite(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     canRead(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     canReadBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
+    canReadAsGroupBatch(workspaceId: string, group: string, relativePaths: string[]): Promise<Map<string, boolean> | null>;
+    canReadAsEveryoneBatch(workspaceId: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     canWriteBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     canDownload(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     canOwnerBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
@@ -166,6 +207,7 @@ export declare class AccessControlService implements IAccessControl {
             name: string;
             email: string;
         }[];
+        publicVia: string[];
     }>;
     eligibleDownloaders(workspaceId: string, relativePath: string): Promise<{
         principals: ResolvedPrincipal[];
@@ -175,6 +217,19 @@ export declare class AccessControlService implements IAccessControl {
             email: string;
         }[];
     }>;
+    /**
+     * The read and write holders of one file at its current path and at a path
+     * it has not moved to yet (see the interface).
+     *
+     * A move changes nothing about the file's own frontmatter — that travels
+     * with the bytes — and everything about the folder chain above it. So the
+     * hypothetical side is the ordinary resolution with the destination path
+     * substituted: the same model, the same own-entries (read from the SOURCE,
+     * since nothing sits at the destination to read), resolved against the
+     * destination's ancestors. One model load and one file read serve all four
+     * lookups.
+     */
+    prospectiveHolders(workspaceId: string, fromPath: string, toPath: string): Promise<ProspectiveHolders>;
     eligibleWriterEmails(workspaceId: string, relativePath: string): Promise<Map<string, {
         name: string;
         email: string;
@@ -186,9 +241,24 @@ export declare class AccessControlService implements IAccessControl {
     grantSources(workspaceId: string, kind: AccessTargetKind, relativePath: string, principal: GrantPrincipal, opts?: {
         tokenMatch?: 'exact' | 'name';
     }): Promise<GrantSources>;
+    denialSources(workspaceId: string, kind: AccessTargetKind, relativePath: string, principal: GrantPrincipal, opts?: {
+        tokenMatch?: 'exact' | 'name';
+    }): Promise<DenialSources>;
+    locallyDeniedPrincipals(workspaceId: string, kind: AccessTargetKind, relativePath: string): Promise<{
+        principals: ResolvedPrincipal[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    }>;
+    explainAccess(workspaceId: string, userEmail: string, kind: AccessTargetKind, relativePath: string): Promise<Record<Verb, AccessDecision>>;
     kbPrincipals(workspaceId: string): Promise<{
         roles: string[];
         groups: string[];
+        plugins: {
+            name: string;
+            folder: string;
+        }[];
         people: {
             name: string;
             email: string;
@@ -218,6 +288,8 @@ export declare class AccessControlService implements IAccessControl {
             email: string;
         }[];
     } | null>;
+    holdsAdminRootWrite(workspaceId: string, userEmail: string): Promise<boolean>;
+    canRestorePlatformFile(workspaceId: string, userEmail: string, destinationRelativePath: string): Promise<boolean>;
     eligibleWritersForPathsAtRef(workspaceId: string, ref: string, relativePaths: string[]): Promise<Map<string, {
         roles: string[];
         users: {
@@ -228,7 +300,6 @@ export declare class AccessControlService implements IAccessControl {
         excludedEmails?: Set<string>;
     }> | null>;
     private loadModel;
-    private collectAccessFiles;
     private repoDir;
     /**
      * Read the access verbs a file declares FOR ITSELF from the working tree.

package/dist/modules/access/access-control.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EAEd,YAAY,EACZ,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AAiIxC;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQtF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAgDhG;AAUD;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AA6hBhF,qBAAa,oBAAqB,YAAW,cAAc;IA6DvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IA7D5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IAO1C;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAKrC,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAKzE,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAaI,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC;IAyBlB,YAAY,CAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IA2CtF,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCzD;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAKvB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IA0BjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1E,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA+CK,SAAS;YA4FT,kBAAkB;YA0ClB,OAAO;IAKrB;;;;;;;OAOG;YACW,cAAc;IAe5B;;;;;OAKG;YACW,mBAAmB;IAYjC;;;;;;;OAOG;YACW,wBAAwB;IAqBtC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;;OAMG;YACW,SAAS;IAKvB;;;;;;OAMG;YACW,gBAAgB;IA2B9B;;;;;;OAMG;YACW,oBAAoB;IAmBlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IAwC5B,iFAAiF;YACnE,cAAc;IAe5B,OAAO,CAAC,aAAa;IAQrB;;;;;;;OAOG;YACW,kBAAkB;CAyFjC"}
+{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,KAAK,WAAW,EAAqB,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAG7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EAEd,gBAAgB,EAChB,aAAa,EACb,cAAc,EAEd,YAAY,EAEZ,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AAQvC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAoBL,KAAK,IAAI,EACV,MAAM,mCAAmC,CAAC;AAsF3C;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA2ChG;AAUD;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAm+BhF,qBAAa,oBAAqB,YAAW,cAAc;IA6DvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAQrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;IA5E5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IACxC;;;;;OAKG;IACc,SAAS,GAAE,UAAgC;IAO9D;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,UAAU,CAAK;IAEvB,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAKzE,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAejC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAenG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAyBI,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMF;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC;IA8BxB,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC;IAyBlB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC;IAwBnB,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAkDnF,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAgBlC,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC;IA+DI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCzD;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAKvB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IA0BjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1E,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7E,sBAAsB,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC;IAuCb,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA+CK,SAAS;YAuGT,OAAO;IAKrB;;;;;;;OAOG;YACW,cAAc;IAe5B;;;;;OAKG;YACW,mBAAmB;IAYjC;;;;;;;OAOG;YACW,wBAAwB;IAqBtC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;;OAMG;YACW,SAAS;IAKvB;;;;;;OAMG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;YACW,oBAAoB;IAsBlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IAwC5B,iFAAiF;YACnE,cAAc;IAoB5B,OAAO,CAAC,aAAa;IAQrB;;;;;;;OAOG;YACW,kBAAkB;CAoGjC"}