@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/dist/modules/access/access-control.interface.d.ts

@@ -93,13 +93,20 @@ export type PathHolders = {
     write: HolderList;
 };
 /**
- * One file's holders where it is now and where a move would put it — see
- * {@link IAccessControl.prospectiveHolders}.
+ * One file's or folder's holders where it is now and where a move would put
+ * it — see {@link IAccessControl.prospectiveHolders}.
  */
 export type ProspectiveHolders = {
     before: PathHolders;
     after: PathHolders;
 };
+/** One caller's own verdict per access verb on one path. */
+export type PathVerbs = {
+    read: boolean;
+    write: boolean;
+    download: boolean;
+    owner: boolean;
+};
 /**
  * Per-verb sources of a principal's access on a target. Only verbs the principal
  * actually holds (via a named file entry) appear; each maps to the closest-first
@@ -316,21 +323,44 @@ export interface IAccessControl {
         }[];
     }>;
     /**
-     * Who can open and who can edit one file where it IS, and where a move
-     * would put it. `toPath` names a path that does not exist yet — the point
-     * of the call is to answer before the move happens — so the resolution
-     * layers the file's OWN rules (its frontmatter, read from `fromPath`,
-     * which travels with the bytes) over the destination's folder chain.
+     * Who can open and who can edit one file or folder where it IS, and where a
+     * move would put it. `toPath` names a path that does not exist yet — the
+     * point of the call is to answer before the move happens — so the
+     * resolution is over what travels with the bytes: a file's OWN rules (its
+     * frontmatter, read from `fromPath`) layered over the destination's folder
+     * chain, or a folder's `access.md` files keyed at the directories they
+     * land in. Either way the rules the source inherited from its old parent
+     * are left behind and the new parent's apply.
      *
      * Writes nothing and moves nothing. The move confirmation diffs the two
      * sides to name who loses and who gains access.
-     *
-     * A FILE question only: a `fromPath` that is a directory is refused with a
-     * 400. A folder's access is its own `access.md` — which moves with it and
-     * governs everything beneath it — so resolving it as a file would name the
-     * wrong principals with the same confidence as the right ones.
      */
     prospectiveHolders(workspaceId: string, fromPath: string, toPath: string): Promise<ProspectiveHolders>;
+    /**
+     * The CALLER'S OWN `{ read, write, download, owner }` at `toPath` as they
+     * will be once `fromPath` has been moved (`sourceRemains: false`, the
+     * default) or copied (`sourceRemains: true`) there — the question a move's
+     * or copy's dry run asks, which the same four gates at `toPath` cannot
+     * answer because what travels with the bytes is not at the destination yet:
+     * the `access.md` files inside a folder, keyed at the directories they land
+     * in, and a file's own frontmatter.
+     *
+     * What a single file's rules GOVERN follows the name it lands under, not the
+     * one it leaves: landing as a directory's `access.md` they are that
+     * directory's rules (so copying `Sales/access.md` to `Legal/access.md`
+     * previews the access `Legal/` is about to have), and landing under any
+     * other name they are the file's own and govern nothing but it. Either way
+     * the answer is the one the gates will give a moment later.
+     *
+     * PREVIEW ONLY. It describes a tree that does not exist, so it must never
+     * decide whether an operation may run: the gates keep resolving against the
+     * tree that does. It writes nothing and moves nothing, and it answers the
+     * caller's own verbs only — never the content of an `access.md` they may
+     * not read.
+     */
+    previewAccessAfterRelocation(workspaceId: string, userEmail: string, fromPath: string, toPath: string, opts?: {
+        sourceRemains?: boolean;
+    }): Promise<PathVerbs>;
     /**
      * Finite expanded email set for configured users who could approve this path
      * — role members + direct user grants, minus anyone denied. The built-in

package/dist/modules/access/access-control.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,GAAG,EACC,QAAQ,GACR,OAAO,GACP,MAAM,GACN,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,eAAe,GACf,cAAc,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;;;;;OASG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpG;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;;;OAcG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,CACtB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1F;;;;;;;;OAQG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5E;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB;;;;WAIG;QACH,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;OAKG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}
+{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,GAAG,EACC,QAAQ,GACR,OAAO,GACP,MAAM,GACN,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,eAAe,GACf,cAAc,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;;;;;OASG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpG;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;;;OAcG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,CACtB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1F;;;;;;;;OAQG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5E;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB;;;;WAIG;QACH,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;OAKG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}

package/dist/modules/access/access-control.service.d.ts

@@ -1,7 +1,7 @@
 import { type ITreeWalker } from '../../shared/fs.contract.js';
 import { type IGitRunner } from '../../shared/git.contract.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import type { IAccessControl, AccessDecision, AccessTargetKind, DenialSources, GrantPrincipal, GrantSources, ProspectiveHolders, ResolvedPrincipal } from './access-control.interface.js';
+import type { IAccessControl, AccessDecision, AccessTargetKind, DenialSources, GrantPrincipal, GrantSources, PathVerbs, ProspectiveHolders, ResolvedPrincipal } from './access-control.interface.js';
 import type { KbContext } from '../../shared/kb-context.js';
 import { type GroupsIndex } from '../access-model/group-files.js';
 import { type Verb } from '../access-model/access-grammar.js';
@@ -235,18 +235,48 @@ export declare class AccessControlService implements IAccessControl {
         }[];
     }>;
     /**
-     * The read and write holders of one file at its current path and at a path
-     * it has not moved to yet (see the interface).
+     * The read and write holders of one file or folder at its current path and
+     * at a path it has not moved to yet (see the interface).
      *
-     * A move changes nothing about the file's own frontmatter — that travels
-     * with the bytes — and everything about the folder chain above it. So the
-     * hypothetical side is the ordinary resolution with the destination path
-     * substituted: the same model, the same own-entries (read from the SOURCE,
-     * since nothing sits at the destination to read), resolved against the
-     * destination's ancestors. One model load and one file read serve all four
-     * lookups.
+     * A move changes nothing about what the thing itself carries — a file's
+     * frontmatter and a folder's `access.md` files travel with the bytes — and
+     * everything about the folder chain above it. So the hypothetical side is
+     * the ordinary resolution at the destination path, over what travels:
+     *
+     * - a FILE's own-entries, read from the SOURCE (nothing sits at the
+     *   destination to read) and parsed as the name they LAND under, layered
+     *   over the destination's ancestors — the two sides can differ, because
+     *   the same frontmatter is a folder's rules in an `access.md` and the
+     *   file's own anywhere else;
+     * - a FOLDER's `access.md` files, keyed at the directories they land in,
+     *   and a file landing as a directory's `access.md` at the directory it
+     *   lands in (`withRelocatedAccessFiles`). A folder has no frontmatter of
+     *   its own, so it passes none.
+     *
+     * One model load and one file read serve all four lookups.
      */
     prospectiveHolders(workspaceId: string, fromPath: string, toPath: string): Promise<ProspectiveHolders>;
+    /**
+     * The caller's own verbs at `toPath` as they will be once `fromPath` has
+     * been moved or copied there (see the interface).
+     *
+     * Identical to asking `canRead`/`canWrite`/`canDownload`/`canOwner` at
+     * `toPath` whenever nothing travels — an ordinary file with no rules of its
+     * own, or a folder with no `access.md` of its own — so the cases this was
+     * not written for answer exactly as they always did.
+     *
+     * What travels is what `prospectiveHolders` says travels, and for the same
+     * reason: the preview and the dialog's holder lists must not disagree about
+     * one move. A file's own-entries come from the SOURCE, where the bytes
+     * carrying them still are — asking the destination, which does not exist
+     * yet, always answered null and so dropped the frontmatter a rename hands
+     * straight back (requirement 6: what the caller has afterwards equals what
+     * the preview said) — and they are parsed as the name they LAND under,
+     * because that is the parse the gates will use a moment later.
+     */
+    previewAccessAfterRelocation(workspaceId: string, userEmail: string, fromPath: string, toPath: string, opts?: {
+        sourceRemains?: boolean;
+    }): Promise<PathVerbs>;
     eligibleWriterEmails(workspaceId: string, relativePath: string): Promise<Map<string, {
         name: string;
         email: string;
@@ -327,6 +357,33 @@ export declare class AccessControlService implements IAccessControl {
      * its frontmatter IS the folder rules the dir chain already applies.
      */
     private readOwnEntries;
+    /**
+     * What a move or a copy of `fromPath` to `toPath` CARRIES — the one disk
+     * read both preview surfaces need:
+     *
+     * - `isFolder`: the source is a folder, so the `access.md` files under it
+     *   travel, keyed at the directories they land in;
+     * - `ownHere` / `ownThere`: a file's own-entries as the SOURCE's name reads
+     *   them and as the DESTINATION's name will. They differ because the same
+     *   frontmatter means two things by name (see `ownEntriesFromText`), so
+     *   `Sales/access.md` copied to `Legal/rules-copy.md` arrives as an
+     *   ordinary file whose frontmatter is its own — reading it as the source's
+     *   name had the preview contradict the copy it was previewing;
+     * - `landing`: the folder rules the bytes WILL be, when they land under the
+     *   name `access.md`. Parsed as the destination path, so the directory it
+     *   governs is already the right one. An `access.md` that will not parse
+     *   travels as nothing, as the loader treats it.
+     *
+     * `lstat`, not `stat`: a SYMLINK is none of this. `move_file` refuses a
+     * symlink source outright, so a link to a directory must not be previewed
+     * as a folder taking access files along, and nothing is read THROUGH the
+     * link either — the link's target is not what would move.
+     *
+     * Only absence is an answer (see `isAbsence`): a probe that failed on
+     * permissions or I/O does not say "this is a file", and reading a folder as
+     * one would resolve it through frontmatter it does not have.
+     */
+    private relocationSubject;
     /**
      * Same as `readOwnEntries` but reads the file at a specific git ref. The ref
      * MUST be the same one the dir model was loaded at — otherwise a user could

package/dist/modules/access/access-control.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,KAAK,WAAW,EAAqB,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAG7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EAEd,gBAAgB,EAChB,aAAa,EACb,cAAc,EAEd,YAAY,EAEZ,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AAQvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAI5D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAoBL,KAAK,IAAI,EACV,MAAM,mCAAmC,CAAC;AAsF3C;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA2ChG;AAUD;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAo+BhF,qBAAa,oBAAqB,YAAW,cAAc;IA6DvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAQrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE;IApFrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IACxC;;;;;OAKG;IACc,SAAS,GAAE,UAAgC;IAC5D;;;;;;OAMG;IACc,EAAE,GAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAiC;IAOhF;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,UAAU,CAAK;IAEvB,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAKzE,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAejC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAenG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAyBI,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMF;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC;IA8BxB,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC;IAyBlB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC;IAwBnB,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAkDnF,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAgBlC,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC;IA+DI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCzD;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAKvB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IA0BjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1E,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7E,sBAAsB,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC;IAuCb,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA+CK,SAAS;YAuGT,OAAO;IAKrB;;;;;;;OAOG;YACW,cAAc;IAe5B;;;;;OAKG;YACW,mBAAmB;IAYjC;;;;;;;OAOG;YACW,wBAAwB;IAqBtC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;;OAMG;YACW,SAAS;IAKvB;;;;;;OAMG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;YACW,oBAAoB;IAuBlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IAwC5B,iFAAiF;YACnE,cAAc;IAoB5B,OAAO,CAAC,aAAa;IAQrB;;;;;;;OAOG;YACW,kBAAkB;CAoGjC"}
+{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,KAAK,WAAW,EAAqB,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAGnG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EAEd,gBAAgB,EAChB,aAAa,EACb,cAAc,EAEd,YAAY,EAEZ,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AAQvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAoBL,KAAK,IAAI,EACV,MAAM,mCAAmC,CAAC;AA4F3C;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA2ChG;AAUD;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AA6jChF,qBAAa,oBAAqB,YAAW,cAAc;IA6DvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAQrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE;IApFrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IACxC;;;;;OAKG;IACc,SAAS,GAAE,UAAgC;IAC5D;;;;;;OAMG;IACc,EAAE,GAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAiC;IAOhF;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,UAAU,CAAK;IAEvB,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAKzE,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAejC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAenG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAyBI,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC;IAoB9B;;;;;;;;;;;;;;;;;OAiBG;IACG,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,SAAS,CAAC;IAmBf,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC;IAyBlB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC;IAwBnB,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAkDnF,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAgBlC,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC;IA+DI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCzD;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAKvB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IA0BjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1E,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7E,sBAAsB,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC;IAuCb,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA+CK,SAAS;YAuGT,OAAO;IAKrB;;;;;;;OAOG;YACW,cAAc;IAc5B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,iBAAiB;IAoC/B;;;;;OAKG;YACW,mBAAmB;IAYjC;;;;;;;OAOG;YACW,wBAAwB;IAqBtC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;;OAMG;YACW,SAAS;IAKvB;;;;;;OAMG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;YACW,oBAAoB;IAuBlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IAwC5B,iFAAiF;YACnE,cAAc;IAoB5B,OAAO,CAAC,aAAa;IAQrB;;;;;;;OAOG;YACW,kBAAkB;CAoGjC"}

package/dist/modules/access/access-control.service.js

@@ -3,12 +3,11 @@ import path from 'node:path';
 import { logger } from '../../shared/logging.js';
 const log = logger('access');
 import { isAbsence } from '../../shared/fs.contract.js';
-import { isGitTimeout } from '../../shared/git.contract.js';
+import { assertOneSpecPerLine, isGitTimeout } from '../../shared/git.contract.js';
 import { hashEmail } from '../../shared/email-identity.js';
 import { NodeGitRunner } from '../workflow/git/node-git-runner.js';
 import { DEFAULT_KB_LAYOUT, PLUGIN_MANIFEST_FILE, isPersonalPluginDir, pluginIdentityOf, platformRestoreDestination, } from '@bevel-software/platform-shared';
 import { AccessConfigError, AccessUnreadableError } from '../access-model/access-errors.js';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { synthesizePluginPrincipals } from '../access-model/plugin-principals.js';
 import { GROUPS_YAML, SYNCED_GROUPS_YAML, parseGroupsFile, } from '../access-model/group-files.js';
 import { ADMIN_CANONICAL, EVERYONE_CANONICAL, EVERYONE_DISPLAY, KNOWN_VERBS, ROLE_TOKEN_PREFIX, accessMdSelfEntries, canonicalEmail, canonicalRoleName, isAccessMdPath, mergeGroupsIntoRoles, parseAccessFile, parseOwnAccessEntries, parseRolesYaml, requiredVerbsFor, sourceVerbsFor, } from '../access-model/access-grammar.js';
@@ -24,6 +23,12 @@ import { DIRECTORY_SYNC_BOT_EMAIL, DIRECTORY_SYNC_BOT_NAME, } from './directory-
 async function catFileBatch(runner, repoDir, specs) {
     // Bytes, not text: every `<size>` in the header counts bytes, and the walk
     // below has to step by that count through content that is not all ASCII.
+    // One spec per LINE is the protocol, and this walk depends on getting back
+    // exactly as many answers as it sent: a spec carrying a line break would
+    // insert an extra answer and shift every result after it, so each directory
+    // would be handed the NEXT one's `access.md`. Paths are refused a control
+    // character at the normaliser; this is the fence at the protocol.
+    assertOneSpecPerLine(specs);
     const { stdout: out } = await runner.run(repoDir, ['cat-file', '--batch'], {
         input: `${specs.join('\n')}\n`,
         encoding: 'buffer',
@@ -723,6 +728,95 @@ function resolveDenialSourcesForVerb(model, verb, kind, relativePath, principal,
     }
     return out;
 }
+/**
+ * The model as it will be once `fromPath` has been moved or copied to
+ * `toPath`: every `access.md` the operation carries, keyed at the directory
+ * it lands in, since the rules a folder carries travel with its bytes.
+ *
+ * What travels is BYTES, and the name they land under decides what they
+ * govern — `landing` is the caller's answer to that (see
+ * `relocationSubject`), already parsed as the destination path:
+ *
+ * - a FOLDER takes every `access.md` at or under it, each re-keyed to the
+ *   directory it lands in, and `landing` plays no part;
+ * - a FILE governs a directory exactly when it lands as that directory's
+ *   `access.md`, whatever it was called before — a copy `copy_file` allows,
+ *   and one that governs the destination folder the moment it lands. Its key
+ *   is a PARENT directory, never a path under `fromPath`, which is why the
+ *   prefix walk above cannot see it.
+ *
+ * The emptied side is the mirror: an `access.md` that MOVES stops governing
+ * the directory it left, whether or not it governs anything where it lands.
+ *
+ * PREVIEW ONLY. Nothing here reads disk and nothing here decides whether an
+ * operation may run — the gates resolve against the model as it IS. This
+ * answers the other question, the one a dry run asks: what will be true
+ * afterwards. Judging the destination as it stands today is what made a
+ * rename warn about losing the owner access the folder's own `access.md` was
+ * about to hand straight back.
+ *
+ * `sourceRemains` is the difference between a copy and a move: a copy leaves
+ * the rules where they were, a move takes them away. It changes the answer
+ * only when the destination resolves through a directory the source
+ * occupied; nothing else consults those keys.
+ */
+function withRelocatedAccessFiles(model, fromPath, toPath, opts) {
+    /** Directories the operation takes an `access.md` AWAY from. */
+    const emptied = [];
+    /** Directories it leaves one IN, with the file as it will be read there. */
+    const landing = [];
+    if (opts.sourceIsFolder) {
+        for (const [dir, file] of model.accessFilesByDir) {
+            if (dir !== fromPath && !dir.startsWith(`${fromPath}/`))
+                continue;
+            emptied.push(dir);
+            landing.push({ toDir: `${toPath}${dir.slice(fromPath.length)}`, file });
+        }
+    }
+    else {
+        const fromDir = parentDirOf(fromPath);
+        if (isAccessMdPath(fromPath) && model.accessFilesByDir.has(fromDir))
+            emptied.push(fromDir);
+        if (opts.landing)
+            landing.push({ toDir: parentDirOf(toPath), file: opts.landing });
+    }
+    if (emptied.length === 0 && landing.length === 0)
+        return model;
+    const accessFilesByDir = new Map(model.accessFilesByDir);
+    if (!opts.sourceRemains)
+        for (const dir of emptied)
+            accessFilesByDir.delete(dir);
+    for (const { toDir, file } of landing) {
+        // A directory that already has an `access.md` keeps it. The operation
+        // would be refused for landing on something that exists long before the
+        // two files could meet, so the model must not invent a merge either.
+        if (accessFilesByDir.has(toDir))
+            continue;
+        accessFilesByDir.set(toDir, {
+            ...file,
+            dir: toDir,
+            path: toDir ? `${toDir}/access.md` : 'access.md',
+        });
+    }
+    return { ...model, accessFilesByDir };
+}
+/** The directory a repo-relative file path sits in; `''` for the repo root. */
+function parentDirOf(relativePath) {
+    const cut = relativePath.lastIndexOf('/');
+    return cut === -1 ? '' : relativePath.slice(0, cut);
+}
+/**
+ * One file's own-entries, parsed as the path `asName` would be read.
+ *
+ * The same frontmatter means two different things by name: in an `access.md`
+ * it is the FOLDER's rules (and the file governs itself only through the
+ * body format — see {@link accessMdSelfEntries}), and anywhere else it is the
+ * file's own. Which is why a preview must read the bytes as the name they
+ * LAND under, not the one they are leaving.
+ */
+function ownEntriesFromText(text, asName) {
+    return isAccessMdPath(asName) ? accessMdSelfEntries(text) : parseOwnAccessEntries(text);
+}
 /**
  * Build the repo-root → path chain of directory scopes that govern
  * `relativePath`, e.g. `Knowledge/Sales/Foo.md` →
@@ -1230,43 +1324,73 @@ export class AccessControlService {
         return eligibleHoldersResolved(model, 'download', relativePath, own);
     }
     /**
-     * The read and write holders of one file at its current path and at a path
-     * it has not moved to yet (see the interface).
+     * The read and write holders of one file or folder at its current path and
+     * at a path it has not moved to yet (see the interface).
+     *
+     * A move changes nothing about what the thing itself carries — a file's
+     * frontmatter and a folder's `access.md` files travel with the bytes — and
+     * everything about the folder chain above it. So the hypothetical side is
+     * the ordinary resolution at the destination path, over what travels:
      *
-     * A move changes nothing about the file's own frontmatter — that travels
-     * with the bytes — and everything about the folder chain above it. So the
-     * hypothetical side is the ordinary resolution with the destination path
-     * substituted: the same model, the same own-entries (read from the SOURCE,
-     * since nothing sits at the destination to read), resolved against the
-     * destination's ancestors. One model load and one file read serve all four
-     * lookups.
+     * - a FILE's own-entries, read from the SOURCE (nothing sits at the
+     *   destination to read) and parsed as the name they LAND under, layered
+     *   over the destination's ancestors — the two sides can differ, because
+     *   the same frontmatter is a folder's rules in an `access.md` and the
+     *   file's own anywhere else;
+     * - a FOLDER's `access.md` files, keyed at the directories they land in,
+     *   and a file landing as a directory's `access.md` at the directory it
+     *   lands in (`withRelocatedAccessFiles`). A folder has no frontmatter of
+     *   its own, so it passes none.
+     *
+     * One model load and one file read serve all four lookups.
      */
     async prospectiveHolders(workspaceId, fromPath, toPath) {
         const model = await this.loadModel(workspaceId);
         const repoDir = await this.repoDir(workspaceId);
-        // A FILE question only. A folder carries its own `access.md` — which moves
-        // with it and governs everything under it — so resolving it as a file
-        // would read frontmatter it does not have and omit the rules it does,
-        // naming principals that are not the ones a folder move changes. Refuse
-        // rather than answer the wrong question convincingly.
-        //
-        // Only absence is an answer here (see `isAbsence`): a probe that failed on
-        // permissions or I/O does not say "this is a file", and folding it into
-        // one would let the very case above through on an unreadable source.
-        const fromStat = await fs.stat(path.join(repoDir, fromPath)).catch((err) => {
-            if (isAbsence(err))
-                return null;
-            throw err;
+        const { isFolder, ownHere, ownThere, landing } = await this.relocationSubject(repoDir, fromPath, toPath);
+        const after = withRelocatedAccessFiles(model, fromPath, toPath, {
+            sourceRemains: false,
+            sourceIsFolder: isFolder,
+            landing,
         });
-        if (fromStat?.isDirectory()) {
-            throw new WorkflowDomainError('prospective access answers for a file, not a folder', 400);
-        }
-        const own = await this.readOwnEntries(repoDir, fromPath);
-        const holdersAt = (relativePath) => ({
-            read: eligibleHoldersResolved(model, 'read', relativePath, own),
-            write: eligibleHoldersResolved(model, 'write', relativePath, own),
+        const holdersAt = (m, relativePath, own) => ({
+            read: eligibleHoldersResolved(m, 'read', relativePath, own),
+            write: eligibleHoldersResolved(m, 'write', relativePath, own),
         });
-        return { before: holdersAt(fromPath), after: holdersAt(toPath) };
+        return {
+            before: holdersAt(model, fromPath, ownHere),
+            after: holdersAt(after, toPath, ownThere),
+        };
+    }
+    /**
+     * The caller's own verbs at `toPath` as they will be once `fromPath` has
+     * been moved or copied there (see the interface).
+     *
+     * Identical to asking `canRead`/`canWrite`/`canDownload`/`canOwner` at
+     * `toPath` whenever nothing travels — an ordinary file with no rules of its
+     * own, or a folder with no `access.md` of its own — so the cases this was
+     * not written for answer exactly as they always did.
+     *
+     * What travels is what `prospectiveHolders` says travels, and for the same
+     * reason: the preview and the dialog's holder lists must not disagree about
+     * one move. A file's own-entries come from the SOURCE, where the bytes
+     * carrying them still are — asking the destination, which does not exist
+     * yet, always answered null and so dropped the frontmatter a rename hands
+     * straight back (requirement 6: what the caller has afterwards equals what
+     * the preview said) — and they are parsed as the name they LAND under,
+     * because that is the parse the gates will use a moment later.
+     */
+    async previewAccessAfterRelocation(workspaceId, userEmail, fromPath, toPath, opts) {
+        const repoDir = await this.repoDir(workspaceId);
+        const { isFolder, ownThere: own, landing } = await this.relocationSubject(repoDir, fromPath, toPath);
+        const model = withRelocatedAccessFiles(await this.loadModel(workspaceId), fromPath, toPath, { sourceRemains: opts?.sourceRemains === true, sourceIsFolder: isFolder, landing });
+        const machineOwned = this.machineOwnedWriteRule(userEmail, toPath);
+        return {
+            read: canReadResolved(model, userEmail, toPath, own),
+            write: machineOwned ?? hasPermissionResolved(model, 'write', userEmail, toPath, own),
+            download: hasPermissionResolved(model, 'download', userEmail, toPath, own),
+            owner: hasPermissionResolved(model, 'owner', userEmail, toPath, own),
+        };
     }
     async eligibleWriterEmails(workspaceId, relativePath) {
         const model = await this.loadModel(workspaceId);
@@ -1744,9 +1868,64 @@ export class AccessControlService {
         catch {
             return null;
         }
-        if (isAccessMdPath(relativePath))
-            return accessMdSelfEntries(text);
-        return parseOwnAccessEntries(text);
+        return ownEntriesFromText(text, relativePath);
+    }
+    /**
+     * What a move or a copy of `fromPath` to `toPath` CARRIES — the one disk
+     * read both preview surfaces need:
+     *
+     * - `isFolder`: the source is a folder, so the `access.md` files under it
+     *   travel, keyed at the directories they land in;
+     * - `ownHere` / `ownThere`: a file's own-entries as the SOURCE's name reads
+     *   them and as the DESTINATION's name will. They differ because the same
+     *   frontmatter means two things by name (see `ownEntriesFromText`), so
+     *   `Sales/access.md` copied to `Legal/rules-copy.md` arrives as an
+     *   ordinary file whose frontmatter is its own — reading it as the source's
+     *   name had the preview contradict the copy it was previewing;
+     * - `landing`: the folder rules the bytes WILL be, when they land under the
+     *   name `access.md`. Parsed as the destination path, so the directory it
+     *   governs is already the right one. An `access.md` that will not parse
+     *   travels as nothing, as the loader treats it.
+     *
+     * `lstat`, not `stat`: a SYMLINK is none of this. `move_file` refuses a
+     * symlink source outright, so a link to a directory must not be previewed
+     * as a folder taking access files along, and nothing is read THROUGH the
+     * link either — the link's target is not what would move.
+     *
+     * Only absence is an answer (see `isAbsence`): a probe that failed on
+     * permissions or I/O does not say "this is a file", and reading a folder as
+     * one would resolve it through frontmatter it does not have.
+     */
+    async relocationSubject(repoDir, fromPath, toPath) {
+        const nothing = { isFolder: false, ownHere: null, ownThere: null, landing: null };
+        const fromStat = await fs.lstat(path.join(repoDir, fromPath)).catch((err) => {
+            if (isAbsence(err))
+                return null;
+            throw err;
+        });
+        if (fromStat?.isSymbolicLink() === true)
+            return nothing;
+        if (fromStat?.isDirectory() === true)
+            return { ...nothing, isFolder: true };
+        // `roles.yaml` carries no own-entries wherever it sits, exactly as
+        // `readOwnEntries` has it; a read that fails for any reason is no rules,
+        // which is what the gates would say about the same file.
+        if (fromPath === 'roles.yaml' || toPath === 'roles.yaml')
+            return nothing;
+        let text;
+        try {
+            text = await fs.readFile(path.join(repoDir, fromPath), 'utf-8');
+        }
+        catch {
+            return nothing;
+        }
+        const parsed = isAccessMdPath(toPath) ? parseAccessFile(text, toPath) : null;
+        return {
+            isFolder: false,
+            ownHere: ownEntriesFromText(text, fromPath),
+            ownThere: ownEntriesFromText(text, toPath),
+            landing: parsed?.ok === true ? parsed.file : null,
+        };
     }
     /**
      * Same as `readOwnEntries` but reads the file at a specific git ref. The ref