@bevel-software/platform-core-backend 0.33.0 → 0.35.0

package/dist/modules/access/access-control.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,GAAG,EACC,QAAQ,GACR,OAAO,GACP,MAAM,GACN,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,eAAe,GACf,cAAc,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;;;;;OASG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpG;;;;;;OAMG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAExE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEpG;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;;;OAcG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,CACtB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1F;;;;;;;;OAQG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5E;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB;;;;WAIG;QACH,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;;;OAOG;IACH,iBAAiB,CACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;OAKG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E;;;;;;;OAOG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}
+{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAE7E,+HAA+H;AAC/H,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,mIAAmI;AACnI,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAAC,IAAI,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC;AAE3E,4DAA4D;AAC5D,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,GAAG,EACC,QAAQ,GACR,OAAO,GACP,MAAM,GACN,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,eAAe,GACf,cAAc,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;;;;;OASG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpG;;;;;;OAMG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAExE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEpG;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;;;OAcG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;;;;;;OAQG;IACH,wBAAwB,CACtB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CAAC,CACtB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1F;;;;;;;;OAQG;IACH,aAAa,CAAC,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5E;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB;;;;WAIG;QACH,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;;;OAOG;IACH,iBAAiB,CACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;OAKG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E;;;;;;;OAOG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}

package/dist/modules/access/access-control.service.d.ts

@@ -1,10 +1,9 @@
 import { type ITreeWalker } from '../../shared/fs.contract.js';
 import { type IGitRunner } from '../../shared/git.contract.js';
 import type { WorkspaceService } from '../workspace/index.js';
-import type { IAccessControl, AccessDecision, AccessTargetKind, DenialSources, GrantPrincipal, GrantSources, PathVerbs, ProspectiveHolders, ResolvedPrincipal } from './access-control.interface.js';
+import type { IAccessControl, AccessDecision, AccessTargetKind, DenialSources, GrantPrincipal, GrantSources, PathVerbs, HolderChanges, ProspectiveHolders, ResolvedPrincipal } from './access-control.interface.js';
 import type { KbContext } from '../../shared/kb-context.js';
-import { type GroupsIndex } from '../access-model/index.js';
-import { type Verb } from '../access-model/index.js';
+import { type GroupsIndex, type Verb } from '../access-model/index.js';
 /**
  * Health of the ACTIVE groups source as of the last load. `ok: false` means
  * the source EXISTS but could not be read or parsed — groups contribute
@@ -296,6 +295,8 @@ export declare class AccessControlService implements IAccessControl {
      * One model load and one file read serve all four lookups.
      */
     prospectiveHolders(workspaceId: string, fromPath: string, toPath: string): Promise<ProspectiveHolders>;
+    /** Who loses and who gains `read` or `write` in a move (see the interface). */
+    prospectiveHolderChanges(workspaceId: string, fromPath: string, toPath: string): Promise<HolderChanges>;
     /**
      * The caller's own verbs at `toPath` as they will be once `fromPath` has
      * been moved or copied there (see the interface).
@@ -316,6 +317,7 @@ export declare class AccessControlService implements IAccessControl {
      */
     previewAccessAfterRelocation(workspaceId: string, userEmail: string, fromPath: string, toPath: string, opts?: {
         sourceRemains?: boolean;
+        sourceContent?: string;
     }): Promise<PathVerbs>;
     eligibleWriterEmails(workspaceId: string, relativePath: string): Promise<Map<string, {
         name: string;
@@ -397,6 +399,10 @@ export declare class AccessControlService implements IAccessControl {
      * in the new (body-governed) format, where its frontmatter is self-access —
      * see {@link accessMdSelfEntries}. A legacy `access.md` still yields null:
      * its frontmatter IS the folder rules the dir chain already applies.
+     *
+     * Any other file declares them in its frontmatter alone, so only as much of
+     * it is read as the frontmatter takes (see {@link frontmatterHead}): a batch
+     * over a tree of megabyte transcripts reads a line of each, not the tree.
      */
     private readOwnEntries;
     /**
@@ -424,6 +430,12 @@ export declare class AccessControlService implements IAccessControl {
      * Only absence is an answer (see `isAbsence`): a probe that failed on
      * permissions or I/O does not say "this is a file", and reading a folder as
      * one would resolve it through frontmatter it does not have.
+     *
+     * `sourceContent` is the text of a source that is NO repository path — a
+     * file staged in the workspace's `tmp/` folder, which `copy_file` lands in
+     * the repository. Nothing is probed on disk for it: it is one file by the
+     * ref's own rule, and its text is read exactly as a repository file's is,
+     * so the copy previews the rules it carries in.
      */
     private relocationSubject;
     /**

package/dist/modules/access/access-control.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,KAAK,WAAW,EAAqB,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAmD,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAIhH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EAEd,gBAAgB,EAChB,aAAa,EACb,cAAc,EAEd,YAAY,EAEZ,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AAQvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAoBL,KAAK,IAAI,EACV,MAAM,0BAA0B,CAAC;AA2HlC;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA2ChG;AAUD;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AA2lChF,qBAAa,oBAAqB,YAAW,cAAc;IAyFvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAQrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE;IAhHrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAO;IAE/C;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwC;IAC3E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAU;IAC3D,2FAA2F;IAC3F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IACtD,yGAAyG;IACzG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,aAAa,CAAK;IAE1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IACxC;;;;;OAKG;IACc,SAAS,GAAE,UAAgC;IAC5D;;;;;;OAMG;IACc,EAAE,GAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAiC;IAC9E;;;;;OAKG;IACH,MAAM,GAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO;IASvE;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,UAAU,CAAK;IAEvB,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAKzE,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAejC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAenG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOnG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAyBI,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC;IAoB9B;;;;;;;;;;;;;;;;;OAiBG;IACG,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,SAAS,CAAC;IAmBf,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC;IAyBlB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC;IAwBnB,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAkDnF,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAgBlC,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC;IA+DI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCzD;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAKvB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IA0BjC,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAgBjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1E,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7E,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmBnD,sBAAsB,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC;IAuCb,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA+CK,SAAS;YAuGT,OAAO;IAKrB;;;;;;;OAOG;YACW,cAAc;IAc5B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,iBAAiB;IAoC/B;;;;;OAKG;YACW,mBAAmB;IAkBjC;;;;;;;OAOG;YACW,wBAAwB;IAkDtC,OAAO,CAAC,0BAA0B;IAQlC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;;OAMG;YACW,SAAS;IAKvB;;;;;;OAMG;YACW,gBAAgB;IAmB9B;;;;;;;;;OASG;YACW,oBAAoB;IA8BlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IA4C5B,iFAAiF;YACnE,cAAc;IA4B5B,OAAO,CAAC,aAAa;IAqBrB,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;;;;;;;;;;;OAgBG;YACW,kBAAkB;CAyJjC"}
+{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAa,KAAK,WAAW,EAAqB,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAmD,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAIhH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EAEd,gBAAgB,EAChB,aAAa,EACb,cAAc,EAEd,YAAY,EAEZ,SAAS,EAET,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AASvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAwBL,KAAK,WAAW,EAKhB,KAAK,IAAI,EACV,MAAM,0BAA0B,CAAC;AA2HlC;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA2ChG;AAUD;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AA4tChF,qBAAa,oBAAqB,YAAW,cAAc;IAyFvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAQrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE;IAhHrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAO;IAE/C;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwC;IAC3E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAU;IAC3D,2FAA2F;IAC3F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IACtD,yGAAyG;IACzG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,aAAa,CAAK;IAE1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IACxC;;;;;OAKG;IACc,SAAS,GAAE,UAAgC;IAC5D;;;;;;OAMG;IACc,EAAE,GAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAiC;IAC9E;;;;;OAKG;IACH,MAAM,GAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO;IASvE;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,UAAU,CAAK;IAEvB,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAKzE,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAejC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAenG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAavE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOnG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAyBI,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC;IAoB9B,+EAA+E;IACzE,wBAAwB,CAC5B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,CAAC;IAqBzB;;;;;;;;;;;;;;;;;OAiBG;IACG,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,SAAS,CAAC;IAmBf,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC;IAyBlB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC;IAwBnB,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAkDnF,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAgBlC,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5C,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC3C,CAAC;IA+DI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCzD;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAKvB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IA0BjC,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAgBjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1E,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7E,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmBnD,sBAAsB,CAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,uBAAuB,EAAE,MAAM,GAC9B,OAAO,CAAC,OAAO,CAAC;IAuCb,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA+CK,SAAS;YAuGT,OAAO;IAKrB;;;;;;;;;;;OAWG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,iBAAiB;IAuC/B;;;;;OAKG;YACW,mBAAmB;IAkBjC;;;;;;;OAOG;YACW,wBAAwB;IAkDtC,OAAO,CAAC,0BAA0B;IAQlC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;;;OAMG;YACW,SAAS;IAKvB;;;;;;OAMG;YACW,gBAAgB;IAmB9B;;;;;;;;;OASG;YACW,oBAAoB;IA8BlC;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IA4C5B,iFAAiF;YACnE,cAAc;IA4B5B,OAAO,CAAC,aAAa;IAqBrB,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;;;;;;;;;;;OAgBG;YACW,kBAAkB;CAyJjC"}

package/dist/modules/access/access-control.service.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
 import { logger } from '../../shared/logging.js';
 const log = logger('access');
 import { isAbsence } from '../../shared/fs.contract.js';
@@ -7,10 +8,8 @@ import { assertOneSpecPerLine, isCommitSha, isGitTimeout } from '../../shared/gi
 import { hashEmail } from '../../shared/email-identity.js';
 import { NodeGitRunner } from '../workflow/index.js';
 import { readRevSha } from '../kb-fs/index.js';
-import { DEFAULT_KB_LAYOUT, PLUGIN_MANIFEST_FILE, isPersonalPluginDir, pluginIdentityOf, platformRestoreDestination, } from '@bevel-software/platform-shared';
-import { AccessConfigError, AccessUnreadableError, synthesizePluginPrincipals } from '../access-model/index.js';
-import { GROUPS_YAML, SYNCED_GROUPS_YAML, parseGroupsFile, } from '../access-model/index.js';
-import { ADMIN_CANONICAL, EVERYONE_CANONICAL, EVERYONE_DISPLAY, KNOWN_VERBS, ROLE_TOKEN_PREFIX, accessMdSelfEntries, canonicalEmail, canonicalRoleName, isAccessMdPath, mergeGroupsIntoRoles, parseAccessFile, parseOwnAccessEntries, parseRolesYaml, requiredVerbsFor, sourceVerbsFor, } from '../access-model/index.js';
+import { DEFAULT_KB_LAYOUT, PLUGIN_MANIFEST_FILE, isFrontmatterFence, isPersonalPluginDir, pluginIdentityOf, platformRestoreDestination, } from '@bevel-software/platform-shared';
+import { AccessConfigError, AccessUnreadableError, synthesizePluginPrincipals, GROUPS_YAML, SYNCED_GROUPS_YAML, parseGroupsFile, ADMIN_CANONICAL, EVERYONE_CANONICAL, EVERYONE_DISPLAY, KNOWN_VERBS, ROLE_TOKEN_PREFIX, GROUP_TOKEN_PREFIX, splitPrincipalToken, accessMdSelfEntries, canonicalEmail, canonicalRoleName, isAccessMdPath, mergeGroupsIntoRoles, parseAccessFile, parseOwnAccessEntries, parseRolesYaml, requiredVerbsFor, sourceVerbsFor, } from '../access-model/index.js';
 import { DIRECTORY_SYNC_BOT_EMAIL, DIRECTORY_SYNC_BOT_NAME, } from './directory-sync-bot.js';
 /**
  * Read many objects from a git repo in ONE `git cat-file --batch` process.
@@ -387,18 +386,22 @@ function addDerivedKeys(model, keys) {
  * twin of `principalKeysOf`: a member's key set minus everything they hold
  * for reasons of their own. `null` when no group of that name exists.
  *
- * Groups are keyed by their bare canonical name (`mergeGroupsIntoRoles`);
- * roles by `role/<name>`. A bare key whose record is a ROLE is not a group,
- * however it was spelled.
+ * Groups are keyed by `group/<name>`, and by their bare canonical name
+ * when no role owns it (`mergeGroupsIntoRoles`); roles by the bare name and
+ * `role/<name>`. `group` may be spelled either way: a bare name whose record
+ * is a ROLE still finds the group through its `group/` alias, because this
+ * question is always asked of the group.
  */
 function principalKeysOfGroup(model, group) {
-    const canonical = canonicalRoleName(group);
-    const record = model.roles.byCanonical.get(canonical);
+    const { name } = splitPrincipalToken(canonicalRoleName(group));
+    const record = model.roles.byCanonical.get(`${GROUP_TOKEN_PREFIX}${name}`);
     if (!record || record.kind !== 'group')
         return null;
-    const keys = new Set([canonical]);
+    const keys = new Set();
     for (const [key, principal] of model.roles.byCanonical) {
-        if (principal.kind === 'role' && principal.groupRefs?.has(canonical))
+        if (principal === record)
+            keys.add(key);
+        else if (principal.kind === 'role' && principal.groupRefs?.has(name))
             keys.add(key);
     }
     // Plugin principals were expanded from role/group entries; a plugin that
@@ -454,9 +457,9 @@ function isAdminEmail(model, email) {
     if (model.deploymentOwners.has(email))
         return true;
     const roles = model.roles.byEmail.get(email);
-    // Check the explicit `role/admin` alias, NOT the bare token: bare-name
-    // precedence is group-first, so a group that happens to be named "Admin"
-    // owns the bare key — and its members must never inherit the capability.
+    // Check the explicit `role/admin` alias: it is the role's whatever the
+    // bare key holds, and a group that happens to be named "Admin" is only
+    // ever `group/admin` — its members never inherit the capability.
     return !!roles && roles.has(ADMIN_ROLE_KEY);
 }
 /**
@@ -649,26 +652,11 @@ function resolveGrantSourcesForVerb(model, verb, kind, relativePath, principal,
     const out = [];
     if (principal.kind === 'role') {
         // A named principal can be spelled two ways in a file: the bare token and
-        // the explicit `role/<name>` token. WHICH spellings are THIS principal's
-        // entries depends on who owns the bare key in the merged index:
-        //
-        //   - UNSHADOWED (no group named `<bare>`): both spellings resolve to the
-        //     role, so both count — a grant under either adds a source; a deny
-        //     under either cuts off farther grants. (The revoke splice strips both
-        //     spellings in this case too, so classification and removal agree.)
-        //   - SHADOWED (a group owns the bare key): the spellings are DIFFERENT
-        //     principals. A bare-token principal is the GROUP — only bare entries
-        //     are its own; a `role/`-token principal is the ROLE — only `role/`
-        //     entries are its own. Counting the other spelling would attribute a
-        //     shadowed bare token to the role (hiding a real `role/<name>`
-        //     ancestor grant and making its revoke a false no-op), or vice versa.
-        //
-        //   - PINNED EXACT (`tokenMatch: 'exact'`): only the literally-spelled
-        //     token is this principal's entry, shadowing notwithstanding. The
-        //     caller pinned the same identity into the splice it is checking —
-        //     a GROUP whose group has VANISHED reads "unshadowed" here, and the
-        //     alias-tolerant pair would then attribute a same-named role's
-        //     surviving `role/<name>` grant to the group.
+        //     its explicit `role/<name>` or `group/<name>` token. Which spellings
+        //     are THIS principal's entries is `ownTokensOf`'s one rule — the bare
+        //     token counts only when the bare key is this principal's (the role
+        //     when one exists, else the group), and a pinned `'exact'` counts the
+        //     literal spelling alone.
         const tokens = ownTokensOf(model, principal.role, tokenMatch);
         for (const scope of scopes) {
             const states = tokens.map((t) => scope.byRole.get(t));
@@ -698,20 +686,37 @@ function resolveGrantSourcesForVerb(model, verb, kind, relativePath, principal,
 }
 /**
  * WHICH token spellings in a file are THIS role-shaped principal's own entries
- * — the shadowing rule, in one place because the grant walk, the denial walk
- * and the revoke splice must all agree on it (a disagreement attributes a
- * shadowed bare token to the wrong principal, which is how a "restrict" silently
- * strips a same-named role's grant). See `resolveGrantSourcesForVerb` for the
- * full reasoning behind each branch.
+ * — in one place because the grant walk, the denial walk and the revoke splice
+ * must all agree on it (a disagreement attributes a bare token to the wrong
+ * principal, which is how a "restrict" silently strips a same-named role's
+ * grant).
+ *
+ *   - `role/X` is the role: its own entries are `role/X`, plus the bare `X`
+ *     unless a GROUP owns the bare key (no role X exists, a group X does).
+ *   - `group/X` is the group: `group/X`, plus the bare `X` unless a ROLE
+ *     owns it — under role-first precedence a same-named role always does.
+ *   - A bare `X` is whoever owns the bare key, with that kind's explicit
+ *     spelling; a bare token with no record (`everyone`, a plugin token, a
+ *     vanished principal) is just itself plus the `role/` spelling a legacy
+ *     role grant may carry.
+ *   - PINNED EXACT (`tokenMatch: 'exact'`): only the literal spelling. The
+ *     caller pinned the same identity into the splice it is checking.
  */
 function ownTokensOf(model, role, tokenMatch) {
     const canonical = canonicalRoleName(role);
-    const explicit = canonical.startsWith(ROLE_TOKEN_PREFIX);
-    const bare = explicit ? canonical.slice(ROLE_TOKEN_PREFIX.length) : canonical;
-    const shadowed = model.roles.byCanonical.get(bare)?.kind === 'group';
-    return tokenMatch === 'exact' || shadowed
-        ? [explicit ? `${ROLE_TOKEN_PREFIX}${bare}` : bare]
-        : [bare, `${ROLE_TOKEN_PREFIX}${bare}`];
+    if (tokenMatch === 'exact')
+        return [canonical];
+    const { prefix, name } = splitPrincipalToken(canonical);
+    const bareOwner = model.roles.byCanonical.get(name)?.kind;
+    if (prefix === 'role')
+        return bareOwner === 'group' ? [canonical] : [name, canonical];
+    if (prefix === 'group')
+        return bareOwner === 'role' ? [canonical] : [name, canonical];
+    if (bareOwner === 'group')
+        return [name, `${GROUP_TOKEN_PREFIX}${name}`];
+    if (bareOwner === 'plugin')
+        return [name];
+    return [name, `${ROLE_TOKEN_PREFIX}${name}`];
 }
 /**
  * The polarity twin of {@link resolveGrantSourcesForVerb}: every file scope
@@ -836,6 +841,73 @@ function parentDirOf(relativePath) {
     const cut = relativePath.lastIndexOf('/');
     return cut === -1 ? '' : relativePath.slice(0, cut);
 }
+/** The first read of {@link frontmatterHead}; each later one doubles, up to the last. */
+const HEAD_FIRST_READ = 1_024;
+const HEAD_LAST_READ = 64 * 1_024;
+/**
+ * The start of `file` that holds everything its frontmatter can say: its
+ * first line when that is no fence (no frontmatter at all), the text through
+ * the closing fence when there is one, and the whole file when an opening
+ * fence is never closed. Scanned for its frontmatter (`scanFrontmatter`), it
+ * answers exactly as the whole file does, by the same fence rule
+ * (`isFrontmatterFence`) — and a file with no frontmatter costs one small
+ * read however long it is.
+ */
+async function frontmatterHead(file) {
+    const handle = await fs.open(file, 'r');
+    try {
+        const decoder = new StringDecoder('utf8');
+        // What was read, kept as it was decoded and joined once, when answered:
+        // each character is scanned once, however long a line runs.
+        const pieces = [];
+        let before = 0;
+        // The line being read so far, folded (see `foldLine`), or null once it
+        // can no longer be a fence.
+        let line = '';
+        let first = true;
+        let position = 0;
+        for (let size = HEAD_FIRST_READ;; size = Math.min(size * 2, HEAD_LAST_READ)) {
+            const chunk = Buffer.allocUnsafe(size);
+            const { bytesRead } = await handle.read(chunk, 0, size, position);
+            if (bytesRead === 0)
+                return pieces.join('') + decoder.end();
+            position += bytesRead;
+            const piece = decoder.write(chunk.subarray(0, bytesRead));
+            pieces.push(piece);
+            let from = 0;
+            for (let nl = piece.indexOf('\n'); nl !== -1; nl = piece.indexOf('\n', from)) {
+                const fence = line !== null && isFrontmatterFence(foldLine(line, piece.slice(from, nl)));
+                // The first line opens a block or there is none; after it, the first
+                // fence closes the block.
+                if (first ? !fence : fence)
+                    return pieces.join('').slice(0, before + nl);
+                first = false;
+                line = '';
+                from = nl + 1;
+            }
+            if (line !== null) {
+                line = foldLine(line, piece.slice(from));
+                if (!'---'.startsWith(line.trim()))
+                    line = null;
+            }
+            // A first line still unfinished that already cannot be a fence.
+            if (first && line === null)
+                return pieces.join('');
+            before += piece.length;
+        }
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * `line` continued by `more`, every run of whitespace folded to one space.
+ * Trimmed, it is `---` exactly when the unfolded line is, so it judges a fence
+ * as `isFrontmatterFence` does while staying a few characters long.
+ */
+function foldLine(line, more) {
+    return `${line}${more}`.replace(/\s+/g, ' ');
+}
 /**
  * One file's own-entries, parsed as the path `asName` would be read.
  *
@@ -946,15 +1018,15 @@ function eligibleHoldersResolved(model, verb, relativePath, fileOwn) {
     const { byRole, byEmail, everyone } = resolveAtPath(model, verb, relativePath, fileOwn);
     // (kind, display name) → one entry. The `byRole` keys are the merged
     // index's canonical tokens exactly as granted (bare, or the
-    // `role/<canonical>` alias); the `byCanonical` record a key hits carries
-    // its kind — a `role/` alias always hits the role record, a bare key hits
-    // whichever principal owns it under group-first precedence. A token with no
-    // record (the built-in `everyone`, or a grant naming a since-vanished
-    // principal) degrades to 'role', the pre-groups display. When one display
-    // name is granted as BOTH (a role via its `role/` alias plus a same-named
-    // group via the bare token) BOTH entries survive — they are DIFFERENT
-    // principals, and collapsing them to one would hide the role's live
-    // `role/<name>` grant from every consumer of the eligible list.
+    // `role/` or `group/` alias); the `byCanonical` record a key hits carries
+    // its kind — a `role/` alias always hits the role record, a `group/` alias
+    // the group record, a bare key the role when one exists, else the group. A
+    // token with no record (the built-in `everyone`, or a grant naming a
+    // since-vanished principal) degrades to 'role', the pre-groups display.
+    // When one display name is granted as BOTH (the role plus a same-named
+    // group via `group/`) BOTH entries survive — they are DIFFERENT
+    // principals, and collapsing them to one would hide one of the grants from
+    // every consumer of the eligible list.
     const byIdentity = new Map();
     const addPrincipal = (name, kind) => {
         const key = `${kind}\0${name.toLowerCase()}`;
@@ -997,9 +1069,9 @@ function eligibleHoldersResolved(model, verb, relativePath, fileOwn) {
     // access.md (it'd say "restricted to no one" when Admin is the answer).
     if (verb === 'write' &&
         (relativePath === 'roles.yaml' || isAccessMdPath(relativePath))) {
-        // Look the Admin ROLE up via its explicit alias — the bare key may be
-        // owned by a same-named group under group-first precedence. The override
-        // is the ROLE's capability, so the row's kind is 'role' regardless.
+        // Look the Admin ROLE up via its explicit alias, the key that is always
+        // the role's. The override is the ROLE's capability, so the row's kind is
+        // 'role' regardless.
         const adminRole = model.roles.byCanonical.get(ADMIN_ROLE_KEY);
         addPrincipal(adminRole ? adminRole.displayName : ADMIN_CANONICAL, 'role');
     }
@@ -1019,6 +1091,61 @@ function eligibleHoldersResolved(model, verb, relativePath, fileOwn) {
     users.sort((a, b) => a.email.localeCompare(b.email));
     return { principals, roles, users };
 }
+/** The key set behind one entry of an eligible-holders list, read back from its name and kind. */
+function keysOfHolder(model, holder) {
+    for (const [canonical, record] of model.roles.byCanonical) {
+        if (record.kind === holder.kind && record.displayName === holder.name)
+            return principalKeysOfToken(model, canonical);
+    }
+    return principalKeysOfToken(model, canonicalRoleName(holder.name));
+}
+/**
+ * Who loses and who gains `verb` between the two sides of a move. The
+ * candidates are every principal and person a rule on either side names for
+ * the verb, as a grant or as a denial, and every holder either side lists;
+ * each is put to both sides' resolvers as the gates would put it. The holder
+ * lists alone are not enough: they name grants, so they miss a group still
+ * covered by `everyone`, and they cannot show someone whose only access was
+ * `everyone` and whom a rule on the far side denies by name.
+ */
+function holderChangesFor(verb, here, there) {
+    const collectives = new Map();
+    const people = new Set();
+    const addCollective = (holder, keys) => {
+        const id = `${holder.kind}\0${holder.name.toLowerCase()}`;
+        if (!collectives.has(id))
+            collectives.set(id, { holder, keys });
+    };
+    for (const side of [here, there]) {
+        const held = eligibleHoldersResolved(side.model, verb, side.path, side.own);
+        for (const holder of held.principals)
+            addCollective(holder, keysOfHolder(side.model, holder));
+        for (const user of held.users)
+            people.add(user.email);
+        const { byRole, byEmail } = resolveAtPath(side.model, verb, side.path, side.own);
+        for (const token of byRole.keys()) {
+            const record = side.model.roles.byCanonical.get(token);
+            addCollective({ name: record ? record.displayName : token, kind: record?.kind ?? 'role' }, principalKeysOfToken(side.model, token));
+        }
+        for (const email of byEmail.keys())
+            people.add(email);
+    }
+    const lose = [];
+    const gain = [];
+    const record = (had, has, change) => {
+        if (had && !has)
+            lose.push(change);
+        if (!had && has)
+            gain.push(change);
+    };
+    for (const { holder, keys } of collectives.values()) {
+        record(hasPermissionForKeys(here.model, verb, keys, here.path, here.own), hasPermissionForKeys(there.model, verb, keys, there.path, there.own), { kind: holder.kind, name: holder.name, verb });
+    }
+    for (const email of [...people].sort()) {
+        record(hasPermissionResolved(here.model, verb, email, here.path, here.own), hasPermissionResolved(there.model, verb, email, there.path, there.own), { kind: 'person', name: email, email, verb });
+    }
+    return { lose, gain };
+}
 /**
  * Every individual the model names: `roles.yaml` members, emails named inline
  * at this path's scope, and the deployment owner (bound by every rule that
@@ -1323,7 +1450,11 @@ export class AccessControlService {
         const model = await this.loadModel(workspaceId);
         const email = canonicalEmail(userEmail);
         const names = [];
-        for (const principal of model.roles.byCanonical.values()) {
+        // Each group once, through its `group/` alias (the bare key, when the
+        // group owns it, is the same record).
+        for (const [key, principal] of model.roles.byCanonical) {
+            if (!key.startsWith(GROUP_TOKEN_PREFIX))
+                continue;
             if (principal.kind === 'group' && principal.emails.has(email))
                 names.push(principal.displayName);
         }
@@ -1459,6 +1590,26 @@ export class AccessControlService {
             after: holdersAt(after, toPath, ownThere),
         };
     }
+    /** Who loses and who gains `read` or `write` in a move (see the interface). */
+    async prospectiveHolderChanges(workspaceId, fromPath, toPath) {
+        const model = await this.loadModel(workspaceId);
+        const repoDir = await this.repoDir(workspaceId);
+        const { isFolder, ownHere, ownThere, landing } = await this.relocationSubject(repoDir, fromPath, toPath);
+        const here = { model, path: fromPath, own: ownHere };
+        const there = {
+            model: withRelocatedAccessFiles(model, fromPath, toPath, { sourceRemains: false, sourceIsFolder: isFolder, landing }),
+            path: toPath,
+            own: ownThere,
+        };
+        const lose = [];
+        const gain = [];
+        for (const verb of ['read', 'write']) {
+            const changes = holderChangesFor(verb, here, there);
+            lose.push(...changes.lose);
+            gain.push(...changes.gain);
+        }
+        return { lose, gain };
+    }
     /**
      * The caller's own verbs at `toPath` as they will be once `fromPath` has
      * been moved or copied there (see the interface).
@@ -1479,7 +1630,7 @@ export class AccessControlService {
      */
     async previewAccessAfterRelocation(workspaceId, userEmail, fromPath, toPath, opts) {
         const repoDir = await this.repoDir(workspaceId);
-        const { isFolder, ownThere: own, landing } = await this.relocationSubject(repoDir, fromPath, toPath);
+        const { isFolder, ownThere: own, landing } = await this.relocationSubject(repoDir, fromPath, toPath, opts?.sourceContent);
         const model = withRelocatedAccessFiles(await this.loadModel(workspaceId), fromPath, toPath, { sourceRemains: opts?.sourceRemains === true, sourceIsFolder: isFolder, landing });
         const machineOwned = this.machineOwnedWriteRule(userEmail, toPath);
         return {
@@ -1604,9 +1755,9 @@ export class AccessControlService {
         }
         // Roles = the built-in `everyone` role plus every declared role's display
         // name — ROLE principals only, never groups. Each role is enumerated via
-        // its `role/<canonical>` alias key, which exists exactly once per role
-        // (the bare key may be owned by a same-named group under group-first
-        // precedence, and merged group entries must not appear here). `everyone`
+        // its `role/<canonical>` alias key, which exists exactly once per role;
+        // each group likewise via its `group/<canonical>` alias (a group that
+        // owns its bare key is registered under both, as one record). `everyone`
         // is surfaced so the share UI can grant public read; the grant route
         // gates it to the `read` verb only (write/owner/download everyone stay a
         // direct-access.md edit).
@@ -1620,7 +1771,7 @@ export class AccessControlService {
         for (const [key, principal] of model.roles.byCanonical) {
             if (key.startsWith(ROLE_TOKEN_PREFIX))
                 roles.push(principal.displayName);
-            else if (principal.kind === 'group')
+            else if (key.startsWith(GROUP_TOKEN_PREFIX) && principal.kind === 'group')
                 groups.push(principal.displayName);
             else if (principal.kind === 'plugin' &&
                 principal.pluginName &&
@@ -1990,13 +2141,18 @@ export class AccessControlService {
      * in the new (body-governed) format, where its frontmatter is self-access —
      * see {@link accessMdSelfEntries}. A legacy `access.md` still yields null:
      * its frontmatter IS the folder rules the dir chain already applies.
+     *
+     * Any other file declares them in its frontmatter alone, so only as much of
+     * it is read as the frontmatter takes (see {@link frontmatterHead}): a batch
+     * over a tree of megabyte transcripts reads a line of each, not the tree.
      */
     async readOwnEntries(repoDir, relativePath) {
         if (relativePath === 'roles.yaml')
             return null;
+        const file = path.join(repoDir, relativePath);
         let text;
         try {
-            text = await fs.readFile(path.join(repoDir, relativePath), 'utf-8');
+            text = isAccessMdPath(relativePath) ? await fs.readFile(file, 'utf-8') : await frontmatterHead(file);
         }
         catch {
             return null;
@@ -2028,18 +2184,26 @@ export class AccessControlService {
      * Only absence is an answer (see `isAbsence`): a probe that failed on
      * permissions or I/O does not say "this is a file", and reading a folder as
      * one would resolve it through frontmatter it does not have.
+     *
+     * `sourceContent` is the text of a source that is NO repository path — a
+     * file staged in the workspace's `tmp/` folder, which `copy_file` lands in
+     * the repository. Nothing is probed on disk for it: it is one file by the
+     * ref's own rule, and its text is read exactly as a repository file's is,
+     * so the copy previews the rules it carries in.
      */
-    async relocationSubject(repoDir, fromPath, toPath) {
+    async relocationSubject(repoDir, fromPath, toPath, sourceContent) {
         const nothing = { isFolder: false, ownHere: null, ownThere: null, landing: null };
-        const fromStat = await fs.lstat(path.join(repoDir, fromPath)).catch((err) => {
-            if (isAbsence(err))
-                return null;
-            throw err;
-        });
-        if (fromStat?.isSymbolicLink() === true)
-            return nothing;
-        if (fromStat?.isDirectory() === true)
-            return { ...nothing, isFolder: true };
+        if (sourceContent === undefined) {
+            const fromStat = await fs.lstat(path.join(repoDir, fromPath)).catch((err) => {
+                if (isAbsence(err))
+                    return null;
+                throw err;
+            });
+            if (fromStat?.isSymbolicLink() === true)
+                return nothing;
+            if (fromStat?.isDirectory() === true)
+                return { ...nothing, isFolder: true };
+        }
         // `roles.yaml` carries no own-entries wherever it sits, exactly as
         // `readOwnEntries` has it; a read that fails for any reason is no rules,
         // which is what the gates would say about the same file.
@@ -2047,7 +2211,7 @@ export class AccessControlService {
             return nothing;
         let text;
         try {
-            text = await fs.readFile(path.join(repoDir, fromPath), 'utf-8');
+            text = sourceContent ?? (await fs.readFile(path.join(repoDir, fromPath), 'utf-8'));
         }
         catch {
             return nothing;