@bevel-software/platform-core-backend 0.33.0 → 0.35.0

package/dist/modules/access/access-mutation.service.js

@@ -35,7 +35,7 @@
 import path from 'node:path';
 import { isAbsence } from '../../shared/fs.contract.js';
 import { isTextBytes } from '../workspace/index.js';
-import { ADMIN_CANONICAL, KNOWN_VERBS, ROLE_TOKEN_PREFIX, canonicalRoleName, accessFrontmatterExtensionList, } from '../access-model/index.js';
+import { ADMIN_CANONICAL, KNOWN_VERBS, canonicalRoleName, splitPrincipalToken, accessFrontmatterExtensionList, } from '../access-model/index.js';
 import { spliceRevoke, spliceGrant, validatePrincipal, AccessSpliceError, } from '../access-model/index.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { canCarryFrontmatter, FOLDER_GOVERNS_ACCESS_KIND, folderGovernsAccessMessage, } from '@bevel-software/platform-shared';
@@ -60,20 +60,18 @@ export const ADMIN_ROOT_WRITE_MESSAGE = 'Admins always keep write access at the
  * this target touches the Admin ROLE's write at the repository root — the
  * root folder's `access.md`, or a file directly in the root. The resolver
  * ignores such a rule anyway (the Admin write floor), so writing it would only
- * leave a line that says something the app does not do. A bare token matched
- * `exact` is a group's (or a shadowed name's), never the Admin role. Targets
- * arrive in one spelling: the routes refuse `.` and `..` segments.
+ * leave a line that says something the app does not do. A bare `Admin` is the
+ * role (a bare name is always the role when one exists, and roles.yaml always
+ * declares Admin); `group/Admin` is a group and never the role. Targets arrive
+ * in one spelling: the routes refuse `.` and `..` segments.
  */
-export function removesAdminRootWrite(kind, repoRelTarget, principal, verb, tokenMatch) {
+export function removesAdminRootWrite(kind, repoRelTarget, principal, verb) {
     if (principal.kind !== 'role')
         return false;
     if (!touchesRootWrite(kind, repoRelTarget, verb))
         return false;
-    const canonical = canonicalRoleName(principal.role);
-    const explicit = canonical.startsWith(ROLE_TOKEN_PREFIX);
-    if (!explicit && tokenMatch === 'exact')
-        return false;
-    return (explicit ? canonical.slice(ROLE_TOKEN_PREFIX.length) : canonical) === ADMIN_CANONICAL;
+    const { prefix, name } = splitPrincipalToken(canonicalRoleName(principal.role));
+    return prefix !== 'group' && name === ADMIN_CANONICAL;
 }
 /** Whether a mutation on `verb` (absent = every verb) at this target reaches write at the repository root. */
 function touchesRootWrite(kind, repoRelTarget, verb) {
@@ -230,39 +228,41 @@ export class AccessMutationService {
         return path.posix.join(this.kbDirName, repoRelative);
     }
     /**
-     * How a REVOKE of `principal` matches file tokens — the shadowing rule:
+     * How a REVOKE of `principal` matches file tokens. `'name'` strips the
+     * principal's explicit spelling AND the bare name (never the other kind's
+     * explicit spelling — see `TokenMatch`); `'exact'` strips the literal
+     * spelling alone. The bare name is stripped only when it is THIS
+     * principal's under role-first precedence:
      *
-     *   - When a GROUP owns the principal's bare name (group-first precedence),
-     *     the two spellings are DIFFERENT principals: the bare token is the
-     *     group's, `role/<name>` is the role's. Matching is `'exact'` so
-     *     revoking the role never strips the group's bare grant (and revoking
-     *     the group never strips the role's explicit grant).
-     *   - Unshadowed, both spellings resolve to the ROLE (bare falls back to
-     *     it), so matching is `'name'`: revoking the role also removes legacy
-     *     bare spellings — the historical cleanup behavior.
+     *   - A ROLE (`role/<name>`, or a bare name) owns the bare key unless no
+     *     role of that name exists and a group does — then the bare token is
+     *     the group's, and matching is `'exact'`. A model that fails to load
+     *     keeps it `'exact'` too.
+     *   - A GROUP (`group/<name>`) owns the bare key only while no role of
+     *     that name exists — otherwise the bare token is the role's, and
+     *     matching is `'exact'`. A group that has VANISHED from the active
+     *     source still reads correctly: the question is whether a ROLE holds
+     *     the name. A model that fails to load says nothing about roles, so a
+     *     group revoke then stays `'exact'` rather than risk a role's grant.
      *
      * Judged against THIS workspace's merged principal index (`kbPrincipals` —
      * the same model the resolver reads), so revoke agrees with resolution on
-     * who owns the bare key. A model that fails to load yields no groups, i.e.
-     * unshadowed — matching degrades to the pre-groups name-level behavior.
-     *
-     * GROUP revokes never take the name-level path: the route passes
-     * `tokenMatch: 'exact'` explicitly (see `revoke`'s `opts`), because this
-     * shadow probe cannot tell a group apart from a role once the group has
-     * VANISHED from the active source — the bare name then reads "unshadowed"
-     * and a name-level group revoke would strip a same-named role's live
-     * `role/<Name>` grant.
+     * who owns the bare key.
      */
     async revokeTokenMatch(workspaceId, principal) {
         if (principal.kind !== 'role')
             return 'exact'; // user matching ignores the mode
-        const canonical = canonicalRoleName(principal.role);
-        const bare = canonical.startsWith(ROLE_TOKEN_PREFIX)
-            ? canonical.slice(ROLE_TOKEN_PREFIX.length)
-            : canonical;
-        const { groups } = await this.accessControl.kbPrincipals(workspaceId);
-        const shadowed = groups.some((g) => canonicalRoleName(g) === bare);
-        return shadowed ? 'exact' : 'name';
+        const { prefix, name } = splitPrincipalToken(canonicalRoleName(principal.role));
+        const { roles, groups } = await this.accessControl.kbPrincipals(workspaceId);
+        const isRole = roles.some((r) => canonicalRoleName(r) === name);
+        if (prefix === 'group') {
+            // `roles` always carries at least `Everyone` once the model loads.
+            return isRole || roles.length === 0 ? 'exact' : 'name';
+        }
+        const isGroup = groups.some((g) => canonicalRoleName(g) === name);
+        // No roles at all means the model failed to load: stay exact, so a role
+        // revoke never strips a same-named group's bare grant.
+        return roles.length === 0 || (!isRole && isGroup) ? 'exact' : 'name';
     }
     /**
      * Grant `principal` `verb` on `target`. Adds the principal under exactly this
@@ -312,11 +312,10 @@ export class AccessMutationService {
     // When present, strip ONLY this verb (a per-checkbox toggle in the share UI);
     // absent strips the principal from every verb (the whole-principal Remove).
     verb, 
-    // `tokenMatch` overrides the shadow-derived matching. The route passes
-    // 'exact' for GROUP principals: a group's grant is its bare token only,
-    // and once the group has vanished the shadow probe can no longer tell it
-    // from a role — name-level matching would then strip a same-named role's
-    // `role/<Name>` grant.
+    // `tokenMatch` overrides the derived matching (see revokeTokenMatch).
+    // One production caller: the plugin-links unlink pins `'exact'` for its
+    // `plugin/<Name>/<verb>` tokens. Pin only `'exact'` — a pinned `'name'`
+    // would bypass the guard that never strips across kinds.
     opts) {
         void _actingUserEmail; // referenced to satisfy no-unused-vars until something consumes it
         this.assertPrincipalSafe(principal); // same injection/shape guard grant runs
@@ -325,8 +324,8 @@ export class AccessMutationService {
         // missing FILE node is a bad target and should surface, not silently no-op
         // — same rule grant() uses.
         const original = await this.readOrEmpty(workspaceId, kind, repoRelTarget, editPath);
-        // Alias-tolerant vs exact-token matching, decided by group shadowing —
-        // see revokeTokenMatch — unless the caller pinned it.
+        // Alias-tolerant vs exact-token matching, decided by who owns the bare
+        // name — see revokeTokenMatch — unless the caller pinned it.
         const tokenMatch = opts?.tokenMatch ?? (await this.revokeTokenMatch(workspaceId, principal));
         let next = original;
         let changed = false;
@@ -349,7 +348,7 @@ export class AccessMutationService {
         // Refused only when an Admin write entry would really go: a whole-row
         // Remove at a root that grants Admin other verbs but no write line (write
         // comes from the floor) strips those verbs as usual.
-        if (writeRemoved && removesAdminRootWrite(kind, repoRelTarget, principal, verb, tokenMatch)) {
+        if (writeRemoved && removesAdminRootWrite(kind, repoRelTarget, principal, verb)) {
             throw adminRootWriteRefusal();
         }
         if (!changed)
@@ -390,16 +389,16 @@ export class AccessMutationService {
      * apply to whichever verbs were targeted.
      */
     async denyHere(workspaceId, kind, repoRelTarget, principal, verb, 
-    // Same override as `revoke` — the route pins 'exact' for GROUP principals.
+    // Same override as `revoke`; no production caller passes it here.
     opts) {
         this.assertPrincipalSafe(principal);
         const { editPath, allowScalar } = this.fileToEdit(kind, repoRelTarget);
         const original = await this.readOrEmpty(workspaceId, kind, repoRelTarget, editPath);
         const verbsToDeny = verb ? [verb] : KNOWN_VERBS;
-        // Same shadowing-aware matching as revoke(): the strip must not swallow a
-        // same-named OTHER principal's grant (bare = group vs role/<name> = role).
+        // Same matching as revoke(): the strip must not swallow a same-named
+        // OTHER principal's grant (`group/<name>` vs the role's bare/`role/`).
         const tokenMatch = opts?.tokenMatch ?? (await this.revokeTokenMatch(workspaceId, principal));
-        if (removesAdminRootWrite(kind, repoRelTarget, principal, verb, tokenMatch)) {
+        if (removesAdminRootWrite(kind, repoRelTarget, principal, verb)) {
             throw adminRootWriteRefusal();
         }
         // A PERSON who is an admin keeps root write through the floor, so a deny
@@ -435,10 +434,8 @@ export class AccessMutationService {
         this.accessControl.invalidate(workspaceId);
         // (3) Assert the deny actually removed effective access on the targeted
         // verb(s) — else roll back. The check evaluates the SAME token identity
-        // the deny above spliced (`tokenMatch` rides along): with a pinned exact
-        // GROUP deny whose group has vanished, alias-tolerant matching would read
-        // a same-named role's surviving `role/<Name>` grant as the group still
-        // having access — rolling back a fully effective deny as "ineffective".
+        // the deny above spliced (`tokenMatch` rides along), so a pinned exact
+        // deny is never judged by spellings it did not touch.
         const stillHas = await this.principalStillHasAccess(workspaceId, kind, repoRelTarget, principal, verb, tokenMatch);
         if (stillHas) {
             await this.workspaceService.writeFile(workspaceId, wsRelative, original);

package/dist/modules/access/access-mutation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-mutation.service.js","sourceRoot":"","sources":["../../../src/modules/access/access-mutation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAEL,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AAKzC,2FAA2F;AAC3F,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAC1D,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAiC;QAC1E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9D,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAsB,EACtB,UAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,eAAe,CAAC;AAChG,CAAC;AAED,8GAA8G;AAC9G,SAAS,gBAAgB,CAAC,IAAgB,EAAE,aAAqB,EAAE,IAAsB;IACvF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAgB,EAAE,aAAqB;IAClF,IAAI,IAAI,KAAK,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC;QAAE,OAAO;IACrE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,mBAAmB,CAAC,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,wBAAwB,CAAC,aAAqB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO,IAAI,mBAAmB,CAC5B,0BAA0B,CAAC,MAAM,IAAI,qBAAqB,CAAC,EAC3D,GAAG,EACH,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAC7C,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IAHnB,YACmB,gBAAkC,EAClC,aAA6B,EAC7B,SAAiB;QAFjB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;;;;;OAQG;IACH,UAAU,CAAC,IAAgB,EAAE,aAAqB;QAChD,4BAA4B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,qBAAqB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,IAAgB,EAAE,aAAqB;QACtF,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,WAAmB;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACtD,WAAW,EACX,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CACtC,CAAC;YACF,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,WAAW,CACvB,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,eAAuB;QAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAClF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,YAAoB;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,SAAoB;QACtE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,CAAC,iCAAiC;QAChF,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,IAAU,EACV,SAAoB;QAEpB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,yDAAyD;QAC9F,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACnC,WAAW,EACX,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAClC,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB;IACpB,yEAAyE;IACzE,0CAA0C;IAC1C,gBAAwB;IACxB,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAW;IACX,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB;IACvB,IAAkC;QAElC,KAAK,gBAAgB,CAAC,CAAC,mEAAmE;QAC1F,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC;QAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,2EAA2E;QAC3E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpF,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACzC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACd,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC/B,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,YAAY,IAAI,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5F,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAElD,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW;IACX,2EAA2E;IAC3E,IAAkC;QAElC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEpF,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAChD,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,2BAA2B;QAC3B,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC;YAC3C,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAC5E,CAAC;YACD,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,wEAAwE;gBACxE,sDAAsD;gBACtD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACtC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC,IAAI,CAAC;gBACR,wCAAwC;gBACxC,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YAC1H,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,uFAAuF;YACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,SAAS,EACT,IAAI,EACJ,UAAU,CACX,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,IAAI,mBAAmB,CAC3B,4GAA4G,EAC5G,GAAG,EACH,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,uBAAuB,CACnC,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW,EACX,UAAuB;QAEvB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;YAC9B,MAAM,KAAK,GAAyC;gBAClD,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACzE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBAC3E,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACjF,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;aAC5E,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACnD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACtC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACxC,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,SAAoB;QAC9C,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAY;QAClC,IAAI,GAAG,YAAY,mBAAmB;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvF,OAAO,IAAI,mBAAmB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;CACF"}
+{"version":3,"file":"access-mutation.service.js","sourceRoot":"","sources":["../../../src/modules/access/access-mutation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AAKzC,2FAA2F;AAC3F,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAC1D,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAiC;QAC1E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9D,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,OAAO,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,eAAe,CAAC;AACxD,CAAC;AAED,8GAA8G;AAC9G,SAAS,gBAAgB,CAAC,IAAgB,EAAE,aAAqB,EAAE,IAAsB;IACvF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAgB,EAAE,aAAqB;IAClF,IAAI,IAAI,KAAK,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC;QAAE,OAAO;IACrE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,mBAAmB,CAAC,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,wBAAwB,CAAC,aAAqB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO,IAAI,mBAAmB,CAC5B,0BAA0B,CAAC,MAAM,IAAI,qBAAqB,CAAC,EAC3D,GAAG,EACH,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAC7C,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IAHnB,YACmB,gBAAkC,EAClC,aAA6B,EAC7B,SAAiB;QAFjB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;;;;;OAQG;IACH,UAAU,CAAC,IAAgB,EAAE,aAAqB;QAChD,4BAA4B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,qBAAqB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,IAAgB,EAAE,aAAqB;QACtF,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,WAAmB;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACtD,WAAW,EACX,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CACtC,CAAC;YACF,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,WAAW,CACvB,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,eAAuB;QAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAClF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,YAAoB;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,SAAoB;QACtE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,CAAC,iCAAiC;QAChF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,mEAAmE;YACnE,OAAO,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACzD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAClE,wEAAwE;QACxE,uDAAuD;QACvD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,IAAU,EACV,SAAoB;QAEpB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,yDAAyD;QAC9F,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACnC,WAAW,EACX,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAClC,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB;IACpB,yEAAyE;IACzE,0CAA0C;IAC1C,gBAAwB;IACxB,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAW;IACX,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,yDAAyD;IACzD,IAAkC;QAElC,KAAK,gBAAgB,CAAC,CAAC,mEAAmE;QAC1F,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC;QAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,2EAA2E;QAC3E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpF,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACzC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACd,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC/B,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,YAAY,IAAI,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;YAChF,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAElD,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW;IACX,kEAAkE;IAClE,IAAkC;QAElC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEpF,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAChD,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,2BAA2B;QAC3B,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC;YAC3C,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAC5E,CAAC;YACD,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,wEAAwE;gBACxE,sDAAsD;gBACtD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACtC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC,IAAI,CAAC;gBACR,wCAAwC;gBACxC,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YAC1H,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,uFAAuF;YACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,SAAS,EACT,IAAI,EACJ,UAAU,CACX,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,IAAI,mBAAmB,CAC3B,4GAA4G,EAC5G,GAAG,EACH,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,uBAAuB,CACnC,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW,EACX,UAAuB;QAEvB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;YAC9B,MAAM,KAAK,GAAyC;gBAClD,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACzE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBAC3E,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACjF,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;aAC5E,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACnD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACtC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACxC,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,SAAoB;QAC9C,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAY;QAClC,IAAI,GAAG,YAAY,mBAAmB;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvF,OAAO,IAAI,mBAAmB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;CACF"}

package/dist/modules/access/access-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-view.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,WAAW,EAEX,UAAU,EACV,cAAc,EACd,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAKL,KAAK,IAAI,EACV,MAAM,0BAA0B,CAAC;AAElC;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0GvB;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC;AAOvE;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAMvE;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAiBvD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,CAwB1G;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,KAAK,QAAQ,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,IAAI,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG;IACzF,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,UAAU,EACV,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CACjE,GAAG;IACF,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;CAChD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAcvD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,kBAAkB,CAgBpB"}
+{"version":3,"file":"access-view.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,WAAW,EAEX,UAAU,EACV,cAAc,EACd,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAML,KAAK,IAAI,EACV,MAAM,0BAA0B,CAAC;AAElC;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2GvB;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC;AAOvE;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAMvE;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAiBvD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,CAwB1G;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,KAAK,QAAQ,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,IAAI,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG;IACzF,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,UAAU,EACV,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CACjE,GAAG;IACF,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;CAChD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAcvD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,kBAAkB,CAgBpB"}

package/dist/modules/access/access-view.js

@@ -1,4 +1,4 @@
-import { canonicalRoleName, EVERYONE_CANONICAL, KNOWN_VERBS, ROLE_TOKEN_PREFIX, } from '../access-model/index.js';
+import { canonicalRoleName, EVERYONE_CANONICAL, KNOWN_VERBS, ROLE_TOKEN_PREFIX, GROUP_TOKEN_PREFIX, } from '../access-model/index.js';
 /**
  * The resolved access view of one target, as the Manage access dialog reads it
  * (`GET /api/workspace/:id/access`): the caller's four verdicts, the eligible
@@ -26,13 +26,12 @@ export async function resolveAccessView(accessControl, workspaceId, repoRelTarge
     // files). Keyed `u:<email>` / `r:<role>` / `g:<group>` to match the
     // dialog's row keys, so each row can show where its access comes from and
     // which verbs are removable here. Groups get their OWN `g:` namespace: a
-    // group and a role sharing a name are DIFFERENT principals (bare token vs
-    // `role/<name>`), and one shared `r:` entry could only describe one of
-    // them. Each kind resolves through the token spelling that IS that
-    // principal — a group through its bare token (group-first precedence), a
-    // role through its explicit `role/<name>` alias (correct whether or not a
-    // group shadows the name; the built-in `everyone` keeps its bare spelling,
-    // it has no alias). A row whose verbs resolve only via a
+    // group and a role sharing a name are DIFFERENT principals (`group/<name>`
+    // vs the bare name and `role/<name>`), and one shared `r:` entry could only
+    // describe one of them. Each kind resolves through the explicit token that
+    // IS that principal — a group through `group/<name>`, a role through
+    // `role/<name>` (the built-in `everyone` keeps its bare spelling, it has no
+    // alias); the bare spelling counts toward whichever kind owns it. A row whose verbs resolve only via a
     // group/everyone/rescue has no source (the verb is absent) and renders
     // non-actionable. Built over the union of every principal in the four
     // eligible lists (kinded `principals`, with the name-only `roles` list as
@@ -73,9 +72,11 @@ export async function resolveAccessView(accessControl, workspaceId, repoRelTarge
     const denials = {};
     await Promise.all([
         ...[...collectives.entries()].map(async ([key, p]) => {
-            const token = p.kind === 'role' && canonicalRoleName(p.name) !== EVERYONE_CANONICAL
-                ? `${ROLE_TOKEN_PREFIX}${p.name}`
-                : p.name;
+            const token = p.kind === 'group'
+                ? `${GROUP_TOKEN_PREFIX}${p.name}`
+                : p.kind === 'role' && canonicalRoleName(p.name) !== EVERYONE_CANONICAL
+                    ? `${ROLE_TOKEN_PREFIX}${p.name}`
+                    : p.name;
             const principal = { kind: 'role', role: token };
             const [grants, denied] = await Promise.all([
                 accessControl.grantSources(workspaceId, kind, repoRelTarget, principal),

package/dist/modules/access/access-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-view.js","sourceRoot":"","sources":["../../../src/modules/access/access-view.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAElC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAA6B,EAC7B,WAAmB,EACnB,aAAqB,EACrB,SAAiB,EACjB,IAAsB;IAEtB,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,GAClG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAC5D,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAC7D,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAChE,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAC7D,aAAa,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC;QACzD,aAAa,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC;QACzD,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC;QACxD,aAAa,CAAC,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC;QAC7D,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,aAAa,CAAC,uBAAuB,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC;YACvE,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;KACjD,CAAC,CAAC;IAEL,yEAAyE;IACzE,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,sCAAsC;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IACzD,MAAM,aAAa,GAAG,CAAC,CAAoB,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GACV,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC;QACjF,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU;QAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI;QACd,GAAG,QAAQ,CAAC,KAAK;QACjB,GAAG,OAAO,CAAC,KAAK;QAChB,GAAG,MAAM,CAAC,KAAK;QACf,GAAG,WAAW,CAAC,KAAK;QACpB,GAAG,UAAU,CAAC,KAAK;KACpB,EAAE,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,2EAA2E;IAC3E,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YACnD,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;gBACnE,CAAC,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC,IAAI,EAAE;gBACjC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACb,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzC,aAAa,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;gBACvE,aAAa,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;oBACxE,OAAO,CAAC,OAAO,CAAC,EAAmB,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACtB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAC5D,CAAC,CAAC;QACF,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACvC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzC,aAAa,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;gBACvE,aAAa,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;oBACxE,OAAO,CAAC,OAAO,CAAC,EAAmB,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;YAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;QACrF,CAAC,CAAC;KACH,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,MAAM;QACN,WAAW;QACX,OAAO;QACP,OAAO;QACP,UAAU;KACX,CAAC;AACJ,CAAC;AAID,uDAAuD;AACvD,SAAS,MAAM,CAAC,CAAoB;IAClC,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AACjG,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC;IAC9F,OAAO;QACL,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;KACjG,CAAC;AACJ,CAAC;AAiBD,4EAA4E;AAC5E,SAAS,gBAAgB,CACvB,MAAmB,EACnB,IAAsB,EACtB,aAAqB;IAErB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE;QAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAsB,EAAE,aAAqB;IAC1F,MAAM,KAAK,GAAyC;QAClD,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,QAAQ,EAAE,IAAI,CAAC,WAAW;QAC1B,KAAK,EAAE,IAAI,CAAC,MAAM;KACnB,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAU,EAAE,EAAE,CAC7C,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,EAAkB,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,GAAG;YACb,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACzG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC;aACxD,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAyCD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,OAAO;QACL,GAAG,IAAI,GAAG,CACR;YACE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK;YACtB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;YACrB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;YACpB,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK;YACzB,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK;SACzB;aACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAgB,EAChB,aAAkC;IAElC,MAAM,IAAI,GAAG,CAAyD,IAAO,EAAe,EAAE,CAAC,CAAC;QAC9F,GAAG,IAAI;QACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC;YACJ,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC5D,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-view.js","sourceRoot":"","sources":["../../../src/modules/access/access-view.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAElC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAA6B,EAC7B,WAAmB,EACnB,aAAqB,EACrB,SAAiB,EACjB,IAAsB;IAEtB,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,GAClG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAC5D,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAC7D,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAChE,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;QAC7D,aAAa,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC;QACzD,aAAa,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC;QACzD,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC;QACxD,aAAa,CAAC,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC;QAC7D,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,aAAa,CAAC,uBAAuB,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC;YACvE,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;KACjD,CAAC,CAAC;IAEL,yEAAyE;IACzE,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,uGAAuG;IACvG,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,sCAAsC;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IACzD,MAAM,aAAa,GAAG,CAAC,CAAoB,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GACV,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC;QACjF,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU;QAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI;QACd,GAAG,QAAQ,CAAC,KAAK;QACjB,GAAG,OAAO,CAAC,KAAK;QAChB,GAAG,MAAM,CAAC,KAAK;QACf,GAAG,WAAW,CAAC,KAAK;QACpB,GAAG,UAAU,CAAC,KAAK;KACpB,EAAE,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,2EAA2E;IAC3E,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YACnD,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,IAAI,EAAE;gBAClC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;oBACrE,CAAC,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC,IAAI,EAAE;oBACjC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACf,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzC,aAAa,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;gBACvE,aAAa,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;oBACxE,OAAO,CAAC,OAAO,CAAC,EAAmB,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACtB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAC5D,CAAC,CAAC;QACF,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACvC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzC,aAAa,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;gBACvE,aAAa,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC;oBACxE,OAAO,CAAC,OAAO,CAAC,EAAmB,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;YAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;QACrF,CAAC,CAAC;KACH,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,MAAM;QACN,WAAW;QACX,OAAO;QACP,OAAO;QACP,UAAU;KACX,CAAC;AACJ,CAAC;AAID,uDAAuD;AACvD,SAAS,MAAM,CAAC,CAAoB;IAClC,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AACjG,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC;IAC9F,OAAO;QACL,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;KACjG,CAAC;AACJ,CAAC;AAiBD,4EAA4E;AAC5E,SAAS,gBAAgB,CACvB,MAAmB,EACnB,IAAsB,EACtB,aAAqB;IAErB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE;QAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAsB,EAAE,aAAqB;IAC1F,MAAM,KAAK,GAAyC;QAClD,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,QAAQ,EAAE,IAAI,CAAC,WAAW;QAC1B,KAAK,EAAE,IAAI,CAAC,MAAM;KACnB,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAU,EAAE,EAAE,CAC7C,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,EAAkB,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,GAAG;YACb,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACzG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC;aACxD,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAyCD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,OAAO;QACL,GAAG,IAAI,GAAG,CACR;YACE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK;YACtB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;YACrB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;YACpB,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK;YACzB,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK;SACzB;aACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAgB,EAChB,aAAkC;IAElC,MAAM,IAAI,GAAG,CAAyD,IAAO,EAAe,EAAE,CAAC,CAAC;QAC9F,GAAG,IAAI;QACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC;YACJ,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC5D,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/modules/access/access.routes.d.ts

@@ -2,6 +2,7 @@ import express from 'express';
 import type { IAccessControl } from './access-control.interface.js';
 import type { WorkspaceService } from '../workspace/index.js';
 import type { KbContext } from '../../shared/kb-context.js';
+import type { ITreeWalker } from '../../shared/fs.contract.js';
 import type { AuthService, IAccountSwitchGuard } from '../auth/index.js';
 import type { WorkflowService, WorkflowEventBus } from '../workflow/index.js';
 import type { Database } from '../database/index.js';
@@ -9,6 +10,8 @@ import '../auth/index.js';
 export declare function createAccessRoutes(accessControl: IAccessControl, workspaceService: WorkspaceService, authService: AuthService, 
 /** Auth's switch-off coordination, for the invite's promotion (`ifActive`). */
 switchGuard: IAccountSwitchGuard, workflowService: WorkflowService, eventBus: WorkflowEventBus, db: Database, kb: KbContext, 
+/** The composition root's walk, for the roles admin's reference scan. */
+disk: ITreeWalker, 
 /** This deployment's configured admins — the break-glass recovery roster. */
 recoveryAdmins?: readonly string[]): express.Router;
 //# sourceMappingURL=access.routes.d.ts.map

package/dist/modules/access/access.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAc9B,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA2B9E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,kBAAkB,CAAC;AA8B1B,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW;AACxB,+EAA+E;AAC/E,WAAW,EAAE,mBAAmB,EAChC,eAAe,EAAE,eAAe,EAChC,QAAQ,EAAE,gBAAgB,EAC1B,EAAE,EAAE,QAAQ,EACZ,EAAE,EAAE,SAAS;AACb,6EAA6E;AAC7E,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,OAAO,CAAC,MAAM,CAmzChB"}
+{"version":3,"file":"access.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAc9B,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA6B9E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,kBAAkB,CAAC;AA8B1B,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW;AACxB,+EAA+E;AAC/E,WAAW,EAAE,mBAAmB,EAChC,eAAe,EAAE,eAAe,EAChC,QAAQ,EAAE,gBAAgB,EAC1B,EAAE,EAAE,QAAQ,EACZ,EAAE,EAAE,SAAS;AACb,yEAAyE;AACzE,IAAI,EAAE,WAAW;AACjB,6EAA6E;AAC7E,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,OAAO,CAAC,MAAM,CA20ChB"}

package/dist/modules/access/access.routes.js

@@ -11,7 +11,7 @@ import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { AccessDeniedError } from '../access-model/index.js';
 import { AccessMutationService, AccessMutationError, accessMdPathForFolder, assertFileCarriesAccessRules, fileCarriesAccessRules, governingFolderOf, } from './access-mutation.service.js';
-import { canonicalRoleName, EVERYONE_CANONICAL, PLUGIN_TOKEN_PREFIX, PLUGIN_TOKEN_VERBS, ROLE_TOKEN_PREFIX, } from '../access-model/index.js';
+import { canonicalRoleName, EVERYONE_CANONICAL, PLUGIN_TOKEN_PREFIX, PLUGIN_TOKEN_VERBS, ROLE_TOKEN_PREFIX, GROUP_TOKEN_PREFIX, splitPrincipalToken, } from '../access-model/index.js';
 import { listAccessDeclarationsUnder } from './access-declarations.js';
 import { emailsInView, holderPrincipals, labelAccountHolders, resolveAccessView } from './access-view.js';
 import { toHttpError as sharedToHttpError, requireNonEmptyString as sharedRequireNonEmptyString } from './admin-route-helpers.js';
@@ -44,12 +44,14 @@ function isFolderGovernsRefusal(err) {
 export function createAccessRoutes(accessControl, workspaceService, authService, 
 /** Auth's switch-off coordination, for the invite's promotion (`ifActive`). */
 switchGuard, workflowService, eventBus, db, kb, 
+/** The composition root's walk, for the roles admin's reference scan. */
+disk, 
 /** This deployment's configured admins — the break-glass recovery roster. */
 recoveryAdmins = []) {
     const router = express.Router({ mergeParams: true });
     const { kbDirName } = kb;
     const mutation = new AccessMutationService(workspaceService, accessControl, kbDirName);
-    const rolesAdmin = new RolesAdminService(workspaceService, workflowService, accessControl, kbDirName, () => kb.defaultBranch, eventBus, recoveryAdmins);
+    const rolesAdmin = new RolesAdminService(workspaceService, workflowService, accessControl, disk, kbDirName, () => kb.defaultBranch, eventBus, recoveryAdmins);
     // Roles and groups are authoritative on the DEFAULT branch — the Roles
     // admin screen only ever edits roles.yaml there, and the ACTIVE group
     // source (IdP-synced or manual) lives there. Resolve both from the
@@ -89,15 +91,17 @@ recoveryAdmins = []) {
     };
     /**
      * The role-shaped principal the splice layer actually writes/matches.
-     *   - group     → its bare name (group-first precedence resolves it).
-     *   - role      → the explicit `role/<Name>` token — the grant route WRITES
-     *                 roles that way from now on (bare role tokens remain
-     *                 read-compatible). The built-in `everyone` stays bare: it
-     *                 is not a roles.yaml role and has no `role/` alias.
+     *   - group     → the explicit `group/<Name>` token. Never the bare name:
+     *                 a bare name is the ROLE whenever one of that name exists,
+     *                 so a bare group grant could silently mean someone else.
+     *   - role      → the explicit `role/<Name>` token. Bare spellings in
+     *                 existing files remain read-compatible. The built-in
+     *                 `everyone` stays bare: it is not a roles.yaml role and
+     *                 has no `role/` alias.
      */
     const asSplicePrincipal = (p) => {
         if (p.kind === 'group')
-            return { kind: 'role', role: p.group };
+            return { kind: 'role', role: `${GROUP_TOKEN_PREFIX}${groupName(p.group)}` };
         // Written with the folder's own casing; `parseAccessEntry` canonicalises
         // the name half to the manifest slug on the way back in.
         if (p.kind === 'plugin')
@@ -127,6 +131,13 @@ recoveryAdmins = []) {
         }
         return p;
     };
+    /** A group as the caller named it, without a `group/` prefix it may carry (casing kept). */
+    function groupName(group) {
+        const raw = group.trim();
+        return splitPrincipalToken(canonicalRoleName(raw)).prefix === 'group'
+            ? raw.slice(GROUP_TOKEN_PREFIX.length).trim()
+            : raw;
+    }
     // Authentication gate only. Per PLAN §3 the workspace `:id` is a branch
     // identifier — any authenticated user can read its access tree.
     async function requireUser(req, res) {
@@ -299,9 +310,20 @@ recoveryAdmins = []) {
      * nothing is moved.
      *
      * Gated like the sibling `overrides` route rather than the permissive
-     * `GET /access`: the caller must resolve read on the thing being moved. The
-     * lists name people, and someone who cannot see it has no business
-     * learning who can.
+     * `GET /access`: the caller must resolve read on the thing being moved AND
+     * on the destination folder. The lists name people, and someone who cannot
+     * see a thing has no business learning who can; the `after` lists and the
+     * `changes` are the destination folder's rules read back (whom it grants,
+     * whom it denies by name), so a folder the caller may not open tells them
+     * nothing either.
+     *
+     * `changes` is who loses and who gains `read` or `write` in the move, as the
+     * resolver judges each candidate on both sides
+     * (`prospectiveHolderChanges`) — the one answer the move dialog and the
+     * agent's `move_file` both show. The two lists are not that answer: they
+     * name grants, so a writer leaving a folder everyone reads shows as losing
+     * `read` it keeps, and a person the destination denies by name is on
+     * neither list.
      */
     router.get('/workspace/:id/access/prospective', async (req, res) => {
         const user = await requireUser(req, res);
@@ -328,12 +350,20 @@ recoveryAdmins = []) {
                 res.status(403).json({ error: 'You do not have access to this file.' });
                 return;
             }
+            if (!(await accessControl.canRead(req.params.id, user.email, toDir))) {
+                res.status(403).json({ error: 'You do not have access to this folder.' });
+                return;
+            }
             const name = from.slice(from.lastIndexOf('/') + 1);
             const to = toDir ? `${toDir}/${name}` : name;
-            const { before, after } = await accessControl.prospectiveHolders(req.params.id, from, to);
+            const [{ before, after }, changes] = await Promise.all([
+                accessControl.prospectiveHolders(req.params.id, from, to),
+                accessControl.prospectiveHolderChanges(req.params.id, from, to),
+            ]);
             res.json({
                 before: { read: holderPrincipals(before.read), write: holderPrincipals(before.write) },
                 after: { read: holderPrincipals(after.read), write: holderPrincipals(after.write) },
+                changes,
             });
         }
         catch (err) {
@@ -403,8 +433,8 @@ recoveryAdmins = []) {
      * signed in — so the dialog can label them; it withholds nobody.
      *
      * A name shared by a group and a role is offered as BOTH — nothing is
-     * withheld: grant precedence resolves the collision (bare token = the
-     * group; the role is written as `role/<Name>`).
+     * withheld: each is written with its own prefix (`group/<Name>`,
+     * `role/<Name>`), so the collision never reaches the file.
      */
     router.get('/workspace/:id/access/suggest', async (req, res) => {
         const user = await requireUser(req, res);
@@ -782,10 +812,10 @@ recoveryAdmins = []) {
                 // uses — and one the caller may see (`visibleGroups`): a group hidden
                 // from the picker is refused here with the same words as one that
                 // does not exist, so the grant route is no oracle for group names.
-                // No role-collision refusal: bare tokens resolve GROUP-FIRST, so the
-                // written bare name IS the group.
+                // No role-collision refusal: the grant is written `group/<Name>`,
+                // which always resolves to the group.
                 const groups = await visibleGroups(user.email, (await defaultBranchPrincipals()).groups);
-                const canonical = canonicalRoleName(principal.group);
+                const canonical = canonicalRoleName(groupName(principal.group));
                 if (!groups.some((g) => canonicalRoleName(g) === canonical)) {
                     throw new AccessMutationError(`No group named "${principal.group}". Pick an existing group.`, 404, { kind: 'unknown-group', group: principal.group });
                 }
@@ -803,8 +833,8 @@ recoveryAdmins = []) {
                     throw new AccessMutationError(`No plugin named "${principal.plugin}". Pick an existing plugin.`, 404, { kind: 'unknown-plugin', plugin: principal.plugin });
                 }
             }
-            // Splice shape: group → bare token (group-first precedence); role →
-            // explicit `role/<Name>` token (see asSplicePrincipal).
+            // Splice shape: group → explicit `group/<Name>` token; role → explicit
+            // `role/<Name>` token (see asSplicePrincipal).
             const splicePrincipal = asSplicePrincipal(principal);
             const { gatePath } = gateAndEditPaths(kind, repoRelTarget);
             // Ensure the branch workspace exists before locking.
@@ -868,17 +898,12 @@ recoveryAdmins = []) {
         try {
             const mode = req.body.mode;
             const { repoRelTarget, kind, principal: routePrincipal } = parseMutationBody(req.body);
-            // A group principal converts straight to the role-shaped bare token —
-            // no existence check (revoking a grant whose group has since vanished
-            // must keep working).
+            // A group principal converts straight to its `group/<Name>` token — no
+            // existence check (revoking a grant whose group has since vanished must
+            // keep working). Which spellings a revoke strips is the mutation
+            // service's call: `group/<Name>` never matches `role/<Name>`, and the
+            // bare name only when no role of that name owns it.
             const principal = asSplicePrincipal(routePrincipal);
-            // GROUP revokes match the EXACT bare token only. The service's own
-            // shadow probe decides exact-vs-name for roles, but it cannot know a
-            // bare token was a GROUP once that group vanished from the active
-            // source — the name would read "unshadowed" and name-level matching
-            // would strip a same-named role's live `role/<Name>` grant. The route
-            // still knows the caller's kind, so it pins the matching here.
-            const revokeOpts = routePrincipal.kind === 'group' ? { tokenMatch: 'exact' } : undefined;
             // Optional `verb` scopes ALL three paths to a single verb: a default revoke
             // strips just that verb; remove-from-parent removes just that verb on the
             // ancestor; deny-here denies just that verb at the target. Absent ⇒ the
@@ -921,7 +946,7 @@ recoveryAdmins = []) {
                         throw new AccessMutationError('This person is no longer inherited from that folder — refresh and try again.', 409, { kind: 'stale-ancestor' });
                     }
                     // Scope the ancestor revoke to the same verb the user acted on (if any).
-                    await mutation.revoke(workspaceId, 'folder', ancestorDir, principal, user.email, verb, revokeOpts);
+                    await mutation.revoke(workspaceId, 'folder', ancestorDir, principal, user.email, verb);
                 });
                 accessControl.invalidate(workspaceId);
                 logger('access.revoke.remove-from-parent').info(`ws=${workspaceId} branch=${branch} ` +
@@ -936,7 +961,7 @@ recoveryAdmins = []) {
                 await mutation.assertTargetHoldsText(workspaceId, kind, repoRelTarget);
                 await withEditLock(workspaceId, branch, gatePath, user, async () => {
                     // Scope the deny to the same verb the user acted on (if any).
-                    await mutation.denyHere(workspaceId, kind, repoRelTarget, principal, verb, revokeOpts);
+                    await mutation.denyHere(workspaceId, kind, repoRelTarget, principal, verb);
                 });
                 accessControl.invalidate(workspaceId);
                 logger('access.revoke.deny-here').info(`ws=${workspaceId} branch=${branch} ` +
@@ -951,7 +976,7 @@ recoveryAdmins = []) {
             const editPath = gatePath;
             let changed = false;
             await withEditLock(workspaceId, branch, editPath, user, async () => {
-                const r = await mutation.revoke(workspaceId, kind, repoRelTarget, principal, user.email, verb, revokeOpts);
+                const r = await mutation.revoke(workspaceId, kind, repoRelTarget, principal, user.email, verb);
                 changed = r.changed;
             });
             accessControl.invalidate(workspaceId);
@@ -1030,7 +1055,7 @@ recoveryAdmins = []) {
             // surface). The frontend hides the page, but the API must gate too — the
             // roster exposes every role + member email.
             await assertRolesAdmin(user.email);
-            res.json({ roles: await rolesAdmin.getRoster() });
+            res.json({ roles: await rolesAdmin.getRoster(user.email) });
         }
         catch (err) {
             const { status, body } = toHttpError(err);