@astram/guide 0.2.19 → 0.2.21

package/CAPABILITIES.md

@@ -169,7 +169,10 @@ imports: [
   `GET /identity/auth-facts` feeds the frontend's permission-gated navigation.
 - **Scoped-hierarchy tenancy** (ADR-0027): a tenant is a company node; an admin's authority covers
   its subtree. Reads, updates, deletes AND creates of subtree-scoped types are walled in the query
-  (ADR-0030, ADR-0034). Non-root admins cannot create top-level tenants.
+  (ADR-0030, ADR-0034). Non-root admins cannot create top-level tenants. With
+  `IdentityFeatureModule` wired, a session's subtree (its company and every company below) is
+  resolved at sign-in automatically (identity 0.24); pass `ShieldModule.forRoot({ scopeSubtreeResolver })`
+  only to replace identity's resolver. Without identity, reach is the active company only.
 - **No escalation**: you can grant, revoke or assign (via postings) only roles and keys you hold
   (ADR-0029); a role used outside your subtree is root-only; changing another user's email or
   status needs dominance over that user. Grant changes are audited in the same transaction.
@@ -504,15 +507,23 @@ imports: [
 - **Admin tasks for new permissions (G-027 step 4, identity 0.22):** each company gets one open
   task per active permission key with a first-seen date that no role owned by the company holds
   (directly or through `identity:<type>:*` / `identity:*`). `GET /identity/permission-announcements
-  ?status=open|dismissed&page=&limit=` (root may add `companyUuid`) lists the tasks the caller can
-  act on: holders of `identity:role:update` whose grant ceiling covers the key, in their active
-  company only; root sees every company. Granting the key to any of the company's roles closes the
+  ?status=open|dismissed&page=&limit=&companyUuid=` lists the tasks the caller can act on: holders
+  of `identity:role:update` whose grant ceiling covers the key, for the companies below them (their
+  own company already holds what they can grant; the subtree comes with `IdentityFeatureModule`,
+  identity 0.24); root sees every company. On a fresh
+  install the keys from the very first catalogue pass raise no task (identity 0.23). Granting the key to any of the company's roles closes the
   task on the next read; `POST /identity/permission-announcements/:companyUuid/:key/dismiss`
   ("Reviewed, not needed", audited) closes it on purpose and `…/reopen` undoes that. A key removed
   and re-added by a later release opens again. Framework keys count like yours. Tasks are not
   notices: they never enter `/account/notifications`.
-- Not yet: the frontend-core service and the scaffold bell and Announcements icon (step 5), email
-  delivery.
+- **Frontend (G-027 step 5, frontend-core 0.10):** `createNotificationService(http)`
+  (`listNotifications`, `unreadNotificationCount`, `markNotificationRead`, `markAllNotificationsRead`) and
+  `identity.{listPermissionAnnouncements,dismissPermissionAnnouncement,reopenPermissionAnnouncement}`. The scaffolded
+  header has a bell (personal notices) and an Announcements icon (announcement notices, plus admin tasks for holders of
+  `identity:role:update`); "Grant…" opens `/access/add?key=<key>` with the key ticked; the Access form marks keys
+  with a caution and asks to confirm before granting them. Counts refresh on focus and every 60 s while the tab is
+  visible, and right after the user's own actions. Delivery is polling; there is no server push yet.
+- Not yet: email delivery.
 
 ## Separation of duties (ADR-0048; core 1.12, engine 0.14, guard 0.21, identity 0.18)
 - **Declare it on the type** when the people who started or asked about a record must not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guide",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "license": "MIT",
   "description": "Astram framework — the AI/dev GUIDE layer (ADR-0025). Ships the framework's hard rules + capabilities manifest as installed, upgrade-refreshed docs. A consumer app's CLAUDE.md references FRAMEWORK_RULES.md from this package; `npm update` replaces it wholesale so new rules arrive cleanly, while the app's own .astram/guide/ layer is never touched. This is the framework-owned FLOOR: an app rule may tighten it, never weaken it.",
   "type": "commonjs",