@astram/identity 0.20.0 → 0.22.0

package/dist/features/authz/grant-admin.service.js

@@ -44,6 +44,7 @@ class GrantAdminService {
     ceiling;
     audit;
     schemas;
+    accessNotifier;
     bundles;
     /**
      * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold") plus the
@@ -55,12 +56,19 @@ class GrantAdminService {
      *   connection, fail-closed. The identity module ALWAYS wires the engine `MariaDbAuditSink`.
      * @param schemas Resolved framework names (absent ⇒ resolved from the namespace, once, here).
      */
-    constructor(pool, bumper, bundleStore, ceiling, audit, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
+    constructor(pool, bumper, bundleStore, ceiling, audit, schemas = (0, schema_js_1.frameworkSchemasFromEnv)(), 
+    /**
+     * G-027 step 3 (notifying-user SPEC §5B, §5C): personal access-change notices on the grant's
+     * own transaction. OPTIONAL (absent ⇒ no notices, no extra reads); the identity module
+     * always wires it.
+     */
+    accessNotifier) {
         this.pool = pool;
         this.bumper = bumper;
         this.ceiling = ceiling;
         this.audit = audit;
         this.schemas = schemas;
+        this.accessNotifier = accessNotifier;
         this.bundles = bundleStore ?? new access_bundle_store_js_1.AccessBundleStore(pool, schemas);
     }
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
@@ -167,10 +175,17 @@ class GrantAdminService {
                     await this.ceiling.assertMayStripRoleFromServiceAccounts(actor, roleUuid, accounts.map((a) => a.sa_tenant_id), 'revoke');
                 }
             }
+            // G-027 step 3 (SPEC §5B): the holders' effective keys before the write, on this
+            // connection, after the lock and every refusal (a refused change never reaches a notice).
+            const notice = await this.beginAccessNotice(conn, roleUuid, actor);
             for (const key of keys)
                 await statement(conn, key);
             const bumped = await this.bumper.bumpForRole(roleUuid, conn);
-            await this.auditGrantChange(conn, action, roleUuid, keys, actor, bumped, extra);
+            const noticeDetail = await this.finishAccessNotice(notice, actor);
+            await this.auditGrantChange(conn, action, roleUuid, keys, actor, bumped, {
+                ...extra,
+                ...noticeDetail,
+            });
             await conn.commit();
             // ADR-0035: the committed versions reach Redis now (gate 5 reads them there).
             await this.bumper.publishCommitted(conn);
@@ -189,6 +204,36 @@ class GrantAdminService {
             await conn.release();
         }
     }
+    /**
+     * G-027 step 3 (SPEC §5B, §5C): read the role's holders and their effective keys on the grant's
+     * own transaction `conn`, BEFORE the `role_permission` write. `null` (no reads at all) when no
+     * notifier is wired or it is disabled for this actor (guard `auth: false`, the org bootstrap).
+     * Never throws: a failed read is carried as an `AccessReadFailure`.
+     */
+    async beginAccessNotice(conn, roleUuid, actor) {
+        const notifier = this.accessNotifier;
+        if (!notifier || !notifier.enabledFor(actor))
+            return null;
+        const query = (sql, params) => conn.query(sql, params);
+        const holders = await notifier.holdersOfRole(query, roleUuid);
+        const before = await notifier.snapshot(query, holders);
+        return { notifier, query, holders, before };
+    }
+    /**
+     * After the write and the bump: the after-snapshot and the notices, on the same connection (a
+     * rollback removes them with the grant). Returns the audit detail addition: `noticesDropped: n`
+     * when n > 0, `'unknown'` when a holder or snapshot read failed, else nothing (byte-identical).
+     */
+    async finishAccessNotice(run, actor) {
+        if (run === null)
+            return {};
+        const after = await run.notifier.snapshot(run.query, run.holders);
+        const { dropped } = await run.notifier.notify(run.query, actor, run.before, after);
+        const readFailed = !Array.isArray(run.holders) || !run.before.ok || !after.ok;
+        if (readFailed)
+            return { noticesDropped: 'unknown' };
+        return dropped > 0 ? { noticesDropped: dropped } : {};
+    }
     /**
      * Write the grant-administration audit row(s) on the transaction connection (D6). One row per
      * distinct tenant among the actor's tenant and every tenant the change bumped, so each affected
@@ -312,6 +357,9 @@ class GrantAdminService {
             if (this.ceiling && actor.isRoot !== true) {
                 await this.ceiling.assertMayStripRoleFromServiceAccounts(actor, roleUuid, accounts.map((a) => a.sa_tenant_id), 'delete');
             }
+            // G-027 step 3 (SPEC §5C): holders + their keys before the grants go. Holders come from
+            // committed postings (the caller's uncommitted role delete is not visible here).
+            const notice = await this.beginAccessNotice(conn, roleUuid, actor);
             const keys = (await conn.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid])).map((r) => r.rp_perm_key);
             const bumped = await this.bumper.bumpForRole(roleUuid, conn);
             await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ?`, [roleUuid]);
@@ -321,9 +369,11 @@ class GrantAdminService {
                 const previous = a.sa_updated_at_ms === null ? 0 : Number(a.sa_updated_at_ms);
                 await conn.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET sa_role_ids = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), Math.max(nowMs, previous + 1), a.sa_id]);
             }
+            const noticeDetail = await this.finishAccessNotice(notice, actor);
             await this.auditGrantChange(conn, 'role.permission_revoked', roleUuid, keys, actor, bumped, {
                 roleDeleted: true,
                 serviceAccountsUpdated: accounts.length,
+                ...noticeDetail,
             });
             await conn.commit();
             await this.bumper.publishCommitted(conn);

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAaL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA0DxB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA0C/E,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAkElF;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,GAAG,SAAS,GAChE,gBAAgB,EAAE,CAapB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAyBhB;AA2BD,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,GACP,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,MAAM,CAAC,EAAE,aAAa,CAAC;KACnB,GAAG,aAAa;CAgqBvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAaL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA4DxB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA6C/E,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAkElF;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,GAAG,SAAS,GAChE,gBAAgB,EAAE,CAapB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAyBhB;AA2BD,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,GACP,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,MAAM,CAAC,EAAE,aAAa,CAAC;KACnB,GAAG,aAAa;CA6rBvB"}

package/dist/features/identity-feature.module.js

@@ -54,6 +54,9 @@ const access_bundle_store_js_1 = require("./authz/access-bundle-store.js");
 const grant_admin_service_js_1 = require("./authz/grant-admin.service.js");
 const grant_admin_controller_js_1 = require("./authz/grant-admin.controller.js");
 const grant_ceiling_js_1 = require("./authz/grant-ceiling.js");
+const permission_announcement_service_js_1 = require("./permission-announcement/permission-announcement.service.js");
+const permission_announcement_controller_js_1 = require("./permission-announcement/permission-announcement.controller.js");
+const access_change_notifier_js_1 = require("./authz/access-change-notifier.js");
 const policy_service_js_1 = require("./policy/policy.service.js");
 const security_policy_service_js_1 = require("./security-policy/security-policy.service.js");
 const security_policy_controller_js_1 = require("./security-policy/security-policy.controller.js");
@@ -301,6 +304,10 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // registered for the cross-tenant writer and the policy author too.
         const recordAuthorization = (0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool, extraObjects, schemas);
         const ceilingRegistry = recordAuthorization.registry;
+        // G-027 step 3: personal access-change notices, keys expanded against the SAME registry the
+        // request path grants from. Attached to guard's NotificationService by the provider below
+        // (absent with `auth: false` ⇒ a no-op notifier).
+        const accessChangeNotifier = new access_change_notifier_js_1.AccessChangeNotifier(ceilingRegistry, schemas);
         const bumper = new permission_version_bumper_js_1.PermissionVersionBumper(undefined, schemas);
         const postingVersionBump = {
             bumpTenant: (tenantUuid) => bumper.bumpForTenant(tenantUuid, authzPool),
@@ -331,7 +338,11 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         const auditSinkConfig = { schema: schemas.audit };
         // Grant administration is audited on the grant's own transaction (D6, fail-closed).
         const grantAdminAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
-        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink, schemas);
+        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink, schemas, accessChangeNotifier);
+        // G-027 step 4: permission-announcement admin tasks, over the SAME authz pool, ceiling and
+        // registry as grant administration; dismissals audited on their own transaction through the
+        // grant-admin sink (stateless; same fail-closed in-transaction contract).
+        const permissionAnnouncementService = new permission_announcement_service_js_1.PermissionAnnouncementService(authzPool, grantCeiling, ceilingRegistry, grantAdminAuditSink, schemas);
         // Scope closure (Task 1.2 of the scoped-hierarchy program): the reconciler + node
         // move/delete maintenance, over the SAME shared authzPool (it reaches BOTH shield_app —
         // companies — and shield_authz — scope_closure). Reuses the SAME `bumper` instance so a
@@ -661,6 +672,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Mandatory-2FA policies (auth capabilities R2.9) — `security-policies/*` collides with
                 // nothing. Gated on `security_policy:<action>`. Appended last.
                 security_policy_controller_js_1.SecurityPolicyController,
+                // Permission announcements (G-027 step 4) — `permission-announcements/*` collides with no
+                // `/:uuid` route under `identity`; its `:companyUuid/:key/{dismiss,reopen}` are static-suffixed.
+                permission_announcement_controller_js_1.PermissionAnnouncementController,
             ],
             providers: [
                 company_service_js_1.CompanyService,
@@ -671,6 +685,16 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 org_catalog_service_js_1.OrgCatalogService,
                 record_resolver_js_1.RecordResolverService,
                 { provide: posting_version_bump_js_1.POSTING_VERSION_BUMP, useValue: postingVersionBump },
+                // G-027 step 3: the one access-change notifier (also held by GrantAdminService), attached
+                // here to guard's NotificationService when guard provides it (`auth: true`), else none.
+                {
+                    provide: access_change_notifier_js_1.ACCESS_CHANGE_NOTIFIER,
+                    useFactory: (service) => {
+                        accessChangeNotifier.attach(service ?? null);
+                        return accessChangeNotifier;
+                    },
+                    inject: [{ token: guard_1.SHIELD_NOTIFICATIONS, optional: true }],
+                },
                 // Mandatory-2FA policies (R2.6, R2.9): the service, and its permission-version bump over
                 // the ONE shared bumper (bumps on the write's transaction, published after the commit).
                 security_policy_service_js_1.SecurityPolicyService,
@@ -749,6 +773,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Grant-admin stack — all over the ONE shared authzPool.
                 { provide: access_bundle_store_js_1.AccessBundleStore, useValue: accessBundleStore },
                 { provide: grant_admin_service_js_1.GrantAdminService, useValue: grantAdminService },
+                { provide: permission_announcement_service_js_1.PermissionAnnouncementService, useValue: permissionAnnouncementService },
                 // The ONE tenant-boundary authority (ADR-0029 ceiling + block A: role assignment, user
                 // dominance, role binding) — injected by RoleService, PostingService and UserService.
                 { provide: grant_ceiling_js_1.GrantCeiling, useValue: grantCeiling },

package/dist/features/membership/membership.service.d.ts

@@ -20,11 +20,22 @@ import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
 import type { Principal } from '@astram/core';
 import { type PostingVersionBump } from './posting-version-bump.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
+import { type AccessChangeNotifier } from '../authz/access-change-notifier.js';
 export declare class MembershipService {
     private readonly records;
     private readonly ceiling;
     private readonly versionBump?;
-    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined);
+    private readonly accessNotifier?;
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined, accessNotifier?: (AccessChangeNotifier | null) | undefined);
+    /**
+     * G-027 step 3 (SPEC §5E): the before-snapshot of `pairs` on the engine transaction's own
+     * connection (`transactionQueryOf`), so the after-snapshot sees the uncommitted membership
+     * writes and the notice commits or rolls back with them. `null` (no reads) when no notifier is
+     * wired or it is disabled for this actor (guard `auth: false`, the org bootstrap). Never throws.
+     */
+    private beginAccessNotice;
+    /** After the last write: after-snapshot + notify (a drop is logged by the notifier only). */
+    private finishAccessNotice;
     /**
      * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
      * acting on their OWN membership, require the actor to dominate its user (security review): a
@@ -48,7 +59,8 @@ export declare class MembershipService {
      */
     addMembership(actor: Principal, userUuid: string, companyUuid: string): Promise<RecordId>;
     /**
-     * Add an ACTIVE membership for `(userUuid, companyUuid)` in one create (G-009 R4): a brand-new
+     * Add an ACTIVE membership for `(userUuid, companyUuid)` in one create, inside one engine
+     * transaction with the user's access notice (G-009 R4; G-027 step 3): a brand-new
      * membership has no other active card to displace, so no create-then-activate pair. A
      * membership for that pair already existing is an `IdentityConflictError`, from the pre-check
      * and from the `(cm_user_uuid, cm_company_uuid)` unique index (the pre-check read is SQL-scoped
@@ -88,6 +100,11 @@ export declare class MembershipService {
     /**
      * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
      * membership needs dominance over the peer (security review); your own does not.
+     *
+     * Intentionally sends NO access-change notice (notifying-user SPEC §11): the user can no longer
+     * open that company's inbox, and the notice store's recipient filter would skip them anyway.
+     * `updateMembership` (status only, no key change), user status changes and `deleteUser` are
+     * likewise not hooked.
      */
     removeMembership(actor: Principal, membershipUuid: string): Promise<void>;
 }

package/dist/features/membership/membership.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAYzD,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAXZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F;;;;;;;OAOG;IACG,mBAAmB,CACvB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAwBpB,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0D1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}
+{"version":3,"file":"membership.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,oCAAoC,CAAC;AAoB5C,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAQxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAhBf,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAQrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,cAAc,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA;IAG/D;;;;;OAKG;YACW,iBAAiB;IAY/B,6FAA6F;YAC/E,kBAAkB;IAShC;;;;OAIG;YACW,WAAW;IAQzB;;;;;;OAMG;YACW,WAAW;IAYzB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB/F;;;;;;;;OAQG;IACG,mBAAmB,CACvB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC;IAgCpB,kEAAkE;IAC5D,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAKvE;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyE1F;;;;OAIG;IACG,gBAAgB,CACpB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;OAQG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYhF"}

package/dist/features/membership/membership.service.js

@@ -33,9 +33,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MembershipService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
+const internal_1 = require("@astram/engine/internal");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const access_change_notifier_js_1 = require("../authz/access-change-notifier.js");
 /** The only status the active membership may have (case-sensitive, as the readers' predicate). */
 const ACTIVE_STATUS = 'active';
 /** A driver duplicate-key error (errno 1062), recognised by errno/code only, never its message. */
@@ -49,13 +51,36 @@ let MembershipService = class MembershipService {
     records;
     ceiling;
     versionBump;
+    accessNotifier;
     constructor(records, 
     // Dominance over the member for destructive ops (security review): REQUIRED, so a missing
     // ceiling fails DI at boot instead of silently skipping the check.
-    ceiling, versionBump) {
+    ceiling, versionBump, accessNotifier) {
         this.records = records;
         this.ceiling = ceiling;
         this.versionBump = versionBump;
+        this.accessNotifier = accessNotifier;
+    }
+    /**
+     * G-027 step 3 (SPEC §5E): the before-snapshot of `pairs` on the engine transaction's own
+     * connection (`transactionQueryOf`), so the after-snapshot sees the uncommitted membership
+     * writes and the notice commits or rolls back with them. `null` (no reads) when no notifier is
+     * wired or it is disabled for this actor (guard `auth: false`, the org bootstrap). Never throws.
+     */
+    async beginAccessNotice(tx, actor, pairs) {
+        const notifier = this.accessNotifier;
+        if (!notifier || !notifier.enabledFor(actor))
+            return null;
+        const query = (0, internal_1.transactionQueryOf)(tx);
+        const before = await notifier.snapshot(query, pairs);
+        return { notifier, query, pairs, before };
+    }
+    /** After the last write: after-snapshot + notify (a drop is logged by the notifier only). */
+    async finishAccessNotice(run, actor) {
+        if (run === null)
+            return;
+        const after = await run.notifier.snapshot(run.query, run.pairs);
+        await run.notifier.notify(run.query, actor, run.before, after);
     }
     /**
      * Read a membership through the subtree wall (404 when out of reach) and, unless the actor is
@@ -117,7 +142,8 @@ let MembershipService = class MembershipService {
         });
     }
     /**
-     * Add an ACTIVE membership for `(userUuid, companyUuid)` in one create (G-009 R4): a brand-new
+     * Add an ACTIVE membership for `(userUuid, companyUuid)` in one create, inside one engine
+     * transaction with the user's access notice (G-009 R4; G-027 step 3): a brand-new
      * membership has no other active card to displace, so no create-then-activate pair. A
      * membership for that pair already existing is an `IdentityConflictError`, from the pre-check
      * and from the `(cm_user_uuid, cm_company_uuid)` unique index (the pre-check read is SQL-scoped
@@ -136,8 +162,16 @@ let MembershipService = class MembershipService {
         }
         let id;
         try {
-            id = await this.records.create('company_membership', {
-                fields: { userUuid, companyUuid, isActive: true, status: 'active' },
+            // G-027 step 3 (SPEC §5E): the create and the user's access notice in one transaction.
+            id = await this.records.transaction(async (tx) => {
+                const notice = await this.beginAccessNotice(tx, actor, [
+                    { userId: userUuid, tenantId: companyUuid },
+                ]);
+                const created = await tx.create('company_membership', {
+                    fields: { userUuid, companyUuid, isActive: true, status: 'active' },
+                });
+                await this.finishAccessNotice(notice, actor);
+                return created;
             });
         }
         catch (err) {
@@ -203,6 +237,16 @@ let MembershipService = class MembershipService {
             if (current.fields?.status !== ACTIVE_STATUS) {
                 throw new identity_errors_js_1.IdentityConflictError('Only a membership with status active can be made the active membership.');
             }
+            // G-027 step 3 (SPEC §5E): the user in every company of their memberships (the target's
+            // and each one this flip deactivates), before the first write. One notice per company
+            // whose key set changed.
+            const companies = new Set();
+            for (const m of rows) {
+                const c = m.fields?.companyUuid;
+                if (typeof c === 'string' && c.length > 0)
+                    companies.add(c);
+            }
+            const notice = await this.beginAccessNotice(tx, actor, [...companies].map((tenantId) => ({ userId: userUuid, tenantId })));
             // 1) TARGET FIRST (defence in depth, see the method comment).
             await tx.update('company_membership', target.id, { fields: { isActive: true } });
             // 2) Deactivate every OTHER membership (skip the target we just activated).
@@ -212,6 +256,7 @@ let MembershipService = class MembershipService {
                 await tx.update('company_membership', m.id, { fields: { isActive: false } });
                 deactivated.push(m);
             }
+            await this.finishAccessNotice(notice, actor);
         });
         // ADR-0011 STALENESS FIX: activation ADDS the target company's role grants and each
         // deactivation REMOVES that company's grants — a coarse-grant change in BOTH directions.
@@ -262,6 +307,11 @@ let MembershipService = class MembershipService {
     /**
      * Remove a membership card (its postings cascade at the DB via FK ON DELETE CASCADE). A peer's
      * membership needs dominance over the peer (security review); your own does not.
+     *
+     * Intentionally sends NO access-change notice (notifying-user SPEC §11): the user can no longer
+     * open that company's inbox, and the notice store's recipient filter would skip them anyway.
+     * `updateMembership` (status only, no key change), user status changes and `deleteUser` are
+     * likewise not hooked.
      */
     async removeMembership(actor, membershipUuid) {
         // ADR-0011 STALENESS FIX: resolve the membership's tenant BEFORE the delete (it's
@@ -281,6 +331,8 @@ exports.MembershipService = MembershipService = __decorate([
     (0, common_1.Injectable)(),
     __param(2, (0, common_1.Optional)()),
     __param(2, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(access_change_notifier_js_1.ACCESS_CHANGE_NOTIFIER)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object])
 ], MembershipService);

package/dist/features/membership/posting.service.d.ts

@@ -27,6 +27,7 @@ import { RecordsService, type RecordView } from '@astram/engine';
 import type { Principal } from '@astram/core';
 import { type PostingVersionBump } from './posting-version-bump.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
+import { type AccessChangeNotifier } from '../authz/access-change-notifier.js';
 /**
  * The shape of one desired posting row submitted by the editor. The effective-window
  * bounds arrive from the client as a bare `YYYY-MM-DD` date string (native `<input
@@ -44,7 +45,8 @@ export declare class PostingService {
     private readonly records;
     private readonly ceiling;
     private readonly versionBump?;
-    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined);
+    private readonly accessNotifier?;
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (PostingVersionBump | null) | undefined, accessNotifier?: (AccessChangeNotifier | null) | undefined);
     /** List a membership's postings (tenant-scoped by the pipe). */
     listPostings(membershipUuid: string): Promise<readonly RecordView[]>;
     /**
@@ -64,6 +66,15 @@ export declare class PostingService {
     addPostings(actor: Principal, membershipUuid: string, toAdd: readonly PostingInput[], opts?: {
         operationRoleIds?: ReadonlySet<string> | readonly string[];
     }): Promise<void>;
+    /**
+     * G-027 step 3 (SPEC §5D): the before-snapshot of (member, company) on the engine transaction's
+     * own connection (`transactionQueryOf`), so the after-snapshot sees the uncommitted posting
+     * writes and the notice commits or rolls back with them. `null` (no reads) when no notifier is
+     * wired or it is disabled for this actor (guard `auth: false`, the org bootstrap). Never throws.
+     */
+    private beginAccessNotice;
+    /** After the last write: after-snapshot + notify (a drop is logged by the notifier only). */
+    private finishAccessNotice;
     private assertEveryRole;
     /** The membership through the subtree read wall (404 when out of reach) and its company. */
     private reachMembership;

package/dist/features/membership/posting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAA6B,MAAM,2BAA2B,CAAC;AAOpF;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0EhB;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAA;KAAE,GACpE,OAAO,CAAC,IAAI,CAAC;IA4ChB,OAAO,CAAC,eAAe;IAQvB,4FAA4F;YAC9E,eAAe;IAY7B,iGAAiG;YACnF,YAAY;IAuB1B;;;;OAIG;YACW,cAAc;IAa5B;;;;;;;;;;;;OAYG;YACW,YAAY;YA+BZ,UAAU;CAkBzB"}
+{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAA6B,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,oCAAoC,CAAC;AAO5C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AAkFD,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAbf,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,cAAc,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA;IAG/D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IA6EhB;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAA;KAAE,GACpE,OAAO,CAAC,IAAI,CAAC;IAiDhB;;;;;OAKG;YACW,iBAAiB;IAiB/B,6FAA6F;YAC/E,kBAAkB;IAShC,OAAO,CAAC,eAAe;IAQvB,4FAA4F;YAC9E,eAAe;IAY7B,iGAAiG;YACnF,YAAY;IAuB1B;;;;OAIG;YACW,cAAc;IAa5B;;;;;;;;;;;;OAYG;YACW,YAAY;YA+BZ,UAAU;CAkBzB"}

package/dist/features/membership/posting.service.js

@@ -40,8 +40,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PostingService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
+const internal_1 = require("@astram/engine/internal");
 const posting_version_bump_js_1 = require("./posting-version-bump.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const access_change_notifier_js_1 = require("../authz/access-change-notifier.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 /** The field keys whose values are effective-window epoch-ms bounds (normalized on write). */
 const WINDOW_KEYS = new Set(['effectiveFrom', 'effectiveUntil']);
@@ -115,13 +117,15 @@ let PostingService = class PostingService {
     records;
     ceiling;
     versionBump;
+    accessNotifier;
     constructor(records, 
     // The role-assignment ceiling + binding rule (security hardening #11). REQUIRED: a missing
     // ceiling must fail DI at boot, never silently skip the check.
-    ceiling, versionBump) {
+    ceiling, versionBump, accessNotifier) {
         this.records = records;
         this.ceiling = ceiling;
         this.versionBump = versionBump;
+        this.accessNotifier = accessNotifier;
     }
     /** List a membership's postings (tenant-scoped by the pipe). */
     async listPostings(membershipUuid) {
@@ -170,12 +174,15 @@ let PostingService = class PostingService {
             // delete, while we waited is refused before the INSERT (rolled back).
             await this.lockAndRecheck(tx, actor, tenantUuid, addedRoles, undefined);
             await this.lockOrgUnits(tx, tenantUuid, added);
+            // G-027 step 3 (SPEC §5D): the member's keys in this company before the first write.
+            const notice = await this.beginAccessNotice(tx, actor, memberUuid, tenantUuid);
             for (const d of added) {
                 await tx.create('membership_posting', { fields: { ...stripEmpty(d), membershipUuid } });
             }
             for (const r of removed) {
                 await tx.delete('membership_posting', r.id);
             }
+            await this.finishAccessNotice(notice, actor);
         });
         await this.bumpTenant(tenantUuid);
     }
@@ -209,15 +216,43 @@ let PostingService = class PostingService {
         if (added.length === 0)
             return; // nothing missing: no write, no bump
         const addedRoles = await this.assertMayAdd(actor, tenantUuid, added, ceilingOpts);
+        const memberUuid = typeof membership.fields?.userUuid === 'string' ? membership.fields.userUuid : '';
         await this.records.transaction(async (tx) => {
             await this.lockAndRecheck(tx, actor, tenantUuid, addedRoles, ceilingOpts);
             await this.lockOrgUnits(tx, tenantUuid, added);
+            // G-027 step 3 (SPEC §5D): the member's keys in this company before the first write.
+            const notice = await this.beginAccessNotice(tx, actor, memberUuid, tenantUuid);
             for (const d of added) {
                 await tx.create('membership_posting', { fields: { ...stripEmpty(d), membershipUuid } });
             }
+            await this.finishAccessNotice(notice, actor);
         });
         await this.bumpTenant(tenantUuid);
     }
+    /**
+     * G-027 step 3 (SPEC §5D): the before-snapshot of (member, company) on the engine transaction's
+     * own connection (`transactionQueryOf`), so the after-snapshot sees the uncommitted posting
+     * writes and the notice commits or rolls back with them. `null` (no reads) when no notifier is
+     * wired or it is disabled for this actor (guard `auth: false`, the org bootstrap). Never throws.
+     */
+    async beginAccessNotice(tx, actor, memberUuid, tenantUuid) {
+        const notifier = this.accessNotifier;
+        if (!notifier || !notifier.enabledFor(actor))
+            return null;
+        const query = (0, internal_1.transactionQueryOf)(tx);
+        const pairs = memberUuid !== '' && tenantUuid !== null
+            ? [{ userId: memberUuid, tenantId: tenantUuid }]
+            : [];
+        const before = await notifier.snapshot(query, pairs);
+        return { notifier, query, pairs, before };
+    }
+    /** After the last write: after-snapshot + notify (a drop is logged by the notifier only). */
+    async finishAccessNotice(run, actor) {
+        if (run === null)
+            return;
+        const after = await run.notifier.snapshot(run.query, run.pairs);
+        await run.notifier.notify(run.query, actor, run.before, after);
+    }
     assertEveryRole(postings) {
         for (const d of postings) {
             if (typeof d?.roleUuid !== 'string' || d.roleUuid.length === 0) {
@@ -327,6 +362,8 @@ exports.PostingService = PostingService = __decorate([
     (0, common_1.Injectable)(),
     __param(2, (0, common_1.Optional)()),
     __param(2, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(access_change_notifier_js_1.ACCESS_CHANGE_NOTIFIER)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object])
 ], PostingService);

package/dist/features/permission-announcement/permission-announcement.controller.d.ts

@@ -0,0 +1,22 @@
+import type { Principal } from '@astram/core';
+import { PermissionAnnouncementService, type PermissionAnnouncementQuery } from './permission-announcement.service.js';
+/** The request shape after the enforcement guard attaches the resolved principal. */
+interface AuthedRequest {
+    principal: Principal;
+}
+/** Validate the list query (spec §3, §13: bad `status`/`page`/`limit`/uuid ⇒ 400). */
+export declare function parseAnnouncementQuery(query: Record<string, unknown> | undefined): PermissionAnnouncementQuery;
+/** Validate a `:key` route param (spec §5.B), or 400 (the value is never echoed). */
+export declare function parsePermissionKeyParam(value: unknown): string;
+export declare class PermissionAnnouncementController {
+    private readonly announcements;
+    constructor(announcements: PermissionAnnouncementService);
+    /** The caller's tasks, grouped per company: `{ total, rows, page, limit }`. */
+    list(req: AuthedRequest, query: Record<string, unknown>): Promise<import("./permission-announcement.service.js").PermissionAnnouncementPage>;
+    /** "Reviewed, not needed" (idempotent, audited). */
+    dismiss(req: AuthedRequest, companyUuid: string, key: string): Promise<void>;
+    /** Undo a dismissal (idempotent, audited). */
+    reopen(req: AuthedRequest, companyUuid: string, key: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=permission-announcement.controller.d.ts.map

package/dist/features/permission-announcement/permission-announcement.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-announcement.controller.d.ts","sourceRoot":"","sources":["../../../src/features/permission-announcement/permission-announcement.controller.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAIL,6BAA6B,EAE7B,KAAK,2BAA2B,EACjC,MAAM,sCAAsC,CAAC;AAE9C,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAsBD,sFAAsF;AACtF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACzC,2BAA2B,CAoB7B;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAS9D;AAED,qBAEa,gCAAgC;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,6BAA6B;IAEzE,+EAA+E;IAGzE,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAW,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI7E,oDAAoD;IAI9C,OAAO,CACJ,GAAG,EAAE,aAAa,EACO,WAAW,EAAE,MAAM,EACrC,GAAG,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC;IAIhB,8CAA8C;IAIxC,MAAM,CACH,GAAG,EAAE,aAAa,EACO,WAAW,EAAE,MAAM,EACrC,GAAG,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC;CAGjB"}