@7365admin1/layer-common 4.36.0 → 4.38.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @iservice365/layer-common
 
+## 4.38.0
+
+### Minor Changes
+
+- 59ce7ed: Passes & Keys permissions and the membership the app is working in (DV-0409).
+
+  - Passes And Keys Management: new `add-passes-and-keys`, `update-passes-and-keys` and `delete-passes-and-keys` permissions in both the Security and the Property Management role catalogues (`useSecurityPermission`, `usePropertyPermission`). API-core now enforces them on `/api/keys` and `/api/qr-code-templates`; "See All Passes And Keys" is what shows the Templates and Passes & Keys pages.
+  - `plugins/API.ts` sends `X-App` (this app's member type, from `runtimeConfig.public.APP`) and `X-Org` (the organisation in the address) with every request, so core checks the role of the membership the screen is using when a person holds several memberships at one site. Only chooses among the user's own memberships; grants nothing. A server that does not read them is unaffected.
+
+- 27c17b7: Service-provider invitations can be answered in the app: the notification bell opens "<Company> has invited you to <site>" on the organisation app's Invitations page (other apps send the click there by URL), the new `ServiceProviderInvitationsReceived` section lists invitations from other organisations with Accept / Decline, `useServiceProviderInvitation` gains `acceptInvitation` and `getReceivedInvitations`, and the invitation card shows a failed accept or decline instead of swallowing it.
+
+## 4.37.0
+
+### Minor Changes
+
+- 8ccdca4: HERO building map and lift queue show the HERO Fleet Core building at sites with fleet robots: walls, doors (open doors highlighted) and lift shafts from the fleet, refreshed every 5 s, read-only (no Edit map); the lift queue shows each fleet lift's car floor and the robot holding it. The map editor's duplicate "Full screen" button is removed - the page header's one full-screens the viewer or the editor.
+
 ## 4.36.0
 
 ### Minor Changes
@@ -1424,11 +1441,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                                                                        GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                                                                        GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                            GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                            GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                                                                        owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                                                                        staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                            owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                            staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and

package/assets/css/robot-hero.css

@@ -951,6 +951,7 @@
 .hero-bmap__wall { stroke: var(--hero-text); stroke-width: 3; opacity: 0.8; }
 .hero-bmap__zone { fill: color-mix(in srgb, var(--hero-text) 10%, transparent); stroke: var(--hero-text); stroke-width: 1; stroke-dasharray: 4 3; }
 .hero-bmap__doorline { stroke: var(--hero-accent); stroke-width: 3; }
+.hero-bmap__doorline--open { stroke: rgb(var(--v-theme-success)); stroke-dasharray: 2 2; }
 .hero-bmap__anchor { position: absolute; width: 0; height: 0; transform-style: preserve-3d; }
 .hero-bmap__routetag { position: absolute; left: -6px; top: -30px; transform-origin: 0 0; white-space: nowrap; font-size: 9px; letter-spacing: 0.08em; text-transform: uppercase; font-weight: 800; padding: 1px 6px; background: var(--hero-accent); color: #fff; }
 .hero-bmap__cp { position: absolute; left: -6px; top: -6px; width: 12px; height: 12px; box-sizing: border-box; border: 2px solid var(--hero-accent); background: var(--hero-bg); display: grid; place-items: center; font-size: 7px; font-weight: 800; color: var(--hero-accent); }
@@ -985,6 +986,7 @@
 .hero-bmap__legend { position: absolute; left: 14px; bottom: 12px; z-index: 3; font-size: 11px; opacity: 0.65; display: flex; gap: 14px; white-space: nowrap; }
 .hero-bmap__key { display: inline-block; width: 8px; height: 8px; vertical-align: middle; margin-right: 5px; }
 .hero-bmap__key--door { background: var(--hero-accent); }
+.hero-bmap__key--dooropen { background: rgb(var(--v-theme-success)); }
 .hero-bmap__key--shaft { background: color-mix(in srgb, var(--hero-accent) 30%, transparent); border: 1px solid var(--hero-accent); box-sizing: border-box; }
 .hero-bmap__key--bot { background: var(--hero-text); }
 .hero-bmap__key--route { width: 12px; height: 0; border-top: 2px dashed var(--hero-accent); }
@@ -1010,8 +1012,6 @@
 .hero .hero-input.hero-editor__floor { width: auto; min-height: 32px; padding: 4px 26px 4px 8px; }
 .hero .hero-input.hero-editor__zone { width: 220px; min-height: 32px; }
 .hero-editor__hint { font-size: 12px; opacity: 0.7; order: 1; flex-basis: 100%; } /* own line: switching tools never moves the plan */
-.hero .v-btn.hero-editor__fs { margin-left: auto; }
-.hero .v-btn.hero-editor__fs .v-btn__content { gap: 8px; }
 .hero-editor__notice { padding: 10px 12px; font-size: 12.5px; border-left: 2px solid var(--hero-accent); background: var(--hero-surface); }
 .hero-editor__notice--ok { border-left-color: rgb(var(--v-theme-success)); }
 .hero-editor__split { display: flex; flex-wrap: wrap; gap: 24px; align-items: stretch; flex: 1; }

package/components/NotificationBell.vue

@@ -134,7 +134,7 @@ import {
   timeAgo,
   type TInboxItem,
 } from "../utils/notification-inbox";
-import { notificationTarget } from "../utils/notification-target";
+import { externalTargetUrl, notificationTarget } from "../utils/notification-target";
 
 /**
  * The top-bar notification feed for the web, in every signed-in app.
@@ -168,6 +168,7 @@ const { getAll, getUnreadCount, markAsRead, markAllAsRead } = useNotification();
 const { currentUser } = useLocalAuth();
 const route = useRoute();
 const router = useRouter();
+const appConfig = useRuntimeConfig();
 
 const open = ref(false);
 const loading = ref(false);
@@ -305,14 +306,24 @@ function markRead(item: Record<string, any>) {
  */
 async function goToSubject(item: Record<string, any>) {
   const target = notificationTarget(item as any, {
-    organization: String(route.params?.organization ?? ""),
+    // The org app nests under `organization`; the service apps under `org`.
+    organization: String(route.params?.organization ?? route.params?.org ?? ""),
   });
   if (!target) return;
-  if (typeof router.hasRoute !== "function" || !router.hasRoute(target.name)) return;
+
+  if (typeof router.hasRoute !== "function" || !router.hasRoute(target.name)) {
+    // The page lives in another web app (the invitation is answered in the
+    // organisation app): go there by URL, or stay put if it is not configured.
+    const href = externalTargetUrl(target, { org: String(appConfig?.public?.APP_ORG ?? "") });
+    if (!href) return;
+    open.value = false;
+    window.location.assign(href);
+    return;
+  }
 
   open.value = false;
   try {
-    await router.push(target);
+    await router.push({ name: target.name, params: target.params, query: target.query });
   } catch {
     // A cancelled or duplicate navigation is not worth an error in the top bar.
   }

package/components/Robot/BuildingMap.vue

@@ -18,7 +18,7 @@
       <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M8 3H5a2 2 0 0 0-2 2v3m18 0V5a2 2 0 0 0-2-2h-3m0 18h3a2 2 0 0 0 2-2v-3M3 16v3a2 2 0 0 0 2 2h3" /></svg>
       Full screen
     </v-btn>
-    <v-btn v-if="canEditMap" :variant="editing ? 'outlined' : 'flat'" :color="editing ? undefined : 'primary'" @click="editing = !editing">
+    <v-btn v-if="canEditMap && !fleet" :variant="editing ? 'outlined' : 'flat'" :color="editing ? undefined : 'primary'" @click="editing = !editing">
       {{ editing ? "Exit edit mode" : "Edit map" }}
     </v-btn>
   </div>
@@ -26,8 +26,10 @@
   <div v-if="error" class="hero-notice" role="alert">{{ error }}</div>
   <div v-else-if="!loading && emptyNote" class="hero-notice">{{ emptyNote }}</div>
 
+  <div v-if="fleet" class="hero-notice" role="status">Live building from HERO Fleet Core - doors and lifts update every few seconds. It is managed by the fleet, so it cannot be edited here.</div>
+
   <RobotMapEditor
-    v-if="editing && canEditMap"
+    v-if="editing && canEditMap && !fleet"
     ref="editor"
     :map="map"
     :floors="floors"
@@ -105,9 +107,11 @@
             class="hero-bmap__floor"
             :style="{ transform: `translateZ(${i * FLOOR_GAP_PX}px)`, opacity: f.dim, '--hero-fill': look.fill }"
           >
-            <span class="hero-bmap__room" style="left: 8%; top: 10%; width: 34%; height: 30%" aria-hidden="true" />
-            <span class="hero-bmap__room" style="left: 58%; top: 10%; width: 34%; height: 44%" aria-hidden="true" />
-            <span class="hero-bmap__room" style="left: 8%; top: 62%; width: 60%; height: 28%" aria-hidden="true" />
+            <template v-if="!fleet">
+              <span class="hero-bmap__room" style="left: 8%; top: 10%; width: 34%; height: 30%" aria-hidden="true" />
+              <span class="hero-bmap__room" style="left: 58%; top: 10%; width: 34%; height: 44%" aria-hidden="true" />
+              <span class="hero-bmap__room" style="left: 8%; top: 62%; width: 60%; height: 28%" aria-hidden="true" />
+            </template>
             <template v-if="!map">
               <span class="hero-bmap__door" style="left: 42%; top: 22%" aria-hidden="true" />
               <span class="hero-bmap__door" style="left: 58%; top: 30%" aria-hidden="true" />
@@ -116,7 +120,7 @@
               <template v-for="s in f.shapes" :key="s.id">
                 <polygon v-if="s.kind === 'zone'" class="hero-bmap__zone" :points="svgPoints(s)" vector-effect="non-scaling-stroke" />
                 <line v-else-if="s.kind === 'wall'" class="hero-bmap__wall" :x1="s.points[0]!.x" :y1="s.points[0]!.y" :x2="s.points[1]!.x" :y2="s.points[1]!.y" vector-effect="non-scaling-stroke" />
-                <line v-else-if="s.kind === 'door'" class="hero-bmap__doorline" :x1="s.points[0]!.x" :y1="s.points[0]!.y" :x2="s.points[1]!.x" :y2="s.points[1]!.y" vector-effect="non-scaling-stroke" />
+                <line v-else-if="s.kind === 'door'" class="hero-bmap__doorline" :class="{ 'hero-bmap__doorline--open': openDoors.has(String(s.meta?.name)) }" :x1="s.points[0]!.x" :y1="s.points[0]!.y" :x2="s.points[1]!.x" :y2="s.points[1]!.y" vector-effect="non-scaling-stroke" />
               </template>
             </svg>
 
@@ -165,6 +169,7 @@
 
       <div class="hero-bmap__legend">
         <span><i class="hero-bmap__key hero-bmap__key--door" />Door</span>
+        <span v-if="fleet"><i class="hero-bmap__key hero-bmap__key--dooropen" />Door open</span>
         <span><i class="hero-bmap__key hero-bmap__key--shaft" />Lift shaft</span>
         <span><i class="hero-bmap__key hero-bmap__key--bot" />Robot (live)</span>
         <span v-if="type === 'security'"><i class="hero-bmap__key hero-bmap__key--route" />Patrol route · numbered checkpoints</span>
@@ -197,6 +202,7 @@ import RobotMapEditor from "./MapEditor.vue";
 import RobotReconnecting from "./Reconnecting.vue";
 import useRobotBuilding from "../../composables/useRobotBuilding";
 import useRobotLive, { siteStatesFeed } from "../../composables/useRobotLive";
+import { openDoorNames } from "../../utils/robot-fleet-core";
 import {
   brandName,
   floorName,
@@ -258,11 +264,12 @@ const emit = defineEmits<{
   status: [status: { connected: boolean; faults: number; siteName: string; clientName: string }];
 }>();
 
-const { rows, map, names, loading, error, reload } = useRobotBuilding(
+const { rows, map, fleet, names, loading, error, reload } = useRobotBuilding(
   toRef(props, "organization"),
   toRef(props, "site"),
   toRef(props, "type"),
 );
+const openDoors = computed(() => openDoorNames(map.value));
 const siteLabel = computed(() => props.siteName || names.value.siteName || "This site");
 
 /* ---- live states + patrol routes of the robots on screen ---- */
@@ -381,8 +388,8 @@ function fullscreen(el?: HTMLElement | null) {
   else el?.requestFullscreen?.();
 }
 const editing = ref(false);
-watch(() => props.canEditMap, (can) => {
-  if (!can) editing.value = false;
+watch([() => props.canEditMap, fleet], ([can, isFleet]) => {
+  if (!can || isFleet) editing.value = false;
 });
 /** The robot a first save is attached to (maps are stored per robot): one of this site's. */
 const ownerRobotId = computed(() => String(map.value?.robotId ?? rows.value[0]?._id ?? ""));

package/components/Robot/LiftQueue.vue

@@ -16,6 +16,7 @@
   </div>
 
   <div v-if="error" class="hero-notice" role="alert">{{ error }}</div>
+  <div v-else-if="fleet" class="hero-notice" role="status">Live lifts from HERO Fleet Core - the fleet calls and releases lifts itself.</div>
   <div v-else-if="!connected" class="hero-notice" role="status">Reconnecting… the lift queue shows its last reading.</div>
 
   <div v-if="loading && !cards.length" class="hero-lifts" role="status" aria-label="Loading the lift queue">
@@ -75,7 +76,7 @@
             <span class="hero-lift-row__wait">{{ q.wait }}</span>
             <span class="hero-chip" :class="`hero-tone--${liftState(q.state).tone}`">{{ liftState(q.state).label }}</span>
             <button
-              v-if="canCommand"
+              v-if="canCommand && !fleet"
               type="button"
               class="hero-lift-row__release"
               :style="{ visibility: q.state === 'riding' || q.state === 'requested' ? 'visible' : 'hidden' }"
@@ -88,7 +89,7 @@
           </div>
         </div>
 
-        <form v-if="canCommand && demoRobots.length" class="hero-lift__ask" @submit.prevent="ask(l)">
+        <form v-if="canCommand && demoRobots.length && !fleet" class="hero-lift__ask" @submit.prevent="ask(l)">
           <select v-model="askRobot[l.name]" class="hero-input hero-select hero-select--sm" aria-label="Robot">
             <option value="" disabled>Robot</option>
             <option v-for="r in demoRobots" :key="String(r._id)" :value="String(r._id)">{{ r.name }}</option>
@@ -115,6 +116,7 @@ import RobotToast from "./Toast.vue";
 import useRobotBuilding from "../../composables/useRobotBuilding";
 import { floorName, liftState, robotErrorMessage } from "../../utils/robot-display";
 import { liftCard, type TLiftRowView } from "../../utils/robot-building";
+import { fleetLiftItems } from "../../utils/robot-fleet-core";
 
 const props = withDefaults(
   defineProps<{
@@ -137,7 +139,7 @@ const emit = defineEmits<{
   status: [status: { connected: boolean; faults: number; siteName: string; clientName: string }];
 }>();
 
-const { rows, map, names, loading: mapLoading, error: mapError } = useRobotBuilding(
+const { rows, all, map, fleet, names, loading: mapLoading, error: mapError } = useRobotBuilding(
   toRef(props, "organization"),
   toRef(props, "site"),
   toRef(props, "type"),
@@ -154,6 +156,8 @@ const loading = computed(() => mapLoading.value || queueLoading.value);
 const error = computed(() => mapError.value);
 
 async function poll() {
+  // The fleet building has no lift sessions of ours: its lifts come live with the building (5 s refresh).
+  if (fleet.value) return void (items.value = fleetLiftItems(map.value, all.value), (queueLoading.value = false));
   const id = map.value?._id;
   if (!id) return void (items.value = []);
   if (typeof document !== "undefined" && document.visibilityState === "hidden") return;
@@ -169,9 +173,10 @@ async function poll() {
 }
 let timer: ReturnType<typeof setInterval> | undefined;
 watch(
-  () => map.value?._id,
+  () => (fleet.value ? map.value : map.value?._id),
   (id) => {
     clearInterval(timer);
+    if (fleet.value) return void poll();
     items.value = [];
     if (!id) return;
     queueLoading.value = true;

package/components/Robot/MapEditor.vue

@@ -38,10 +38,6 @@
         @input="dispatch({ type: 'rename', name: zoneName })"
       />
       <span class="hero-editor__hint">{{ TOOL_HINTS[tool] }}</span>
-      <v-btn variant="outlined" class="hero-editor__fs" @click="fullscreen">
-        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M8 3H5a2 2 0 0 0-2 2v3m18 0V5a2 2 0 0 0-2-2h-3m0 18h3a2 2 0 0 0 2-2v-3M3 16v3a2 2 0 0 0 2 2h3" /></svg>
-        Full screen
-      </v-btn>
     </div>
 
     <div v-if="state.notice" class="hero-editor__notice" :class="{ 'hero-editor__notice--ok': state.notice.ok }" role="status" aria-live="polite">{{ state.notice.text }}</div>
@@ -482,9 +478,6 @@ const isFs = ref(false);
 const onFs = () => (isFs.value = document.fullscreenElement === root.value);
 onMounted(() => document.addEventListener("fullscreenchange", onFs));
 onBeforeUnmount(() => document.removeEventListener("fullscreenchange", onFs));
-function fullscreen() {
-  if (document.fullscreenElement) document.exitFullscreen?.();
-  else root.value?.requestFullscreen?.();
-}
+// Full screen is the page header's one button (BuildingMap), which full-screens `root` while editing.
 defineExpose({ root });
 </script>

package/components/ServiceProviderInvitationPrompt.vue

@@ -57,6 +57,11 @@
         :label="invitation.statusLabel"
       />
     </div>
+
+    <!-- An accept or decline that failed: said on the card, not swallowed. -->
+    <div v-if="error" class="px-4 pb-4 text-error sp-invite-prompt__body" role="alert">
+      {{ error }}
+    </div>
   </AppCard>
 
   <AppCard v-else-if="error">
@@ -82,8 +87,8 @@ const props = defineProps({
 
 const emit = defineEmits<{ (e: "answered", status: string): void }>();
 
-const { getInvitation, declineInvitation } = useServiceProviderInvitation();
-const { addViaInvite } = useCustomerSite();
+const { getInvitation, declineInvitation, acceptInvitation } =
+  useServiceProviderInvitation();
 
 const invitation = ref<any>(null);
 const error = ref("");
@@ -112,9 +117,10 @@ async function load() {
 }
 
 async function accept() {
+  error.value = "";
   working.value = "accept";
   try {
-    await addViaInvite(props.invitationId);
+    await acceptInvitation(props.invitationId);
     await load();
     emit("answered", "complete");
   } catch (err: any) {
@@ -125,6 +131,7 @@ async function accept() {
 }
 
 async function decline() {
+  error.value = "";
   working.value = "decline";
   try {
     await declineInvitation(props.invitationId);

package/components/ServiceProviderInvitationsReceived.vue

@@ -0,0 +1,113 @@
+<template>
+  <!-- Nothing to answer and nothing linked: the section stays out of the way. -->
+  <section v-if="ids.length" class="sp-received mb-4" aria-labelledby="sp-received-title">
+    <div class="mb-2">
+      <div id="sp-received-title" class="screen-card-title">
+        Invitations from other organisations
+      </div>
+      <div class="screen-hint">
+        Another organisation has asked your company to provide services at one
+        of its sites. Accept to add the site to your Sites list, or decline.
+      </div>
+    </div>
+
+    <div class="d-flex flex-column ga-3">
+      <div
+        v-for="id in ids"
+        :key="id"
+        :class="{ 'sp-received__linked': id === linked }"
+      >
+        <Suspense>
+          <ServiceProviderInvitationPrompt
+            :invitation-id="id"
+            @answered="(status: string) => onAnswered(id, status)"
+          />
+        </Suspense>
+
+        <div v-if="answered[id] === 'complete'" class="sp-received__done mt-2">
+          {{ doneLine(id) }}
+          <NuxtLink v-if="sitesLink(id)" :to="sitesLink(id)">Open Sites</NuxtLink>
+        </div>
+      </div>
+    </div>
+  </section>
+</template>
+
+<script setup lang="ts">
+/**
+ * "Invitations from other organisations" — where a service provider answers an
+ * invitation another organisation sent it (owner report 2026-09-24: the bell
+ * said "Open the invitation to accept or decline" and there was nowhere to do
+ * either).
+ *
+ * The list comes from the server keyed on the signed-in account, so it is the
+ * same whichever organisation is on screen. The row the bell linked to
+ * (`?invite=<id>`) is always shown — even once answered or expired, so the
+ * person sees what happened to it — and is outlined.
+ */
+import type { TReceivedServiceProviderInvitation } from "../composables/useServiceProviderInvitation";
+
+const route = useRoute();
+const { getReceivedInvitations } = useServiceProviderInvitation();
+
+const items = ref<TReceivedServiceProviderInvitation[]>([]);
+const answered = reactive<Record<string, string>>({});
+
+const linked = computed(() => {
+  const value = String(route.query?.invite ?? "").trim();
+  return /^[a-f0-9]{24}$/i.test(value) ? value : "";
+});
+
+const ids = computed(() => {
+  const listed = items.value.map((i) => String(i._id));
+  return linked.value && !listed.includes(linked.value)
+    ? [linked.value, ...listed]
+    : listed;
+});
+
+function itemFor(id: string) {
+  return items.value.find((i) => String(i._id) === id);
+}
+
+function doneLine(id: string) {
+  const item = itemFor(id);
+  const whose = item?.providerOrgName ? `${item.providerOrgName}'s` : "your";
+  return item?.siteName
+    ? `${item.siteName} is now on ${whose} Sites list.`
+    : `The site is now on ${whose} Sites list.`;
+}
+
+function sitesLink(id: string) {
+  const org = itemFor(id)?.providerOrgId || String(route.params?.organization ?? "");
+  return org ? `/org/${org}/sites` : "";
+}
+
+function onAnswered(id: string, status: string) {
+  answered[id] = status;
+}
+
+async function load() {
+  try {
+    const res = await getReceivedInvitations();
+    items.value = Array.isArray(res?.items) ? res.items : [];
+  } catch {
+    // The section is an addition to the Invitations page; if it cannot load,
+    // the rest of the page must still work. A linked row still renders and
+    // reports its own error.
+    items.value = [];
+  }
+}
+
+await load();
+</script>
+
+<style scoped>
+.sp-received__linked :deep(.app-card) {
+  outline: 2px solid rgb(var(--v-theme-primary));
+  outline-offset: 2px;
+}
+
+.sp-received__done {
+  font-size: var(--fs-cell);
+}
+</style>

package/composables/usePropertyPermission.ts

@@ -579,6 +579,23 @@ export default function usePropertyPermission() {
         description:
           "Allows the user to view the list of all passes and keys on mobile. Checked by the iMA365 mobile app.",
       },
+      // DV-0396: the same three writes Security offers, enforced by API-core on
+      // /api/keys and /api/qr-code-templates for every app that calls them.
+      "add-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to add pass templates and to create or generate passes and keys.",
+      },
+      "update-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to edit pass templates, passes and keys, restore them, and change a pass or key back to Available.",
+      },
+      "delete-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to delete pass templates, passes and keys.",
+      },
     },
     "online-forms": {
       "see-all-online-forms": {

package/composables/useRobotBuilding.ts

@@ -1,4 +1,5 @@
-import { computed, ref, watch, type Ref } from "vue";
+import { computed, onBeforeUnmount, ref, watch, type Ref } from "vue";
+import { hasFleetRobots, isFleetBuilding } from "../utils/robot-fleet-core";
 
 /**
  * One site's building for the HERO building map and lift queue: the robots
@@ -7,6 +8,10 @@ import { computed, ref, watch, type Ref } from "vue";
  * SITE (`/building-maps?site=`), whichever robot type it was saved from: the
  * building belongs to the site, so a map drawn in Hygiene shows in Security.
  *
+ * A site with HERO Fleet Core robots draws the FLEET building instead (read
+ * through from the fleet server, in the same plan frame as those robots,
+ * read-only), refreshed every 5 s so doors and lifts move.
+ *
  * ponytail: the first 50 robots at the site; the map read is one call.
  */
 export default function useRobotBuilding(
@@ -14,7 +19,7 @@ export default function useRobotBuilding(
   site: Ref<string>,
   type: Ref<"cleaning" | "security">,
 ) {
-  const { getSiteFleet, getSiteSummary, listSiteBuildingMaps, getBuildingMap } = useRobots();
+  const { getSiteFleet, getSiteSummary, listSiteBuildingMaps, getBuildingMap, getFleetCoreBuilding } = useRobots();
 
   /** Every robot at the site this app may see, both types where the app shows both. */
   const all = ref<Array<Record<string, any>>>([]);
@@ -27,10 +32,24 @@ export default function useRobotBuilding(
   const rows = computed(() => all.value.filter((r) => r.type === type.value));
 
   async function loadMap() {
+    if (hasFleetRobots(all.value)) {
+      const building = await getFleetCoreBuilding(site.value).catch(() => null);
+      if (building) return building;
+    }
     const newest = (await listSiteBuildingMaps(site.value, { limit: 1 }))?.items?.[0];
     return newest ? await getBuildingMap(String(newest._id)) : null;
   }
 
+  /** Live doors and lifts of the fleet building; a failed refresh keeps the last reading. */
+  const fleet = computed(() => isFleetBuilding(map.value));
+  const timer = setInterval(async () => {
+    if (!fleet.value || (typeof document !== "undefined" && document.visibilityState === "hidden")) return;
+    const mine = run;
+    const next = await getFleetCoreBuilding(site.value).catch(() => null);
+    if (next && mine === run) map.value = next;
+  }, 5000);
+  onBeforeUnmount(() => clearInterval(timer));
+
   let run = 0;
   async function load() {
     const mine = ++run;
@@ -59,5 +78,5 @@ export default function useRobotBuilding(
 
   watch([organization, site], load, { immediate: true });
 
-  return { all, rows, map, names, loading, error, reload: load };
+  return { all, rows, map, fleet, names, loading, error, reload: load };
 }

package/composables/useRobots.ts

@@ -293,6 +293,18 @@ export default function useRobots() {
     });
   }
 
+  /**
+   * The HERO Fleet Core building at a site: levels, walls, doors, lifts (in the
+   * HERO plan frame) with live door and lift states, read through from the
+   * fleet server - nothing stored. 404 where the server has no fleet.
+   */
+  function getFleetCoreBuilding(site: string) {
+    return useNuxtApp().$api<Record<string, any>>("/api/robots/fleet-core/building", {
+      method: "GET",
+      query: { site, appSlug },
+    });
+  }
+
   /* ------------------------------------------ alerts + activity log */
 
   /**
@@ -394,6 +406,7 @@ export default function useRobots() {
   return {
     listBuildingMaps,
     listSiteBuildingMaps,
+    getFleetCoreBuilding,
     getSiteFaults,
     getSiteActivity,
     getNetworkActivity,

package/composables/useSecurityPermission.ts

@@ -669,12 +669,31 @@ export default function useSecurityPermission() {
     },
     // Property's descriptions minus its "Checked by the iMA365 mobile app."
     // sentence, which is not true of this application.
+    // Add / update / delete (DV-0396), also offered by Property Management and
+    // enforced by API-core on /api/keys and /api/qr-code-templates. The security web app's
+    // Templates and Passes & Keys pages and the guard app's pass & key screen
+    // read them. See All is also what shows those two web pages.
     "passes-and-keys-mgmt": {
       "see-all-passes-and-keys": {
         check: true,
         description:
           "Allows the user to view the list of all passes and keys on mobile.",
       },
+      "add-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to add pass templates and to create or generate passes and keys.",
+      },
+      "update-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to edit pass templates, passes and keys, restore them, and change a pass or key back to Available.",
+      },
+      "delete-passes-and-keys": {
+        check: true,
+        description:
+          "Allows the user to delete pass templates, passes and keys.",
+      },
     },
     "resident-transactions": {
       "see-all-resident-transactions": {

package/composables/useServiceProviderInvitation.ts

@@ -26,6 +26,19 @@ export type TServiceProviderInvitation = {
   }>;
 };
 
+/** One row of "Invitations from other organisations". */
+export type TReceivedServiceProviderInvitation = {
+  _id: string;
+  orgName: string;
+  siteName: string;
+  status: string;
+  statusLabel: string;
+  expireAt?: string;
+  /** The invited company's own organisation (the one whose list gains the site). */
+  providerOrgId?: string;
+  providerOrgName?: string;
+};
+
 /** The words on screen. Kept beside the server's own list on purpose — a
  *  status the server invents must never render as a raw stored value. */
 export const SERVICE_PROVIDER_INVITE_LABELS: Record<string, string> = {
@@ -130,6 +143,23 @@ export default function useServiceProviderInvitation() {
     });
   }
 
+  /** Adds the site to the invited company's list. The invited account only. */
+  function acceptInvitation(id: string) {
+    return useNuxtApp().$api<{ message: string }>(`${base}/${id}/accept`, {
+      method: "PUT",
+    });
+  }
+
+  /**
+   * Invitations from other organisations still waiting for the signed-in
+   * account's answer — keyed on the account, not on the organisation on screen.
+   */
+  function getReceivedInvitations(): Promise<{
+    items: TReceivedServiceProviderInvitation[];
+  }> {
+    return useNuxtApp().$api(`${base}/received`, { method: "GET" });
+  }
+
   return {
     getInvitations,
     cancelInvitation,
@@ -141,5 +171,7 @@ export default function useServiceProviderInvitation() {
     rejectInvitation,
     getInvitation,
     declineInvitation,
+    acceptInvitation,
+    getReceivedInvitations,
   };
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@7365admin1/layer-common",
   "license": "MIT",
   "type": "module",
-  "version": "4.36.0",
+  "version": "4.38.0",
   "author": "7365admin1",
   "main": "./nuxt.config.ts",
   "//files": "What a consumer extending this layer actually loads. Without this npm ships the whole working tree - the changesets, the CI workflows, the render harness in tools/ and any scratch directory that happened to exist at publish time. Nuxt resolves a layer by directory, so every runtime directory below has to stay listed; adding a new top-level runtime directory means adding it here too.",
@@ -36,7 +36,7 @@
     "build": "nuxt build .playground",
     "generate": "nuxt generate .playground",
     "preview": "nuxt preview .playground",
-    "test": "esbuild composables/useVisitorSocket.ts --format=esm --outfile=test/.build/useVisitorSocket.mjs --log-level=error && esbuild composables/usePlateToastWindow.ts --format=esm --outfile=test/.build/usePlateToastWindow.mjs --log-level=error && esbuild utils/client-invite-modules.ts --bundle --platform=node --format=esm --outfile=test/.build/client-invite-modules.mjs --log-level=error && esbuild utils/robot-display.ts --bundle --platform=node --format=esm --outfile=test/.build/robot-display.mjs --log-level=error && esbuild utils/building-map.ts --bundle --platform=node --format=esm --outfile=test/.build/building-map.mjs --log-level=error && esbuild utils/robot-building.ts --bundle --platform=node --format=esm --outfile=test/.build/robot-building.mjs --log-level=error && node --experimental-strip-types --test \"test/*.test.mjs\" && yarn test:units",
+    "test": "esbuild composables/useVisitorSocket.ts --format=esm --outfile=test/.build/useVisitorSocket.mjs --log-level=error && esbuild composables/usePlateToastWindow.ts --format=esm --outfile=test/.build/usePlateToastWindow.mjs --log-level=error && esbuild utils/client-invite-modules.ts --bundle --platform=node --format=esm --outfile=test/.build/client-invite-modules.mjs --log-level=error && esbuild utils/robot-display.ts --bundle --platform=node --format=esm --outfile=test/.build/robot-display.mjs --log-level=error && esbuild utils/building-map.ts --bundle --platform=node --format=esm --outfile=test/.build/building-map.mjs --log-level=error && esbuild utils/robot-building.ts --bundle --platform=node --format=esm --outfile=test/.build/robot-building.mjs --log-level=error && esbuild utils/robot-fleet-core.ts --bundle --platform=node --format=esm --outfile=test/.build/robot-fleet-core.mjs --log-level=error && node --experimental-strip-types --test \"test/*.test.mjs\" && yarn test:units",
     "test:units": "node --experimental-strip-types --test \"utils/*.test.ts\"",
     "release": "yarn run build && changeset publish"
   },

package/plugins/API.ts

@@ -11,6 +11,17 @@ export default defineNuxtPlugin((nuxtApp) => {
     onRequest({ options }) {
       const sid = useCookie("sid", cookieConfig).value ?? "";
       options.headers.set("Authorization", sid);
+      // Which of the user's memberships this screen is working in (DV-0396):
+      // this app's member type and the organisation in the address. With
+      // several memberships pinned to one site, the server then checks the
+      // same role the screen was drawn from (core `requireSiteReach`). Only
+      // chooses among the user's own memberships; it grants nothing.
+      const app = useRuntimeConfig().public.APP;
+      if (app) options.headers.set("X-App", String(app));
+      const org = (nuxtApp as any).$router?.currentRoute?.value?.params?.org;
+      if (typeof org === "string" && /^[0-9a-f]{24}$/i.test(org)) {
+        options.headers.set("X-Org", org);
+      }
     },
     // "You do not have permission to ..." - the role changed since the page
     // read it. Re-read it in the background (plugins/secure-member.client.ts)

package/utils/notification-target.ts

@@ -31,7 +31,8 @@
 /** Only the fields a destination is decided from. */
 export type TTargetRow = {
   module?: string;
-  params?: { id?: string } | null;
+  screen?: string;
+  params?: { id?: string; org?: string } | null;
 };
 
 /** What the surrounding app knows that the stored row does not. */
@@ -43,6 +44,13 @@ export type TTargetContext = {
 export type TNotificationTarget = {
   name: string;
   params: Record<string, string>;
+  query?: Record<string, string>;
+  /**
+   * Set when the page lives in another web app. The bell opens
+   * `<that app's URL><path>` when its own router has no route by `name`.
+   */
+  app?: "org";
+  path?: string;
 };
 
 /** Nuxt's generated names for `pages/org/[organization]/marketplace/orders/`. */
@@ -52,12 +60,42 @@ export const ORDER_DETAIL_ROUTE = "org-organization-marketplace-orders-id";
 /** The stored `module` tag on a row sent to a vendor's staff. */
 export const VENDOR_ORDER_MODULE = "marketplace-vendor-order";
 
+/**
+ * "<Company> has invited you to <site>" — core `serviceProviderInvited` stores
+ * `module: "other"` (the apps route on it; it never changes) with this
+ * `screen`, the invitation id in `params.id`, and, since 2026-09-24, the
+ * invited company's own organisation in `params.org`.
+ *
+ * It opens the organisation app's Invitations page, where "Invitations from
+ * other organisations" lists it with Accept / Decline. Only the organisation
+ * app has that page; every other app sends the click there by URL.
+ */
+export const SP_INVITATION_SCREEN = "/service-provider-invitation";
+export const INVITATIONS_ROUTE = "org-organization-invitations-status-status";
+
 export function notificationTarget(
   item: TTargetRow | null | undefined,
   context: TTargetContext = {},
 ): TNotificationTarget | null {
   const organization = String(context.organization ?? "").trim();
 
+  if (String(item?.screen ?? "") === SP_INVITATION_SCREEN) {
+    // The invited company's organisation when the row names it (the invitation
+    // belongs there), otherwise the one on screen. The list on that page is
+    // keyed on the signed-in account, so either shows the invitation.
+    const org = String(item?.params?.org ?? "").trim() || organization;
+    if (!org) return null;
+    const id = String(item?.params?.id ?? "").trim();
+    const query: Record<string, string> = id ? { invite: id } : {};
+    return {
+      name: INVITATIONS_ROUTE,
+      params: { organization: org, status: "pending" },
+      query,
+      app: "org",
+      path: `/org/${encodeURIComponent(org)}/invitations/status/pending`,
+    };
+  }
+
   if (String(item?.module ?? "") !== VENDOR_ORDER_MODULE) return null;
 
   // Every order route is nested under the organization. Without one there is no
@@ -73,3 +111,18 @@ export function notificationTarget(
 
   return { name: ORDER_DETAIL_ROUTE, params: { organization, id } };
 }
+
+/**
+ * The full URL for a target whose page lives in another web app, or "" when
+ * there is none to build (no path, or that app's URL is not configured).
+ */
+export function externalTargetUrl(
+  target: TNotificationTarget | null | undefined,
+  appUrls: { org?: string } = {},
+): string {
+  if (!target?.app || !target.path) return "";
+  const base = String(appUrls[target.app] ?? "").trim().replace(/\/+$/, "");
+  if (!base) return "";
+  const qs = new URLSearchParams(target.query ?? {}).toString();
+  return `${base}${target.path}${qs ? `?${qs}` : ""}`;
+}

package/utils/robot-fleet-core.ts

@@ -0,0 +1,57 @@
+/**
+ * HERO Fleet Core building helpers (pure, tested in test/robot-fleet-core.test.mjs).
+ *
+ * The fleet building (`GET /api/robots/fleet-core/building`) comes in the same
+ * shape as a saved building map - levels / doors / lifts in the HERO plan frame -
+ * plus live `doorStates` and `liftStates` in the lift / door contract shape.
+ * Not part of the mobile-synced rules (`robot-display.ts`), so web only for now.
+ */
+
+export const FLEET_CORE_BRAND = "fleet-core";
+
+/** Is this building the read-only fleet building rather than a saved map? */
+export const isFleetBuilding = (map: Record<string, any> | null | undefined) => map?.source === FLEET_CORE_BRAND;
+
+/** Does the site have fleet robots (then their building is the one to draw)? */
+export const hasFleetRobots = (rows: Array<Record<string, any>>) => rows.some((r) => r?.brand === FLEET_CORE_BRAND);
+
+/** "L2" -> 2, "B1" -> -1, "G" -> 0 (the fleet names its floors). */
+export function fleetFloorNo(name: unknown): number | null {
+  if (typeof name !== "string") return null;
+  const m = /^(L|B)(\d{1,3})$/i.exec(name.trim());
+  if (m) return m[1]!.toUpperCase() === "B" ? -Number(m[2]) : Number(m[2]);
+  return /^G$/i.test(name.trim()) ? 0 : null;
+}
+
+/** Names of the doors that read OPEN (door contract mode 2). */
+export function openDoorNames(map: Record<string, any> | null | undefined): Set<string> {
+  return new Set((map?.doorStates ?? []).filter((d: any) => d?.currentMode === 2).map((d: any) => String(d.doorName)));
+}
+
+/**
+ * The fleet's lifts as lift-queue items (the shape `liftCard` reads): the car's
+ * floor from the live state, and the robot holding the lift (its session is
+ * "<fleet>/<robot>", our robotSn) as the one riding, from its floor to the
+ * lift's destination. The fleet runs no waiting queue we can read.
+ */
+export function fleetLiftItems(map: Record<string, any> | null | undefined, rows: Array<Record<string, any>>) {
+  if (!isFleetBuilding(map)) return [];
+  const states = new Map<string, any>((map!.liftStates ?? []).map((s: any) => [String(s.liftName), s]));
+  return (map!.lifts ?? []).map((lift: any) => {
+    const st = states.get(String(lift.name));
+    const current = fleetFloorNo(st?.currentFloor);
+    const dest = fleetFloorNo(st?.destinationFloor);
+    const holder = st?.sessionId ? rows.find((r) => r?.robotSn === st.sessionId) : null;
+    return {
+      liftName: String(lift.name),
+      floors: lift.floors ?? [],
+      state: { currentFloor: current },
+      active: holder
+        ? { _id: `fleet-${lift.name}`, robotId: String(holder._id), robotName: holder.name, fromFloor: current ?? dest, toFloor: dest ?? current }
+        : null,
+      queue: [],
+      recent: [],
+      simulated: false,
+    };
+  });
+}