@asteby/metacore-permissions 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Asteby, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,38 @@
-# Temporary Holding Version
+# @asteby/metacore-permissions
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Capability feed, role/grant API, screen-implied capabilities, nav gating and a
+ready-made `PermissionsPage` built on `PermissionsManager`. Transport, labels,
+navigation and translation are all injected - nothing here knows about a host
+app or vertical.
+
+## Adoption
+
+```tsx
+import {
+  createPermissionsApi, createScreenCapabilityRegistry, PermissionsPage,
+  useMyPermissions, filterNavGroupsByCan,
+} from '@asteby/metacore-permissions'
+
+const registry = createScreenCapabilityRegistry({
+  modules: { product: 'Products' },          // labels for implied caps
+  groups: { product: 'Catalog' },
+  screenAccess: t('permissions.access'),
+})
+const api = createPermissionsApi({ http: axiosInstance, registry })
+// custom routes: createPermissionsApi({ http, paths: { me: '/v2/me' } })
+```
+
+1. **Session feed** - `useMyPermissions({ fetch: api.fetchMyPermissions, userId, scope })`
+   returns `{ permissions, role, isAdmin }` (persisted per scope for first paint);
+   feed it to `PermissionsProvider` from `@asteby/metacore-runtime-react`.
+2. **Page** - `<PermissionsPage api={api} groups={navGroups} extraItems={addonItems} registry={registry} translate={t} labels={{ title: t('permissions.title') }} />`.
+   States: loading (aria-busy skeleton), error (role=alert + retry), empty, ready.
+   Syncing invalidates `MY_PERMISSIONS_QUERY_KEY` so the signed-in user's gating refreshes.
+3. **Nav gating** - `filterNavGroupsByCan(groups, can, { trusted: sidebarTrustedPaths(host, addon), adminShellUrls })`.
+   Rules: `/m/<model>` needs `<model>.index`; addon screens need `screen.<slug>.access`;
+   `adminShellUrls` (default: small generic set) need the same probe; `folderKey` needs
+   `folder.<key>.access`; server-trusted leaves skip legacy probes.
+
+Peers: `@asteby/metacore-runtime-react`, `@asteby/metacore-ui`, `@tanstack/react-query`, `react`.
+Backend contract: `GET /permissions/me`, `GET /permissions/modules` (`modules`, `general`,
+`screen_implies`; legacy `data[]` accepted), roles CRUD and `POST .../sync` (full replace).

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from './types';
+export * from './screen-capability-implies';
+export * from './nav-permission-filter';
+export * from './permissions-api';
+export * from './use-my-permissions';
+export * from './use-permissions-catalog';
+export * from './permissions-page';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export * from './types';
+export * from './screen-capability-implies';
+export * from './nav-permission-filter';
+export * from './permissions-api';
+export * from './use-my-permissions';
+export * from './use-permissions-catalog';
+export * from './permissions-page';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA"}

package/dist/nav-permission-filter.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pure nav permission helpers - free of React so tests and sidebars share the
+ * same gating rules.
+ */
+import type { CanFn } from '@asteby/metacore-runtime-react';
+import type { NavItemLike } from './types';
+/**
+ * Generic host-shell routes hidden from capability-limited roles. Hosts pass
+ * their own set through `adminShellUrls`; this default is intentionally small.
+ */
+export declare const DEFAULT_ADMIN_SHELL_URLS: ReadonlySet<string>;
+/** Per-leaf predicate (e.g. the SDK's `useNavItemVisible`). */
+export type NavLeafVisible = (item: {
+    url: string;
+    requires?: string;
+}) => boolean;
+export interface FilterNavOptions {
+    /** Leaf paths the server already authorised (skip legacy probes). */
+    trusted?: ReadonlySet<string>;
+    isItemVisible?: NavLeafVisible;
+    /** Routes requiring `screen.<slug>.access`. Defaults to DEFAULT_ADMIN_SHELL_URLS. */
+    adminShellUrls?: ReadonlySet<string>;
+    /** Prefix of addon screens gated by `screen.<slug>.access`. Default `/addons/`. */
+    addonUrlPrefix?: string;
+}
+/** Roles allowed to open admin-only viewers. */
+export declare function isAdminRole(role: string | undefined | null, roles?: readonly string[]): boolean;
+/** `/m/pos_orders?f_x=1` -> `pos_orders`; non-model URLs -> null. */
+export declare function navUrlModel(url: unknown): string | null;
+/** Normalised key used to match a nav leaf against the server-approved set. */
+export declare function trustKey(url: unknown): string;
+/** Leaf paths the server already authorised (server-filtered navigation). */
+export declare function collectTrustedPaths(groups: ReadonlyArray<{
+    items: NavItemLike[];
+}>): Set<string>;
+/** Trusted set for a sidebar: host nav plus addon module items. */
+export declare function sidebarTrustedPaths(hostGroups: ReadonlyArray<{
+    items: NavItemLike[];
+}>, addonModuleItems: NavItemLike[]): Set<string>;
+/** First leaf URL under a nav tree. */
+export declare function firstLeafUrl(items: NavItemLike[]): string | undefined;
+/**
+ * Single gating point for nav items:
+ * - trusted leaves skip the legacy probes
+ * - `/m/<model>` requires `can(<model>.index)`
+ * - addon screens require `can(screen.<slug>.access)`
+ * - admin shell routes require `can(screen.<slug>.access)` (admins pass)
+ * - folders require `can(folder.<key>.access)`
+ * - collapsible parents follow their children
+ */
+export declare function filterNavItemsByCan<T extends NavItemLike>(items: T[], can: CanFn, options?: FilterNavOptions): T[];
+/** Applies {@link filterNavItemsByCan} per group and drops emptied groups. */
+export declare function filterNavGroupsByCan<G extends {
+    items: NavItemLike[];
+}>(groups: G[], can: CanFn, options?: FilterNavOptions): G[];
+//# sourceMappingURL=nav-permission-filter.d.ts.map

package/dist/nav-permission-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav-permission-filter.d.ts","sourceRoot":"","sources":["../src/nav-permission-filter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAA;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAI1C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAOvD,CAAA;AAEF,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAA;AAElF,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7B,aAAa,CAAC,EAAE,cAAc,CAAA;IAC9B,qFAAqF;IACrF,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACpC,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,gDAAgD;AAChD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC/B,KAAK,GAAE,SAAS,MAAM,EAAqC,GAC1D,OAAO,CAET;AAOD,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAK7C;AAQD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC,GAC9C,GAAG,CAAC,MAAM,CAAC,CAab;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC,EACnD,gBAAgB,EAAE,WAAW,EAAE,GAC9B,GAAG,CAAC,MAAM,CAAC,CAEb;AAED,uCAAuC;AACvC,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,WAAW,EACvD,KAAK,EAAE,CAAC,EAAE,EACV,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,gBAAqB,GAC7B,CAAC,EAAE,CAoCL;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,WAAW,EAAE,CAAA;CAAE,EACrE,MAAM,EAAE,CAAC,EAAE,EACX,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,gBAAqB,GAC7B,CAAC,EAAE,CAIL"}

package/dist/nav-permission-filter.js

@@ -0,0 +1,129 @@
+import { screenKeyForUrl } from './screen-capability-implies';
+const DYNAMIC_MODEL_URL_RE = /^\/m\/([^/?#]+)/;
+/**
+ * Generic host-shell routes hidden from capability-limited roles. Hosts pass
+ * their own set through `adminShellUrls`; this default is intentionally small.
+ */
+export const DEFAULT_ADMIN_SHELL_URLS = new Set([
+    '/users',
+    '/permissions',
+    '/organizations',
+    '/marketplace',
+    '/integrations',
+    '/activity',
+]);
+/** Roles allowed to open admin-only viewers. */
+export function isAdminRole(role, roles = ['owner', 'admin', 'superadmin']) {
+    return roles.includes((role ?? '').toLowerCase());
+}
+function navPath(url) {
+    if (typeof url !== 'string' || !url)
+        return null;
+    return url.split(/[?#]/)[0] || null;
+}
+/** `/m/pos_orders?f_x=1` -> `pos_orders`; non-model URLs -> null. */
+export function navUrlModel(url) {
+    if (typeof url !== 'string')
+        return null;
+    const m = DYNAMIC_MODEL_URL_RE.exec(url);
+    return m?.[1] ? decodeURIComponent(m[1]).toLowerCase() : null;
+}
+/** Normalised key used to match a nav leaf against the server-approved set. */
+export function trustKey(url) {
+    const s = typeof url === 'string' ? url : undefined;
+    const addon = s ? /^addon:\/\/([^/?#]+)\/?([^?#]*)/.exec(s) : null;
+    const resolved = addon ? `/addons/${addon[1]}/${addon[2]}`.replace(/\/+$/, '') : s;
+    return (navPath(resolved)?.replace(/\/+$/, '') ?? '').toLowerCase();
+}
+function isCollapsible(item) {
+    return Array.isArray(item.items) && item.items.length > 0;
+}
+/** Leaf paths the server already authorised (server-filtered navigation). */
+export function collectTrustedPaths(groups) {
+    const out = new Set();
+    const walk = (items) => {
+        for (const item of items) {
+            if (isCollapsible(item))
+                walk(item.items);
+            else {
+                const k = trustKey(item.url);
+                if (k)
+                    out.add(k);
+            }
+        }
+    };
+    for (const g of groups)
+        walk(g.items);
+    return out;
+}
+/** Trusted set for a sidebar: host nav plus addon module items. */
+export function sidebarTrustedPaths(hostGroups, addonModuleItems) {
+    return collectTrustedPaths([...hostGroups, { items: addonModuleItems }]);
+}
+/** First leaf URL under a nav tree. */
+export function firstLeafUrl(items) {
+    for (const item of items) {
+        if (isCollapsible(item)) {
+            const nested = firstLeafUrl(item.items);
+            if (nested)
+                return nested;
+            continue;
+        }
+        if (typeof item.url === 'string' && item.url)
+            return item.url;
+    }
+    return undefined;
+}
+/**
+ * Single gating point for nav items:
+ * - trusted leaves skip the legacy probes
+ * - `/m/<model>` requires `can(<model>.index)`
+ * - addon screens require `can(screen.<slug>.access)`
+ * - admin shell routes require `can(screen.<slug>.access)` (admins pass)
+ * - folders require `can(folder.<key>.access)`
+ * - collapsible parents follow their children
+ */
+export function filterNavItemsByCan(items, can, options = {}) {
+    const { trusted, isItemVisible, adminShellUrls = DEFAULT_ADMIN_SHELL_URLS, addonUrlPrefix = '/addons/', } = options;
+    const visible = [];
+    for (const item of items) {
+        if (item.folderKey && !can(`folder.${item.folderKey}.access`))
+            continue;
+        if (isCollapsible(item)) {
+            const children = filterNavItemsByCan(item.items, can, options);
+            if (children.length === 0)
+                continue;
+            const url = navUrlModel(item.url)
+                ? (firstLeafUrl(children) ?? children[0]?.url)
+                : item.url;
+            visible.push({ ...item, url, items: children });
+            continue;
+        }
+        const url = typeof item.url === 'string' ? item.url : undefined;
+        const isTrusted = trusted?.has(trustKey(url)) ?? false;
+        const model = navUrlModel(url);
+        if (!isTrusted && model && !can(`${model}.index`))
+            continue;
+        if (!isTrusted && !model && url?.startsWith(addonUrlPrefix)) {
+            if (!can(`${screenKeyForUrl(url)}.access`))
+                continue;
+        }
+        const path = navPath(url);
+        if (path && adminShellUrls.has(path)) {
+            if (!can(`${screenKeyForUrl(path)}.access`))
+                continue;
+        }
+        if (!isTrusted && isItemVisible && url && !isItemVisible({ url, requires: item.requires })) {
+            continue;
+        }
+        visible.push(item);
+    }
+    return visible;
+}
+/** Applies {@link filterNavItemsByCan} per group and drops emptied groups. */
+export function filterNavGroupsByCan(groups, can, options = {}) {
+    return groups
+        .map((g) => ({ ...g, items: filterNavItemsByCan(g.items, can, options) }))
+        .filter((g) => g.items.length > 0);
+}
+//# sourceMappingURL=nav-permission-filter.js.map

package/dist/nav-permission-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav-permission-filter.js","sourceRoot":"","sources":["../src/nav-permission-filter.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAG7D,MAAM,oBAAoB,GAAG,iBAAiB,CAAA;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,QAAQ;IACR,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,WAAW;CACZ,CAAC,CAAA;AAeF,gDAAgD;AAChD,MAAM,UAAU,WAAW,CACzB,IAA+B,EAC/B,QAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC;IAE3D,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AACrC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACnD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAClF,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACrE,CAAC;AAED,SAAS,aAAa,CACpB,IAAO;IAEP,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;AAC3D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CACjC,MAA+C;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAoB,EAAE,EAAE;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,aAAa,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;iBACpC,CAAC;gBACJ,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC5B,IAAI,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,UAAmD,EACnD,gBAA+B;IAE/B,OAAO,mBAAmB,CAAC,CAAC,GAAG,UAAU,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,YAAY,CAAC,KAAoB;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YACzB,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAA;IAC/D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAU,EACV,GAAU,EACV,UAA4B,EAAE;IAE9B,MAAM,EACJ,OAAO,EACP,aAAa,EACb,cAAc,GAAG,wBAAwB,EACzC,cAAc,GAAG,UAAU,GAC5B,GAAG,OAAO,CAAA;IACX,MAAM,OAAO,GAAQ,EAAE,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,SAAS,SAAS,CAAC;YAAE,SAAQ;QACvE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;YAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/C,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,MAAM,SAAS,GAAG,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAA;QACtD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC;YAAE,SAAQ;QAC3D,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAQ;QACtD,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAQ;QACvD,CAAC;QACD,IAAI,CAAC,SAAS,IAAI,aAAa,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC3F,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAClC,MAAW,EACX,GAAU,EACV,UAA4B,EAAE;IAE9B,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;SACzE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACtC,CAAC"}

package/dist/permissions-api.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Permissions transport. Everything goes through an injected HTTP client so the
+ * package works with any axios-like instance and any route layout.
+ */
+import type { PermissionsCatalog, RoleDef, RoleInput } from '@asteby/metacore-runtime-react';
+import type { ScreenCapabilityRegistry } from './screen-capability-implies';
+import type { PermissionsHttpClient } from './types';
+export interface MyPermissions {
+    permissions: string[];
+    role: string;
+    isAdmin: boolean;
+}
+export declare const MY_PERMISSIONS_QUERY_KEY: readonly ["permissions", "me"];
+/** Per-user key: SPA account switches never reuse another session's caps. */
+export declare function myPermissionsQueryKey(userId: string | undefined | null): readonly ["permissions", "me", string];
+export interface PermissionsApiPaths {
+    me: string;
+    modules: string;
+    roles: string;
+    /** `:id` is appended. */
+    rolePermissions: string;
+}
+export declare const DEFAULT_PERMISSIONS_PATHS: PermissionsApiPaths;
+export interface PermissionsApiOptions {
+    http: PermissionsHttpClient;
+    paths?: Partial<PermissionsApiPaths>;
+    /** Registry fed by `screen_implies` and used to expand grants. Optional. */
+    registry?: ScreenCapabilityRegistry;
+    /** Default icon for new roles. */
+    defaultRoleIcon?: string;
+}
+export interface PermissionsApi {
+    fetchMyPermissions(): Promise<MyPermissions>;
+    loadPermissionModules(): Promise<PermissionsCatalog>;
+    loadRoles(): Promise<RoleDef[]>;
+    createRole(input: RoleInput): Promise<RoleDef | void>;
+    updateRole(roleId: string, input: RoleInput): Promise<RoleDef | void>;
+    deleteRole(roleId: string): Promise<void>;
+    loadRolePermissions(roleId: string): Promise<string[]>;
+    syncRolePermissions(roleId: string, capabilities: string[]): Promise<void>;
+}
+export declare function createPermissionsApi(opts: PermissionsApiOptions): PermissionsApi;
+//# sourceMappingURL=permissions-api.d.ts.map

package/dist/permissions-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-api.d.ts","sourceRoot":"","sources":["../src/permissions-api.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAGV,kBAAkB,EAClB,OAAO,EACP,SAAS,EACV,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,eAAO,MAAM,wBAAwB,gCAAiC,CAAA;AAEtE,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,0CAEtE;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB;IACzB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,yBAAyB,EAAE,mBAKvC,CAAA;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,qBAAqB,CAAA;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,wBAAwB,CAAA;IACnC,kCAAkC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAqCD,MAAM,WAAW,cAAc;IAC7B,kBAAkB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAA;IAC5C,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACpD,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC/B,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACrD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACrE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACtD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3E;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAyGhF"}

package/dist/permissions-api.js

@@ -0,0 +1,115 @@
+export const MY_PERMISSIONS_QUERY_KEY = ['permissions', 'me'];
+/** Per-user key: SPA account switches never reuse another session's caps. */
+export function myPermissionsQueryKey(userId) {
+    return [...MY_PERMISSIONS_QUERY_KEY, userId ?? 'anon'];
+}
+export const DEFAULT_PERMISSIONS_PATHS = {
+    me: '/permissions/me',
+    modules: '/permissions/modules',
+    roles: '/data/roles/me',
+    rolePermissions: '/permissions/role',
+};
+const CRUD_ACTION_KEYS = new Set(['index', 'create', 'update', 'delete', 'export', 'import']);
+function toRoleDef(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        label: row.label || undefined,
+        color: row.color || undefined,
+        icon: row.icon || undefined,
+    };
+}
+function asRole(data) {
+    const body = data;
+    const row = (body?.data ?? body);
+    if (row && typeof row.id === 'string' && typeof row.name === 'string')
+        return toRoleDef(row);
+    return undefined;
+}
+export function createPermissionsApi(opts) {
+    const { http, registry } = opts;
+    const paths = { ...DEFAULT_PERMISSIONS_PATHS, ...opts.paths };
+    const expand = (caps) => (registry ? registry.expand(caps) : caps);
+    return {
+        async fetchMyPermissions() {
+            const res = await http.get(paths.me);
+            const body = (res.data ?? {});
+            return {
+                permissions: Array.isArray(body.permissions) ? body.permissions : [],
+                role: typeof body.role === 'string' ? body.role : '',
+                // accept both casings so either side of a backend rollout works
+                isAdmin: Boolean(body.isAdmin ?? body.is_admin),
+            };
+        },
+        /**
+         * Accepts `{ modules, general, screen_implies }` (current contract) or the
+         * legacy `{ data: [{key, actions[]}] }` array.
+         */
+        async loadPermissionModules() {
+            const res = await http.get(paths.modules);
+            const body = (res.data ?? {});
+            if (body.screen_implies && typeof body.screen_implies === 'object') {
+                registry?.set(body.screen_implies);
+            }
+            const general = Array.isArray(body.general)
+                ? body.general
+                : [];
+            if (Array.isArray(body.modules) && body.modules.length > 0) {
+                return { modules: body.modules, general };
+            }
+            const legacy = Array.isArray(body.data) ? body.data : [];
+            return {
+                modules: legacy.map((m) => ({
+                    key: m.key,
+                    label: m.label || m.key,
+                    actions: (m.actions ?? []).map((key) => ({
+                        key,
+                        label: m.actionLabels?.[key] || key,
+                        icon: m.actionIcons?.[key],
+                        kind: CRUD_ACTION_KEYS.has(key) ? 'crud' : 'custom',
+                    })),
+                })),
+                general,
+            };
+        },
+        async loadRoles() {
+            const res = await http.get(paths.roles);
+            const body = res.data;
+            const rows = body?.data ?? body;
+            return (Array.isArray(rows) ? rows : []).map(toRoleDef);
+        },
+        async createRole(input) {
+            const res = await http.post(paths.roles, {
+                name: input.name,
+                label: input.label ?? input.name,
+                color: input.color ?? '',
+                icon: input.icon ?? opts.defaultRoleIcon ?? 'Shield',
+            });
+            return asRole(res.data);
+        },
+        async updateRole(roleId, input) {
+            const res = await http.put(`${paths.roles}/${encodeURIComponent(roleId)}`, {
+                name: input.name,
+                label: input.label ?? input.name,
+                color: input.color ?? '',
+                icon: input.icon ?? '',
+            });
+            return asRole(res.data);
+        },
+        async deleteRole(roleId) {
+            await http.delete(`${paths.roles}/${encodeURIComponent(roleId)}`);
+        },
+        async loadRolePermissions(roleId) {
+            const res = await http.get(`${paths.rolePermissions}/${encodeURIComponent(roleId)}`);
+            const data = res.data?.data;
+            return expand(Array.isArray(data) ? data : []);
+        },
+        /** Full-replace sync; screen access grants are expanded to their deps. */
+        async syncRolePermissions(roleId, capabilities) {
+            await http.post(`${paths.rolePermissions}/${encodeURIComponent(roleId)}/sync`, {
+                permissions: expand(capabilities),
+            });
+        },
+    };
+}
+//# sourceMappingURL=permissions-api.js.map

package/dist/permissions-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-api.js","sourceRoot":"","sources":["../src/permissions-api.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,aAAa,EAAE,IAAI,CAAU,CAAA;AAEtE,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,MAAiC;IACrE,OAAO,CAAC,GAAG,wBAAwB,EAAE,MAAM,IAAI,MAAM,CAAU,CAAA;AACjE,CAAC;AAUD,MAAM,CAAC,MAAM,yBAAyB,GAAwB;IAC5D,EAAE,EAAE,iBAAiB;IACrB,OAAO,EAAE,sBAAsB;IAC/B,KAAK,EAAE,gBAAgB;IACvB,eAAe,EAAE,mBAAmB;CACrC,CAAA;AAWD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;AAkB7F,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC3B,MAAM,IAAI,GAAG,IAAsC,CAAA;IACnD,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAwB,CAAA;IACvD,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5F,OAAO,SAAS,CAAA;AAClB,CAAC;AAaD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAA;IAC/B,MAAM,KAAK,GAAG,EAAE,GAAG,yBAAyB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;IAC7D,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAE5E,OAAO;QACL,KAAK,CAAC,kBAAkB;YACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAK3B,CAAA;YACD,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,WAAwB,CAAC,CAAC,CAAC,EAAE;gBAClF,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACpD,gEAAgE;gBAChE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC;aAChD,CAAA;QACH,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,qBAAqB;YACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACzC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAK3B,CAAA;YACD,IAAI,IAAI,CAAC,cAAc,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACnE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,cAA0C,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,OAAO,GAA2B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBACjE,CAAC,CAAE,IAAI,CAAC,OAAkC;gBAC1C,CAAC,CAAC,EAAE,CAAA;YACN,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAgC,EAAE,OAAO,EAAE,CAAA;YACpE,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,IAAuB,CAAC,CAAC,CAAC,EAAE,CAAA;YAC5E,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,GAAG,CACjB,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC;oBAC3B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG;oBACvB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBACvC,GAAG;wBACH,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG;wBACnC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC;wBAC1B,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;qBACpD,CAAC,CAAC;iBACJ,CAAC,CACH;gBACD,OAAO;aACR,CAAA;QACH,CAAC;QAED,KAAK,CAAC,SAAS;YACb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAsC,CAAA;YACvD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAA;YAC/B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACxE,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;gBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,IAAI,QAAQ;aACrD,CAAC,CAAA;YACF,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE;gBACzE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;aACvB,CAAC,CAAA;YACF,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,MAAM;YAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,eAAe,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACpF,MAAM,IAAI,GAAI,GAAG,CAAC,IAAuC,EAAE,IAAI,CAAA;YAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,0EAA0E;QAC1E,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,YAAY;YAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,eAAe,IAAI,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;gBAC7E,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC;aAClC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/permissions-page.d.ts

@@ -0,0 +1,24 @@
+import { type ReactNode } from 'react';
+import { type PermissionsApi } from './permissions-api';
+import { type UsePermissionsCatalogOptions } from './use-permissions-catalog';
+export interface PermissionsPageLabels {
+    title?: string;
+    loading?: string;
+    error?: string;
+    retry?: string;
+    empty?: string;
+}
+export interface PermissionsPageProps extends Omit<UsePermissionsCatalogOptions, 'loadBackendCatalog'> {
+    api: PermissionsApi;
+    labels?: PermissionsPageLabels;
+    /** Extra content rendered above the manager (e.g. a breadcrumb). */
+    header?: ReactNode;
+    className?: string;
+}
+/**
+ * Role x module x action grid. States: loading (skeleton, aria-busy), error
+ * (alert + retry), empty (status) and ready (PermissionsManager). After a sync
+ * the signed-in user's own capability feed is invalidated.
+ */
+export declare function PermissionsPage({ api, labels, header, className, ...catalogOpts }: PermissionsPageProps): import("react").JSX.Element;
+//# sourceMappingURL=permissions-page.d.ts.map

package/dist/permissions-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-page.d.ts","sourceRoot":"","sources":["../src/permissions-page.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAInD,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACjF,OAAO,EAAyB,KAAK,4BAA4B,EAAE,MAAM,2BAA2B,CAAA;AAEpG,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBACf,SAAQ,IAAI,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;IAChE,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,CAAC,EAAE,qBAAqB,CAAA;IAC9B,oEAAoE;IACpE,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,EAAE,EAAE,oBAAoB,+BA4DvG"}

package/dist/permissions-page.js

@@ -0,0 +1,43 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+import { PermissionsManager } from '@asteby/metacore-runtime-react';
+import { Button, Skeleton } from '@asteby/metacore-ui';
+import { MY_PERMISSIONS_QUERY_KEY } from './permissions-api';
+import { usePermissionsCatalog } from './use-permissions-catalog';
+const DEFAULT_LABELS = {
+    title: 'Permissions',
+    loading: 'Loading permissions',
+    error: 'Could not load the permission catalog.',
+    retry: 'Retry',
+    empty: 'No modules available to assign.',
+};
+/**
+ * Role x module x action grid. States: loading (skeleton, aria-busy), error
+ * (alert + retry), empty (status) and ready (PermissionsManager). After a sync
+ * the signed-in user's own capability feed is invalidated.
+ */
+export function PermissionsPage({ api, labels, header, className, ...catalogOpts }) {
+    const l = { ...DEFAULT_LABELS, ...labels };
+    const qc = useQueryClient();
+    const cat = usePermissionsCatalog({ ...catalogOpts, loadBackendCatalog: api.loadPermissionModules });
+    const handleSync = useCallback(async (roleId, capabilities) => {
+        await api.syncRolePermissions(roleId, capabilities);
+        await qc.invalidateQueries({ queryKey: MY_PERMISSIONS_QUERY_KEY });
+    }, [api, qc]);
+    let body;
+    if (cat.isError) {
+        body = (_jsxs("div", { role: "alert", className: "flex flex-col items-start gap-3 text-sm", children: [_jsx("p", { className: "text-destructive", children: l.error }), _jsx(Button, { type: "button", variant: "outline", onClick: cat.retry, children: l.retry })] }));
+    }
+    else if (cat.ready) {
+        body = (_jsx(PermissionsManager, { title: l.title, loadModules: cat.loadModules, loadRoles: api.loadRoles, loadRolePermissions: api.loadRolePermissions, syncRolePermissions: handleSync, createRole: api.createRole, updateRole: api.updateRole, deleteRole: api.deleteRole }));
+    }
+    else if (cat.isLoading) {
+        body = (_jsxs("div", { role: "status", "aria-busy": "true", "aria-label": l.loading, className: "flex flex-col gap-4", children: [_jsx(Skeleton, { className: "h-9 w-64" }), _jsxs("div", { className: "grid grid-cols-1 gap-4 lg:grid-cols-2", children: [_jsx(Skeleton, { className: "h-72 w-full" }), _jsx(Skeleton, { className: "h-72 w-full" })] })] }));
+    }
+    else {
+        body = (_jsx("p", { role: "status", className: "text-sm text-muted-foreground", children: l.empty }));
+    }
+    return (_jsxs("div", { className: className ?? 'h-full overflow-y-auto p-6', children: [header, body] }));
+}
+//# sourceMappingURL=permissions-page.js.map

package/dist/permissions-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-page.js","sourceRoot":"","sources":["../src/permissions-page.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,OAAO,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAuB,MAAM,mBAAmB,CAAA;AACjF,OAAO,EAAE,qBAAqB,EAAqC,MAAM,2BAA2B,CAAA;AAmBpG,MAAM,cAAc,GAAoC;IACtD,KAAK,EAAE,aAAa;IACpB,OAAO,EAAE,qBAAqB;IAC9B,KAAK,EAAE,wCAAwC;IAC/C,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,iCAAiC;CACzC,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,EAAwB;IACtG,MAAM,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAA;IAC1C,MAAM,EAAE,GAAG,cAAc,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,GAAG,WAAW,EAAE,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAA;IAEpG,MAAM,UAAU,GAAG,WAAW,CAC5B,KAAK,EAAE,MAAc,EAAE,YAAsB,EAAE,EAAE;QAC/C,MAAM,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QACnD,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACpE,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,CACV,CAAA;IAED,IAAI,IAAe,CAAA;IACnB,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,IAAI,GAAG,CACL,eAAK,IAAI,EAAC,OAAO,EAAC,SAAS,EAAC,yCAAyC,aACnE,YAAG,SAAS,EAAC,kBAAkB,YAAE,CAAC,CAAC,KAAK,GAAK,EAC7C,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAE,GAAG,CAAC,KAAK,YACvD,CAAC,CAAC,KAAK,GACD,IACL,CACP,CAAA;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,GAAG,CACL,KAAC,kBAAkB,IACjB,KAAK,EAAE,CAAC,CAAC,KAAK,EACd,WAAW,EAAE,GAAG,CAAC,WAAW,EAC5B,SAAS,EAAE,GAAG,CAAC,SAAS,EACxB,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAC5C,mBAAmB,EAAE,UAAU,EAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,EAC1B,UAAU,EAAE,GAAG,CAAC,UAAU,EAC1B,UAAU,EAAE,GAAG,CAAC,UAAU,GAC1B,CACH,CAAA;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,GAAG,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,MAAM,gBAAa,CAAC,CAAC,OAAO,EAAE,SAAS,EAAC,qBAAqB,aACxF,KAAC,QAAQ,IAAC,SAAS,EAAC,UAAU,GAAG,EACjC,eAAK,SAAS,EAAC,uCAAuC,aACpD,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,GAAG,EACpC,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,GAAG,IAChC,IACF,CACP,CAAA;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CACL,YAAG,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,+BAA+B,YACvD,CAAC,CAAC,KAAK,GACN,CACL,CAAA;IACH,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAE,SAAS,IAAI,4BAA4B,aACtD,MAAM,EACN,IAAI,IACD,CACP,CAAA;AACH,CAAC"}

package/dist/screen-capability-implies.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Screen -> implied model capabilities.
+ *
+ * A "screen" grant (`screen.<slug>.access`) can imply model CRUD capabilities
+ * (declared by addon manifests as `requires_capabilities`). The host feeds the
+ * map in (usually from `GET /permissions/modules` -> `screen_implies`); labels
+ * are injected, nothing here knows about a specific addon or vertical.
+ */
+import type { ModuleGroup, PermissionActionDef } from '@asteby/metacore-runtime-react';
+export interface ScreenCapabilityLabels {
+    /** action key -> label (`index` -> "List / read"). Unknown keys render raw. */
+    actions?: Record<string, string>;
+    /** module key -> label. Unknown keys render raw. */
+    modules?: Record<string, string>;
+    /** module key -> section title for the shortcut badges. */
+    groups?: Record<string, string>;
+    /** Section for modules not present in `groups`. */
+    fallbackGroup?: string;
+    /** Title of the "implied API dependencies" catalog group. */
+    impliedGroupTitle?: string;
+    /** Label of the per-screen access action. */
+    screenAccess?: string;
+    /** Icon names understood by the PermissionsManager. */
+    dependencyIcon?: string;
+}
+export interface ScreenCapabilityRegistry {
+    set(map: Record<string, string[]> | null | undefined): void;
+    get(): Record<string, string[]>;
+    summarizeImpliedModules(screenAccessCap: string): string;
+    impliedShortcutActions(screenAccessCap: string): PermissionActionDef[];
+    expand(grant: string[]): string[];
+    buildImpliedApiModuleGroup(): ModuleGroup;
+    /** The screen "access" action definition (label injected). */
+    screenAction(): PermissionActionDef;
+}
+/** Route -> screen capability key: `/addons/x/y` -> `screen.addons.x.y`. */
+export declare function screenKeyForUrl(url: string): string;
+export declare function createScreenCapabilityRegistry(labels?: ScreenCapabilityLabels): ScreenCapabilityRegistry;
+//# sourceMappingURL=screen-capability-implies.d.ts.map

package/dist/screen-capability-implies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen-capability-implies.d.ts","sourceRoot":"","sources":["../src/screen-capability-implies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EACV,WAAW,EACX,mBAAmB,EAEpB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AASD,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3D,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/B,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAA;IACxD,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAAA;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;IACjC,0BAA0B,IAAI,WAAW,CAAA;IACzC,8DAA8D;IAC9D,YAAY,IAAI,mBAAmB,CAAA;CACpC;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,GAAE,sBAA2B,GAClC,wBAAwB,CA8F1B"}

package/dist/screen-capability-implies.js

@@ -0,0 +1,119 @@
+const DEFAULT_ACTION_LABELS = {
+    index: 'List / read',
+    create: 'Create',
+    update: 'Update',
+    delete: 'Delete',
+};
+/** Route -> screen capability key: `/addons/x/y` -> `screen.addons.x.y`. */
+export function screenKeyForUrl(url) {
+    const slug = url
+        .replace(/^\/+/, '')
+        .replace(/[?#].*$/, '')
+        .replace(/[^a-zA-Z0-9]+/g, '.')
+        .replace(/\.+$/, '')
+        .toLowerCase();
+    return `screen.${slug || 'root'}`;
+}
+export function createScreenCapabilityRegistry(labels = {}) {
+    let implies = {};
+    const actionLabels = { ...DEFAULT_ACTION_LABELS, ...labels.actions };
+    const moduleLabels = labels.modules ?? {};
+    const groups = labels.groups ?? {};
+    const fallbackGroup = labels.fallbackGroup ?? 'Other APIs';
+    const icon = labels.dependencyIcon ?? 'Link2';
+    const split = (cap) => {
+        const dot = cap.indexOf('.');
+        return dot > 0 ? [cap.slice(0, dot), cap.slice(dot + 1)] : [cap, cap];
+    };
+    return {
+        set(map) {
+            implies = map && typeof map === 'object' ? { ...map } : {};
+        },
+        get: () => ({ ...implies }),
+        summarizeImpliedModules(cap) {
+            const caps = implies[cap];
+            if (!caps?.length)
+                return '';
+            const mods = new Set();
+            for (const c of caps) {
+                const mod = c.split('.')[0];
+                if (mod)
+                    mods.add(moduleLabels[mod] ?? mod);
+            }
+            return [...mods].sort((a, b) => a.localeCompare(b)).join(', ');
+        },
+        impliedShortcutActions(cap) {
+            const caps = implies[cap];
+            if (!caps?.length)
+                return [];
+            return caps.map((c) => {
+                const [mod, action] = split(c);
+                return {
+                    key: c,
+                    label: moduleLabels[mod] ?? mod,
+                    description: actionLabels[action] ?? action,
+                    icon,
+                    kind: 'dependency',
+                    capability: c,
+                    group: groups[mod] ?? fallbackGroup,
+                };
+            });
+        },
+        expand(grant) {
+            const seen = new Set();
+            const out = [];
+            const add = (name) => {
+                const n = name.trim();
+                if (!n || seen.has(n))
+                    return;
+                seen.add(n);
+                out.push(n);
+            };
+            for (const name of grant)
+                add(name);
+            for (const name of grant)
+                for (const i of implies[name] ?? [])
+                    add(i);
+            return out;
+        },
+        buildImpliedApiModuleGroup() {
+            const byModule = new Map();
+            for (const caps of Object.values(implies)) {
+                for (const c of caps) {
+                    if (c.indexOf('.') <= 0)
+                        continue;
+                    const [mod, action] = split(c);
+                    let set = byModule.get(mod);
+                    if (!set)
+                        byModule.set(mod, (set = new Set()));
+                    set.add(action);
+                }
+            }
+            const modules = [...byModule.entries()]
+                .sort(([a], [b]) => a.localeCompare(b))
+                .map(([key, actions]) => ({
+                key,
+                label: moduleLabels[key] ?? key,
+                kind: 'model',
+                icon,
+                actions: [...actions].sort().map((a) => ({
+                    key: a,
+                    label: actionLabels[a] ?? a,
+                    kind: 'crud',
+                })),
+            }));
+            return {
+                title: labels.impliedGroupTitle ??
+                    'API dependencies - granted with screen access (not shown in the menu)',
+                modules,
+            };
+        },
+        screenAction: () => ({
+            key: 'access',
+            label: labels.screenAccess ?? 'Access',
+            icon: 'Eye',
+            kind: 'screen',
+        }),
+    };
+}
+//# sourceMappingURL=screen-capability-implies.js.map

package/dist/screen-capability-implies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen-capability-implies.js","sourceRoot":"","sources":["../src/screen-capability-implies.ts"],"names":[],"mappings":"AA+BA,MAAM,qBAAqB,GAA2B;IACpD,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAA;AAaD,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,WAAW,EAAE,CAAA;IAChB,OAAO,UAAU,IAAI,IAAI,MAAM,EAAE,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,SAAiC,EAAE;IAEnC,IAAI,OAAO,GAA6B,EAAE,CAAA;IAC1C,MAAM,YAAY,GAAG,EAAE,GAAG,qBAAqB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IACpE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,YAAY,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,IAAI,OAAO,CAAA;IAC7C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAoB,EAAE;QAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACvE,CAAC,CAAA;IAED,OAAO;QACL,GAAG,CAAC,GAAG;YACL,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5D,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3B,uBAAuB,CAAC,GAAG;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,CAAC,IAAI,EAAE,MAAM;gBAAE,OAAO,EAAE,CAAA;YAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC3B,IAAI,GAAG;oBAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAA;YAC7C,CAAC;YACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,CAAC;QACD,sBAAsB,CAAC,GAAG;YACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,CAAC,IAAI,EAAE,MAAM;gBAAE,OAAO,EAAE,CAAA;YAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBAC9B,OAAO;oBACL,GAAG,EAAE,CAAC;oBACN,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG;oBAC/B,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM;oBAC3C,IAAI;oBACJ,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,aAAa;iBACb,CAAA;YAC1B,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,KAAK;YACV,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;YACxB,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE;gBAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;gBACrB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,OAAM;gBAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACb,CAAC,CAAA;YACD,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YACnC,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YACrE,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,0BAA0B;YACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAA;YAC/C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBACjC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;oBAC9B,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBAC3B,IAAI,CAAC,GAAG;wBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;oBAC9C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACjB,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAA0B,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;iBAC3D,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxB,GAAG;gBACH,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG;gBAC/B,IAAI,EAAE,OAAgB;gBACtB,IAAI;gBACJ,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACvC,GAAG,EAAE,CAAC;oBACN,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC3B,IAAI,EAAE,MAAe;iBACtB,CAAC,CAAC;aACJ,CAAC,CAAC,CAAA;YACL,OAAO;gBACL,KAAK,EACH,MAAM,CAAC,iBAAiB;oBACxB,uEAAuE;gBACzE,OAAO;aACR,CAAA;QACH,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACnB,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ;YACtC,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,QAAQ;SACf,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,29 @@
+/** Minimal HTTP surface the package needs. An axios instance satisfies it. */
+export interface PermissionsHttpClient {
+    get(url: string): Promise<{
+        data?: unknown;
+    }>;
+    post(url: string, body?: unknown): Promise<{
+        data?: unknown;
+    }>;
+    put(url: string, body?: unknown): Promise<{
+        data?: unknown;
+    }>;
+    delete(url: string): Promise<{
+        data?: unknown;
+    }>;
+}
+/** Structural nav item — compatible with the SDK's NavItem and with host types. */
+export interface NavItemLike {
+    title: string;
+    url?: string | unknown;
+    icon?: unknown;
+    items?: NavItemLike[];
+    requires?: string;
+    folderKey?: string;
+}
+export interface NavGroupLike<T extends NavItemLike = NavItemLike> {
+    title: string;
+    items: T[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC7D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACjD;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,EAAE,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,CAAC,EAAE,CAAA;CACX"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/use-my-permissions.d.ts

@@ -0,0 +1,19 @@
+import { type MyPermissions } from './permissions-api';
+export interface UseMyPermissionsOptions {
+    /** Loader, usually `api.fetchMyPermissions`. */
+    fetch: () => Promise<MyPermissions>;
+    /** Signed-in user id; the query is disabled while empty. */
+    userId: string | undefined | null;
+    /** Cache scope (org/user) for the persisted first-paint snapshot. */
+    scope: string;
+    /** localStorage namespace of the snapshot. Default `metacore:permissions-me`. */
+    snapshotKey?: string;
+    staleTime?: number;
+}
+/**
+ * The signed-in user's capability feed, seeded from a persisted per-scope
+ * snapshot so gated UI does not reorder on reload. UI gating only - the server
+ * still enforces every capability.
+ */
+export declare function useMyPermissions(opts: UseMyPermissionsOptions): import("@tanstack/react-query").UseQueryResult<MyPermissions, Error>;
+//# sourceMappingURL=use-my-permissions.d.ts.map

package/dist/use-my-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-my-permissions.d.ts","sourceRoot":"","sources":["../src/use-my-permissions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE7E,MAAM,WAAW,uBAAuB;IACtC,gDAAgD;IAChD,KAAK,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IACnC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IACjC,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,wEAa7D"}

package/dist/use-my-permissions.js

@@ -0,0 +1,20 @@
+import { createPersistedSnapshot, usePersistedQuery, } from '@asteby/metacore-runtime-react';
+import { useMemo } from 'react';
+import { myPermissionsQueryKey } from './permissions-api';
+/**
+ * The signed-in user's capability feed, seeded from a persisted per-scope
+ * snapshot so gated UI does not reorder on reload. UI gating only - the server
+ * still enforces every capability.
+ */
+export function useMyPermissions(opts) {
+    const { fetch, userId, scope, snapshotKey = 'metacore:permissions-me', staleTime = 60_000 } = opts;
+    const snapshot = useMemo(() => createPersistedSnapshot({ key: snapshotKey, version: 1 }), [snapshotKey]);
+    return usePersistedQuery({
+        queryKey: myPermissionsQueryKey(userId),
+        queryFn: fetch,
+        enabled: Boolean(userId),
+        staleTime,
+        persist: { snapshot, scope },
+    });
+}
+//# sourceMappingURL=use-my-permissions.js.map

package/dist/use-my-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-my-permissions.js","sourceRoot":"","sources":["../src/use-my-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAC/B,OAAO,EAAE,qBAAqB,EAAsB,MAAM,mBAAmB,CAAA;AAc7E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6B;IAC5D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,yBAAyB,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,IAAI,CAAA;IAClG,MAAM,QAAQ,GAAG,OAAO,CACtB,GAAG,EAAE,CAAC,uBAAuB,CAAgB,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAC9E,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,iBAAiB,CAAgB;QACtC,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC;QACvC,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;QACxB,SAAS;QACT,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;KAC7B,CAAC,CAAA;AACJ,CAAC"}

package/dist/use-permissions-catalog.d.ts

@@ -0,0 +1,46 @@
+import type { GeneralPermissionDef, ModuleGroup, PermissionActionDef, PermissionsCatalog } from '@asteby/metacore-runtime-react';
+import { type ScreenCapabilityRegistry } from './screen-capability-implies';
+import type { NavGroupLike, NavItemLike } from './types';
+export interface BuildCatalogInput {
+    /** Host navigation groups. */
+    groups: NavGroupLike[];
+    /** Extra module items (e.g. addon contributions). */
+    extraItems?: NavItemLike[];
+    /** Backend action catalog. */
+    backend: PermissionsCatalog;
+    /** Title translator for nav titles. */
+    translate?: (s: string) => string;
+    registry?: ScreenCapabilityRegistry;
+    /** Fallback screen action when no registry is given. */
+    screenAction?: PermissionActionDef;
+}
+/** Pure: crosses the nav with the backend action catalog. */
+export declare function buildCatalogFromNav(input: BuildCatalogInput): {
+    groups: ModuleGroup[];
+    general: GeneralPermissionDef[];
+};
+export interface UsePermissionsCatalogOptions {
+    /** Live nav groups (the host's navigation query result). */
+    groups: NavGroupLike[];
+    extraItems?: NavItemLike[];
+    /** Loads the backend catalog, usually `api.loadPermissionModules`. */
+    loadBackendCatalog: () => Promise<PermissionsCatalog>;
+    translate?: (s: string) => string;
+    registry?: ScreenCapabilityRegistry;
+    /** Gate extra readiness (e.g. nav still loading). Default true. */
+    navReady?: boolean;
+    queryKey?: readonly unknown[];
+}
+/**
+ * Returns `{ loadModules, ready, isError, error, retry }`. Render the
+ * PermissionsManager only when `ready` - it loads its catalog once on mount.
+ */
+export declare function usePermissionsCatalog(opts: UsePermissionsCatalogOptions): {
+    loadModules: () => Promise<PermissionsCatalog>;
+    ready: boolean;
+    isLoading: boolean;
+    isError: boolean;
+    error: Error | null;
+    retry: () => undefined;
+};
+//# sourceMappingURL=use-permissions-catalog.d.ts.map

package/dist/use-permissions-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-permissions-catalog.d.ts","sourceRoot":"","sources":["../src/use-permissions-catalog.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EAEnB,kBAAkB,EACnB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAIxD,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,qDAAqD;IACrD,UAAU,CAAC,EAAE,WAAW,EAAE,CAAA;IAC1B,8BAA8B;IAC9B,OAAO,EAAE,kBAAkB,CAAA;IAC3B,uCAAuC;IACvC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IACjC,QAAQ,CAAC,EAAE,wBAAwB,CAAA;IACnC,wDAAwD;IACxD,YAAY,CAAC,EAAE,mBAAmB,CAAA;CACnC;AASD,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG;IAC7D,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,OAAO,EAAE,oBAAoB,EAAE,CAAA;CAChC,CAkDA;AAED,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,WAAW,EAAE,CAAA;IAC1B,sEAAsE;IACtE,kBAAkB,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACrD,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IACjC,QAAQ,CAAC,EAAE,wBAAwB,CAAA;IACnC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;CAC9B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B;uBAY5B,OAAO,CAAC,kBAAkB,CAAC;;;;;;EAUtE"}

package/dist/use-permissions-catalog.js

@@ -0,0 +1,103 @@
+/**
+ * Builds the PermissionsManager catalog from the SAME nav the sidebar renders,
+ * so the grid mirrors what users see. The backend supplies the actions per
+ * model; the host nav decides which modules appear and how they group.
+ */
+import { useCallback, useMemo } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { screenKeyForUrl, } from './screen-capability-implies';
+const MODEL_URL_RE = /^\/m\/([^/?#]+)/;
+const FALLBACK_SCREEN_ACTION = {
+    key: 'access',
+    label: 'Access',
+    icon: 'Eye',
+    kind: 'screen',
+};
+/** Pure: crosses the nav with the backend action catalog. */
+export function buildCatalogFromNav(input) {
+    const { backend, registry } = input;
+    const tr = input.translate ?? ((s) => s);
+    const screenAction = registry?.screenAction() ?? input.screenAction ?? FALLBACK_SCREEN_ACTION;
+    const flat = 'groups' in backend ? backend.groups.flatMap((g) => g.modules) : backend.modules;
+    const actionsByKey = new Map();
+    for (const m of flat)
+        actionsByKey.set(m.key.toLowerCase(), m.actions);
+    const general = backend.general ?? [];
+    const moduleForItem = (item) => {
+        const url = typeof item.url === 'string' ? item.url : '';
+        const icon = typeof item.icon === 'string' ? item.icon : undefined;
+        const m = MODEL_URL_RE.exec(url);
+        if (m?.[1]) {
+            const table = decodeURIComponent(m[1]).toLowerCase();
+            const actions = actionsByKey.get(table);
+            if (!actions || actions.length === 0)
+                return null;
+            return { key: table, label: tr(item.title), icon, kind: 'model', actions };
+        }
+        if (!url || url === '#')
+            return null;
+        const screenKey = screenKeyForUrl(url);
+        return {
+            key: screenKey,
+            label: tr(item.title),
+            icon,
+            kind: 'screen',
+            actions: [screenAction, ...(registry?.impliedShortcutActions(`${screenKey}.access`) ?? [])],
+        };
+    };
+    const groups = [];
+    const pushGroup = (title, items) => {
+        const modules = items.map(moduleForItem).filter((x) => x !== null);
+        if (modules.length > 0)
+            groups.push({ title, modules });
+    };
+    for (const g of input.groups) {
+        const leaves = [];
+        for (const item of g.items) {
+            if (item.items && item.items.length > 0)
+                pushGroup(tr(item.title), item.items);
+            else
+                leaves.push(item);
+        }
+        pushGroup(tr(g.title), leaves);
+    }
+    for (const item of input.extraItems ?? []) {
+        if (item.items && item.items.length > 0)
+            pushGroup(tr(item.title), item.items);
+        else
+            pushGroup(tr(item.title), [item]);
+    }
+    const implied = registry?.buildImpliedApiModuleGroup();
+    if (implied && implied.modules.length > 0)
+        groups.push(implied);
+    return { groups, general };
+}
+/**
+ * Returns `{ loadModules, ready, isError, error, retry }`. Render the
+ * PermissionsManager only when `ready` - it loads its catalog once on mount.
+ */
+export function usePermissionsCatalog(opts) {
+    const { groups, extraItems, loadBackendCatalog, translate, registry, navReady = true } = opts;
+    const q = useQuery({
+        queryKey: opts.queryKey ?? ['permissions', 'modules', 'catalog'],
+        queryFn: loadBackendCatalog,
+        staleTime: 60_000,
+    });
+    const backend = q.data;
+    const catalog = useMemo(() => {
+        if (!backend || !navReady)
+            return { groups: [], general: [] };
+        return buildCatalogFromNav({ groups, extraItems, backend, translate, registry });
+    }, [groups, extraItems, backend, translate, registry, navReady]);
+    const loadModules = useCallback(async () => catalog, [catalog]);
+    const retry = useCallback(() => void q.refetch(), [q]);
+    return {
+        loadModules,
+        ready: catalog.groups.length > 0,
+        isLoading: q.isLoading || !navReady,
+        isError: q.isError,
+        error: q.error,
+        retry,
+    };
+}
+//# sourceMappingURL=use-permissions-catalog.js.map

package/dist/use-permissions-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-permissions-catalog.js","sourceRoot":"","sources":["../src/use-permissions-catalog.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAQhD,OAAO,EACL,eAAe,GAEhB,MAAM,6BAA6B,CAAA;AAGpC,MAAM,YAAY,GAAG,iBAAiB,CAAA;AAgBtC,MAAM,sBAAsB,GAAwB;IAClD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,QAAQ;CACf,CAAA;AAED,6DAA6D;AAC7D,MAAM,UAAU,mBAAmB,CAAC,KAAwB;IAI1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IAChD,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,EAAE,IAAI,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAA;IAC7F,MAAM,IAAI,GAAG,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IAC7F,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAA;IAC7D,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAErC,MAAM,aAAa,GAAG,CAAC,IAAiB,EAA8B,EAAE;QACtE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACxD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QAClE,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YACpD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACvC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YACjD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACpC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACtC,OAAO;YACL,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YACrB,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,sBAAsB,CAAC,GAAG,SAAS,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;SAC5F,CAAA;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,KAAoB,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;QAC5F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACzD,CAAC,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAkB,EAAE,CAAA;QAChC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;;gBACzE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;QACD,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;IAChC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;;YACzE,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,EAAE,0BAA0B,EAAE,CAAA;IACtD,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5B,CAAC;AAeD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IAC7F,MAAM,CAAC,GAAG,QAAQ,CAAC;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;QAChE,OAAO,EAAE,kBAAkB;QAC3B,SAAS,EAAE,MAAM;KAClB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAA;IACtB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,EAAmB,EAAE,OAAO,EAAE,EAA4B,EAAE,CAAA;QACxG,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClF,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IAChE,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,IAAiC,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,OAAO;QACL,WAAW;QACX,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ;QACnC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK;KACN,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@asteby/metacore-permissions",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Metacore permissions — capability feed, role/grant API factory, screen-implied capabilities, nav gating and a PermissionsPage, all with injected transport, i18n and nav.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/asteby/metacore-sdk",
+    "directory": "packages/permissions"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@asteby/metacore-runtime-react": "^50.1.0",
+    "@asteby/metacore-ui": "^2.25.0",
+    "@tanstack/react-query": ">=5",
+    "react": ">=18",
+    "react-dom": ">=18"
+  },
+  "devDependencies": {
+    "@asteby/metacore-runtime-react": "50.1.0",
+    "@asteby/metacore-ui": "2.25.0",
+    "@tanstack/react-query": "^5.95.0",
+    "@testing-library/react": "^16.3.2",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "happy-dom": "^20.10.2",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4",
+    "typescript": "^6.0.0",
+    "vitest": "^4.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -w -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rm -rf dist",
+    "test": "vitest run"
+  }
 }