@eintrek/erp-shell 0.1.22 → 0.1.25

package/dist/navigation/nav-user.d.ts

@@ -1,3 +1,10 @@
+import { type ReactNode } from "react";
+/** Cross-app / module link shown in the user menu (e.g. Accounting, HR). */
+export interface NavUserSystemLink {
+    label: string;
+    href: string;
+    icon?: ReactNode;
+}
 export interface NavUserProps {
     /**
      * Currently-selected organization context. The shell only reads `name`,
@@ -26,5 +33,10 @@ export interface NavUserProps {
     selectOrganizationHref?: string;
     /** Redirect after signOut. Default: "/auth/signin". */
     signInRedirectHref?: string;
+    /**
+     * Links to sibling ERP apps (Accounting, HR, …). Absolute URLs preferred
+     * so navigation works across origins; relative paths use the Next router.
+     */
+    systemLinks?: NavUserSystemLink[];
 }
-export declare function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref, signInRedirectHref, }?: NavUserProps): import("react/jsx-runtime").JSX.Element | null;
+export declare function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref, signInRedirectHref, systemLinks, }?: NavUserProps): import("react/jsx-runtime").JSX.Element | null;

package/dist/navigation/navigation-data-helpers.d.ts

@@ -2,8 +2,12 @@ import type { PermissionRulesMap } from "../providers/permission-rules-context";
 import type { Module, Tool } from "./navigation-types";
 /**
  * True when the user's child-group segments include at least one of the
- * groups required for `permissionRouteKey`. Missing key / empty required
- * list both fall open (no restriction).
+ * groups required for `permissionRouteKey`.
+ *
+ * Fail-closed:
+ * - Nav item without `permissionRouteKey` → deny (must declare a key)
+ * - Key absent from `rulesMap` → deny (unknown route is not public)
+ * - Key present with `required_child_groups: []` → allow (explicit public)
  */
 export declare function canAccessNavPermissionRoute(permissionRouteKey: string | undefined, rulesMap: PermissionRulesMap, userChildSegments: string[]): boolean;
 /** Footer tools — same JWT child-group rules as main nav. */

package/dist/providers/permission-rules-context.d.ts

@@ -48,8 +48,8 @@ export interface PermissionRulesProviderProps {
  */
 export declare function PermissionRulesProvider({ children, data, isLoading, isError, fallbackPolicies, }: PermissionRulesProviderProps): import("react/jsx-runtime").JSX.Element;
 /**
- * Read the permission rules. Returns empty maps when used outside the
- * provider (lets pages render without a hard-fail in tests).
+ * Read the permission rules. Outside the provider, report loading so
+ * fail-closed consumers (nav / gates) do not treat empty maps as "allow all".
  */
 export declare function usePermissionRules(): PermissionRulesContextValue;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eintrek/erp-shell",
-  "version": "0.1.22",
+  "version": "0.1.25",
   "private": false,
   "type": "module",
   "description": "Shared frontend platform for ERP apps — HTTP client, providers, navigation, hooks.",