@feedmepos/mf-hrm-portal 2.3.1 → 2.3.2-dev.10

package/dist/src/api/audit-log/index.d.ts

@@ -14,6 +14,7 @@ declare const AuditLogAPI: {
         searchSubjects?: string[];
         sources?: string[];
         restaurantIds?: string[];
+        traceId?: string;
     }): Promise<number>;
     read(params?: {
         limit?: number;
@@ -31,6 +32,7 @@ declare const AuditLogAPI: {
         searchSubjects?: string[];
         sources?: string[];
         restaurantIds?: string[];
+        traceId?: string;
     }): Promise<AuditLogEntry[]>;
     /**
      * FeedMe-admin options for the User filter. `actors` is the named admin list (internal

package/dist/src/api/employee/index.d.ts

@@ -1,11 +1,10 @@
 import { FdtoUpdatePosUserReq, FdtoUpdatePosMasterUserReq } from '@feedmepos/core/entity';
-import type { Employee, IFdtoEmployeePage, IFdtoPosUser, IReadEmployeesPageReq } from '@/types/employee';
+import type { Employee, IFdtoEmployeePage, IReadEmployeesPageReq } from '@/types/employee';
 export interface IGeneratePasscodeParams {
     restaurantIds: string[];
     excludePosUserId?: string;
 }
 declare const EmployeeAPI: {
-    readEmployees(): Promise<IFdtoPosUser[]>;
     readEmployeesPage(query: IReadEmployeesPageReq): Promise<IFdtoEmployeePage>;
     createEmployee(dto: FdtoUpdatePosUserReq): Promise<string>;
     createMasterEmployee(dto: FdtoUpdatePosMasterUserReq): Promise<string>;

package/dist/src/api/my-pos-profile/index.d.ts

@@ -0,0 +1,3 @@
+import type { FdtoMyPosProfile, FdtoRegenerateMyPosPasscodeRes } from '@/types/my-pos-profile';
+export declare const readMyPosProfile: () => Promise<FdtoMyPosProfile>;
+export declare const regenerateMyPosPasscode: () => Promise<FdtoRegenerateMyPosPasscodeRes>;

package/dist/src/api/sso-provider/index.d.ts

@@ -0,0 +1,5 @@
+import type { IFdtoSsoProvider } from '@/types/sso-provider';
+declare const SsoProviderAPI: {
+    readProviders(): Promise<IFdtoSsoProvider[]>;
+};
+export default SsoProviderAPI;

package/dist/src/api/staff-invite/index.d.ts

@@ -0,0 +1,16 @@
+import type { IFdtoCreateStaffInviteReq, IFdtoCreateStaffInviteRes, IFdtoResendStaffInviteRes, IFdtoStaffInvite, IFdtoStaffInviteLookup, IFdtoUpdateStaffInviteReq } from '@/types/staff-invite';
+declare const StaffInviteAPI: {
+    readInvites(status?: IFdtoStaffInvite["status"]): Promise<IFdtoStaffInvite[]>;
+    lookup(key: {
+        mobile: string;
+    } | {
+        email: string;
+    }, provider?: string): Promise<IFdtoStaffInviteLookup | null>;
+    createInvite(req: IFdtoCreateStaffInviteReq): Promise<IFdtoCreateStaffInviteRes>;
+    updateInvite(id: string, req: IFdtoUpdateStaffInviteReq): Promise<IFdtoStaffInvite>;
+    revokeInvite(id: string): Promise<{
+        ok: true;
+    }>;
+    resendInvite(id: string): Promise<IFdtoResendStaffInviteRes>;
+};
+export default StaffInviteAPI;

package/dist/src/api/timesheet/index.d.ts

@@ -1,6 +1,6 @@
 import type { IFdtoTimesheet, UpdateTimesheetDTO } from '@/types/timesheet';
 declare const TimesheetAPI: {
-    readTimesheets(startIso: string, endIso: string): Promise<IFdtoTimesheet[]>;
+    readTimesheets(startIso: string, endIso: string, restaurantIds?: string[]): Promise<IFdtoTimesheet[]>;
     updateTimesheet(restaurantId: string, dto: UpdateTimesheetDTO): Promise<void>;
 };
 export default TimesheetAPI;

package/dist/src/components/CollapsibleWrapper.vue.d.ts

@@ -2,17 +2,25 @@ interface Props {
     title?: string;
     subtitle?: string;
     initiallyCollapsed?: boolean;
+    /**
+     * 'trailing': toggle on the right, subtitle beside the title while collapsed.
+     * 'leading': chevron before the title, subtitle always under it (member sheet cards).
+     */
+    layout?: 'trailing' | 'leading';
 }
-declare var __VLS_1: {}, __VLS_7: {};
+declare var __VLS_5: {}, __VLS_7: {}, __VLS_13: {};
 type __VLS_Slots = {} & {
-    title?: (props: typeof __VLS_1) => any;
+    title?: (props: typeof __VLS_5) => any;
 } & {
-    default?: (props: typeof __VLS_7) => any;
+    title?: (props: typeof __VLS_7) => any;
+} & {
+    default?: (props: typeof __VLS_13) => any;
 };
 declare const __VLS_component: import("vue").DefineComponent<Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<Props> & Readonly<{}>, {
     title: string;
     subtitle: string;
     initiallyCollapsed: boolean;
+    layout: "trailing" | "leading";
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: __VLS_WithSlots<typeof __VLS_component, __VLS_Slots>;
 export default _default;

package/dist/src/components/form/SegmentedTabs.vue.d.ts

@@ -0,0 +1,23 @@
+declare const _default: <T extends string>(__VLS_props: NonNullable<Awaited<typeof __VLS_setup>>["props"], __VLS_ctx?: __VLS_PrettifyLocal<Pick<NonNullable<Awaited<typeof __VLS_setup>>, "attrs" | "emit" | "slots">>, __VLS_expose?: NonNullable<Awaited<typeof __VLS_setup>>["expose"], __VLS_setup?: Promise<{
+    props: __VLS_PrettifyLocal<Pick<Partial<{}> & Omit<{
+        readonly "onUpdate:modelValue"?: ((value: T) => any) | undefined;
+    } & import("vue").VNodeProps & import("vue").AllowedComponentProps & import("vue").ComponentCustomProps, never>, "onUpdate:modelValue"> & ({
+        items: {
+            label: string;
+            value: T;
+        }[];
+        disabled?: boolean;
+    } & {
+        modelValue: T;
+    }) & Partial<{}>> & import("vue").PublicProps;
+    expose(exposed: import("vue").ShallowUnwrapRef<{}>): void;
+    attrs: any;
+    slots: {};
+    emit: (evt: "update:modelValue", value: T) => void;
+}>) => import("vue").VNode & {
+    __ctx?: Awaited<typeof __VLS_setup>;
+};
+export default _default;
+type __VLS_PrettifyLocal<T> = {
+    [K in keyof T]: T[K];
+} & {};

package/dist/src/composables/useMenuAccess.d.ts

@@ -0,0 +1,56 @@
+import { type ComputedRef } from 'vue';
+import { type LocationQuery, type RouteLocationMatched } from 'vue-router';
+import { RouteName } from '@/router/shared';
+/**
+ * One HRM side-menu entry. `to` is the route the item opens; its accessibility is the
+ * accessibility of that route, so the menu and the route guards can never disagree.
+ */
+export interface MenuItemDef {
+    /** FmCollapsibleTabs value; kept identical to the values the Navigator always used. */
+    value: string;
+    labelKey: string;
+    to: RouteName;
+    /** Carry the current query (business query state) along when navigating. */
+    keepQuery: boolean;
+    /** Route names that highlight this item. */
+    activeRoutes: RouteName[];
+}
+export interface MenuAccessItem extends MenuItemDef {
+    accessible: boolean;
+    /** Access is not known yet (only My POS Profile, while its lookup runs). */
+    loading: boolean;
+}
+/**
+ * Menu order: existing items first, My POS Profile last. Built lazily because
+ * `@/router/shared` imports this module (through the route guard), so `RouteName` is not
+ * initialised yet while this module is first evaluated.
+ */
+export declare function menuItemDefs(): MenuItemDef[];
+type SessionUser = {
+    _role?: string;
+    permissions: unknown[];
+} | null | undefined;
+/**
+ * Same rule `withPermission` applies (hrm-permission `validateRoute` → `validate`): every
+ * matched record's `meta.validationManifest` must pass its role list and its CASL
+ * requirements, checked with the package's own `checkAccess`. `validateRoute` itself is not
+ * exported, so this walks the manifests and delegates the rule to `checkAccess`.
+ * No route here uses `customValidationFunction`; a manifest that has one is left to
+ * `withPermission` (treated as passing here).
+ */
+export declare function passesRouteManifests(matched: readonly Pick<RouteLocationMatched, 'meta'>[], sessionUser: SessionUser): boolean;
+/** Test hook: forget every cached lookup. */
+export declare function resetMenuAccessCache(): void;
+export declare function useMenuAccess(): {
+    items: ComputedRef<MenuAccessItem[]>;
+    visibleItems: ComputedRef<MenuAccessItem[]>;
+    firstAccessible: ComputedRef<MenuAccessItem | undefined>;
+    hasPosUser: ComputedRef<boolean | undefined>;
+    isLoading: ComputedRef<boolean>;
+    canOpenMatched: (matched: readonly RouteLocationMatched[]) => boolean | undefined;
+    locationFor: (item: MenuItemDef, query?: LocationQuery) => {
+        query?: LocationQuery | undefined;
+        name: RouteName;
+    };
+};
+export {};

package/dist/src/composables/useSsoProviders.d.ts

@@ -0,0 +1,19 @@
+import type { IFdtoSsoProvider } from '@/types/sso-provider';
+export declare function useSsoProviders(): {
+    providers: import("vue").Ref<{
+        slug: string;
+        label: string;
+        type: string;
+        enabled: boolean;
+        inviteMatch: import("../types/staff-invite").StaffInviteMatch | "none";
+    }[], IFdtoSsoProvider[] | {
+        slug: string;
+        label: string;
+        type: string;
+        enabled: boolean;
+        inviteMatch: import("../types/staff-invite").StaffInviteMatch | "none";
+    }[]>;
+    isLoaded: import("vue").ComputedRef<boolean>;
+    loadProviders: () => Promise<void>;
+    providerLabel: (slug: string) => string;
+};

package/dist/src/composables/useStaffInviteProviders.d.ts

@@ -0,0 +1,8 @@
+export declare function useStaffInviteProviders(): {
+    providers: import("vue").ComputedRef<import("../types/staff-invite").IFdtoStaffInviteProvider[]>;
+    isLoaded: import("vue").ComputedRef<boolean>;
+    hasProviders: import("vue").ComputedRef<boolean>;
+    canInvite: import("vue").ComputedRef<boolean>;
+    loadProviders: () => Promise<void>;
+    providerLabel: (slug: string) => string;
+};

package/dist/src/helpers/member-grant.d.ts

@@ -0,0 +1,36 @@
+import type { FdoPermissionRule } from '@feedmepos/core/entity';
+import type { IFdtoPermissionSet } from '@/types/permission-set';
+import type { IFdtoCreatePortalUserReq, IFdtoPermissionPosUser, IFdtoUpdatePortalUserReq } from '@/types/team';
+/** The grant half of a portal user request: roles, custom permissions and POS master user. */
+export type MemberGrantPayload = Required<Pick<IFdtoCreatePortalUserReq, 'customPermissions' | 'permissions' | 'permissionSetIds'>> & Pick<IFdtoCreatePortalUserReq, 'posUser'>;
+export interface MemberGrantState {
+    userPermissions: FdoPermissionRule[];
+    /** Permission sets collected from the selected roles. */
+    inheritedPermissions: IFdtoPermissionSet[];
+    permissionSetIds: string[];
+    posUser: IFdtoPermissionPosUser | null | undefined;
+    /** Report subjects still known; report rules outside it are stale. */
+    reportSubjects: Set<string>;
+    defaultReportSubjects: Set<string>;
+    /** Saved POS user, used when the form leaves name or code empty. */
+    savedPosUser?: IFdtoPermissionPosUser;
+    fallbackName: string;
+}
+/**
+ * Rules that scope where a member works (outlets, warehouses, usable POS roles) rather
+ * than which portal pages they open. "Where they work" edits these; "Portal access" the rest.
+ */
+export declare const WORKPLACE_SUBJECTS: readonly string[];
+/** Whether a grant opens any portal page: a role, or a granted rule beyond the workplace ones. */
+export declare function hasPortalAccess(rules: FdoPermissionRule[], permissionSetIds: string[]): boolean;
+/** Portal access off: keep only where they work, so they get My POS Profile and nothing else. */
+export declare function withoutPortalAccess(rules: FdoPermissionRule[]): FdoPermissionRule[];
+/** What an untouched grant section submits. */
+export declare const EMPTY_MEMBER_GRANT: MemberGrantPayload;
+export declare function buildMemberGrantPayload(state: MemberGrantState): MemberGrantPayload;
+/**
+ * Member edit request: the passcode goes out only when the admin changed it. The form
+ * holds the passcode loaded when it opened; sending that back would overwrite a newer one
+ * the member set in My POS Profile (KDI-5225 review #2). Add member sends it as is.
+ */
+export declare function toMemberUpdateReq(req: IFdtoCreatePortalUserReq, saved: IFdtoPermissionPosUser | undefined): IFdtoUpdatePortalUserReq;

package/dist/src/helpers/my-pos-profile.d.ts

@@ -0,0 +1,37 @@
+import type { FdtoMyPosProfile, FdtoMyPosProfileAssignment } from '@/types/my-pos-profile';
+type Profile = NonNullable<FdtoMyPosProfile['profile']>;
+export interface MyPosProfileRow {
+    /** Name and contact show on the first row only, as in the design. */
+    name: string | null;
+    contact: string | null;
+    restaurant: string;
+    role: string;
+    assignment: FdtoMyPosProfileAssignment;
+}
+/** A null phone number shows the email instead (contract). */
+export declare const profileContact: (profile: Profile) => string;
+/** One row per assignment; name and contact on the first row only. */
+export declare function toProfileRows(profile: Profile): MyPosProfileRow[];
+/**
+ * "Updated …" for the passcode card: null when the change time is unknown (D53: the line
+ * is hidden), "just now" under a minute, else a localized relative time. Weeks run to 13
+ * (the design shows "12 weeks ago") before months take over.
+ */
+export declare function formatPasscodeUpdated(updatedAt: string | null, t: (key: string, values?: Record<string, unknown>) => string, locale: string, now?: number): string | null;
+/**
+ * Opens account-service's Manage Account page through the FeedMeAuth that
+ * @feedmepos/mf-common exposes (the same page the portal shell's "Manage Account" leads
+ * to). openManageProfile is newer than the @feedmepos/auth types this app builds against,
+ * so it is looked up at runtime. Returns false when it is missing or throws (e.g. no
+ * FeedMe session), for the caller to report.
+ */
+export declare function openManageAccount(auth: object): boolean;
+/**
+ * 409 `pos_user_shared`: the POS user's id is shared with another team member, so the
+ * backend refuses to show or change it (KDI-5225 review #1). Checked structurally, so
+ * callers need not import the API client.
+ */
+export declare const isPosUserSharedError: (err: unknown) => boolean;
+/** Locale key for a failed Change passcode. */
+export declare function passcodeChangeErrorKey(err: unknown): string;
+export {};

package/dist/src/helpers/permission-set.d.ts

@@ -1,21 +1,5 @@
 import type { InheritedPermission, IFdtoPermissionSet } from '@/types/permission-set';
-import type { FdoPermissionRule } from '@feedmepos/core/entity';
-/**
- * Recursively collect all permission sets following permissionSetIds links.
- * Returns a flat, deduplicated list in depth-first order (parent before children).
- * Cycle-safe via the visited set.
- */
-export declare function collectAllPermissionSets(setIds: string[], allSets: IFdtoPermissionSet[], visited?: Set<string>): IFdtoPermissionSet[];
-/**
- * Compute the effective permissions from a list of permission sets.
- *
- * Unlike a raw `mergePermissionSet().map(...)`, this correctly handles sets that store
- * override diffs (inverted rules): it first merges all grants and denials from the sets,
- * then applies the denials on top of the grants via `getEffectivePermissions`, producing a
- * clean list of effective grants only. This ensures that subjects removed by a child set's
- * inversion are not incorrectly shown as granted.
- */
-export declare function mergeToEffectivePermissions(sets: IFdtoPermissionSet[]): FdoPermissionRule[];
+export { collectAllPermissionSets, mergeToEffectivePermissions, getOverridePermissions, materializeSystemPermissionSetOverrides, stripSystemExpandedPositives, REPORT_SUBJECT_PREFIX, filterStalePermissions, filterRedundantReportPermissions, getEffectivePermissions, getEditorPermissions, } from '@feedmepos/hrm-permission/utils';
 /**
  * Transform permission sets by grouping role names by collection IDs for a specific field
  * @param permissionSets - Array of permission sets with their permissions
@@ -24,88 +8,3 @@ export declare function mergeToEffectivePermissions(sets: IFdtoPermissionSet[]):
  * @returns Array of objects containing collection ID and associated role names
  */
 export declare function transformByCollection(permissionSets: IFdtoPermissionSet[], field: string, resourceIds: string[]): InheritedPermission[];
-/**
- * Combine base permissions (permissions set) with user permissions
- * @param basePermissions - Base permissions
- * @param overridePermissions - User permissions
- * @returns Combined permissions
- * Return combined result with below criteria:
- * - If base has it and user doesn't, return base permission with { inverted: true }
- * - If user has it and base doesn't, return user permission
- * - If base and user has it, nothing return
- * For permission with conditions (collection: warehouses, roles, restaurants)
- * - If base conditions different from user conditions, return rule with { inverted: true } and conditions on collection ids to be denied
- * - If base has conditions and user doesn't, return base with { inverted: true } without conditions, essentially denied all access
- * - If user has conditions and base doesn't, return user's rule (user added)
- */
-export declare function getOverridePermissions(basePermissions: FdoPermissionRule[], overridePermissions: FdoPermissionRule[]): FdoPermissionRule[];
-export declare function materializeSystemPermissionSetOverrides(overridePermissions: FdoPermissionRule[]): FdoPermissionRule[];
-/**
- * Strip positive rules whose subject would be re-injected by system permission set expansion.
- * These need not be persisted to DB — expansion re-adds them at runtime.
- *
- * Also strips inverted rules for subjects that are ONLY reachable as non-manage via permissions[]
- * leaf injection. Such inverted rules cannot block permissions[] injection (only visitedSetIds/
- * permissionSets[] expansion is blockable), are useless, and cause a CASL side-effect where an
- * inverted `manage` rule inadvertently blocks `read` access.
- *
- * Inverted rules targeting subjects reachable as `manage` (via permissionSets[] chaining) are
- * always preserved — they seed visitedSetIds to block system set re-expansion.
- */
-export declare function stripSystemExpandedPositives(permissions: FdoPermissionRule[]): FdoPermissionRule[];
-export declare const REPORT_SUBJECT_PREFIX = "business::report::";
-/**
- * Filter out stale report permission rules.
- *
- * Only rules whose subject starts with `business::report::` are candidates for removal —
- * any other subject (restaurant, role, warehouse, etc.) passes through untouched.
- * A report-prefixed subject is kept only if it exists in `knownReportSubjects`.
- *
- * This handles:
- * - Deprecated/renamed subjects (e.g. `business::report::closeup` → `business::report::reports::closeup`)
- * - Deleted dynamic reports that no longer exist
- */
-export declare function filterStalePermissions(permissions: FdoPermissionRule[], knownReportSubjects: Set<string>): FdoPermissionRule[];
-/**
- * Strip individual-report actions already covered by an `allDefaultReports` or
- * `allCustomReports` positive grant, preventing redundant data from being saved.
- *
- * - If the cover rule has `manage` selected → every individual rule in that bucket is
- *   fully covered and dropped entirely only when the cover condition also covers the
- *   individual rule.
- * - Otherwise, only covered non-manage actions are stripped from individual rules when
- *   the cover condition also covers the individual rule.
- *   `manage` is a real CASL wildcard grant that implies every action, not merely a
- *   shorthand for "all non-manage actions selected" — a rule carrying `manage` is
- *   pushed through UNCHANGED (a cover lacking `manage` cannot cover it). Stripping its
- *   constituent actions and then dropping `manage` would destroy the user's grant.
- *   Rules that end up with no remaining actions are dropped.
- *
- * Inverted rules and the cover subjects themselves pass through untouched.
- *
- * @param defaultReportSubjects  Full set of subjects in the "Default Report" UI category —
- *   includes static hardcoded subjects AND dynamic reports with `isDefault: true`.
- *   Built by the caller from `portalTeamPermissions` + `customReportPermissions`.
- */
-export declare function filterRedundantReportPermissions(permissions: FdoPermissionRule[], defaultReportSubjects: Set<string>): FdoPermissionRule[];
-/**
- * Combine base permissions with override permissions to get effective permissions
- * @param basePermissions - Base permissions from permission sets
- * @param overridePermissions - Override permissions from permission user
- * @returns - Combined effective permissions
- */
-export declare function getEffectivePermissions(basePermissions: FdoPermissionRule[], overridePermissions: FdoPermissionRule[]): FdoPermissionRule[];
-/**
- * Compute the initial permissions for the permission editor.
- *
- * Like `getEffectivePermissions`, but also preserves "orphaned" inverted rules — denials whose
- * subject is NOT present in any base permission set (i.e. they target system-expanded subjects,
- * not permission-set-inherited subjects). These denials seed `visitedSetIds` in
- * `expandWithSystemPermissionSets` to block runtime re-expansion of system sets that the user
- * explicitly unchecked. Without them the editor would initialize without the denial guard and
- * those subjects would reappear as checked the next time the form opens.
- *
- * Inverted rules whose subject IS in base are handled correctly by `getEffectivePermissions`
- * already (they cancel the inherited grant) and do not need special treatment here.
- */
-export declare function getEditorPermissions(basePermissions: FdoPermissionRule[], customPermissions: FdoPermissionRule[]): FdoPermissionRule[];

package/dist/src/helpers/pos-assignment-rows.d.ts

@@ -0,0 +1,28 @@
+import type { HrmRestaurant } from '@/types/restaurant';
+import type { Role } from '@/types/role';
+import type { IFdtoPermissionPosUserRole } from '@/types/team';
+/** One row of the POS access card: the outlets that share a POS role. */
+export interface PosAssignmentRow {
+    restaurantIds: string[];
+    roleId: string;
+}
+export interface SelectOption {
+    label: string;
+    value: string;
+    disabled: boolean;
+}
+/** Groups a POS user's per-outlet roles into rows by role, in first-seen order. */
+export declare function toRows(roles: IFdtoPermissionPosUserRole[]): PosAssignmentRow[];
+/** The per-outlet roles a POS user stores. A row without outlets adds nothing. */
+export declare function toRoles(rows: PosAssignmentRow[]): IFdtoPermissionPosUserRole[];
+export declare function sameRoles(a: IFdtoPermissionPosUserRole[], b: IFdtoPermissionPosUserRole[]): boolean;
+export declare function restaurantLabel(restaurant: HrmRestaurant): string;
+/** The row's outlets as one line for its select field, in the order the list shows them. */
+export declare function rowRestaurantSummary(restaurants: HrmRestaurant[], row: PosAssignmentRow): string;
+/** Outlets for a row; one already in another row can't be picked twice. */
+export declare function rowRestaurantOptions(restaurants: HrmRestaurant[], rows: PosAssignmentRow[], index: number): SelectOption[];
+/** Roles that exist at every outlet of the row; unusable ones stay visible but disabled. */
+export declare function rowRoleOptions(roles: Role[], row: PosAssignmentRow, isRoleUsable: (role: Role) => boolean): SelectOption[];
+/** Keeps the row's role when it still applies to all its outlets, else the first usable one. */
+export declare function pickRowRole(roles: Role[], row: PosAssignmentRow, isRoleUsable: (role: Role) => boolean): string;
+export declare function canAddRow(restaurants: HrmRestaurant[], rows: PosAssignmentRow[]): boolean;

package/dist/src/helpers/rule.d.ts

@@ -1,5 +1,6 @@
 import type { RawRule } from '@casl/ability';
 import { F_RULE_SUBJECT, type FdoPermissionRule } from '@feedmepos/core/entity';
+import { getManagableRestaurantIds, usableRoleIds } from '@feedmepos/hrm-permission/utils';
 import type { Rule } from '../types/role';
 export declare function filterPermissions(permissions: FdoPermissionRule[], subject: F_RULE_SUBJECT, availablePermissions?: FdoPermissionRule[]): string;
 export declare function ruleExtension(rule: FdoPermissionRule): {
@@ -19,7 +20,7 @@ export declare function ruleExtension(rule: FdoPermissionRule): {
     actions: ("update" | "create" | "read" | "delete" | "manage")[];
 };
 export declare function getMaxDiscount(rules: FdoPermissionRule[]): number;
-export declare function getManagableRestaurantIds(rules: (FdoPermissionRule | RawRule)[]): string[] | null;
+export { getManagableRestaurantIds, usableRoleIds };
 export interface MasterUserAccess {
     /** null = every restaurant, [] = none */
     restaurantIds: string[] | null;
@@ -36,7 +37,6 @@ export declare function resolveMasterUserAccess(rules: (FdoPermissionRule | RawR
     isOwner: boolean;
 }): MasterUserAccess;
 export declare function hasAdminRule(rules: FdoPermissionRule[]): boolean;
-export declare function usableRoleIds(rules: (FdoPermissionRule | RawRule)[]): string[] | null;
 export declare function extractReportExtraCondition(rule: FdoPermissionRule): Record<string, unknown> | undefined;
 export declare function fromValue(values: string[], maxDiscountPercentage: number, periodConditions?: Map<string, Record<string, unknown>>): {
     subject: string;

package/dist/src/helpers/staff-invite.d.ts

@@ -0,0 +1,54 @@
+import type { RawRule } from '@casl/ability';
+import { type IFdtoCreateStaffInviteReq, type IFdtoCreateStaffInviteRes, type IFdtoStaffInvite, type IFdtoStaffInviteProvider, type IFdtoUpdateStaffInviteReq, type StaffInviteMatch, type StaffInviteWarning } from '@/types/staff-invite';
+import type { IFdtoSsoProvider } from '@/types/sso-provider';
+type Translate = (key: string, params?: Record<string, unknown>) => string;
+/**
+ * Same check the backend makes for POST /portal-users: create on hrm::portalUsers, which the
+ * Team member toggle (hrm_teamMember:manage) grants through its system permission set.
+ */
+export declare function canCreatePortalUsers(permissions: RawRule[]): boolean;
+/** The providers invites can go through: switched on, with a key to match people on. */
+export declare function invitableProviders(providers: IFdtoSsoProvider[]): IFdtoStaffInviteProvider[];
+export declare function canInviteStaff(providers: IFdtoStaffInviteProvider[], permissions: RawRule[]): boolean;
+/** E.164 form of a valid phone number, or null. */
+export declare function toE164(phone: string): string | null;
+/** False for an empty field, including the bare dial code FmPhoneNumber keeps in its model. */
+export declare function hasPhoneInput(phone: string): boolean;
+export declare function isValidEmail(email: string): boolean;
+export declare const DISPLAY_NAME_MAX_LENGTH = 100;
+export declare const EMPLOYEE_ID_MAX_LENGTH = 50;
+export declare function staffInviteKey(invite: IFdtoStaffInvite): string;
+/** What the Update member sheet edits besides the grant. */
+export interface InviteDetailsEdit {
+    displayName: string;
+    employeeId: string;
+    /** The contact that isn't the sign-in key; '' clears it. */
+    contact: string;
+}
+/**
+ * An invite edit from the Update member sheet. Without `details` the name, employee ID and
+ * contact stay as saved (the backend clears a contact that is left out, so it is resent).
+ */
+export declare function toInviteGrantUpdateReq(invite: IFdtoStaffInvite, grant: Pick<IFdtoCreateStaffInviteReq, 'permissions' | 'customPermissions' | 'permissionSetIds' | 'posUser'>, details?: InviteDetailsEdit): IFdtoUpdateStaffInviteReq;
+/** Provider label and key type, for copy that names the IdP or says "number"/"email". */
+export interface StaffInviteCopyContext {
+    label: string;
+    match: StaffInviteMatch;
+}
+/** One message per warning. A direct add has no invite, so its copy says so. */
+export declare function staffInviteWarningMessages(warnings: StaffInviteWarning[], ctx: StaffInviteCopyContext, t: Translate, result?: IFdtoCreateStaffInviteRes['result']): string[];
+export declare function staffInviteResultMessage(res: IFdtoCreateStaffInviteRes, ctx: StaffInviteCopyContext, t: Translate): {
+    title: string;
+    lines: string[];
+};
+/**
+ * The message of a rejected request. The portal's own client rejects with an `ApiError`;
+ * mf-common's `baseClientInstance` (used when no backend URL is configured) rejects with the
+ * plain message string.
+ */
+export declare function errorMessageOf(err: unknown): string;
+/** The invite was claimed, revoked or deleted elsewhere: the row is stale. */
+export declare function isStaleInviteError(err: unknown): boolean;
+/** Copy for a backend error code; any other message is shown as is. */
+export declare function staffInviteErrorMessage(err: unknown, ctx: StaffInviteCopyContext, t: Translate): string;
+export {};

package/dist/src/helpers/string.d.ts

@@ -1,6 +1,15 @@
 declare function randomString(length: number, config?: {
     includeSpecialCase: boolean;
 }): string;
+/**
+ * "A, B +2 more" for a selection; null means everything (the "include future" choice).
+ * Collapsed permission rows show it under their title.
+ */
+declare function summarizeNames(names: string[] | null, labels: {
+    all: string;
+    none: string;
+    more: (count: number) => string;
+}, shown?: number): string;
 declare const filter: {
     alphabetOnly(word: string): string;
     alphaNumeric(word: string): string;
@@ -10,4 +19,4 @@ declare const validate: {
     email(input: string): RegExpMatchArray | null;
 };
 declare function nameInitials(name: string | null | undefined): string;
-export { filter, validate, randomString, nameInitials };
+export { filter, validate, randomString, nameInitials, summarizeNames };

package/dist/src/router/menu-access-guard.d.ts

@@ -0,0 +1,17 @@
+import { type Component } from 'vue';
+/**
+ * Wraps a top-level route component so a user who can't open the current route lands on
+ * the first menu item they can open (D52). It lives in the route records, so it works in
+ * the standalone router and in the host portal that mounts `routes`.
+ *
+ * - Accessible: render the page.
+ * - Not accessible, access still loading: render nothing (no flash of the no-permission page).
+ * - Not accessible, some item accessible: replace with that item.
+ * - Nothing accessible: today's behaviour. A route with a permission manifest renders its
+ *   page, whose `withPermission` shows the no-permission screen; any other route (landing,
+ *   My POS Profile) goes to Employee, which does the same. Targets are always either
+ *   accessible or manifest-guarded, so this never loops.
+ */
+export declare function withMenuAccess(Comp?: Component): Component;
+/** `/`: shows nothing and sends the user to the first page they can open. */
+export declare const MenuLanding: Component;

package/dist/src/router/shared.d.ts

@@ -8,12 +8,14 @@ export declare enum RouteName {
     TEAM = "team",
     TEAM_MEMBER = "team-member",
     TEAM_ROLE = "team-role",
+    TEAM_INVITE = "team-invite",
     POS_ACCESS = "pos-access",
     POS_GRANT = "pos-grant",
     APPROVAL_CODE = "approval-code",
     SCHEDULE = "schedule",
     SCHEDULE_POSITION = "schedule-position",
-    SCHEDULE_GENERAL = "schedule-general"
+    SCHEDULE_GENERAL = "schedule-general",
+    MY_POS_PROFILE = "my-pos-profile"
 }
 declare const routes: RouteRecordRaw[];
 export { routes };

package/dist/src/stores/approval-code.d.ts

@@ -1,5 +1,5 @@
 import type { IFdtoApprovalCode, IFdtoCreateApprovalCodeReq } from '@/types/approval-code';
-export declare const useApprovalCodeStore: import("pinia").StoreDefinition<"approvalCode", Pick<{
+export declare const useApprovalCodeStore: import("pinia").StoreDefinition<"hrm-approval-code", Pick<{
     approvalCodes: import("vue").Ref<{
         _id: string;
         businessId: string;

package/dist/src/stores/employee.d.ts

@@ -374,7 +374,6 @@ export declare const useEmployeeStore: () => {
         })[]>;
         totalEmployees: import("vue").Ref<number, number>;
         isLoading: import("vue").Ref<boolean, boolean>;
-        readEmployees: () => Promise<void>;
         readEmployeesPage: (query: IReadEmployeesPageReq) => Promise<void>;
         readAllEmployeesPage: (query: Omit<IReadEmployeesPageReq, "limit" | "offset">, knownTotal?: number) => Promise<Employee[]>;
         createEmployee: (dto: FdtoUpdatePosUserReq) => Promise<string>;
@@ -692,7 +691,6 @@ export declare const useEmployeeStore: () => {
         })[]>;
         totalEmployees: import("vue").Ref<number, number>;
         isLoading: import("vue").Ref<boolean, boolean>;
-        readEmployees: () => Promise<void>;
         readEmployeesPage: (query: IReadEmployeesPageReq) => Promise<void>;
         readAllEmployeesPage: (query: Omit<IReadEmployeesPageReq, "limit" | "offset">, knownTotal?: number) => Promise<Employee[]>;
         createEmployee: (dto: FdtoUpdatePosUserReq) => Promise<string>;
@@ -706,7 +704,7 @@ export declare const useEmployeeStore: () => {
     }, "isLoading" | "employees" | "listEmployees" | "totalEmployees">>, options?: {
         detached?: boolean;
     } & import("vue").WatchOptions): () => void;
-    $onAction(callback: import("pinia").StoreOnActionListener<"employee", Pick<{
+    $onAction(callback: import("pinia").StoreOnActionListener<"hrm-employee", Pick<{
         employees: import("vue").Ref<({
             faceId?: unknown;
             name: string;
@@ -855,7 +853,6 @@ export declare const useEmployeeStore: () => {
         })[]>;
         totalEmployees: import("vue").Ref<number, number>;
         isLoading: import("vue").Ref<boolean, boolean>;
-        readEmployees: () => Promise<void>;
         readEmployeesPage: (query: IReadEmployeesPageReq) => Promise<void>;
         readAllEmployeesPage: (query: Omit<IReadEmployeesPageReq, "limit" | "offset">, knownTotal?: number) => Promise<Employee[]>;
         createEmployee: (dto: FdtoUpdatePosUserReq) => Promise<string>;
@@ -1015,7 +1012,6 @@ export declare const useEmployeeStore: () => {
         })[]>;
         totalEmployees: import("vue").Ref<number, number>;
         isLoading: import("vue").Ref<boolean, boolean>;
-        readEmployees: () => Promise<void>;
         readEmployeesPage: (query: IReadEmployeesPageReq) => Promise<void>;
         readAllEmployeesPage: (query: Omit<IReadEmployeesPageReq, "limit" | "offset">, knownTotal?: number) => Promise<Employee[]>;
         createEmployee: (dto: FdtoUpdatePosUserReq) => Promise<string>;
@@ -1175,7 +1171,6 @@ export declare const useEmployeeStore: () => {
         })[]>;
         totalEmployees: import("vue").Ref<number, number>;
         isLoading: import("vue").Ref<boolean, boolean>;
-        readEmployees: () => Promise<void>;
         readEmployeesPage: (query: IReadEmployeesPageReq) => Promise<void>;
         readAllEmployeesPage: (query: Omit<IReadEmployeesPageReq, "limit" | "offset">, knownTotal?: number) => Promise<Employee[]>;
         createEmployee: (dto: FdtoUpdatePosUserReq) => Promise<string>;
@@ -1186,11 +1181,10 @@ export declare const useEmployeeStore: () => {
         deleteMasterEmployee: (employee: Employee) => Promise<void>;
         migrateToMasterUser: (userId: string, dto: FdtoUpdatePosMasterUserReq) => Promise<void>;
         syncUsersMeta: () => Promise<void>;
-    }, "readEmployees" | "readEmployeesPage" | "readAllEmployeesPage" | "createEmployee" | "updateEmployee" | "deleteEmployee" | "createMasterEmployee" | "updateMasterEmployee" | "deleteMasterEmployee" | "migrateToMasterUser" | "syncUsersMeta">>, detached?: boolean): () => void;
+    }, "readEmployeesPage" | "readAllEmployeesPage" | "createEmployee" | "updateEmployee" | "deleteEmployee" | "createMasterEmployee" | "updateMasterEmployee" | "deleteMasterEmployee" | "migrateToMasterUser" | "syncUsersMeta">>, detached?: boolean): () => void;
     $dispose(): void;
-    $id: "employee";
+    $id: "hrm-employee";
     _customProperties: Set<string>;
-    readEmployees: () => Promise<void>;
     readEmployeesPage: (query: IReadEmployeesPageReq) => Promise<void>;
     readAllEmployeesPage: (query: Omit<IReadEmployeesPageReq, "limit" | "offset">, knownTotal?: number) => Promise<Employee[]>;
     createEmployee: (dto: FdtoUpdatePosUserReq) => Promise<string>;