@the-portland-company/shell 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.8.0 — 2026-07-02
+
+### Added (backward-compatible)
+
+- **Host-driven auth for non-Supabase apps**: `ShellProviderProps.supabaseClient` is now optional, and a new optional `auth: ShellInjectedAuth` prop (`{ status, user, signOut }`, exported type) takes precedence over Supabase session tracking. This lets OIDC apps (e.g. the standalone Contacts app) mount the full Chakra chrome — `ShellProvider` → `ShellChrome` → `AppLayout` — with their own identity feeding `useShellAuth`/`UserMenu`. The host builds a Supabase-shaped `user.raw` (`id`/`email`/`user_metadata.full_name`) so chrome components render identically. With neither prop, auth resolves to `unauthenticated`. Existing `supabaseClient` consumers are unaffected.
+
+### Tests
+
+- Injected auth: precedence over Supabase (no `getSession`/`onAuthStateChange`/`auth.signOut` calls), client-less mounting, neither-prop fallback (3 tests).
+
+## 0.7.0 — 2026-07-01
+
+### Added (native chrome — all backward-compatible)
+
+- **Expandable nav groups**: `NavItem` gains optional `children?: NavItem[]`. A parent with children renders as an accordion group header — clicking toggles (never navigates, even with `href`; the href only feeds active detection), a right-aligned chevron rotates 180° when open, the sidebar keeps a single group open at a time, and the group containing the active route auto-expands on route change. Sub-items render as smaller nav rows on a lighter panel through the same injected `LinkComponent` (with `onClick` button support), with the main app's exact treatments: parent solid race-red when itself-or-a-child is active, active sub-item on elevated panel with race-red text, inactive rows keep the orange→red hover gradient sweep. Flat menus are byte-identical to before.
+- **`standardPolitogyNav`** (new export, with `StandardNavOptions` / `StandardNavIconKey`): the canonical Politogy VRM menu — Dashboard, Contacts, Email Broadcast, SMS/MMS Blast, Calls to Action, Forms & Surveys, Support — encoded once in the shell with core-relative routes absolutized against `coreBaseUrl`. Apps map icon slots to their own icon library, and an app that owns an item nests its local pages via `contactsItem: { href, children }` (used verbatim, not absolutized) while everything else links out to VRM core. `supportItem` supplies the Support handler (`onClick`/`href`) or omits the row.
+
+### Tests
+
+- Group behavior: render-when-expanded, toggle, auto-expand on active child, single-open accordion (6 tests).
+- `standardPolitogyNav`: order/wording, absolutization, href-less CTA/Forms parents, default vs local Contacts children, Support variants, icon mapping (7 tests).
+
 ## 0.6.0 — 2026-07-01
 
 ### Added (native chrome — all backward-compatible)

package/dist/index.cjs

@@ -1126,6 +1126,7 @@ function toShellUser(session) {
 function ShellProvider({
   children,
   supabaseClient,
+  auth,
   currentApp,
   appRegistry,
   basename,
@@ -1139,6 +1140,11 @@ function ShellProvider({
   const [status, setStatus] = react$1.useState("loading");
   const [session, setSession] = react$1.useState(null);
   react$1.useEffect(() => {
+    if (auth || !supabaseClient) {
+      setSession(null);
+      if (!auth) setStatus("unauthenticated");
+      return;
+    }
     let cancelled = false;
     supabaseClient.auth.getSession().then(({ data }) => {
       if (cancelled) return;
@@ -1153,18 +1159,27 @@ function ShellProvider({
       cancelled = true;
       sub.data.subscription.unsubscribe();
     };
-  }, [supabaseClient]);
-  const value = react$1.useMemo(
-    () => ({
+  }, [supabaseClient, auth]);
+  const value = react$1.useMemo(() => {
+    if (auth) {
+      return {
+        status: auth.status,
+        session: null,
+        user: auth.user,
+        signOut: async () => {
+          await auth.signOut();
+        }
+      };
+    }
+    return {
       status,
       session,
       user: toShellUser(session),
       signOut: async () => {
-        await supabaseClient.auth.signOut();
+        await supabaseClient?.auth.signOut();
       }
-    }),
-    [status, session, supabaseClient]
-  );
+    };
+  }, [auth, status, session, supabaseClient]);
   const meta = react$1.useMemo(
     () => ({
       currentApp,