@infuro/cms-core 1.0.33 → 1.0.35

package/dist/chunk-46GKADYE.cjs

@@ -0,0 +1,84 @@
+'use strict';
+
+var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
+
+// src/plugins/email/templates/layout.ts
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+chunkUSNT2KNT_cjs.__name(escapeHtml, "escapeHtml");
+function socialLinkInnerHtml(s) {
+  if (s.iconUrl?.trim()) {
+    return `<img src="${escapeHtml(s.iconUrl.trim())}" alt="" width="20" height="20" style="display:inline-block;vertical-align:middle;border:0;" />`;
+  }
+  const label = s.icon && s.icon.trim() || "\u{1F517}";
+  return escapeHtml(label);
+}
+chunkUSNT2KNT_cjs.__name(socialLinkInnerHtml, "socialLinkInnerHtml");
+function supportLinesHtml(supportEmail, supportPhone, opts) {
+  const parts = [];
+  const top = opts?.tightTop ? "margin-top:0;" : "margin-top:4px;";
+  if (supportEmail) {
+    parts.push(`<div style="font-size:13px;color:#444;${top}">&#128231; ${escapeHtml(supportEmail)}</div>`);
+  }
+  if (supportPhone) {
+    parts.push(`<div style="font-size:13px;color:#444;margin-top:2px;">&#128222; ${escapeHtml(supportPhone)}</div>`);
+  }
+  return parts.join("");
+}
+chunkUSNT2KNT_cjs.__name(supportLinesHtml, "supportLinesHtml");
+function renderLayout(options) {
+  const { bodyHtml, companyDetails } = options;
+  const { logoUrl, companyName, supportEmail, supportPhone, socialLinks, footerDisclaimer, followUsTitle = "Follow Us" } = companyDetails;
+  const supportFooterHtml = supportLinesHtml(supportEmail, supportPhone, {
+    tightTop: true
+  });
+  const hasSocial = Boolean(socialLinks?.length);
+  const brandFooterInner = [];
+  if (logoUrl) {
+    brandFooterInner.push(`<img src="${escapeHtml(logoUrl)}" alt="" style="max-height:28px;max-width:160px;height:auto;width:auto;display:inline-block;vertical-align:middle;margin-right:10px;border:0;" />`);
+  }
+  if (companyName) {
+    brandFooterInner.push(`<span style="font-size:14px;font-weight:600;color:#111;vertical-align:middle;">${escapeHtml(companyName)}</span>`);
+  }
+  const brandFooterHtml = brandFooterInner.length ? `<div style="line-height:1.4;">${brandFooterInner.join("")}</div>` : "";
+  const followTitleHtml = hasSocial && followUsTitle ? `<div class="footer-follow-title" style="font-size:13px;font-weight:600;color:#555;margin:0;">${escapeHtml(followUsTitle)}</div>` : "";
+  const socialRowHtml = hasSocial && socialLinks ? `<div class="footer-social-icons" style="margin-top:6px;text-align:left;font-size:0;line-height:0;">${socialLinks.map((s) => `<a href="${escapeHtml(s.url)}" style="display:inline-block;margin-right:12px;text-decoration:none;color:#333;font-size:18px;line-height:1;vertical-align:middle;">${socialLinkInnerHtml(s)}</a>`).join("")}</div>` : "";
+  const rowSupport = supportFooterHtml ? `<tr><td class="footer-support-cell" colspan="2" valign="top" style="padding:0 0 10px 0;">${supportFooterHtml}</td></tr>` : "";
+  let footerBlock = "";
+  if (brandFooterHtml || followTitleHtml || socialRowHtml || footerDisclaimer || rowSupport) {
+    const rowBrand = brandFooterHtml ? `<tr><td class="footer-brand-cell" colspan="2" valign="top" style="padding:0 0 10px 0;">${brandFooterHtml}</td></tr>` : "";
+    const rowFollowTitle = followTitleHtml ? `<tr><td class="footer-follow-cell" colspan="2" valign="top" style="padding:14px 0 0 0;text-align:left;">${followTitleHtml}</td></tr>` : "";
+    const rowSocial = socialRowHtml ? `<tr><td class="footer-social-cell" colspan="2" style="padding:0;text-align:left;">${socialRowHtml}</td></tr>` : "";
+    footerBlock = `<table role="presentation" class="footer-main" width="100%" cellpadding="0" cellspacing="0" style="margin-top:28px;padding-top:16px;">${rowBrand}${rowSupport}${rowFollowTitle}${rowSocial}</table>`;
+  }
+  const disclaimerBlock = footerDisclaimer ? `<div style="margin-top:20px;padding-top:12px;font-size:11px;line-height:1.5;color:#888;">${escapeHtml(footerDisclaimer).replace(/\n/g, "<br/>")}</div>` : "";
+  const responsiveCss = `
+@media only screen and (max-width: 600px) {
+  .email-wrap { padding-left: 12px !important; padding-right: 12px !important; }
+  .footer-follow-cell { padding-top: 12px !important; }
+}
+`;
+  return `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<style type="text/css">${responsiveCss}</style>
+</head>
+<body style="margin:0;padding:0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;font-size:14px;line-height:1.5;color:#333;background:#fff;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#fff;">
+    <tr><td class="email-wrap" style="padding:16px;">
+          <div>
+            ${bodyHtml}
+          </div>
+          ${footerBlock}
+          ${disclaimerBlock}
+    </td></tr>
+  </table>
+</body>
+</html>`;
+}
+chunkUSNT2KNT_cjs.__name(renderLayout, "renderLayout");
+
+exports.renderLayout = renderLayout;

package/dist/chunk-4TRPKBKO.js

@@ -0,0 +1,589 @@
+import { __name } from './chunk-SHUYVCID.js';
+
+// src/auth/permission-entities.ts
+var PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
+  "users",
+  "password_reset_tokens",
+  "user_groups",
+  "permissions",
+  "comments",
+  "form_fields",
+  "configs",
+  "knowledge_base_chunks",
+  "carts",
+  "cart_items",
+  "wishlists",
+  "wishlist_items",
+  "message_templates",
+  "vendor_users",
+  "vendor_roles",
+  "vendor_role_permissions"
+]);
+var PERMISSION_LOGICAL_ENTITIES = [
+  "users",
+  "forms",
+  "form_submissions",
+  "dashboard",
+  "upload",
+  "settings",
+  "analytics",
+  "chat"
+];
+var ADMIN_GROUP_NAME = "Administrator";
+function isSuperAdminGroupName(name) {
+  return name === ADMIN_GROUP_NAME;
+}
+__name(isSuperAdminGroupName, "isSuperAdminGroupName");
+function getPermissionableEntityKeys(entityMap) {
+  const fromMap = Object.keys(entityMap).filter((k) => !PERMISSION_ENTITY_INTERNAL_EXCLUDE.has(k));
+  const logical = PERMISSION_LOGICAL_ENTITIES.filter((k) => !fromMap.includes(k));
+  return [
+    ...fromMap.sort(),
+    ...logical
+  ].filter((k, i, a) => a.indexOf(k) === i);
+}
+__name(getPermissionableEntityKeys, "getPermissionableEntityKeys");
+function permissionRowsToRecord(rows) {
+  const out = {};
+  if (!rows?.length) return out;
+  for (const p of rows) {
+    out[p.entity] = {
+      c: !!p.canCreate,
+      r: !!p.canRead,
+      u: !!p.canUpdate,
+      d: !!p.canDelete
+    };
+  }
+  return out;
+}
+__name(permissionRowsToRecord, "permissionRowsToRecord");
+function hasEntityPermission(record, entity, action) {
+  const p = record?.[entity];
+  if (!p) return false;
+  if (action === "create") return p.c;
+  if (action === "read") return p.r;
+  if (action === "update") return p.u;
+  return p.d;
+}
+__name(hasEntityPermission, "hasEntityPermission");
+
+// src/auth/vendor-scope.ts
+var VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
+  "products",
+  "collections",
+  "brands",
+  "product_categories",
+  "orders",
+  "payments",
+  "taxes",
+  "attributes",
+  "vendor_customers",
+  "discounts",
+  "events",
+  "refund_policies"
+]);
+var VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
+  ...VENDOR_SCOPED_STORE_ENTITIES,
+  "order_discounts",
+  "order_addresses",
+  "event_products"
+]);
+var VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+function isVendorGroupName(name) {
+  if (!name?.trim()) return false;
+  const n = name.trim().toLowerCase();
+  return n === VENDOR_OWNER_GROUP_NAME.toLowerCase() || n.includes("vendor");
+}
+__name(isVendorGroupName, "isVendorGroupName");
+function isPlatformAdministrator(user) {
+  if (!user?.email) return false;
+  return isSuperAdmin(user);
+}
+__name(isPlatformAdministrator, "isPlatformAdministrator");
+function isVendorPortalUser(user) {
+  if (user?.isVendorPortal === true) return true;
+  if (!user?.email || isPlatformAdministrator(user)) return false;
+  if (isVendorAdmin(user)) return true;
+  return isVendorGroupName(user.groupName);
+}
+__name(isVendorPortalUser, "isVendorPortalUser");
+function isVendorStaff(user) {
+  return isVendorPortalUser(user);
+}
+__name(isVendorStaff, "isVendorStaff");
+function isVendorOwner(user) {
+  if (user?.isVendorOwner === true) return true;
+  if (!user?.email || isPlatformAdministrator(user)) return false;
+  if (user.isVendorRoleOwner === true) return true;
+  if (user.vendorRole === "staff") return false;
+  if (user.vendorRole === "owner") return true;
+  if (!isVendorPortalUser(user)) return false;
+  return user.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase();
+}
+__name(isVendorOwner, "isVendorOwner");
+function canManageVendorTeam(user) {
+  return isPlatformAdministrator(user) || isVendorOwner(user);
+}
+__name(canManageVendorTeam, "canManageVendorTeam");
+function canManageVendorRoles(user) {
+  return isPlatformAdministrator(user) || isVendorOwner(user);
+}
+__name(canManageVendorRoles, "canManageVendorRoles");
+function canOnboardVendors(user) {
+  return isPlatformAdministrator(user);
+}
+__name(canOnboardVendors, "canOnboardVendors");
+function resolveVendorScopeFromSessionUser(user) {
+  if (!user?.email) return {
+    type: "deny"
+  };
+  if (isPlatformAdministrator(user)) return {
+    type: "all"
+  };
+  const vendorIds = user.vendorIds ?? [];
+  if (vendorIds.length === 0) return {
+    type: "deny"
+  };
+  const preferred = user.activeVendorId ?? vendorIds[0];
+  const vendorId = vendorIds.includes(preferred) ? preferred : vendorIds[0];
+  return {
+    type: "vendor",
+    vendorId,
+    vendorIds
+  };
+}
+__name(resolveVendorScopeFromSessionUser, "resolveVendorScopeFromSessionUser");
+function vendorPortalFlagsFromUser(input) {
+  const vendorIds = input.vendorIds ?? [];
+  const isVendorPortal = !input.isRBACAdmin && (vendorIds.length > 0 || isVendorGroupName(input.groupName));
+  const isVendorOwner2 = isVendorPortal && (input.isVendorRoleOwner === true || input.vendorRole !== "staff" && (input.vendorRole === "owner" || input.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase()));
+  return {
+    isVendorPortal,
+    isVendorOwner: isVendorOwner2
+  };
+}
+__name(vendorPortalFlagsFromUser, "vendorPortalFlagsFromUser");
+
+// src/auth/role-helpers.ts
+var SUPER_ADMIN_GROUP_ID = 1;
+var VENDOR_ADMIN_GROUP_ID = 5;
+function isSuperAdmin(user) {
+  if (!user) return false;
+  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
+  if (user.isRBACAdmin === true) return true;
+  return isSuperAdminGroupName(user.groupName);
+}
+__name(isSuperAdmin, "isSuperAdmin");
+function isVendorAdmin(user) {
+  if (!user?.email || isSuperAdmin(user)) return false;
+  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
+  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  return isVendorGroupName(user.groupName);
+}
+__name(isVendorAdmin, "isVendorAdmin");
+
+// src/lib/vendor-role-defaults.ts
+var VENDOR_RBAC_ENTITIES = [
+  ...VENDOR_STORE_RBAC_ENTITIES,
+  "dashboard",
+  "settings",
+  "team",
+  "roles"
+];
+var STORE_ENTITIES = [
+  ...VENDOR_STORE_RBAC_ENTITIES
+];
+function full() {
+  return {
+    canCreate: true,
+    canRead: true,
+    canUpdate: true,
+    canDelete: true
+  };
+}
+__name(full, "full");
+function read() {
+  return {
+    canCreate: false,
+    canRead: true,
+    canUpdate: false,
+    canDelete: false
+  };
+}
+__name(read, "read");
+function none() {
+  return {
+    canCreate: false,
+    canRead: false,
+    canUpdate: false,
+    canDelete: false
+  };
+}
+__name(none, "none");
+function readUpdate() {
+  return {
+    canCreate: false,
+    canRead: true,
+    canUpdate: true,
+    canDelete: false
+  };
+}
+__name(readUpdate, "readUpdate");
+function storePerms(spec) {
+  const resolve = /* @__PURE__ */ __name((v) => {
+    if (v === "full") return full();
+    if (v === "read") return read();
+    if (v === "none") return none();
+    return v;
+  }, "resolve");
+  const out = {};
+  for (const entity of STORE_ENTITIES) {
+    out[entity] = resolve(spec[entity] ?? "none");
+  }
+  return out;
+}
+__name(storePerms, "storePerms");
+var DEFAULT_VENDOR_ROLE_DEFS = [
+  {
+    name: "Owner",
+    description: "Full store access and team/role management",
+    isSystem: true,
+    isOwnerRole: true,
+    permissions: {
+      ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
+        e,
+        "full"
+      ]))),
+      dashboard: read(),
+      settings: readUpdate(),
+      team: full(),
+      roles: full()
+    }
+  },
+  {
+    name: "Manager",
+    description: "Day-to-day store operations",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms({
+        products: "full",
+        collections: "full",
+        brands: "full",
+        product_categories: "full",
+        orders: "full",
+        vendor_customers: "full",
+        discounts: "full",
+        order_discounts: "full",
+        order_addresses: "full",
+        payments: "read",
+        taxes: "read",
+        attributes: "read"
+      }),
+      dashboard: read(),
+      settings: read(),
+      team: none(),
+      roles: none()
+    }
+  },
+  {
+    name: "Catalog Staff",
+    description: "Manage products and catalog content",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms({
+        products: "full",
+        collections: "full",
+        brands: "full",
+        product_categories: "full",
+        attributes: "full",
+        orders: "read",
+        vendor_customers: "read"
+      }),
+      dashboard: read(),
+      settings: none(),
+      team: none(),
+      roles: none()
+    }
+  },
+  {
+    name: "Fulfillment",
+    description: "Orders and fulfillment",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms({
+        products: "read",
+        orders: "full",
+        order_addresses: "full",
+        order_discounts: "read",
+        vendor_customers: "read"
+      }),
+      dashboard: read(),
+      settings: none(),
+      team: none(),
+      roles: none()
+    }
+  },
+  {
+    name: "Viewer",
+    description: "Read-only access to store data",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
+        e,
+        "read"
+      ]))),
+      dashboard: read(),
+      settings: none(),
+      team: none(),
+      roles: none()
+    }
+  }
+];
+var VENDOR_VIEWER_ROLE_NAME = "Viewer";
+
+// src/auth/rbac-debug.ts
+var LOG_PREFIX = "[cms-rbac]";
+function isRbacDebugEnabled() {
+  const v = process.env.CMS_RBAC_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+__name(isRbacDebugEnabled, "isRbacDebugEnabled");
+function logRbac(message, data) {
+  if (!isRbacDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX, message, data);
+  else console.info(LOG_PREFIX, message);
+}
+__name(logRbac, "logRbac");
+function summarizeEntityPerms(entityPerms) {
+  const out = {};
+  if (!entityPerms) return out;
+  for (const [entity, p] of Object.entries(entityPerms)) {
+    out[entity] = {
+      c: p.c,
+      r: p.r,
+      u: p.u,
+      d: p.d
+    };
+  }
+  return out;
+}
+__name(summarizeEntityPerms, "summarizeEntityPerms");
+function vendorPortalFallbackReason(user, entity, action) {
+  if (!isVendorPortalUser(user)) return null;
+  if (entity === "dashboard" && action === "read") return "vendor_portal_dashboard_fallback";
+  if (entity === "analytics" && action === "read") return "vendor_portal_analytics_fallback";
+  if (entity === "settings" && action === "read") return "vendor_portal_settings_read_fallback";
+  if (VENDOR_STORE_RBAC_ENTITIES.has(entity) && action === "read") return "vendor_portal_store_read_fallback";
+  return null;
+}
+__name(vendorPortalFallbackReason, "vendorPortalFallbackReason");
+function explainSessionEntityAccess(user, entity, action) {
+  const userSnapshot = {
+    email: user?.email ?? null,
+    id: user?.id ?? null,
+    groupId: user?.groupId ?? null,
+    groupName: user?.groupName ?? null,
+    isRBACAdmin: user?.isRBACAdmin ?? false,
+    adminAccess: user?.adminAccess ?? null,
+    vendorIds: user?.vendorIds ?? [],
+    activeVendorId: user?.activeVendorId ?? null,
+    vendorRole: user?.vendorRole ?? null,
+    vendorRoleId: user?.vendorRoleId ?? null,
+    vendorRoleName: user?.vendorRoleName ?? null,
+    isVendorRoleOwner: user?.isVendorRoleOwner ?? false,
+    vendorEntityPerms: summarizeEntityPerms(user?.vendorEntityPerms),
+    isVendorPortal: user?.isVendorPortal ?? false,
+    isVendorOwner: user?.isVendorOwner ?? false,
+    isVendorPortalComputed: isVendorPortalUser(user),
+    isVendorOwnerComputed: isVendorOwner(user),
+    jwtEntityPerms: summarizeEntityPerms(user?.entityPerms),
+    jwtEntityPermForTarget: user?.entityPerms?.[entity] ?? null
+  };
+  if (!user?.email) {
+    return {
+      allowed: false,
+      reason: "no_session_email",
+      userSnapshot
+    };
+  }
+  if (user.isRBACAdmin) {
+    return {
+      allowed: true,
+      reason: "platform_administrator",
+      userSnapshot
+    };
+  }
+  const vendorIds = user.vendorIds ?? [];
+  const isStaff = user.vendorRole === "staff";
+  const vendorPerms = user.vendorEntityPerms;
+  const hasVendorRolePerms = vendorPerms != null && Object.keys(vendorPerms).length > 0;
+  if (vendorIds.length > 0 && hasVendorRolePerms) {
+    const vendorRbacSet = new Set(VENDOR_RBAC_ENTITIES);
+    if (vendorRbacSet.has(entity) || entity === "analytics") {
+      if (entity === "analytics" && action === "read") {
+        const allowed3 = hasEntityPermission(vendorPerms, "dashboard", "read");
+        return {
+          allowed: allowed3,
+          reason: allowed3 ? "vendor_role_analytics_via_dashboard" : "vendor_role_analytics_denied",
+          userSnapshot
+        };
+      }
+      if (user.isVendorRoleOwner === true) {
+        return {
+          allowed: true,
+          reason: "vendor_owner_role_full",
+          userSnapshot
+        };
+      }
+      const allowed2 = hasEntityPermission(vendorPerms, entity, action);
+      return {
+        allowed: allowed2,
+        reason: allowed2 ? "vendor_role_permissions_allow" : "vendor_role_permissions_deny",
+        userSnapshot
+      };
+    }
+  }
+  if (vendorIds.length > 0) {
+    if (entity === "dashboard" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_link_dashboard_read",
+        userSnapshot
+      };
+    }
+    if (entity === "analytics" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_link_analytics_read",
+        userSnapshot
+      };
+    }
+    if (entity === "settings") {
+      if (action === "read") {
+        return {
+          allowed: true,
+          reason: "vendor_link_settings_read",
+          userSnapshot
+        };
+      }
+      if (action === "update" && !isStaff) {
+        return {
+          allowed: true,
+          reason: "vendor_link_settings_update",
+          userSnapshot
+        };
+      }
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      if (isStaff && action === "read") {
+        return {
+          allowed: true,
+          reason: "vendor_staff_store_read",
+          userSnapshot
+        };
+      }
+      if (!isStaff) {
+        return {
+          allowed: true,
+          reason: "vendor_link_store_full",
+          userSnapshot
+        };
+      }
+      return {
+        allowed: false,
+        reason: "vendor_staff_store_write_denied",
+        userSnapshot
+      };
+    }
+  }
+  if (isVendorPortalUser(user) && isVendorOwner(user)) {
+    if (entity === "dashboard" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_dashboard",
+        userSnapshot
+      };
+    }
+    if (entity === "analytics" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_analytics",
+        userSnapshot
+      };
+    }
+    if (entity === "settings" && (action === "read" || action === "update")) {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_settings",
+        userSnapshot
+      };
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_store",
+        userSnapshot
+      };
+    }
+  }
+  const vendorPortalReason = vendorPortalFallbackReason(user, entity, action);
+  if (vendorPortalReason) {
+    return {
+      allowed: true,
+      reason: vendorPortalReason,
+      userSnapshot
+    };
+  }
+  const explicit = user.entityPerms?.[entity];
+  if (explicit !== void 0) {
+    const allowed2 = hasEntityPermission(user.entityPerms, entity, action);
+    return {
+      allowed: allowed2,
+      reason: allowed2 ? "jwt_entity_perms_allow" : "jwt_entity_perms_deny",
+      userSnapshot
+    };
+  }
+  const allowed = hasEntityPermission(user.entityPerms, entity, action);
+  return {
+    allowed,
+    reason: allowed ? "entity_perms_fallback_allow" : "no_matching_rule",
+    userSnapshot
+  };
+}
+__name(explainSessionEntityAccess, "explainSessionEntityAccess");
+async function logEntityAccessDecision(dataSource, context, user, entity, action, extra) {
+  if (!isRbacDebugEnabled()) return;
+  const explanation = explainSessionEntityAccess(user, entity, action);
+  let dbPermissions;
+  if (dataSource && user?.id) {
+    const id = Number(user.id);
+    if (Number.isFinite(id)) {
+      try {
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-MTCTVNNM.js');
+        dbPermissions = await loadDbPermissionsForUser(dataSource, id);
+      } catch (e) {
+        dbPermissions = {
+          error: e instanceof Error ? e.message : String(e)
+        };
+      }
+    }
+  }
+  logRbac(context, {
+    entity,
+    action,
+    allowed: explanation.allowed,
+    reason: explanation.reason,
+    ...explanation.userSnapshot,
+    dbPermissions,
+    ...extra
+  });
+}
+__name(logEntityAccessDecision, "logEntityAccessDecision");
+
+export { ADMIN_GROUP_NAME, DEFAULT_VENDOR_ROLE_DEFS, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_RBAC_ENTITIES, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser };