@infuro/cms-core 1.0.34 → 1.0.36

package/dist/auth.d.cts

@@ -1,71 +1,105 @@
-import { S as SessionUser, E as EntityCrudAction, b as EntityPermissionFlags } from './vendor-scope-DTYhJk_I.cjs';
-export { A as ADMIN_GROUP_NAME, a as AuthHelpers, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, V as VENDOR_OWNER_GROUP_NAME, c as VENDOR_SCOPED_STORE_ENTITIES, d as VENDOR_STORE_RBAC_ENTITIES, f as canManageRoles, g as canManageVendorRoles, h as canManageVendorTeam, i as canOnboardVendors, j as createAuthHelpers, k as createCmsAuthBundle, l as getPermissionableEntityKeys, m as getRequiredPermission, n as hasEntityPermission, o as isOpenEndpoint, p as isPlatformAdministrator, q as isPublicMethod, r as isSuperAdminGroupName, s as isVendorGroupName, t as isVendorOwner, u as isVendorPortalUser, v as isVendorStaff, w as permissionRowsToRecord, x as resolveVendorScopeFromSessionUser, y as sessionHasEntityAccess, z as vendorPortalFlagsFromUser } from './vendor-scope-DTYhJk_I.cjs';
 import { DataSource } from 'typeorm';
 import { getToken } from 'next-auth/jwt';
 import { NextAuthOptions } from 'next-auth';
 
+/** Canonical name for new installs / migrations */
+declare const ADMIN_GROUP_NAME = "Administrator";
+/** System administrator group (roles UI + users / user_groups / permissions bypass). */
+declare function isSuperAdminGroupName(name: string | null | undefined): boolean;
+type EntityCrudAction = 'create' | 'read' | 'update' | 'delete';
+type EntityPermissionFlags = {
+    c: boolean;
+    r: boolean;
+    u: boolean;
+    d: boolean;
+};
+declare function getPermissionableEntityKeys(entityMap: Record<string, unknown>): string[];
+declare function permissionRowsToRecord(rows: Array<{
+    entity: string;
+    canCreate: boolean;
+    canRead: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+}> | undefined): Record<string, EntityPermissionFlags>;
+declare function hasEntityPermission(record: Record<string, EntityPermissionFlags> | undefined, entity: string, action: EntityCrudAction): boolean;
+
 /**
- * Build NextAuth options for credentials auth. App can extend/override via extend().
+ * @deprecated Administrator bypass is now full entity access via `isRBACAdmin` in `sessionHasEntityAccess`.
+ * Kept for backwards-compatible imports.
  */
-
-interface NextAuthUser {
-    id: number;
-    email: string;
-    name: string | null;
-    password: string | null;
-    blocked?: boolean;
-    deleted?: boolean;
-    groupId?: number | null;
+declare const RBAC_ADMIN_ONLY_ENTITIES: Set<string>;
+interface SessionUser {
+    id?: string;
+    email?: string | null;
+    name?: string | null;
+    groupId?: number;
+    /** User group display name (from login). */
+    groupName?: string | null;
+    /** @deprecated use entityPerms / isRBACAdmin */
+    permissions?: string[];
+    /** Administrator group: bypasses entity-level RBAC on all resources */
+    isRBACAdmin?: boolean;
+    entityPerms?: Record<string, EntityPermissionFlags>;
+    /** When false and not isRBACAdmin, admin API/UI is denied. */
     adminAccess?: boolean;
-    group?: {
-        name?: string;
-        permissions?: Array<{
-            entity: string;
-            canCreate: boolean;
-            canRead: boolean;
-            canUpdate: boolean;
-            canDelete: boolean;
-        }>;
-    };
+    /** Vendor stores this user can access (from vendor_users). */
     vendorIds?: number[];
+    /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
+    /** Role for the active vendor link (`vendor_users.role`). */
     vendorRole?: 'owner' | 'staff' | null;
+    /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
+    vendorRoleId?: number | null;
+    vendorRoleName?: string | null;
+    /** True when active vendor role has `isOwnerRole`. */
+    isVendorRoleOwner?: boolean;
+    /** Permissions from active vendor role (`vendor_role_permissions`). */
+    vendorEntityPerms?: Record<string, EntityPermissionFlags>;
+    /** Set at login: vendor store portal (not platform admin). */
+    isVendorPortal?: boolean;
+    /** Set at login: vendor store owner (team + permissions). */
+    isVendorOwner?: boolean;
 }
-interface AuthorizeOtpInput {
-    identifier: string;
-    channel: 'email' | 'sms';
-    code: string;
+declare function sessionHasEntityAccess(user: SessionUser | null | undefined, entity: string, action: EntityCrudAction): boolean;
+declare function canManageRoles(user: SessionUser | null | undefined): boolean;
+type GetSession = () => Promise<{
+    user?: SessionUser;
+} | null>;
+declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
+declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
+declare function isOpenEndpoint(pathname: string): boolean;
+declare function getRequiredPermission(pathname: string): string[] | null;
+declare function isPublicMethod(pathname: string, method: string): boolean;
+interface AuthHelpers {
+    requireAuth(req: Request): Promise<Response | null>;
+    requirePermission(req: Request, permission: string): Promise<Response | null>;
+    requireEntityPermission(req: Request, entity: string, action: EntityCrudAction): Promise<Response | null>;
+    requireAdminAccess(req: Request): Promise<Response | null>;
+    getAuthenticatedUser(): Promise<SessionUser | null>;
 }
-interface NextAuthOptionsConfig {
-    /** Resolve user by email (e.g. from TypeORM). Return null if not found. */
-    getUserByEmail: (email: string) => Promise<NextAuthUser | null>;
-    comparePassword: (plain: string, hash: string) => Promise<boolean>;
-    signInPage?: string;
-    secret?: string;
-    extend?: (options: NextAuthOptions) => NextAuthOptions;
-    /** When false, password CredentialsProvider is omitted. Default true. */
-    enablePasswordLogin?: boolean;
-    /** When true, registers CredentialsProvider id `otp`. Requires authorizeOtp. Default false. */
-    enableOtpLogin?: boolean;
-    /** Validate OTP and return user (same shape as password flow) or null. */
-    authorizeOtp?: (input: AuthorizeOtpInput) => Promise<NextAuthUser | null>;
-    /**
-     * Customer group sign-in policy for credentials/OTP on a shared `/api/auth` route:
-     * - `true` — always allow (dedicated storefront auth)
-     * - `false` — always block
-     * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
-     */
-    allowCustomerLogin?: boolean;
-}
-declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
-/** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
-declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+declare function createAuthHelpers(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): AuthHelpers;
+/** Pass return value into `createCmsApiHandler` (includes `getSessionUser` for vendor store APIs). */
+declare function createCmsAuthBundle(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): {
+    requireAuth: (req: Request) => Promise<Response | null>;
+    requireAdminAccess: (req: Request) => Promise<Response | null>;
+    requireEntityPermission: (req: Request, entity: string, action: EntityCrudAction) => Promise<Response | null>;
+    getSessionUser: () => Promise<SessionUser | null>;
+    getAuthenticatedUser: () => Promise<SessionUser | null>;
+};
 
 /** Minimal DB handle for RBAC debug (avoids importing `typeorm` in the auth bundle). */
 type RbacDebugDataSource = {
     query: (sql: string, parameters?: unknown[]) => Promise<unknown>;
 };
-/** Set `CMS_RBAC_DEBUG=true` in `.env` to log permission decisions (server console). */
+/** Set `CMS_RBAC_DEBUG=true` in `.env` to log permission decisions (server console). Off by default. */
 declare function isRbacDebugEnabled(): boolean;
 declare function logRbac(message: string, data?: Record<string, unknown>): void;
 declare function summarizeEntityPerms(entityPerms: Record<string, EntityPermissionFlags> | undefined): Record<string, {
@@ -90,6 +124,49 @@ declare const VENDOR_ADMIN_GROUP_ID = 5;
 declare function isSuperAdmin(user: SessionUser | null | undefined): boolean;
 declare function isVendorAdmin(user: SessionUser | null | undefined): boolean;
 
+/** Entities with a `vendorId` column (store data). */
+declare const VENDOR_SCOPED_STORE_ENTITIES: Set<string>;
+/**
+ * Store admin RBAC for vendor portal users (read/create/update/delete fallbacks in rbac-debug).
+ * Includes entities without `vendorId` that are still part of the store admin UI.
+ */
+declare const VENDOR_STORE_RBAC_ENTITIES: Set<string>;
+type VendorScope = {
+    type: 'all';
+} | {
+    type: 'vendor';
+    vendorId: number;
+    vendorIds: number[];
+} | {
+    type: 'deny';
+};
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+/** User groups treated as vendor store staff (sidebar + scoped admin). */
+declare function isVendorGroupName(name: string | null | undefined): boolean;
+declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
+/** Vendor portal UI (store + store admin), not platform admin. */
+declare function isVendorPortalUser(user: SessionUser | null | undefined): boolean;
+declare function isVendorStaff(user: SessionUser | null | undefined): boolean;
+/** Vendor store owner (manages team + role permissions for their store). */
+declare function isVendorOwner(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorTeam(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorRoles(user: SessionUser | null | undefined): boolean;
+/** Platform admins (Administrator group) can onboard vendors. */
+declare function canOnboardVendors(user: SessionUser | null | undefined): boolean;
+declare function resolveVendorScopeFromSessionUser(user: SessionUser | null | undefined): VendorScope;
+/** Compute portal flags at login (persist on JWT). */
+declare function vendorPortalFlagsFromUser(input: {
+    email: string;
+    isRBACAdmin: boolean;
+    groupName?: string | null;
+    vendorIds?: number[];
+    vendorRole?: 'owner' | 'staff' | null;
+    isVendorRoleOwner?: boolean;
+}): {
+    isVendorPortal: boolean;
+    isVendorOwner: boolean;
+};
+
 /**
  * Ensures the Administrator group has full CRUD on every permissionable entity
  * for the given entity map. Idempotent: upserts per entity.
@@ -145,13 +222,79 @@ declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: Cm
     body: unknown;
 }>;
 
-/** Set `CMS_AUTH_DEBUG=false` to silence server auth logs in development. */
+/** Set `CMS_AUTH_DEBUG=true` to log server auth decisions. Off by default (including in development). */
 declare function isAuthDebugEnabled(): boolean;
-/** Browser console logs; set `NEXT_PUBLIC_CMS_AUTH_DEBUG=false` to silence. */
+/** Browser console logs; set `NEXT_PUBLIC_CMS_AUTH_DEBUG=true` to enable. */
 declare function isAuthDebugClientEnabled(): boolean;
 declare function logAuth(message: string, data?: Record<string, unknown>): void;
 declare function logAuthClient(message: string, data?: Record<string, unknown>): void;
 declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
 declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
-export { type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, EntityCrudAction, EntityPermissionFlags, type NextAuthOptionsConfig, type NextAuthUser, SUPER_ADMIN_GROUP_ID, SessionUser, VENDOR_ADMIN_GROUP_ID, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, isRbacDebugEnabled, isSuperAdmin, isVendorAdmin, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeEntityPerms, summarizeSessionUserForLog };
+/**
+ * Build NextAuth options for credentials auth. App can extend/override via extend().
+ */
+
+interface NextAuthUser {
+    id: number;
+    email: string;
+    name: string | null;
+    password: string | null;
+    blocked?: boolean;
+    deleted?: boolean;
+    groupId?: number | null;
+    adminAccess?: boolean;
+    group?: {
+        name?: string;
+        permissions?: Array<{
+            entity: string;
+            canCreate: boolean;
+            canRead: boolean;
+            canUpdate: boolean;
+            canDelete: boolean;
+        }>;
+    };
+    vendorIds?: number[];
+    activeVendorId?: number | null;
+    vendorRole?: 'owner' | 'staff' | null;
+    vendorRoleId?: number | null;
+    vendorRoleName?: string | null;
+    isVendorRoleOwner?: boolean;
+    vendorEntityPerms?: Record<string, {
+        c: boolean;
+        r: boolean;
+        u: boolean;
+        d: boolean;
+    }>;
+}
+interface AuthorizeOtpInput {
+    identifier: string;
+    channel: 'email' | 'sms';
+    code: string;
+}
+interface NextAuthOptionsConfig {
+    /** Resolve user by email (e.g. from TypeORM). Return null if not found. */
+    getUserByEmail: (email: string) => Promise<NextAuthUser | null>;
+    comparePassword: (plain: string, hash: string) => Promise<boolean>;
+    signInPage?: string;
+    secret?: string;
+    extend?: (options: NextAuthOptions) => NextAuthOptions;
+    /** When false, password CredentialsProvider is omitted. Default true. */
+    enablePasswordLogin?: boolean;
+    /** When true, registers CredentialsProvider id `otp`. Requires authorizeOtp. Default false. */
+    enableOtpLogin?: boolean;
+    /** Validate OTP and return user (same shape as password flow) or null. */
+    authorizeOtp?: (input: AuthorizeOtpInput) => Promise<NextAuthUser | null>;
+    /**
+     * Customer group sign-in policy for credentials/OTP on a shared `/api/auth` route:
+     * - `true` — always allow (dedicated storefront auth)
+     * - `false` — always block
+     * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
+     */
+    allowCustomerLogin?: boolean;
+}
+declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
+/** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
+declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+
+export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };

package/dist/auth.d.ts

@@ -1,71 +1,105 @@
-import { S as SessionUser, E as EntityCrudAction, b as EntityPermissionFlags } from './vendor-scope-DTYhJk_I.js';
-export { A as ADMIN_GROUP_NAME, a as AuthHelpers, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, V as VENDOR_OWNER_GROUP_NAME, c as VENDOR_SCOPED_STORE_ENTITIES, d as VENDOR_STORE_RBAC_ENTITIES, f as canManageRoles, g as canManageVendorRoles, h as canManageVendorTeam, i as canOnboardVendors, j as createAuthHelpers, k as createCmsAuthBundle, l as getPermissionableEntityKeys, m as getRequiredPermission, n as hasEntityPermission, o as isOpenEndpoint, p as isPlatformAdministrator, q as isPublicMethod, r as isSuperAdminGroupName, s as isVendorGroupName, t as isVendorOwner, u as isVendorPortalUser, v as isVendorStaff, w as permissionRowsToRecord, x as resolveVendorScopeFromSessionUser, y as sessionHasEntityAccess, z as vendorPortalFlagsFromUser } from './vendor-scope-DTYhJk_I.js';
 import { DataSource } from 'typeorm';
 import { getToken } from 'next-auth/jwt';
 import { NextAuthOptions } from 'next-auth';
 
+/** Canonical name for new installs / migrations */
+declare const ADMIN_GROUP_NAME = "Administrator";
+/** System administrator group (roles UI + users / user_groups / permissions bypass). */
+declare function isSuperAdminGroupName(name: string | null | undefined): boolean;
+type EntityCrudAction = 'create' | 'read' | 'update' | 'delete';
+type EntityPermissionFlags = {
+    c: boolean;
+    r: boolean;
+    u: boolean;
+    d: boolean;
+};
+declare function getPermissionableEntityKeys(entityMap: Record<string, unknown>): string[];
+declare function permissionRowsToRecord(rows: Array<{
+    entity: string;
+    canCreate: boolean;
+    canRead: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+}> | undefined): Record<string, EntityPermissionFlags>;
+declare function hasEntityPermission(record: Record<string, EntityPermissionFlags> | undefined, entity: string, action: EntityCrudAction): boolean;
+
 /**
- * Build NextAuth options for credentials auth. App can extend/override via extend().
+ * @deprecated Administrator bypass is now full entity access via `isRBACAdmin` in `sessionHasEntityAccess`.
+ * Kept for backwards-compatible imports.
  */
-
-interface NextAuthUser {
-    id: number;
-    email: string;
-    name: string | null;
-    password: string | null;
-    blocked?: boolean;
-    deleted?: boolean;
-    groupId?: number | null;
+declare const RBAC_ADMIN_ONLY_ENTITIES: Set<string>;
+interface SessionUser {
+    id?: string;
+    email?: string | null;
+    name?: string | null;
+    groupId?: number;
+    /** User group display name (from login). */
+    groupName?: string | null;
+    /** @deprecated use entityPerms / isRBACAdmin */
+    permissions?: string[];
+    /** Administrator group: bypasses entity-level RBAC on all resources */
+    isRBACAdmin?: boolean;
+    entityPerms?: Record<string, EntityPermissionFlags>;
+    /** When false and not isRBACAdmin, admin API/UI is denied. */
     adminAccess?: boolean;
-    group?: {
-        name?: string;
-        permissions?: Array<{
-            entity: string;
-            canCreate: boolean;
-            canRead: boolean;
-            canUpdate: boolean;
-            canDelete: boolean;
-        }>;
-    };
+    /** Vendor stores this user can access (from vendor_users). */
     vendorIds?: number[];
+    /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
+    /** Role for the active vendor link (`vendor_users.role`). */
     vendorRole?: 'owner' | 'staff' | null;
+    /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
+    vendorRoleId?: number | null;
+    vendorRoleName?: string | null;
+    /** True when active vendor role has `isOwnerRole`. */
+    isVendorRoleOwner?: boolean;
+    /** Permissions from active vendor role (`vendor_role_permissions`). */
+    vendorEntityPerms?: Record<string, EntityPermissionFlags>;
+    /** Set at login: vendor store portal (not platform admin). */
+    isVendorPortal?: boolean;
+    /** Set at login: vendor store owner (team + permissions). */
+    isVendorOwner?: boolean;
 }
-interface AuthorizeOtpInput {
-    identifier: string;
-    channel: 'email' | 'sms';
-    code: string;
+declare function sessionHasEntityAccess(user: SessionUser | null | undefined, entity: string, action: EntityCrudAction): boolean;
+declare function canManageRoles(user: SessionUser | null | undefined): boolean;
+type GetSession = () => Promise<{
+    user?: SessionUser;
+} | null>;
+declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
+declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
+declare function isOpenEndpoint(pathname: string): boolean;
+declare function getRequiredPermission(pathname: string): string[] | null;
+declare function isPublicMethod(pathname: string, method: string): boolean;
+interface AuthHelpers {
+    requireAuth(req: Request): Promise<Response | null>;
+    requirePermission(req: Request, permission: string): Promise<Response | null>;
+    requireEntityPermission(req: Request, entity: string, action: EntityCrudAction): Promise<Response | null>;
+    requireAdminAccess(req: Request): Promise<Response | null>;
+    getAuthenticatedUser(): Promise<SessionUser | null>;
 }
-interface NextAuthOptionsConfig {
-    /** Resolve user by email (e.g. from TypeORM). Return null if not found. */
-    getUserByEmail: (email: string) => Promise<NextAuthUser | null>;
-    comparePassword: (plain: string, hash: string) => Promise<boolean>;
-    signInPage?: string;
-    secret?: string;
-    extend?: (options: NextAuthOptions) => NextAuthOptions;
-    /** When false, password CredentialsProvider is omitted. Default true. */
-    enablePasswordLogin?: boolean;
-    /** When true, registers CredentialsProvider id `otp`. Requires authorizeOtp. Default false. */
-    enableOtpLogin?: boolean;
-    /** Validate OTP and return user (same shape as password flow) or null. */
-    authorizeOtp?: (input: AuthorizeOtpInput) => Promise<NextAuthUser | null>;
-    /**
-     * Customer group sign-in policy for credentials/OTP on a shared `/api/auth` route:
-     * - `true` — always allow (dedicated storefront auth)
-     * - `false` — always block
-     * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
-     */
-    allowCustomerLogin?: boolean;
-}
-declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
-/** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
-declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+declare function createAuthHelpers(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): AuthHelpers;
+/** Pass return value into `createCmsApiHandler` (includes `getSessionUser` for vendor store APIs). */
+declare function createCmsAuthBundle(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): {
+    requireAuth: (req: Request) => Promise<Response | null>;
+    requireAdminAccess: (req: Request) => Promise<Response | null>;
+    requireEntityPermission: (req: Request, entity: string, action: EntityCrudAction) => Promise<Response | null>;
+    getSessionUser: () => Promise<SessionUser | null>;
+    getAuthenticatedUser: () => Promise<SessionUser | null>;
+};
 
 /** Minimal DB handle for RBAC debug (avoids importing `typeorm` in the auth bundle). */
 type RbacDebugDataSource = {
     query: (sql: string, parameters?: unknown[]) => Promise<unknown>;
 };
-/** Set `CMS_RBAC_DEBUG=true` in `.env` to log permission decisions (server console). */
+/** Set `CMS_RBAC_DEBUG=true` in `.env` to log permission decisions (server console). Off by default. */
 declare function isRbacDebugEnabled(): boolean;
 declare function logRbac(message: string, data?: Record<string, unknown>): void;
 declare function summarizeEntityPerms(entityPerms: Record<string, EntityPermissionFlags> | undefined): Record<string, {
@@ -90,6 +124,49 @@ declare const VENDOR_ADMIN_GROUP_ID = 5;
 declare function isSuperAdmin(user: SessionUser | null | undefined): boolean;
 declare function isVendorAdmin(user: SessionUser | null | undefined): boolean;
 
+/** Entities with a `vendorId` column (store data). */
+declare const VENDOR_SCOPED_STORE_ENTITIES: Set<string>;
+/**
+ * Store admin RBAC for vendor portal users (read/create/update/delete fallbacks in rbac-debug).
+ * Includes entities without `vendorId` that are still part of the store admin UI.
+ */
+declare const VENDOR_STORE_RBAC_ENTITIES: Set<string>;
+type VendorScope = {
+    type: 'all';
+} | {
+    type: 'vendor';
+    vendorId: number;
+    vendorIds: number[];
+} | {
+    type: 'deny';
+};
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+/** User groups treated as vendor store staff (sidebar + scoped admin). */
+declare function isVendorGroupName(name: string | null | undefined): boolean;
+declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
+/** Vendor portal UI (store + store admin), not platform admin. */
+declare function isVendorPortalUser(user: SessionUser | null | undefined): boolean;
+declare function isVendorStaff(user: SessionUser | null | undefined): boolean;
+/** Vendor store owner (manages team + role permissions for their store). */
+declare function isVendorOwner(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorTeam(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorRoles(user: SessionUser | null | undefined): boolean;
+/** Platform admins (Administrator group) can onboard vendors. */
+declare function canOnboardVendors(user: SessionUser | null | undefined): boolean;
+declare function resolveVendorScopeFromSessionUser(user: SessionUser | null | undefined): VendorScope;
+/** Compute portal flags at login (persist on JWT). */
+declare function vendorPortalFlagsFromUser(input: {
+    email: string;
+    isRBACAdmin: boolean;
+    groupName?: string | null;
+    vendorIds?: number[];
+    vendorRole?: 'owner' | 'staff' | null;
+    isVendorRoleOwner?: boolean;
+}): {
+    isVendorPortal: boolean;
+    isVendorOwner: boolean;
+};
+
 /**
  * Ensures the Administrator group has full CRUD on every permissionable entity
  * for the given entity map. Idempotent: upserts per entity.
@@ -145,13 +222,79 @@ declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: Cm
     body: unknown;
 }>;
 
-/** Set `CMS_AUTH_DEBUG=false` to silence server auth logs in development. */
+/** Set `CMS_AUTH_DEBUG=true` to log server auth decisions. Off by default (including in development). */
 declare function isAuthDebugEnabled(): boolean;
-/** Browser console logs; set `NEXT_PUBLIC_CMS_AUTH_DEBUG=false` to silence. */
+/** Browser console logs; set `NEXT_PUBLIC_CMS_AUTH_DEBUG=true` to enable. */
 declare function isAuthDebugClientEnabled(): boolean;
 declare function logAuth(message: string, data?: Record<string, unknown>): void;
 declare function logAuthClient(message: string, data?: Record<string, unknown>): void;
 declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
 declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
-export { type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, EntityCrudAction, EntityPermissionFlags, type NextAuthOptionsConfig, type NextAuthUser, SUPER_ADMIN_GROUP_ID, SessionUser, VENDOR_ADMIN_GROUP_ID, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, isRbacDebugEnabled, isSuperAdmin, isVendorAdmin, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeEntityPerms, summarizeSessionUserForLog };
+/**
+ * Build NextAuth options for credentials auth. App can extend/override via extend().
+ */
+
+interface NextAuthUser {
+    id: number;
+    email: string;
+    name: string | null;
+    password: string | null;
+    blocked?: boolean;
+    deleted?: boolean;
+    groupId?: number | null;
+    adminAccess?: boolean;
+    group?: {
+        name?: string;
+        permissions?: Array<{
+            entity: string;
+            canCreate: boolean;
+            canRead: boolean;
+            canUpdate: boolean;
+            canDelete: boolean;
+        }>;
+    };
+    vendorIds?: number[];
+    activeVendorId?: number | null;
+    vendorRole?: 'owner' | 'staff' | null;
+    vendorRoleId?: number | null;
+    vendorRoleName?: string | null;
+    isVendorRoleOwner?: boolean;
+    vendorEntityPerms?: Record<string, {
+        c: boolean;
+        r: boolean;
+        u: boolean;
+        d: boolean;
+    }>;
+}
+interface AuthorizeOtpInput {
+    identifier: string;
+    channel: 'email' | 'sms';
+    code: string;
+}
+interface NextAuthOptionsConfig {
+    /** Resolve user by email (e.g. from TypeORM). Return null if not found. */
+    getUserByEmail: (email: string) => Promise<NextAuthUser | null>;
+    comparePassword: (plain: string, hash: string) => Promise<boolean>;
+    signInPage?: string;
+    secret?: string;
+    extend?: (options: NextAuthOptions) => NextAuthOptions;
+    /** When false, password CredentialsProvider is omitted. Default true. */
+    enablePasswordLogin?: boolean;
+    /** When true, registers CredentialsProvider id `otp`. Requires authorizeOtp. Default false. */
+    enableOtpLogin?: boolean;
+    /** Validate OTP and return user (same shape as password flow) or null. */
+    authorizeOtp?: (input: AuthorizeOtpInput) => Promise<NextAuthUser | null>;
+    /**
+     * Customer group sign-in policy for credentials/OTP on a shared `/api/auth` route:
+     * - `true` — always allow (dedicated storefront auth)
+     * - `false` — always block
+     * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
+     */
+    allowCustomerLogin?: boolean;
+}
+declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
+/** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
+declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+
+export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };