@infuro/cms-core 1.0.45 → 1.0.47

package/dist/api.cjs

@@ -1,17 +1,19 @@
 'use strict';
 
-var chunkF5XFHYTG_cjs = require('./chunk-F5XFHYTG.cjs');
-require('./chunk-22FFHLTO.cjs');
+var chunkXUCKZPML_cjs = require('./chunk-XUCKZPML.cjs');
+require('./chunk-HY3AXLOI.cjs');
+require('./chunk-OY2YTBMP.cjs');
+require('./chunk-LMJ7RKPF.cjs');
 require('./chunk-UCKN4BBY.cjs');
 require('./chunk-7NMT3GBR.cjs');
-require('./chunk-PNOKNSG2.cjs');
-require('./chunk-XW5ATPRW.cjs');
+require('./chunk-V25RDUOU.cjs');
+require('./chunk-BXYZDMTZ.cjs');
 require('./chunk-3DZRIZOD.cjs');
 require('./chunk-OOTLNH63.cjs');
-require('./chunk-SPQFNIYJ.cjs');
+require('./chunk-4PMK3RNA.cjs');
 require('./chunk-XQ3QUHWR.cjs');
-var chunkZMRQ72F6_cjs = require('./chunk-ZMRQ72F6.cjs');
-require('./chunk-X6UQFV4X.cjs');
+var chunkVUQFARRT_cjs = require('./chunk-VUQFARRT.cjs');
+require('./chunk-77NUXO6A.cjs');
 require('./chunk-D5FBNKQM.cjs');
 require('./chunk-UPLVMVRX.cjs');
 require('./chunk-USNT2KNT.cjs');
@@ -20,129 +22,129 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "createAnalyticsHandlers", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createAnalyticsHandlers; }
+  get: function () { return chunkXUCKZPML_cjs.createAnalyticsHandlers; }
 });
 Object.defineProperty(exports, "createBlogBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createBlogBySlugHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createBlogBySlugHandler; }
 });
 Object.defineProperty(exports, "createChangePasswordHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createChangePasswordHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createChangePasswordHandler; }
 });
 Object.defineProperty(exports, "createCmsApiHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createCmsApiHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createCmsApiHandler; }
 });
 Object.defineProperty(exports, "createCrudByIdHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createCrudByIdHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createCrudByIdHandler; }
 });
 Object.defineProperty(exports, "createCrudHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createCrudHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createCrudHandler; }
 });
 Object.defineProperty(exports, "createDashboardStatsHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createDashboardStatsHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createDashboardStatsHandler; }
 });
 Object.defineProperty(exports, "createEcommerceAnalyticsHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createEcommerceAnalyticsHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createEcommerceAnalyticsHandler; }
 });
 Object.defineProperty(exports, "createForgotPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createForgotPasswordHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createForgotPasswordHandler; }
 });
 Object.defineProperty(exports, "createFormBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createFormBySlugHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createFormBySlugHandler; }
 });
 Object.defineProperty(exports, "createInviteAcceptHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createInviteAcceptHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createInviteAcceptHandler; }
 });
 Object.defineProperty(exports, "createJobScheduleHandlers", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createJobScheduleHandlers; }
+  get: function () { return chunkXUCKZPML_cjs.createJobScheduleHandlers; }
 });
 Object.defineProperty(exports, "createLlmAgentKnowledgeHandlers", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createLlmAgentKnowledgeHandlers; }
+  get: function () { return chunkXUCKZPML_cjs.createLlmAgentKnowledgeHandlers; }
 });
 Object.defineProperty(exports, "createMediaZipExtractHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createMediaZipExtractHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createMediaZipExtractHandler; }
 });
 Object.defineProperty(exports, "createSetPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createSetPasswordHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createSetPasswordHandler; }
 });
 Object.defineProperty(exports, "createSettingsApiHandlers", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createSettingsApiHandlers; }
+  get: function () { return chunkXUCKZPML_cjs.createSettingsApiHandlers; }
 });
 Object.defineProperty(exports, "createStorefrontApiHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createStorefrontApiHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createStorefrontApiHandler; }
 });
 Object.defineProperty(exports, "createUploadHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createUploadHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createUploadHandler; }
 });
 Object.defineProperty(exports, "createUserAuthApiRouter", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createUserAuthApiRouter; }
+  get: function () { return chunkXUCKZPML_cjs.createUserAuthApiRouter; }
 });
 Object.defineProperty(exports, "createUserAvatarHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createUserAvatarHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createUserAvatarHandler; }
 });
 Object.defineProperty(exports, "createUserProfileHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createUserProfileHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createUserProfileHandler; }
 });
 Object.defineProperty(exports, "createUsersApiHandlers", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createUsersApiHandlers; }
+  get: function () { return chunkXUCKZPML_cjs.createUsersApiHandlers; }
 });
 Object.defineProperty(exports, "createVendorDashboardHandler", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createVendorDashboardHandler; }
+  get: function () { return chunkXUCKZPML_cjs.createVendorDashboardHandler; }
 });
 Object.defineProperty(exports, "createVendorOnboardHandlers", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.createVendorOnboardHandlers; }
+  get: function () { return chunkXUCKZPML_cjs.createVendorOnboardHandlers; }
 });
 Object.defineProperty(exports, "getPublicSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.getPublicSettingsGroup; }
+  get: function () { return chunkXUCKZPML_cjs.getPublicSettingsGroup; }
 });
 Object.defineProperty(exports, "mergeGuardrailsIntoSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.mergeGuardrailsIntoSystemPrompt; }
+  get: function () { return chunkXUCKZPML_cjs.mergeGuardrailsIntoSystemPrompt; }
 });
 Object.defineProperty(exports, "parseLlmAgentValidationRules", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.parseLlmAgentValidationRules; }
+  get: function () { return chunkXUCKZPML_cjs.parseLlmAgentValidationRules; }
 });
 Object.defineProperty(exports, "simpleDecrypt", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.simpleDecrypt; }
+  get: function () { return chunkXUCKZPML_cjs.simpleDecrypt; }
 });
 Object.defineProperty(exports, "simpleEncrypt", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.simpleEncrypt; }
+  get: function () { return chunkXUCKZPML_cjs.simpleEncrypt; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstAgentRules", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.validateUserMessageAgainstAgentRules; }
+  get: function () { return chunkXUCKZPML_cjs.validateUserMessageAgainstAgentRules; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstStructuredRules", {
   enumerable: true,
-  get: function () { return chunkF5XFHYTG_cjs.validateUserMessageAgainstStructuredRules; }
+  get: function () { return chunkXUCKZPML_cjs.validateUserMessageAgainstStructuredRules; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.createCmsAuthBundle; }
+  get: function () { return chunkVUQFARRT_cjs.createCmsAuthBundle; }
 });

package/dist/api.d.cts

@@ -27,7 +27,7 @@ interface SessionUser {
     vendorIds?: number[];
     /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
-    /** Role for the active vendor link (`vendor_users.role`). */
+    /** @deprecated Prefer isVendorRoleOwner / vendorRoleId. Legacy owner|staff hint. */
     vendorRole?: 'owner' | 'staff' | null;
     /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
     vendorRoleId?: number | null;
@@ -349,7 +349,7 @@ declare function createUsersApiHandlers(config: UsersApiConfig): {
     getById(_req: Request, id: string): Promise<Response>;
     update(req: Request, id: string): Promise<Response>;
     delete(_req: Request, id: string): Promise<Response>;
-    regenerateInvite(_req: Request, id: string): Promise<Response>;
+    regenerateInvite(req: Request, id: string): Promise<Response>;
 };
 interface UserAvatarConfig extends CmsHandlersBase {
     getSession: () => Promise<{
@@ -547,7 +547,7 @@ declare function createCmsApiHandler(config: CmsApiHandlerConfig): {
     handle(method: string, pathInput: string[], req: Request): Promise<Response>;
 };
 
-type VendorOwnerActivation = 'invite' | 'password';
+type VendorOwnerActivation = 'invite' | 'password' | 'membership';
 interface VendorOnboardHandlersConfig {
     dataSource: DataSource;
     entityMap: EntityMap;
@@ -573,8 +573,14 @@ declare function createVendorOnboardHandlers(config: VendorOnboardHandlersConfig
     switchVendor(req: Request): Promise<Response>;
     /** GET /api/admin/vendor/team */
     listTeam(): Promise<Response>;
-    /** POST /api/admin/vendor/team — add staff to vendor */
+    /** POST /api/admin/vendor/team — invite staff (set-password for new; accept-only for existing vendor people) */
     addTeamMember(req: Request): Promise<Response>;
+    /** POST /api/admin/vendor/team/send-invite — send invite email for a pending team member */
+    sendTeamInviteEmail(req: Request): Promise<Response>;
+    /** GET /api/admin/vendor/team-invite?token=&vendorId= — preflight for membership accept (no password) */
+    validateTeamInvite(req: Request): Promise<Response>;
+    /** POST /api/admin/vendor/team-invite — accept membership (token; no password) */
+    acceptTeamInvite(req: Request): Promise<Response>;
     /** PATCH /api/admin/vendor/team/:userId — change member store role */
     updateTeamMemberRole(req: Request, userIdStr: string): Promise<Response>;
     /** DELETE /api/admin/vendor/team/:userId */

package/dist/api.d.ts

@@ -27,7 +27,7 @@ interface SessionUser {
     vendorIds?: number[];
     /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
-    /** Role for the active vendor link (`vendor_users.role`). */
+    /** @deprecated Prefer isVendorRoleOwner / vendorRoleId. Legacy owner|staff hint. */
     vendorRole?: 'owner' | 'staff' | null;
     /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
     vendorRoleId?: number | null;
@@ -349,7 +349,7 @@ declare function createUsersApiHandlers(config: UsersApiConfig): {
     getById(_req: Request, id: string): Promise<Response>;
     update(req: Request, id: string): Promise<Response>;
     delete(_req: Request, id: string): Promise<Response>;
-    regenerateInvite(_req: Request, id: string): Promise<Response>;
+    regenerateInvite(req: Request, id: string): Promise<Response>;
 };
 interface UserAvatarConfig extends CmsHandlersBase {
     getSession: () => Promise<{
@@ -547,7 +547,7 @@ declare function createCmsApiHandler(config: CmsApiHandlerConfig): {
     handle(method: string, pathInput: string[], req: Request): Promise<Response>;
 };
 
-type VendorOwnerActivation = 'invite' | 'password';
+type VendorOwnerActivation = 'invite' | 'password' | 'membership';
 interface VendorOnboardHandlersConfig {
     dataSource: DataSource;
     entityMap: EntityMap;
@@ -573,8 +573,14 @@ declare function createVendorOnboardHandlers(config: VendorOnboardHandlersConfig
     switchVendor(req: Request): Promise<Response>;
     /** GET /api/admin/vendor/team */
     listTeam(): Promise<Response>;
-    /** POST /api/admin/vendor/team — add staff to vendor */
+    /** POST /api/admin/vendor/team — invite staff (set-password for new; accept-only for existing vendor people) */
     addTeamMember(req: Request): Promise<Response>;
+    /** POST /api/admin/vendor/team/send-invite — send invite email for a pending team member */
+    sendTeamInviteEmail(req: Request): Promise<Response>;
+    /** GET /api/admin/vendor/team-invite?token=&vendorId= — preflight for membership accept (no password) */
+    validateTeamInvite(req: Request): Promise<Response>;
+    /** POST /api/admin/vendor/team-invite — accept membership (token; no password) */
+    acceptTeamInvite(req: Request): Promise<Response>;
     /** PATCH /api/admin/vendor/team/:userId — change member store role */
     updateTeamMemberRole(req: Request, userIdStr: string): Promise<Response>;
     /** DELETE /api/admin/vendor/team/:userId */

package/dist/api.js

@@ -1,15 +1,17 @@
-export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-MVXLRANV.js';
-import './chunk-NNQBWDCI.js';
+export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-W42UZLQO.js';
+import './chunk-3K5AIEIZ.js';
+import './chunk-DBPSJYLZ.js';
+import './chunk-YXH2UUEZ.js';
 import './chunk-HCIRL37O.js';
 import './chunk-JXF23MPG.js';
-import './chunk-WEMDMVHQ.js';
-import './chunk-5ELSW2UP.js';
+import './chunk-L3525VXI.js';
+import './chunk-2KUCQVAQ.js';
 import './chunk-MQBT33IV.js';
 import './chunk-CRFV5WJK.js';
-import './chunk-KFFB6EMZ.js';
+import './chunk-2HU5R2JE.js';
 import './chunk-GO7PPYNU.js';
-export { createCmsAuthBundle } from './chunk-BLR6H5GL.js';
-import './chunk-DN65KDIA.js';
+export { createCmsAuthBundle } from './chunk-ZF2RQWXB.js';
+import './chunk-JIWUVQ6B.js';
 import './chunk-SYBOCAWB.js';
 import './chunk-JC6DLWTE.js';
 import './chunk-SHUYVCID.js';

package/dist/auth.cjs

@@ -1,201 +1,205 @@
 'use strict';
 
-var chunkTAHX46EI_cjs = require('./chunk-TAHX46EI.cjs');
-var chunkZMRQ72F6_cjs = require('./chunk-ZMRQ72F6.cjs');
-var chunkX6UQFV4X_cjs = require('./chunk-X6UQFV4X.cjs');
+var chunkQ3HQEM4R_cjs = require('./chunk-Q3HQEM4R.cjs');
+var chunkVUQFARRT_cjs = require('./chunk-VUQFARRT.cjs');
+var chunk77NUXO6A_cjs = require('./chunk-77NUXO6A.cjs');
 require('./chunk-USNT2KNT.cjs');
 
 
 
 Object.defineProperty(exports, "createCmsMiddleware", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.createCmsMiddleware; }
+  get: function () { return chunkQ3HQEM4R_cjs.createCmsMiddleware; }
 });
 Object.defineProperty(exports, "defaultPublicApiMethods", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.defaultPublicApiMethods; }
+  get: function () { return chunkQ3HQEM4R_cjs.defaultPublicApiMethods; }
 });
 Object.defineProperty(exports, "getNextAuthOptions", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.getNextAuthOptions; }
+  get: function () { return chunkQ3HQEM4R_cjs.getNextAuthOptions; }
 });
 Object.defineProperty(exports, "getStorefrontNextAuthOptions", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.getStorefrontNextAuthOptions; }
+  get: function () { return chunkQ3HQEM4R_cjs.getStorefrontNextAuthOptions; }
 });
 Object.defineProperty(exports, "isAuthDebugClientEnabled", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.isAuthDebugClientEnabled; }
+  get: function () { return chunkQ3HQEM4R_cjs.isAuthDebugClientEnabled; }
 });
 Object.defineProperty(exports, "isAuthDebugEnabled", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.isAuthDebugEnabled; }
+  get: function () { return chunkQ3HQEM4R_cjs.isAuthDebugEnabled; }
 });
 Object.defineProperty(exports, "logAuth", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.logAuth; }
+  get: function () { return chunkQ3HQEM4R_cjs.logAuth; }
 });
 Object.defineProperty(exports, "logAuthClient", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.logAuthClient; }
+  get: function () { return chunkQ3HQEM4R_cjs.logAuthClient; }
 });
 Object.defineProperty(exports, "nextAuthCookieDebugInfo", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.nextAuthCookieDebugInfo; }
+  get: function () { return chunkQ3HQEM4R_cjs.nextAuthCookieDebugInfo; }
 });
 Object.defineProperty(exports, "seedAdministratorPermissions", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.seedAdministratorPermissions; }
+  get: function () { return chunkQ3HQEM4R_cjs.seedAdministratorPermissions; }
 });
 Object.defineProperty(exports, "summarizeSessionUserForLog", {
   enumerable: true,
-  get: function () { return chunkTAHX46EI_cjs.summarizeSessionUserForLog; }
+  get: function () { return chunkQ3HQEM4R_cjs.summarizeSessionUserForLog; }
 });
 Object.defineProperty(exports, "OPEN_ENDPOINTS", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.OPEN_ENDPOINTS; }
+  get: function () { return chunkVUQFARRT_cjs.OPEN_ENDPOINTS; }
 });
 Object.defineProperty(exports, "PERMISSION_REQUIRED_ENDPOINTS", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.PERMISSION_REQUIRED_ENDPOINTS; }
+  get: function () { return chunkVUQFARRT_cjs.PERMISSION_REQUIRED_ENDPOINTS; }
 });
 Object.defineProperty(exports, "RBAC_ADMIN_ONLY_ENTITIES", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.RBAC_ADMIN_ONLY_ENTITIES; }
+  get: function () { return chunkVUQFARRT_cjs.RBAC_ADMIN_ONLY_ENTITIES; }
 });
 Object.defineProperty(exports, "canManageRoles", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.canManageRoles; }
+  get: function () { return chunkVUQFARRT_cjs.canManageRoles; }
 });
 Object.defineProperty(exports, "createAuthHelpers", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.createAuthHelpers; }
+  get: function () { return chunkVUQFARRT_cjs.createAuthHelpers; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.createCmsAuthBundle; }
+  get: function () { return chunkVUQFARRT_cjs.createCmsAuthBundle; }
 });
 Object.defineProperty(exports, "getRequiredPermission", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.getRequiredPermission; }
+  get: function () { return chunkVUQFARRT_cjs.getRequiredPermission; }
 });
 Object.defineProperty(exports, "isOpenEndpoint", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.isOpenEndpoint; }
+  get: function () { return chunkVUQFARRT_cjs.isOpenEndpoint; }
 });
 Object.defineProperty(exports, "isPublicMethod", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.isPublicMethod; }
+  get: function () { return chunkVUQFARRT_cjs.isPublicMethod; }
 });
 Object.defineProperty(exports, "sessionHasEntityAccess", {
   enumerable: true,
-  get: function () { return chunkZMRQ72F6_cjs.sessionHasEntityAccess; }
+  get: function () { return chunkVUQFARRT_cjs.sessionHasEntityAccess; }
 });
 Object.defineProperty(exports, "ADMIN_GROUP_NAME", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.ADMIN_GROUP_NAME; }
+  get: function () { return chunk77NUXO6A_cjs.ADMIN_GROUP_NAME; }
 });
 Object.defineProperty(exports, "SUPER_ADMIN_GROUP_ID", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.SUPER_ADMIN_GROUP_ID; }
+  get: function () { return chunk77NUXO6A_cjs.SUPER_ADMIN_GROUP_ID; }
 });
 Object.defineProperty(exports, "VENDOR_ADMIN_GROUP_ID", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.VENDOR_ADMIN_GROUP_ID; }
+  get: function () { return chunk77NUXO6A_cjs.VENDOR_ADMIN_GROUP_ID; }
+});
+Object.defineProperty(exports, "VENDOR_GROUP_NAME", {
+  enumerable: true,
+  get: function () { return chunk77NUXO6A_cjs.VENDOR_GROUP_NAME; }
 });
 Object.defineProperty(exports, "VENDOR_OWNER_GROUP_NAME", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.VENDOR_OWNER_GROUP_NAME; }
+  get: function () { return chunk77NUXO6A_cjs.VENDOR_OWNER_GROUP_NAME; }
 });
 Object.defineProperty(exports, "VENDOR_SCOPED_STORE_ENTITIES", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.VENDOR_SCOPED_STORE_ENTITIES; }
+  get: function () { return chunk77NUXO6A_cjs.VENDOR_SCOPED_STORE_ENTITIES; }
 });
 Object.defineProperty(exports, "VENDOR_STORE_RBAC_ENTITIES", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.VENDOR_STORE_RBAC_ENTITIES; }
+  get: function () { return chunk77NUXO6A_cjs.VENDOR_STORE_RBAC_ENTITIES; }
 });
 Object.defineProperty(exports, "canManageVendorRoles", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.canManageVendorRoles; }
+  get: function () { return chunk77NUXO6A_cjs.canManageVendorRoles; }
 });
 Object.defineProperty(exports, "canManageVendorTeam", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.canManageVendorTeam; }
+  get: function () { return chunk77NUXO6A_cjs.canManageVendorTeam; }
 });
 Object.defineProperty(exports, "canOnboardVendors", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.canOnboardVendors; }
+  get: function () { return chunk77NUXO6A_cjs.canOnboardVendors; }
 });
 Object.defineProperty(exports, "explainSessionEntityAccess", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.explainSessionEntityAccess; }
+  get: function () { return chunk77NUXO6A_cjs.explainSessionEntityAccess; }
 });
 Object.defineProperty(exports, "getPermissionableEntityKeys", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.getPermissionableEntityKeys; }
+  get: function () { return chunk77NUXO6A_cjs.getPermissionableEntityKeys; }
 });
 Object.defineProperty(exports, "hasEntityPermission", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.hasEntityPermission; }
+  get: function () { return chunk77NUXO6A_cjs.hasEntityPermission; }
 });
 Object.defineProperty(exports, "isPlatformAdministrator", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isPlatformAdministrator; }
+  get: function () { return chunk77NUXO6A_cjs.isPlatformAdministrator; }
 });
 Object.defineProperty(exports, "isRbacDebugEnabled", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isRbacDebugEnabled; }
+  get: function () { return chunk77NUXO6A_cjs.isRbacDebugEnabled; }
 });
 Object.defineProperty(exports, "isSuperAdmin", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isSuperAdmin; }
+  get: function () { return chunk77NUXO6A_cjs.isSuperAdmin; }
 });
 Object.defineProperty(exports, "isSuperAdminGroupName", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isSuperAdminGroupName; }
+  get: function () { return chunk77NUXO6A_cjs.isSuperAdminGroupName; }
 });
 Object.defineProperty(exports, "isVendorAdmin", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isVendorAdmin; }
+  get: function () { return chunk77NUXO6A_cjs.isVendorAdmin; }
 });
 Object.defineProperty(exports, "isVendorGroupName", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isVendorGroupName; }
+  get: function () { return chunk77NUXO6A_cjs.isVendorGroupName; }
 });
 Object.defineProperty(exports, "isVendorOwner", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isVendorOwner; }
+  get: function () { return chunk77NUXO6A_cjs.isVendorOwner; }
 });
 Object.defineProperty(exports, "isVendorPortalUser", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isVendorPortalUser; }
+  get: function () { return chunk77NUXO6A_cjs.isVendorPortalUser; }
 });
 Object.defineProperty(exports, "isVendorStaff", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.isVendorStaff; }
+  get: function () { return chunk77NUXO6A_cjs.isVendorStaff; }
 });
 Object.defineProperty(exports, "logEntityAccessDecision", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.logEntityAccessDecision; }
+  get: function () { return chunk77NUXO6A_cjs.logEntityAccessDecision; }
 });
 Object.defineProperty(exports, "logRbac", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.logRbac; }
+  get: function () { return chunk77NUXO6A_cjs.logRbac; }
 });
 Object.defineProperty(exports, "permissionRowsToRecord", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.permissionRowsToRecord; }
+  get: function () { return chunk77NUXO6A_cjs.permissionRowsToRecord; }
 });
 Object.defineProperty(exports, "resolveVendorScopeFromSessionUser", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser; }
+  get: function () { return chunk77NUXO6A_cjs.resolveVendorScopeFromSessionUser; }
 });
 Object.defineProperty(exports, "summarizeEntityPerms", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.summarizeEntityPerms; }
+  get: function () { return chunk77NUXO6A_cjs.summarizeEntityPerms; }
 });
 Object.defineProperty(exports, "vendorPortalFlagsFromUser", {
   enumerable: true,
-  get: function () { return chunkX6UQFV4X_cjs.vendorPortalFlagsFromUser; }
+  get: function () { return chunk77NUXO6A_cjs.vendorPortalFlagsFromUser; }
 });

package/dist/auth.d.cts

@@ -46,7 +46,7 @@ interface SessionUser {
     vendorIds?: number[];
     /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
-    /** Role for the active vendor link (`vendor_users.role`). */
+    /** @deprecated Prefer isVendorRoleOwner / vendorRoleId. Legacy owner|staff hint. */
     vendorRole?: 'owner' | 'staff' | null;
     /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
     vendorRoleId?: number | null;
@@ -140,7 +140,9 @@ type VendorScope = {
 } | {
     type: 'deny';
 };
-declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+declare const VENDOR_GROUP_NAME = "Vendor";
+/** @deprecated Use VENDOR_GROUP_NAME */
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor";
 /** User groups treated as vendor store staff (sidebar + scoped admin). */
 declare function isVendorGroupName(name: string | null | undefined): boolean;
 declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
@@ -241,6 +243,7 @@ interface NextAuthUser {
     name: string | null;
     password: string | null;
     blocked?: boolean;
+    inviteStatus?: 'pending' | 'active';
     deleted?: boolean;
     groupId?: number | null;
     adminAccess?: boolean;
@@ -297,4 +300,4 @@ declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOpti
 /** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
 declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
 
-export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };

package/dist/auth.d.ts

@@ -46,7 +46,7 @@ interface SessionUser {
     vendorIds?: number[];
     /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
-    /** Role for the active vendor link (`vendor_users.role`). */
+    /** @deprecated Prefer isVendorRoleOwner / vendorRoleId. Legacy owner|staff hint. */
     vendorRole?: 'owner' | 'staff' | null;
     /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
     vendorRoleId?: number | null;
@@ -140,7 +140,9 @@ type VendorScope = {
 } | {
     type: 'deny';
 };
-declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+declare const VENDOR_GROUP_NAME = "Vendor";
+/** @deprecated Use VENDOR_GROUP_NAME */
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor";
 /** User groups treated as vendor store staff (sidebar + scoped admin). */
 declare function isVendorGroupName(name: string | null | undefined): boolean;
 declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
@@ -241,6 +243,7 @@ interface NextAuthUser {
     name: string | null;
     password: string | null;
     blocked?: boolean;
+    inviteStatus?: 'pending' | 'active';
     deleted?: boolean;
     groupId?: number | null;
     adminAccess?: boolean;
@@ -297,4 +300,4 @@ declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOpti
 /** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
 declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
 
-export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };