@infuro/cms-core 1.0.69 → 1.0.70

package/dist/index.js

@@ -1,17 +1,17 @@
-export { emitOrderNotificationTrigger, fireOrderNotificationTrigger } from './chunk-T47VP2ZT.js';
-import { checkMultiVendorEnabled, loadUserVendorContext, getPublicSettingsGroup, BlogGeneratorService } from './chunk-DBBYLSQP.js';
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderAssignee, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, autoExpireOrderIfPaymentTimeExceeded, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, whatsappPlugin, wrapGetCmsWithMessaging } from './chunk-DBBYLSQP.js';
+export { emitOrderNotificationTrigger, fireOrderNotificationTrigger } from './chunk-HZZTDM5J.js';
+import { checkMultiVendorEnabled, loadUserVendorContext, getPublicSettingsGroup, BlogGeneratorService } from './chunk-7NQMGB2S.js';
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderAssignee, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, autoExpireOrderIfPaymentTimeExceeded, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, whatsappPlugin, wrapGetCmsWithMessaging } from './chunk-7NQMGB2S.js';
+import { parseEmailRecipientsFromConfig } from './chunk-3LF4RYAJ.js';
+export { buildEventOrderTemplateVariables, emailPlugin, initWhatsappTriggerDispatcher, joinRecipientsForSend, parseEmailRecipientsFromConfig, resendOrderNotification, serializeEmailRecipients } from './chunk-3LF4RYAJ.js';
+export { countRecentOtpSends, createOtpChallenge, generateNumericOtp, hashOtpCode, normalizePhoneE164, verifyAndConsumeOtpChallenge, verifyOtpCodeHash } from './chunk-ECUGNV2I.js';
+export { queueSms, queueWhatsApp, registerSmsQueueProcessor, registerWhatsAppQueueProcessor } from './chunk-K6JT7BKY.js';
+export { KNOWN_NOTIFICATION_TRIGGERS, notificationTriggerEmitter } from './chunk-W2ZTGLUH.js';
+import './chunk-ECNYZG6T.js';
 import './chunk-ZMIMKNSQ.js';
-export { countRecentOtpSends, createOtpChallenge, generateNumericOtp, hashOtpCode, normalizePhoneE164, queueSms, registerSmsQueueProcessor, verifyAndConsumeOtpChallenge, verifyOtpCodeHash } from './chunk-53AMBXMM.js';
 export { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES, resolveEventOrderTemplate } from './chunk-5NVGWJSY.js';
 import { PgBossService } from './chunk-2BNVRFUQ.js';
 export { JOB_RUNNER_QUEUE, PgBossService } from './chunk-2BNVRFUQ.js';
 export { deductInventoryForConfirmedOrder, mergeInventoryLines, orderInventorySnapshotFromRow, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, restoreInventoryForCancelledOrder, validateInventoryForConfirmedOrderLines, validateInventoryForOrderBecomingConfirmed } from './chunk-JYRFSFXH.js';
-import { parseEmailRecipientsFromConfig } from './chunk-RBKVMHBH.js';
-export { buildEventOrderTemplateVariables, emailPlugin, initWhatsappTriggerDispatcher, joinRecipientsForSend, parseEmailRecipientsFromConfig, resendOrderNotification, serializeEmailRecipients } from './chunk-RBKVMHBH.js';
-export { queueWhatsApp, registerWhatsAppQueueProcessor } from './chunk-3XCTGADT.js';
-export { KNOWN_NOTIFICATION_TRIGGERS, notificationTriggerEmitter } from './chunk-WHMIWJL7.js';
-import './chunk-ECNYZG6T.js';
 export { EmailService, emailTemplates, renderEmail, renderLayout } from './chunk-CFUSYGSA.js';
 import { queueOrderPlacedEmails } from './chunk-LJ5C4RBF.js';
 export { queueEmail, queueOrderPlacedEmails, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-LJ5C4RBF.js';
@@ -23,10 +23,10 @@ export { resolveInvoiceAssetUrl } from './chunk-5DSY3GQI.js';
 import { mergeEmailLayoutCompanyDetails } from './chunk-YDMHG6BA.js';
 export { getCompanyDetailsFromSettings, mergeEmailLayoutCompanyDetails } from './chunk-YDMHG6BA.js';
 import './chunk-MGT4DJ2D.js';
-export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCustomerUserFromGoogleOAuth, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isGoogleAuthPubliclyEnabled, resolveGoogleAuthConfig, seedAdministratorPermissions } from './chunk-MJDNS324.js';
-export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, customerPhoneForEmail, customerPhoneForUser, ensureCustomerForUser, ensureCustomerRecord, getRequiredPermission, isOpenEndpoint, isPublicMethod, isSyntheticCustomerPhone, linkUnclaimedContactToUser, normalizeCustomerPhone, sessionHasEntityAccess } from './chunk-D4LR3S77.js';
-import { isSuperAdmin, isVendorGroupName } from './chunk-DWNQTFJ5.js';
-export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-DWNQTFJ5.js';
+export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCustomerUserFromGoogleOAuth, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isGoogleAuthPubliclyEnabled, resolveGoogleAuthConfig, seedAdministratorPermissions } from './chunk-SCE2GIKH.js';
+export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, customerPhoneForEmail, customerPhoneForUser, ensureCustomerForUser, ensureCustomerRecord, getRequiredPermission, isOpenEndpoint, isPublicMethod, isSyntheticCustomerPhone, linkUnclaimedContactToUser, normalizeCustomerPhone, sessionHasEntityAccess } from './chunk-NQF6H656.js';
+import { isSuperAdmin, isVendorGroupName } from './chunk-CJY2HUJC.js';
+export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-CJY2HUJC.js';
 export { activeUniqueValueExists, retireSoftDeletedUniqueValue } from './chunk-BK5XW5XH.js';
 export { createCmsMiddleware, defaultPublicApiMethods, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, summarizeSessionUserForLog } from './chunk-SERRQ736.js';
 export { queueErpPaidOrderForOrderId } from './chunk-PRZOLCFW.js';

package/dist/{order-assignees-handlers-JEJ5IDID.cjs → order-assignees-handlers-E6PQZP4H.cjs}

@@ -99,6 +99,7 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             relations: [
               "user",
               "vendorRole",
+              "vendorRole.permissions",
               "vendor"
             ]
           });
@@ -108,13 +109,21 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             const v = vu.vendor;
             if (u && u.id && !u.deleted && !u.blocked && u.inviteStatus === "active") {
               const roleName = r?.name || (r?.isOwnerRole ? "Owner" : "Vendor Staff");
+              const isOwner = Boolean(r?.isOwnerRole);
+              let hasOrderPermission = isOwner;
+              if (!isOwner && Array.isArray(r?.permissions)) {
+                const orderPerm = r.permissions.find((p) => String(p?.entity).toLowerCase() === "orders");
+                hasOrderPermission = Boolean(orderPerm?.canRead);
+              }
               assigneesMap.set(u.id, {
                 id: u.id,
                 name: u.name || u.email?.split("@")[0] || `User #${u.id}`,
                 email: u.email || "",
                 role: roleName,
                 vendorId: targetVendorId,
-                vendorName: v?.name || `Vendor #${targetVendorId}`
+                vendorName: v?.name || `Vendor #${targetVendorId}`,
+                hasOrderPermission,
+                permissionReason: hasOrderPermission ? void 0 : "No order access in role permissions"
               });
             }
           }
@@ -147,6 +156,7 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             relations: [
               "user",
               "vendorRole",
+              "vendorRole.permissions",
               "vendor"
             ]
           });
@@ -157,13 +167,21 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             if (u && u.id && !u.deleted && !u.blocked && u.inviteStatus === "active") {
               if (v && v.deleted) continue;
               const roleName = r?.name || (r?.isOwnerRole ? "Owner" : "Vendor Staff");
+              const isOwner = Boolean(r?.isOwnerRole);
+              let hasOrderPermission = isOwner;
+              if (!isOwner && Array.isArray(r?.permissions)) {
+                const orderPerm = r.permissions.find((p) => String(p?.entity).toLowerCase() === "orders");
+                hasOrderPermission = Boolean(orderPerm?.canRead);
+              }
               assigneesMap.set(u.id, {
                 id: u.id,
                 name: u.name || u.email?.split("@")[0] || `User #${u.id}`,
                 email: u.email || "",
                 role: roleName,
                 vendorId: vu.vendorId,
-                vendorName: v?.name || `Vendor #${vu.vendorId}`
+                vendorName: v?.name || `Vendor #${vu.vendorId}`,
+                hasOrderPermission,
+                permissionReason: hasOrderPermission ? void 0 : "No order access in role permissions"
               });
             }
           }
@@ -199,7 +217,8 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
               email: u.email || "",
               role: roleLabel,
               vendorId: null,
-              vendorName: "Platform Staff"
+              vendorName: "Platform Staff",
+              hasOrderPermission: true
             });
           }
         }

package/dist/{order-assignees-handlers-F7WOZHOG.js → order-assignees-handlers-YCT3Q3KC.js}

@@ -97,6 +97,7 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             relations: [
               "user",
               "vendorRole",
+              "vendorRole.permissions",
               "vendor"
             ]
           });
@@ -106,13 +107,21 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             const v = vu.vendor;
             if (u && u.id && !u.deleted && !u.blocked && u.inviteStatus === "active") {
               const roleName = r?.name || (r?.isOwnerRole ? "Owner" : "Vendor Staff");
+              const isOwner = Boolean(r?.isOwnerRole);
+              let hasOrderPermission = isOwner;
+              if (!isOwner && Array.isArray(r?.permissions)) {
+                const orderPerm = r.permissions.find((p) => String(p?.entity).toLowerCase() === "orders");
+                hasOrderPermission = Boolean(orderPerm?.canRead);
+              }
               assigneesMap.set(u.id, {
                 id: u.id,
                 name: u.name || u.email?.split("@")[0] || `User #${u.id}`,
                 email: u.email || "",
                 role: roleName,
                 vendorId: targetVendorId,
-                vendorName: v?.name || `Vendor #${targetVendorId}`
+                vendorName: v?.name || `Vendor #${targetVendorId}`,
+                hasOrderPermission,
+                permissionReason: hasOrderPermission ? void 0 : "No order access in role permissions"
               });
             }
           }
@@ -145,6 +154,7 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             relations: [
               "user",
               "vendorRole",
+              "vendorRole.permissions",
               "vendor"
             ]
           });
@@ -155,13 +165,21 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             if (u && u.id && !u.deleted && !u.blocked && u.inviteStatus === "active") {
               if (v && v.deleted) continue;
               const roleName = r?.name || (r?.isOwnerRole ? "Owner" : "Vendor Staff");
+              const isOwner = Boolean(r?.isOwnerRole);
+              let hasOrderPermission = isOwner;
+              if (!isOwner && Array.isArray(r?.permissions)) {
+                const orderPerm = r.permissions.find((p) => String(p?.entity).toLowerCase() === "orders");
+                hasOrderPermission = Boolean(orderPerm?.canRead);
+              }
               assigneesMap.set(u.id, {
                 id: u.id,
                 name: u.name || u.email?.split("@")[0] || `User #${u.id}`,
                 email: u.email || "",
                 role: roleName,
                 vendorId: vu.vendorId,
-                vendorName: v?.name || `Vendor #${vu.vendorId}`
+                vendorName: v?.name || `Vendor #${vu.vendorId}`,
+                hasOrderPermission,
+                permissionReason: hasOrderPermission ? void 0 : "No order access in role permissions"
               });
             }
           }
@@ -197,7 +215,8 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
               email: u.email || "",
               role: roleLabel,
               vendorId: null,
-              vendorName: "Platform Staff"
+              vendorName: "Platform Staff",
+              hasOrderPermission: true
             });
           }
         }

package/dist/{order-completion-otp-handlers-LNAZTMTS.cjs → order-completion-otp-handlers-2ZKRK5SN.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var chunkHGR4IA7I_cjs = require('./chunk-HGR4IA7I.cjs');
-var chunk6MM5OMRL_cjs = require('./chunk-6MM5OMRL.cjs');
-var chunkOXFC3DAM_cjs = require('./chunk-OXFC3DAM.cjs');
-require('./chunk-M5QDJOUP.cjs');
+var chunkNIBEGDD4_cjs = require('./chunk-NIBEGDD4.cjs');
+var chunkKB7EBYPR_cjs = require('./chunk-KB7EBYPR.cjs');
+var chunkKJB5LBFQ_cjs = require('./chunk-KJB5LBFQ.cjs');
+require('./chunk-K742UE6S.cjs');
 var chunk4MNVIGVJ_cjs = require('./chunk-4MNVIGVJ.cjs');
 require('./chunk-BQQMTQ4C.cjs');
 require('./chunk-RQCXRCYM.cjs');
@@ -250,8 +250,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydr
         if (customerEmail) targetChannels.push("email");
         else if (customerPhone) targetChannels.push("whatsapp");
       }
-      const code = chunk6MM5OMRL_cjs.generateNumericOtp(6);
-      const challengeResult = await chunk6MM5OMRL_cjs.createOtpChallenge(dataSource, entityMap, {
+      const code = chunkKB7EBYPR_cjs.generateNumericOtp(6);
+      const challengeResult = await chunkKB7EBYPR_cjs.createOtpChallenge(dataSource, entityMap, {
         purpose: "order_completion",
         channel: targetChannels[0] || "email",
         identifier: `order:${orderId}`,
@@ -294,7 +294,7 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydr
       }
       if (targetChannels.includes("whatsapp") && customerPhone) {
         try {
-          const sent = await chunkOXFC3DAM_cjs.queueWhatsApp(cms, {
+          const sent = await chunkKJB5LBFQ_cjs.queueWhatsApp(cms, {
             to: customerPhone,
             body: `Your completion code for Order #${o.orderNumber} is ${code}. Share this with your representative to complete your order. Valid for 10 minutes.`,
             variables: {
@@ -310,7 +310,7 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydr
       }
       if (targetChannels.includes("sms") && customerPhone) {
         try {
-          await chunk6MM5OMRL_cjs.queueSms(cms, {
+          await chunkKJB5LBFQ_cjs.queueSms(cms, {
             to: customerPhone,
             body: `Your verification code for Order #${o.orderNumber} is ${code}. Valid for 10 minutes.`,
             otpCode: code,
@@ -378,7 +378,7 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydr
       }
       const accessError = await verifyOrderAccess(order);
       if (accessError) return accessError;
-      const verifyResult = await chunk6MM5OMRL_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
+      const verifyResult = await chunkKB7EBYPR_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
         purpose: "order_completion",
         identifier: `order:${orderId}`,
         code
@@ -396,7 +396,7 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydr
       order.updatedAt = now;
       await orderRepo.save(order);
       try {
-        await chunkHGR4IA7I_cjs.fireOrderNotificationTrigger("order_completed", orderId, {
+        await chunkNIBEGDD4_cjs.fireOrderNotificationTrigger("order_completed", orderId, {
           dataSource,
           entityMap
         });

package/dist/{order-completion-otp-handlers-FIW7PZ6W.js → order-completion-otp-handlers-KHLZQQJX.js}

@@ -1,7 +1,7 @@
-import { fireOrderNotificationTrigger } from './chunk-T47VP2ZT.js';
-import { verifyAndConsumeOtpChallenge, generateNumericOtp, createOtpChallenge, queueSms } from './chunk-53AMBXMM.js';
-import { queueWhatsApp } from './chunk-3XCTGADT.js';
-import './chunk-WHMIWJL7.js';
+import { fireOrderNotificationTrigger } from './chunk-HZZTDM5J.js';
+import { verifyAndConsumeOtpChallenge, generateNumericOtp, createOtpChallenge } from './chunk-ECUGNV2I.js';
+import { queueWhatsApp, queueSms } from './chunk-K6JT7BKY.js';
+import './chunk-W2ZTGLUH.js';
 import { queueEmail } from './chunk-LJ5C4RBF.js';
 import './chunk-PQJIJ4ZX.js';
 import './chunk-WQZ4AH2P.js';

package/dist/{order-notification-dispatcher-GG5C4LKZ.cjs → order-notification-dispatcher-37KDVHBM.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunk747MJJCZ_cjs = require('./chunk-747MJJCZ.cjs');
-require('./chunk-OXFC3DAM.cjs');
-require('./chunk-M5QDJOUP.cjs');
+var chunkTTOEY7AH_cjs = require('./chunk-TTOEY7AH.cjs');
+require('./chunk-KJB5LBFQ.cjs');
+require('./chunk-K742UE6S.cjs');
 require('./chunk-CIZZX57T.cjs');
 require('./chunk-QN6PZLAP.cjs');
 require('./chunk-4MNVIGVJ.cjs');
@@ -18,21 +18,21 @@ require('./chunk-XHPRD45G.cjs');
 
 Object.defineProperty(exports, "dispatchOrderNotificationDirectly", {
   enumerable: true,
-  get: function () { return chunk747MJJCZ_cjs.dispatchOrderNotificationDirectly; }
+  get: function () { return chunkTTOEY7AH_cjs.dispatchOrderNotificationDirectly; }
 });
 Object.defineProperty(exports, "emitOrderNotificationTrigger", {
   enumerable: true,
-  get: function () { return chunk747MJJCZ_cjs.emitOrderNotificationTrigger; }
+  get: function () { return chunkTTOEY7AH_cjs.emitOrderNotificationTrigger; }
 });
 Object.defineProperty(exports, "getSettingsGroup", {
   enumerable: true,
-  get: function () { return chunk747MJJCZ_cjs.getSettingsGroup; }
+  get: function () { return chunkTTOEY7AH_cjs.getSettingsGroup; }
 });
 Object.defineProperty(exports, "initWhatsappTriggerDispatcher", {
   enumerable: true,
-  get: function () { return chunk747MJJCZ_cjs.initWhatsappTriggerDispatcher; }
+  get: function () { return chunkTTOEY7AH_cjs.initWhatsappTriggerDispatcher; }
 });
 Object.defineProperty(exports, "resendOrderNotification", {
   enumerable: true,
-  get: function () { return chunk747MJJCZ_cjs.resendOrderNotification; }
+  get: function () { return chunkTTOEY7AH_cjs.resendOrderNotification; }
 });

package/dist/{order-notification-dispatcher-FS54ANAV.js → order-notification-dispatcher-Z3MXNF4U.js}

@@ -1,6 +1,6 @@
-export { dispatchOrderNotificationDirectly, emitOrderNotificationTrigger, getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-RBKVMHBH.js';
-import './chunk-3XCTGADT.js';
-import './chunk-WHMIWJL7.js';
+export { dispatchOrderNotificationDirectly, emitOrderNotificationTrigger, getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-3LF4RYAJ.js';
+import './chunk-K6JT7BKY.js';
+import './chunk-W2ZTGLUH.js';
 import './chunk-ECNYZG6T.js';
 import './chunk-CFUSYGSA.js';
 import './chunk-LJ5C4RBF.js';

package/dist/{rbac-debug-db-IRKT6G62.js → rbac-debug-db-JK3U5UZK.js}

@@ -1,4 +1,4 @@
-import { summarizeEntityPerms, permissionRowsToRecord } from './chunk-DWNQTFJ5.js';
+import { summarizeEntityPerms, permissionRowsToRecord } from './chunk-CJY2HUJC.js';
 import { __name } from './chunk-5BKT4CS5.js';
 
 // src/auth/rbac-debug-db.ts

package/dist/{rbac-debug-db-2ZI3XKA4.cjs → rbac-debug-db-S3D6N6HN.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkLXWF6T7F_cjs = require('./chunk-LXWF6T7F.cjs');
+var chunkLCZZ3S4I_cjs = require('./chunk-LCZZ3S4I.cjs');
 var chunkXHPRD45G_cjs = require('./chunk-XHPRD45G.cjs');
 
 // src/auth/rbac-debug-db.ts
@@ -27,7 +27,7 @@ async function loadDbPermissionsForUser(dataSource, userId) {
   return {
     groupId,
     groupName,
-    dbEntityPerms: chunkLXWF6T7F_cjs.summarizeEntityPerms(chunkLXWF6T7F_cjs.permissionRowsToRecord(permRows))
+    dbEntityPerms: chunkLCZZ3S4I_cjs.summarizeEntityPerms(chunkLCZZ3S4I_cjs.permissionRowsToRecord(permRows))
   };
 }
 chunkXHPRD45G_cjs.__name(loadDbPermissionsForUser, "loadDbPermissionsForUser");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infuro/cms-core",
-  "version": "1.0.69",
+  "version": "1.0.70",
   "private": false,
   "type": "module",
   "main": "./dist/index.cjs",