@infuro/cms-core 1.0.15 → 1.0.16

package/dist/index.d.cts

@@ -1,9 +1,10 @@
-import { C as CompanyDetails, T as TemplateContext, E as EmailTemplateResult, a as EmailTemplateName, O as OrderPlacedLineItem, S as StorageService, b as EntityMap$1 } from './index-BQnqJ7EO.cjs';
-export { A as AnalyticsHandlerConfig, c as AuthHandlersConfig, B as BlogBySlugConfig, d as ChangePasswordConfig, e as CmsApiHandlerConfig, f as CmsGetter, g as CrudHandlerOptions, D as DashboardStatsConfig, F as ForgotPasswordConfig, h as FormBySlugConfig, G as GetPublicSettingsGroupConfig, i as GetPublicSettingsGroupDataSource, I as InviteAcceptConfig, j as SetPasswordConfig, k as SettingsApiConfig, l as SocialLinkItem, m as StorefrontApiConfig, n as StorefrontOtpFlags, U as UploadHandlerConfig, o as UserAuthApiConfig, p as UserAvatarConfig, q as UserProfileConfig, r as UsersApiConfig, s as createAnalyticsHandlers, t as createBlogBySlugHandler, u as createChangePasswordHandler, v as createCmsApiHandler, w as createCrudByIdHandler, x as createCrudHandler, y as createDashboardStatsHandler, z as createForgotPasswordHandler, H as createFormBySlugHandler, J as createInviteAcceptHandler, K as createSetPasswordHandler, L as createSettingsApiHandlers, M as createStorefrontApiHandler, N as createUploadHandler, P as createUserAuthApiRouter, Q as createUserAvatarHandler, R as createUserProfileHandler, V as createUsersApiHandlers, W as getCompanyDetailsFromSettings, X as getPublicSettingsGroup, Y as mergeEmailLayoutCompanyDetails } from './index-BQnqJ7EO.cjs';
+import { C as CompanyDetails, T as TemplateContext, E as EmailTemplateResult, a as EmailTemplateName, O as OrderPlacedLineItem, S as StorageService, b as EntityMap$2 } from './index-h42MoUNq.cjs';
+export { A as AnalyticsHandlerConfig, c as AuthHandlersConfig, B as BlogBySlugConfig, d as ChangePasswordConfig, e as CmsApiHandlerConfig, f as CmsGetter, g as CrudHandlerOptions, D as DashboardStatsConfig, h as EcommerceAnalyticsConfig, F as ForgotPasswordConfig, i as FormBySlugConfig, G as GetPublicSettingsGroupConfig, j as GetPublicSettingsGroupDataSource, I as InviteAcceptConfig, k as SetPasswordConfig, l as SettingsApiConfig, m as SocialLinkItem, n as StorefrontApiConfig, o as StorefrontOtpFlags, U as UploadHandlerConfig, p as UserAuthApiConfig, q as UserAvatarConfig, r as UserProfileConfig, s as UsersApiConfig, t as createAnalyticsHandlers, u as createBlogBySlugHandler, v as createChangePasswordHandler, w as createCmsApiHandler, x as createCrudByIdHandler, y as createCrudHandler, z as createDashboardStatsHandler, H as createEcommerceAnalyticsHandler, J as createForgotPasswordHandler, K as createFormBySlugHandler, L as createInviteAcceptHandler, M as createMediaZipExtractHandler, N as createSetPasswordHandler, P as createSettingsApiHandlers, Q as createStorefrontApiHandler, R as createUploadHandler, V as createUserAuthApiRouter, W as createUserAvatarHandler, X as createUserProfileHandler, Y as createUsersApiHandlers, Z as getCompanyDetailsFromSettings, _ as getPublicSettingsGroup, $ as mergeEmailLayoutCompanyDetails } from './index-h42MoUNq.cjs';
 import { ClassValue } from 'clsx';
 import * as typeorm from 'typeorm';
 import { DataSource, EntityTarget, ObjectLiteral } from 'typeorm';
 import { Metadata } from 'next';
+import { N as NavbarConfig, F as FooterConfig } from './types-D34wmivy.cjs';
 export { A as ADMIN_GROUP_NAME, a as AuthHelpers, E as EntityCrudAction, b as EntityPermissionFlags, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, S as SessionUser, c as canManageRoles, d as createAuthHelpers, g as getPermissionableEntityKeys, e as getRequiredPermission, h as hasEntityPermission, i as isOpenEndpoint, f as isPublicMethod, j as isSuperAdminGroupName, p as permissionRowsToRecord, s as sessionHasEntityAccess } from './helpers-dlrF_49e.cjs';
 export { AuthorizeOtpInput, CmsMiddlewareConfig, NextAuthOptionsConfig, NextAuthUser, createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, seedAdministratorPermissions } from './auth.cjs';
 export { A as AdminNavItem, D as DEFAULT_ADMIN_NAV } from './config-DJ5CmQvS.cjs';
@@ -630,7 +631,7 @@ type SeoMetadataOverrides = {
 };
 /** Per-field: join row wins over slug row. */
 declare function mergeSeoBySlug(join: SeoLike | null | undefined, bySlug: SeoLike | null): SeoLike | null;
-declare function fetchSeoBySlug(dataSource: DataSource, entityMap: EntityMap$1, slug: string): Promise<SeoLike | null>;
+declare function fetchSeoBySlug(dataSource: DataSource, entityMap: EntityMap$2, slug: string): Promise<SeoLike | null>;
 /**
  * Build Next.js Metadata from merged SEO + optional layers.
  * `overrides` win over SEO; `fallbacks` apply when SEO (and overrides) omit a field.
@@ -638,7 +639,7 @@ declare function fetchSeoBySlug(dataSource: DataSource, entityMap: EntityMap$1,
  */
 declare function resolvePublicMetadata(args: {
     dataSource: DataSource;
-    entityMap: EntityMap$1;
+    entityMap: EntityMap$2;
     slug: string;
     seoFromJoin?: SeoLike | null;
     overrides?: SeoMetadataOverrides;
@@ -664,9 +665,9 @@ declare function verifyOtpCodeHash(code: string, storedHash: string, purpose: st
 declare function generateNumericOtp(length?: number): string;
 /** Normalize to E.164-like +digits */
 declare function normalizePhoneE164(raw: string, defaultCountryCode?: string): string | null;
-type EntityMap = Record<string, EntityTarget<ObjectLiteral>>;
-declare function countRecentOtpSends(dataSource: DataSource, entityMap: EntityMap, purpose: OtpPurpose, identifier: string, since: Date): Promise<number>;
-declare function createOtpChallenge(dataSource: DataSource, entityMap: EntityMap, input: {
+type EntityMap$1 = Record<string, EntityTarget<ObjectLiteral>>;
+declare function countRecentOtpSends(dataSource: DataSource, entityMap: EntityMap$1, purpose: OtpPurpose, identifier: string, since: Date): Promise<number>;
+declare function createOtpChallenge(dataSource: DataSource, entityMap: EntityMap$1, input: {
     purpose: OtpPurpose;
     channel: OtpChannel;
     identifier: string;
@@ -679,7 +680,7 @@ declare function createOtpChallenge(dataSource: DataSource, entityMap: EntityMap
     error: string;
     status: number;
 }>;
-declare function verifyAndConsumeOtpChallenge(dataSource: DataSource, entityMap: EntityMap, input: {
+declare function verifyAndConsumeOtpChallenge(dataSource: DataSource, entityMap: EntityMap$1, input: {
     purpose: OtpPurpose;
     identifier: string;
     code: string;
@@ -692,6 +693,79 @@ declare function verifyAndConsumeOtpChallenge(dataSource: DataSource, entityMap:
     status: number;
 }>;
 
+/** Returns true if request is allowed; false if rate limited. */
+declare function allowRateLimit(key: string): Promise<boolean>;
+type ExtraPublicWriteRule = (method: string, segments: string[]) => boolean;
+/** Segments are path parts after `/api/` (e.g. `['form-submissions']`). */
+declare function shouldRateLimitPublicWrite(method: string, segments: string[], extraRule?: ExtraPublicWriteRule): boolean;
+declare function rateLimitKeyForApiRequest(req: Request, segments: string[]): string;
+declare function rateLimitPublicApiIfNeeded(req: Request, method: string, segments: string[], options?: {
+    extraRule?: ExtraPublicWriteRule;
+}): Promise<Response | null>;
+declare function rateLimitCheckoutPost(req: Request): Promise<Response | null>;
+
+interface EntityMapLike {
+    configs: unknown;
+    orders: unknown;
+    order_items: unknown;
+}
+interface SendOrderPlacedEmailDeps {
+    getDataSource: () => Promise<DataSource>;
+    entityMap: EntityMapLike;
+    getCms: () => Promise<CmsApp>;
+}
+/** After payment confirmation: email customer + each sales team address from plugin settings. */
+declare function sendOrderPlacedEmailsAfterConfirmation(orderId: number, deps: SendOrderPlacedEmailDeps): Promise<void>;
+
+interface DataSourceManager {
+    getDataSource: () => DataSource;
+    getDataSourceInitialized: () => Promise<DataSource>;
+    resetDataSource: () => void;
+    registerOnReset: (cb: () => void) => void;
+    isConnectionError: (e: unknown) => boolean;
+}
+declare function createDataSourceManager(entityMap: Record<string, unknown>, options?: {
+    databaseUrl?: string;
+    idleTimeoutMillis?: number;
+}): DataSourceManager;
+
+interface SeedEntityMap {
+    users: unknown;
+    user_groups: unknown;
+}
+declare function seedDefaultAdmin(ds: DataSource, entityMap: SeedEntityMap, opts?: {
+    email?: string;
+    password?: string;
+}): Promise<void>;
+
+interface PublicThemeSettingsPayload {
+    activeThemeId: string;
+    primaryColor: string;
+    secondaryColor: string;
+    navbarConfig: NavbarConfig;
+    footerOverrides: Partial<FooterConfig>;
+}
+declare function loadPublicThemeSettings(config: {
+    dataSource: DataSource;
+    entityMap: EntityMap$2;
+    encryptionKey?: string;
+    defaultActiveThemeId?: string;
+    defaultPrimaryColor?: string;
+    defaultSecondaryColor?: string;
+}): Promise<PublicThemeSettingsPayload>;
+
+/** Normalize a logical media folder path: no leading/trailing slashes, no ".." segments, max length. */
+declare function sanitizeMediaFolderPath(input: unknown): string;
+/** Single path segment for storage (folder name or legacy path segment). */
+declare function sanitizeStorageSegment(name: string): string;
+
+type EntityMap = Record<string, EntityTarget<ObjectLiteral>>;
+/** Build `a/b/c` path under `uploads/` from the chain of folder rows up to root. */
+declare function relativePathFromMediaParentId(dataSource: DataSource, entityMap: EntityMap, parentId: number | null): Promise<string>;
+
+declare const ZIP_MIME_TYPES: Set<string>;
+declare function isZipMedia(mime: string | null | undefined, filename: string): boolean;
+
 declare class Permission {
     id: number;
     groupId: number;
@@ -1239,9 +1313,13 @@ declare class MessageTemplate {
 
 declare class Media {
     id: number;
+    kind: 'file' | 'folder';
+    parentId: number | null;
+    parent: Media | null;
+    children: Media[];
     filename: string;
-    url: string;
-    mimeType: string;
+    url: string | null;
+    mimeType: string | null;
     size: number;
     alt: string | null;
     isPublic: boolean;
@@ -1339,4 +1417,4 @@ declare class Wishlist {
 /** Map API resource segment (e.g. "blogs", "form_submissions") to entity. Used by CRUD handler. */
 declare const CMS_ENTITY_MAP: Record<string, EntityTarget<typeorm.ObjectLiteral>>;
 
-export { type AnalyticsPluginConfig, Attribute, Blog, Brand, CMS_ENTITY_MAP, type CachePluginConfig, type CacheService, type CaptchaProviderId, type CaptchaPublicConfig, CaptchaService, type CaptchaVerifyResult, Cart, CartItem, Category, ChatConversation, ChatMessage, type CmsApp, type CmsPlugin, Collection, Comment, CompanyDetails, Config, Contact, type CreateCmsAppOptions, type ERPPluginConfig, type ERPPluginInstance, ERPSubmissionService, type EmailData, type EmailJobPayload, type EmailPluginConfig, EmailService, type EmailServiceInterface, EmailTemplateName, EmailTemplateResult, EntityMap$1 as EntityMap, type ErpContactSyncInput, type ErpCreateContactPayload, type ErpJobPayload, type ErpPaidOrderDataSource, type ErpPaidOrderEntityMap, Form, FormField, FormSubmission, KnowledgeBaseChunk, KnowledgeBaseDocument, type LlmChatOptions, type LlmMessage, type LlmPluginConfig, LlmService, type LlmServiceInterface, type LocalStoragePluginConfig, type Logger, Media, MessageTemplate, Order, OrderItem, type OrderPlacedEmailPayload, OrderPlacedLineItem, OtpChallenge, type OtpChannel, type OtpPurpose, Page, PasswordResetToken, Payment, type PaymentIntent, type PaymentPluginConfig, type PaymentServiceInterface, Permission, type PipelineNames, type PluginContext, Product, ProductAttribute, ProductCategory, ProductTax, type QueuePluginConfig, type QueueService, type RenderEmailOptions, type RenderedEmail, type S3StoragePluginConfig, Seo, type SeoLike, type SeoMetadataOverrides, type SmsJobPayload, type SmsPluginConfig, type SmsProviderChoice, type SmsProviderId, type SmsServiceConfig, type SmsServiceInterface, StorageService, Tag, Tax, TemplateContext, User, UserGroup, Wishlist, WishlistItem, analyticsPlugin, assertCaptchaOk, buildCaptchaPublicConfig, cachePlugin, captchaPlugin, cn, countRecentOtpSends, createCmsApp, createOtpChallenge, emailPlugin, emailTemplates, erpPlugin, fetchSeoBySlug, formatDate, formatDateOnly, formatDateTime, generateNumericOtp, generateSlug, hashOtpCode, joinRecipientsForSend, linkUnclaimedContactToUser, llmPlugin, localStoragePlugin, mergeSeoBySlug, normalizePhoneE164, parseEmailRecipientsFromConfig, paymentPlugin, queueEmail, queueErp, queueErpCreateContactIfEnabled, queueErpPaidOrderForOrderId, queueOrderPlacedEmails, queuePlugin, queueSms, registerEmailQueueProcessor, registerErpQueueProcessor, registerSmsQueueProcessor, renderEmail, renderLayout, resolvePublicMetadata, s3StoragePlugin, serializeEmailRecipients, smsPlugin, truncateText, validateSlug, verifyAndConsumeOtpChallenge, verifyOtpCodeHash };
+export { Address, type AnalyticsPluginConfig, Attribute, Blog, Brand, CMS_ENTITY_MAP, type CachePluginConfig, type CacheService, type CaptchaProviderId, type CaptchaPublicConfig, CaptchaService, type CaptchaVerifyResult, Cart, CartItem, Category, ChatConversation, ChatMessage, type CmsApp, type CmsPlugin, Collection, Comment, CompanyDetails, Config, Contact, type CreateCmsAppOptions, type DataSourceManager, type ERPPluginConfig, type ERPPluginInstance, ERPSubmissionService, type EmailData, type EmailJobPayload, type EmailPluginConfig, EmailService, type EmailServiceInterface, EmailTemplateName, EmailTemplateResult, EntityMap$2 as EntityMap, type ErpContactSyncInput, type ErpCreateContactPayload, type ErpJobPayload, type ErpPaidOrderDataSource, type ErpPaidOrderEntityMap, type ExtraPublicWriteRule, Form, FormField, FormSubmission, KnowledgeBaseChunk, KnowledgeBaseDocument, type LlmChatOptions, type LlmMessage, type LlmPluginConfig, LlmService, type LlmServiceInterface, type LocalStoragePluginConfig, type Logger, Media, MessageTemplate, Order, OrderItem, type OrderPlacedEmailPayload, OrderPlacedLineItem, OtpChallenge, type OtpChannel, type OtpPurpose, Page, PasswordResetToken, Payment, type PaymentIntent, type PaymentPluginConfig, type PaymentServiceInterface, Permission, type PipelineNames, type PluginContext, Product, ProductAttribute, ProductCategory, ProductTax, type PublicThemeSettingsPayload, type QueuePluginConfig, type QueueService, type RenderEmailOptions, type RenderedEmail, type S3StoragePluginConfig, Seo, type SeoLike, type SeoMetadataOverrides, type SmsJobPayload, type SmsPluginConfig, type SmsProviderChoice, type SmsProviderId, type SmsServiceConfig, type SmsServiceInterface, StorageService, Tag, Tax, TemplateContext, User, UserGroup, Wishlist, WishlistItem, ZIP_MIME_TYPES, allowRateLimit, analyticsPlugin, assertCaptchaOk, buildCaptchaPublicConfig, cachePlugin, captchaPlugin, cn, countRecentOtpSends, createCmsApp, createDataSourceManager, createOtpChallenge, emailPlugin, emailTemplates, erpPlugin, fetchSeoBySlug, formatDate, formatDateOnly, formatDateTime, generateNumericOtp, generateSlug, hashOtpCode, isZipMedia, joinRecipientsForSend, linkUnclaimedContactToUser, llmPlugin, loadPublicThemeSettings, localStoragePlugin, mergeSeoBySlug, normalizePhoneE164, parseEmailRecipientsFromConfig, paymentPlugin, queueEmail, queueErp, queueErpCreateContactIfEnabled, queueErpPaidOrderForOrderId, queueOrderPlacedEmails, queuePlugin, queueSms, rateLimitCheckoutPost, rateLimitKeyForApiRequest, rateLimitPublicApiIfNeeded, registerEmailQueueProcessor, registerErpQueueProcessor, registerSmsQueueProcessor, relativePathFromMediaParentId, renderEmail, renderLayout, resolvePublicMetadata, s3StoragePlugin, sanitizeMediaFolderPath, sanitizeStorageSegment, seedDefaultAdmin, sendOrderPlacedEmailsAfterConfirmation, serializeEmailRecipients, shouldRateLimitPublicWrite, smsPlugin, truncateText, validateSlug, verifyAndConsumeOtpChallenge, verifyOtpCodeHash };

package/dist/index.d.ts

@@ -1,9 +1,10 @@
-import { C as CompanyDetails, T as TemplateContext, E as EmailTemplateResult, a as EmailTemplateName, O as OrderPlacedLineItem, S as StorageService, b as EntityMap$1 } from './index-BiagwMjV.js';
-export { A as AnalyticsHandlerConfig, c as AuthHandlersConfig, B as BlogBySlugConfig, d as ChangePasswordConfig, e as CmsApiHandlerConfig, f as CmsGetter, g as CrudHandlerOptions, D as DashboardStatsConfig, F as ForgotPasswordConfig, h as FormBySlugConfig, G as GetPublicSettingsGroupConfig, i as GetPublicSettingsGroupDataSource, I as InviteAcceptConfig, j as SetPasswordConfig, k as SettingsApiConfig, l as SocialLinkItem, m as StorefrontApiConfig, n as StorefrontOtpFlags, U as UploadHandlerConfig, o as UserAuthApiConfig, p as UserAvatarConfig, q as UserProfileConfig, r as UsersApiConfig, s as createAnalyticsHandlers, t as createBlogBySlugHandler, u as createChangePasswordHandler, v as createCmsApiHandler, w as createCrudByIdHandler, x as createCrudHandler, y as createDashboardStatsHandler, z as createForgotPasswordHandler, H as createFormBySlugHandler, J as createInviteAcceptHandler, K as createSetPasswordHandler, L as createSettingsApiHandlers, M as createStorefrontApiHandler, N as createUploadHandler, P as createUserAuthApiRouter, Q as createUserAvatarHandler, R as createUserProfileHandler, V as createUsersApiHandlers, W as getCompanyDetailsFromSettings, X as getPublicSettingsGroup, Y as mergeEmailLayoutCompanyDetails } from './index-BiagwMjV.js';
+import { C as CompanyDetails, T as TemplateContext, E as EmailTemplateResult, a as EmailTemplateName, O as OrderPlacedLineItem, S as StorageService, b as EntityMap$2 } from './index-C85X7cc7.js';
+export { A as AnalyticsHandlerConfig, c as AuthHandlersConfig, B as BlogBySlugConfig, d as ChangePasswordConfig, e as CmsApiHandlerConfig, f as CmsGetter, g as CrudHandlerOptions, D as DashboardStatsConfig, h as EcommerceAnalyticsConfig, F as ForgotPasswordConfig, i as FormBySlugConfig, G as GetPublicSettingsGroupConfig, j as GetPublicSettingsGroupDataSource, I as InviteAcceptConfig, k as SetPasswordConfig, l as SettingsApiConfig, m as SocialLinkItem, n as StorefrontApiConfig, o as StorefrontOtpFlags, U as UploadHandlerConfig, p as UserAuthApiConfig, q as UserAvatarConfig, r as UserProfileConfig, s as UsersApiConfig, t as createAnalyticsHandlers, u as createBlogBySlugHandler, v as createChangePasswordHandler, w as createCmsApiHandler, x as createCrudByIdHandler, y as createCrudHandler, z as createDashboardStatsHandler, H as createEcommerceAnalyticsHandler, J as createForgotPasswordHandler, K as createFormBySlugHandler, L as createInviteAcceptHandler, M as createMediaZipExtractHandler, N as createSetPasswordHandler, P as createSettingsApiHandlers, Q as createStorefrontApiHandler, R as createUploadHandler, V as createUserAuthApiRouter, W as createUserAvatarHandler, X as createUserProfileHandler, Y as createUsersApiHandlers, Z as getCompanyDetailsFromSettings, _ as getPublicSettingsGroup, $ as mergeEmailLayoutCompanyDetails } from './index-C85X7cc7.js';
 import { ClassValue } from 'clsx';
 import * as typeorm from 'typeorm';
 import { DataSource, EntityTarget, ObjectLiteral } from 'typeorm';
 import { Metadata } from 'next';
+import { N as NavbarConfig, F as FooterConfig } from './types-D34wmivy.js';
 export { A as ADMIN_GROUP_NAME, a as AuthHelpers, E as EntityCrudAction, b as EntityPermissionFlags, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, S as SessionUser, c as canManageRoles, d as createAuthHelpers, g as getPermissionableEntityKeys, e as getRequiredPermission, h as hasEntityPermission, i as isOpenEndpoint, f as isPublicMethod, j as isSuperAdminGroupName, p as permissionRowsToRecord, s as sessionHasEntityAccess } from './helpers-dlrF_49e.js';
 export { AuthorizeOtpInput, CmsMiddlewareConfig, NextAuthOptionsConfig, NextAuthUser, createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, seedAdministratorPermissions } from './auth.js';
 export { A as AdminNavItem, D as DEFAULT_ADMIN_NAV } from './config-DJ5CmQvS.js';
@@ -630,7 +631,7 @@ type SeoMetadataOverrides = {
 };
 /** Per-field: join row wins over slug row. */
 declare function mergeSeoBySlug(join: SeoLike | null | undefined, bySlug: SeoLike | null): SeoLike | null;
-declare function fetchSeoBySlug(dataSource: DataSource, entityMap: EntityMap$1, slug: string): Promise<SeoLike | null>;
+declare function fetchSeoBySlug(dataSource: DataSource, entityMap: EntityMap$2, slug: string): Promise<SeoLike | null>;
 /**
  * Build Next.js Metadata from merged SEO + optional layers.
  * `overrides` win over SEO; `fallbacks` apply when SEO (and overrides) omit a field.
@@ -638,7 +639,7 @@ declare function fetchSeoBySlug(dataSource: DataSource, entityMap: EntityMap$1,
  */
 declare function resolvePublicMetadata(args: {
     dataSource: DataSource;
-    entityMap: EntityMap$1;
+    entityMap: EntityMap$2;
     slug: string;
     seoFromJoin?: SeoLike | null;
     overrides?: SeoMetadataOverrides;
@@ -664,9 +665,9 @@ declare function verifyOtpCodeHash(code: string, storedHash: string, purpose: st
 declare function generateNumericOtp(length?: number): string;
 /** Normalize to E.164-like +digits */
 declare function normalizePhoneE164(raw: string, defaultCountryCode?: string): string | null;
-type EntityMap = Record<string, EntityTarget<ObjectLiteral>>;
-declare function countRecentOtpSends(dataSource: DataSource, entityMap: EntityMap, purpose: OtpPurpose, identifier: string, since: Date): Promise<number>;
-declare function createOtpChallenge(dataSource: DataSource, entityMap: EntityMap, input: {
+type EntityMap$1 = Record<string, EntityTarget<ObjectLiteral>>;
+declare function countRecentOtpSends(dataSource: DataSource, entityMap: EntityMap$1, purpose: OtpPurpose, identifier: string, since: Date): Promise<number>;
+declare function createOtpChallenge(dataSource: DataSource, entityMap: EntityMap$1, input: {
     purpose: OtpPurpose;
     channel: OtpChannel;
     identifier: string;
@@ -679,7 +680,7 @@ declare function createOtpChallenge(dataSource: DataSource, entityMap: EntityMap
     error: string;
     status: number;
 }>;
-declare function verifyAndConsumeOtpChallenge(dataSource: DataSource, entityMap: EntityMap, input: {
+declare function verifyAndConsumeOtpChallenge(dataSource: DataSource, entityMap: EntityMap$1, input: {
     purpose: OtpPurpose;
     identifier: string;
     code: string;
@@ -692,6 +693,79 @@ declare function verifyAndConsumeOtpChallenge(dataSource: DataSource, entityMap:
     status: number;
 }>;
 
+/** Returns true if request is allowed; false if rate limited. */
+declare function allowRateLimit(key: string): Promise<boolean>;
+type ExtraPublicWriteRule = (method: string, segments: string[]) => boolean;
+/** Segments are path parts after `/api/` (e.g. `['form-submissions']`). */
+declare function shouldRateLimitPublicWrite(method: string, segments: string[], extraRule?: ExtraPublicWriteRule): boolean;
+declare function rateLimitKeyForApiRequest(req: Request, segments: string[]): string;
+declare function rateLimitPublicApiIfNeeded(req: Request, method: string, segments: string[], options?: {
+    extraRule?: ExtraPublicWriteRule;
+}): Promise<Response | null>;
+declare function rateLimitCheckoutPost(req: Request): Promise<Response | null>;
+
+interface EntityMapLike {
+    configs: unknown;
+    orders: unknown;
+    order_items: unknown;
+}
+interface SendOrderPlacedEmailDeps {
+    getDataSource: () => Promise<DataSource>;
+    entityMap: EntityMapLike;
+    getCms: () => Promise<CmsApp>;
+}
+/** After payment confirmation: email customer + each sales team address from plugin settings. */
+declare function sendOrderPlacedEmailsAfterConfirmation(orderId: number, deps: SendOrderPlacedEmailDeps): Promise<void>;
+
+interface DataSourceManager {
+    getDataSource: () => DataSource;
+    getDataSourceInitialized: () => Promise<DataSource>;
+    resetDataSource: () => void;
+    registerOnReset: (cb: () => void) => void;
+    isConnectionError: (e: unknown) => boolean;
+}
+declare function createDataSourceManager(entityMap: Record<string, unknown>, options?: {
+    databaseUrl?: string;
+    idleTimeoutMillis?: number;
+}): DataSourceManager;
+
+interface SeedEntityMap {
+    users: unknown;
+    user_groups: unknown;
+}
+declare function seedDefaultAdmin(ds: DataSource, entityMap: SeedEntityMap, opts?: {
+    email?: string;
+    password?: string;
+}): Promise<void>;
+
+interface PublicThemeSettingsPayload {
+    activeThemeId: string;
+    primaryColor: string;
+    secondaryColor: string;
+    navbarConfig: NavbarConfig;
+    footerOverrides: Partial<FooterConfig>;
+}
+declare function loadPublicThemeSettings(config: {
+    dataSource: DataSource;
+    entityMap: EntityMap$2;
+    encryptionKey?: string;
+    defaultActiveThemeId?: string;
+    defaultPrimaryColor?: string;
+    defaultSecondaryColor?: string;
+}): Promise<PublicThemeSettingsPayload>;
+
+/** Normalize a logical media folder path: no leading/trailing slashes, no ".." segments, max length. */
+declare function sanitizeMediaFolderPath(input: unknown): string;
+/** Single path segment for storage (folder name or legacy path segment). */
+declare function sanitizeStorageSegment(name: string): string;
+
+type EntityMap = Record<string, EntityTarget<ObjectLiteral>>;
+/** Build `a/b/c` path under `uploads/` from the chain of folder rows up to root. */
+declare function relativePathFromMediaParentId(dataSource: DataSource, entityMap: EntityMap, parentId: number | null): Promise<string>;
+
+declare const ZIP_MIME_TYPES: Set<string>;
+declare function isZipMedia(mime: string | null | undefined, filename: string): boolean;
+
 declare class Permission {
     id: number;
     groupId: number;
@@ -1239,9 +1313,13 @@ declare class MessageTemplate {
 
 declare class Media {
     id: number;
+    kind: 'file' | 'folder';
+    parentId: number | null;
+    parent: Media | null;
+    children: Media[];
     filename: string;
-    url: string;
-    mimeType: string;
+    url: string | null;
+    mimeType: string | null;
     size: number;
     alt: string | null;
     isPublic: boolean;
@@ -1339,4 +1417,4 @@ declare class Wishlist {
 /** Map API resource segment (e.g. "blogs", "form_submissions") to entity. Used by CRUD handler. */
 declare const CMS_ENTITY_MAP: Record<string, EntityTarget<typeorm.ObjectLiteral>>;
 
-export { type AnalyticsPluginConfig, Attribute, Blog, Brand, CMS_ENTITY_MAP, type CachePluginConfig, type CacheService, type CaptchaProviderId, type CaptchaPublicConfig, CaptchaService, type CaptchaVerifyResult, Cart, CartItem, Category, ChatConversation, ChatMessage, type CmsApp, type CmsPlugin, Collection, Comment, CompanyDetails, Config, Contact, type CreateCmsAppOptions, type ERPPluginConfig, type ERPPluginInstance, ERPSubmissionService, type EmailData, type EmailJobPayload, type EmailPluginConfig, EmailService, type EmailServiceInterface, EmailTemplateName, EmailTemplateResult, EntityMap$1 as EntityMap, type ErpContactSyncInput, type ErpCreateContactPayload, type ErpJobPayload, type ErpPaidOrderDataSource, type ErpPaidOrderEntityMap, Form, FormField, FormSubmission, KnowledgeBaseChunk, KnowledgeBaseDocument, type LlmChatOptions, type LlmMessage, type LlmPluginConfig, LlmService, type LlmServiceInterface, type LocalStoragePluginConfig, type Logger, Media, MessageTemplate, Order, OrderItem, type OrderPlacedEmailPayload, OrderPlacedLineItem, OtpChallenge, type OtpChannel, type OtpPurpose, Page, PasswordResetToken, Payment, type PaymentIntent, type PaymentPluginConfig, type PaymentServiceInterface, Permission, type PipelineNames, type PluginContext, Product, ProductAttribute, ProductCategory, ProductTax, type QueuePluginConfig, type QueueService, type RenderEmailOptions, type RenderedEmail, type S3StoragePluginConfig, Seo, type SeoLike, type SeoMetadataOverrides, type SmsJobPayload, type SmsPluginConfig, type SmsProviderChoice, type SmsProviderId, type SmsServiceConfig, type SmsServiceInterface, StorageService, Tag, Tax, TemplateContext, User, UserGroup, Wishlist, WishlistItem, analyticsPlugin, assertCaptchaOk, buildCaptchaPublicConfig, cachePlugin, captchaPlugin, cn, countRecentOtpSends, createCmsApp, createOtpChallenge, emailPlugin, emailTemplates, erpPlugin, fetchSeoBySlug, formatDate, formatDateOnly, formatDateTime, generateNumericOtp, generateSlug, hashOtpCode, joinRecipientsForSend, linkUnclaimedContactToUser, llmPlugin, localStoragePlugin, mergeSeoBySlug, normalizePhoneE164, parseEmailRecipientsFromConfig, paymentPlugin, queueEmail, queueErp, queueErpCreateContactIfEnabled, queueErpPaidOrderForOrderId, queueOrderPlacedEmails, queuePlugin, queueSms, registerEmailQueueProcessor, registerErpQueueProcessor, registerSmsQueueProcessor, renderEmail, renderLayout, resolvePublicMetadata, s3StoragePlugin, serializeEmailRecipients, smsPlugin, truncateText, validateSlug, verifyAndConsumeOtpChallenge, verifyOtpCodeHash };
+export { Address, type AnalyticsPluginConfig, Attribute, Blog, Brand, CMS_ENTITY_MAP, type CachePluginConfig, type CacheService, type CaptchaProviderId, type CaptchaPublicConfig, CaptchaService, type CaptchaVerifyResult, Cart, CartItem, Category, ChatConversation, ChatMessage, type CmsApp, type CmsPlugin, Collection, Comment, CompanyDetails, Config, Contact, type CreateCmsAppOptions, type DataSourceManager, type ERPPluginConfig, type ERPPluginInstance, ERPSubmissionService, type EmailData, type EmailJobPayload, type EmailPluginConfig, EmailService, type EmailServiceInterface, EmailTemplateName, EmailTemplateResult, EntityMap$2 as EntityMap, type ErpContactSyncInput, type ErpCreateContactPayload, type ErpJobPayload, type ErpPaidOrderDataSource, type ErpPaidOrderEntityMap, type ExtraPublicWriteRule, Form, FormField, FormSubmission, KnowledgeBaseChunk, KnowledgeBaseDocument, type LlmChatOptions, type LlmMessage, type LlmPluginConfig, LlmService, type LlmServiceInterface, type LocalStoragePluginConfig, type Logger, Media, MessageTemplate, Order, OrderItem, type OrderPlacedEmailPayload, OrderPlacedLineItem, OtpChallenge, type OtpChannel, type OtpPurpose, Page, PasswordResetToken, Payment, type PaymentIntent, type PaymentPluginConfig, type PaymentServiceInterface, Permission, type PipelineNames, type PluginContext, Product, ProductAttribute, ProductCategory, ProductTax, type PublicThemeSettingsPayload, type QueuePluginConfig, type QueueService, type RenderEmailOptions, type RenderedEmail, type S3StoragePluginConfig, Seo, type SeoLike, type SeoMetadataOverrides, type SmsJobPayload, type SmsPluginConfig, type SmsProviderChoice, type SmsProviderId, type SmsServiceConfig, type SmsServiceInterface, StorageService, Tag, Tax, TemplateContext, User, UserGroup, Wishlist, WishlistItem, ZIP_MIME_TYPES, allowRateLimit, analyticsPlugin, assertCaptchaOk, buildCaptchaPublicConfig, cachePlugin, captchaPlugin, cn, countRecentOtpSends, createCmsApp, createDataSourceManager, createOtpChallenge, emailPlugin, emailTemplates, erpPlugin, fetchSeoBySlug, formatDate, formatDateOnly, formatDateTime, generateNumericOtp, generateSlug, hashOtpCode, isZipMedia, joinRecipientsForSend, linkUnclaimedContactToUser, llmPlugin, loadPublicThemeSettings, localStoragePlugin, mergeSeoBySlug, normalizePhoneE164, parseEmailRecipientsFromConfig, paymentPlugin, queueEmail, queueErp, queueErpCreateContactIfEnabled, queueErpPaidOrderForOrderId, queueOrderPlacedEmails, queuePlugin, queueSms, rateLimitCheckoutPost, rateLimitKeyForApiRequest, rateLimitPublicApiIfNeeded, registerEmailQueueProcessor, registerErpQueueProcessor, registerSmsQueueProcessor, relativePathFromMediaParentId, renderEmail, renderLayout, resolvePublicMetadata, s3StoragePlugin, sanitizeMediaFolderPath, sanitizeStorageSegment, seedDefaultAdmin, sendOrderPlacedEmailsAfterConfirmation, serializeEmailRecipients, shouldRateLimitPublicWrite, smsPlugin, truncateText, validateSlug, verifyAndConsumeOtpChallenge, verifyOtpCodeHash };