@infuro/cms-core 1.0.31 → 1.0.33

package/dist/index.cjs

@@ -1296,6 +1296,8 @@ __export(src_exports, {
   hasEntityPermission: () => hasEntityPermission,
   hashOtpCode: () => hashOtpCode,
   hydrateVendorSessionUser: () => hydrateVendorSessionUser,
+  isAuthDebugClientEnabled: () => isAuthDebugClientEnabled,
+  isAuthDebugEnabled: () => isAuthDebugEnabled,
   isCustomerTypeContact: () => isCustomerTypeContact,
   isOpenEndpoint: () => isOpenEndpoint,
   isPlatformAdministrator: () => isPlatformAdministrator,
@@ -1314,6 +1316,8 @@ __export(src_exports, {
   loadPublicThemeSettings: () => loadPublicThemeSettings,
   loadUserVendorContext: () => loadUserVendorContext,
   localStoragePlugin: () => localStoragePlugin,
+  logAuth: () => logAuth,
+  logAuthClient: () => logAuthClient,
   logEntityAccessDecision: () => logEntityAccessDecision,
   logRbac: () => logRbac,
   mergeEmailLayoutCompanyDetails: () => mergeEmailLayoutCompanyDetails,
@@ -1323,6 +1327,7 @@ __export(src_exports, {
   metaPostPageFeed: () => metaPostPageFeed,
   metaPostPagePhoto: () => metaPostPagePhoto,
   metaResolvePageAccessToken: () => metaResolvePageAccessToken,
+  nextAuthCookieDebugInfo: () => nextAuthCookieDebugInfo,
   normalizePhoneE164: () => normalizePhoneE164,
   parseBlogGeneratorAgentContent: () => parseBlogGeneratorAgentContent,
   parseBlogGeneratorModelOutput: () => parseBlogGeneratorModelOutput,
@@ -1370,6 +1375,7 @@ __export(src_exports, {
   smsPlugin: () => smsPlugin,
   socialMediaPlugin: () => socialMediaPlugin,
   summarizeEntityPerms: () => summarizeEntityPerms,
+  summarizeSessionUserForLog: () => summarizeSessionUserForLog,
   syncJobScheduleToPgBoss: () => syncJobScheduleToPgBoss,
   truncateText: () => truncateText,
   validateScheduleInput: () => validateScheduleInput,
@@ -2497,6 +2503,58 @@ function escapeHtml7(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
+// src/plugins/email/templates/chatLead.ts
+function render10(ctx) {
+  const {
+    contactName,
+    contactEmail,
+    contactPhone,
+    conversationId,
+    latestMessage,
+    intentCode,
+    intentReason,
+    transcript,
+    companyDetails
+  } = ctx;
+  const intentDisplay = intentCode?.trim() ? `${intentCode.trim()}${intentReason?.trim() ? ` \u2014 ${intentReason.trim()}` : ""}` : intentReason;
+  const subject = `Chat lead${intentCode?.trim() ? ` [${intentCode.trim()}]` : ""}: ${contactName || contactEmail || "Visitor"}`;
+  const transcriptBlock = transcript?.trim() ? `<div style="margin-top:16px;padding:12px;background:#f9fafb;border-radius:6px;border:1px solid #e5e7eb;">
+<p style="margin:0 0 8px 0;font-size:13px;font-weight:600;color:#374151;">Recent conversation</p>
+<pre style="margin:0;font-size:12px;white-space:pre-wrap;font-family:inherit;color:#4b5563;">${escapeHtml8(transcript.trim())}</pre>
+</div>` : "";
+  const bodyHtml = `<p style="margin:0 0 6px 0;font-size:18px;font-weight:600;color:#111;">New chat lead</p>
+<p style="margin:0 0 12px 0;font-size:14px;color:#374151;">A visitor showed interest based on your intent rules.</p>
+<table style="width:100%;border-collapse:collapse;font-size:14px;">
+<tr><td style="padding:4px 8px 4px 0;color:#6b7280;vertical-align:top;">Name</td><td>${escapeHtml8(contactName || "\u2014")}</td></tr>
+<tr><td style="padding:4px 8px 4px 0;color:#6b7280;vertical-align:top;">Email</td><td><a href="mailto:${escapeHtml8(contactEmail)}">${escapeHtml8(contactEmail)}</a></td></tr>
+<tr><td style="padding:4px 8px 4px 0;color:#6b7280;vertical-align:top;">Phone</td><td>${escapeHtml8(contactPhone?.trim() || "\u2014")}</td></tr>
+<tr><td style="padding:4px 8px 4px 0;color:#6b7280;vertical-align:top;">Conversation</td><td>#${conversationId}</td></tr>
+<tr><td style="padding:4px 8px 4px 0;color:#6b7280;vertical-align:top;">Intent</td><td>${escapeHtml8(intentReason)}</td></tr>
+</table>
+<p style="margin:16px 0 6px 0;font-size:13px;font-weight:600;color:#374151;">Latest message</p>
+<p style="margin:0;font-size:14px;white-space:pre-wrap;">${escapeHtml8(latestMessage)}</p>
+${transcriptBlock}`;
+  const text = [
+    "New chat lead",
+    `Name: ${contactName || "\u2014"}`,
+    `Email: ${contactEmail}`,
+    `Phone: ${contactPhone?.trim() || "\u2014"}`,
+    `Conversation: #${conversationId}`,
+    `Intent: ${intentDisplay}`,
+    "",
+    "Latest message:",
+    latestMessage,
+    transcript?.trim() ? `
+Recent conversation:
+${transcript.trim()}` : ""
+  ].join("\n");
+  const html = renderLayout({ bodyHtml, companyDetails });
+  return { subject, html, text };
+}
+function escapeHtml8(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
 // src/plugins/email/templates/index.ts
 var templateRenderMap = {
   signup: render,
@@ -2507,7 +2565,8 @@ var templateRenderMap = {
   shippingUpdate: render6,
   invite: render7,
   formSubmission: render8,
-  otp: render9
+  otp: render9,
+  chatLead: render10
 };
 function getTemplateRenderer(name) {
   return templateRenderMap[name];
@@ -2524,11 +2583,11 @@ function renderEmail(templateName, ctx, options) {
       return { subject: custom.subject, html, text: custom.text };
     }
   }
-  const render10 = getTemplateRenderer(templateName);
-  if (!render10) {
+  const render11 = getTemplateRenderer(templateName);
+  if (!render11) {
     throw new Error(`Unknown email template: ${templateName}`);
   }
-  return render10(ctx);
+  return render11(ctx);
 }
 
 // src/plugins/email/email-service.ts
@@ -2600,6 +2659,10 @@ var EmailService = class {
   renderTemplate(templateName, ctx) {
     return renderEmail(templateName, ctx, this.templateOptions);
   }
+  /** Default notification recipient from plugin config (SMTP_TO / plugin `to`). */
+  getDefaultTo() {
+    return this.config.to;
+  }
 };
 var emailTemplates = {
   formSubmission: (data) => ({
@@ -2630,6 +2693,434 @@ This link expires in 1 hour.`
 
 // src/plugins/email/index.ts
 init_email_queue();
+
+// src/plugins/email/chat-lead-email.ts
+init_email_queue();
+
+// src/lib/email-recipients.ts
+function parseEmailRecipientsFromConfig(raw) {
+  if (raw == null || raw === "") return [];
+  const trimmed = raw.trim();
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed)) {
+        return parsed.map((e) => String(e).trim()).filter(Boolean);
+      }
+    } catch {
+    }
+  }
+  return trimmed.split(/[,;]+/).map((s) => s.trim()).filter(Boolean);
+}
+function serializeEmailRecipients(emails) {
+  return JSON.stringify(emails);
+}
+function joinRecipientsForSend(emails) {
+  if (!emails.length) return null;
+  return emails.join(", ");
+}
+
+// src/plugins/llm/chat-email-intent.ts
+var NONE_INTENT = "NONE";
+var CHAT_EMAIL_LOG = "[chat-email-tool]";
+function logChatEmail(step, data) {
+  if (data && Object.keys(data).length > 0) {
+    console.info(CHAT_EMAIL_LOG, step, data);
+  } else {
+    console.info(CHAT_EMAIL_LOG, step);
+  }
+}
+function normalizeIntentKey(raw) {
+  return raw.trim().toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function parseIntentsJson(raw) {
+  if (!raw?.trim()) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return null;
+    const out = [];
+    for (const row of parsed) {
+      if (!row || typeof row !== "object") continue;
+      const o = row;
+      const intent = normalizeIntentKey(String(o.intent ?? o.id ?? ""));
+      const description = String(o.description ?? "").trim();
+      const emailTo = String(o.emailTo ?? o.email ?? "").trim();
+      if (!intent || !description || !emailTo) continue;
+      out.push({ intent, description, emailTo });
+    }
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+function dedupeIntents(intents) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const row of intents) {
+    const key = normalizeIntentKey(row.intent);
+    if (!key || seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      intent: key,
+      description: row.description.trim(),
+      emailTo: row.emailTo.trim()
+    });
+  }
+  return out;
+}
+function parseChatEmailToolSettings(map) {
+  const fromJson = parseIntentsJson(map.emailIntents);
+  const intents = dedupeIntents(fromJson ?? []);
+  const legacyPositive = map.emailIntentPrompt?.trim() ?? "";
+  const legacyNegative = map.emailNegativeIntentPrompt?.trim() ?? "";
+  let classifierInstructions = map.emailClassifierInstructions?.trim() ?? "";
+  if (!classifierInstructions && (legacyPositive || legacyNegative)) {
+    const parts = [];
+    if (legacyPositive) parts.push(`Legacy positive signals:
+${legacyPositive}`);
+    if (legacyNegative) parts.push(`Do NOT assign an intent when:
+${legacyNegative}`);
+    classifierInstructions = parts.join("\n\n");
+  }
+  return {
+    enabled: map.emailToolEnabled === "true",
+    intents,
+    classifierInstructions,
+    toolPrompt: map.emailToolPrompt ?? ""
+  };
+}
+var EMAIL_TOOL_VALIDATION_KEY = "emailTool";
+function parseEmailToolObject(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const o = raw;
+  const intentsRaw = o.intents;
+  let intents;
+  if (Array.isArray(intentsRaw)) {
+    const parsed = parseIntentsJson(JSON.stringify(intentsRaw));
+    if (parsed?.length) intents = parsed;
+  }
+  return {
+    enabled: o.enabled === true,
+    classifierInstructions: typeof o.classifierInstructions === "string" ? o.classifierInstructions.trim() : void 0,
+    toolPrompt: typeof o.toolPrompt === "string" ? o.toolPrompt.trim() : void 0,
+    intents
+  };
+}
+function parseEmailToolFromAgentValidationRules(validationRulesText) {
+  const raw = validationRulesText?.trim();
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const emailTool = parsed[EMAIL_TOOL_VALIDATION_KEY];
+    return parseEmailToolObject(emailTool);
+  } catch {
+    return null;
+  }
+}
+function resolveChatEmailToolSettings(configMap, sources) {
+  const fromConfig = parseChatEmailToolSettings(configMap);
+  const resolved = typeof sources === "string" || sources == null ? { chatbotValidationRules: typeof sources === "string" ? sources : null } : sources;
+  const fromChatbot = parseEmailToolFromAgentValidationRules(resolved.chatbotValidationRules);
+  const fromNotify = resolved.notifyAgent ? parseEmailToolFromAgentValidationRules(resolved.notifyAgent.validationRules) : null;
+  const notifySystem = resolved.notifyAgent?.systemInstruction?.trim() ?? "";
+  const intents = fromNotify?.intents?.length ? fromNotify.intents : fromChatbot?.intents?.length ? fromChatbot.intents : fromConfig.intents;
+  const classifierParts = [
+    notifySystem,
+    fromNotify?.classifierInstructions?.trim(),
+    fromChatbot?.classifierInstructions?.trim(),
+    fromConfig.classifierInstructions.trim()
+  ].filter(Boolean);
+  const toolPrompt = fromNotify?.toolPrompt?.trim() || fromChatbot?.toolPrompt?.trim() || fromConfig.toolPrompt?.trim() || "";
+  return {
+    enabled: fromConfig.enabled,
+    intents,
+    classifierInstructions: classifierParts.join("\n\n"),
+    toolPrompt
+  };
+}
+function intentByKey(intents, key) {
+  if (!key) return null;
+  const norm3 = normalizeIntentKey(key);
+  return intents.find((i) => i.intent === norm3) ?? null;
+}
+function buildIntentTableForPrompt(intents) {
+  return intents.map((i) => `- ${i.intent}: ${i.description} \u2192 notify ${i.emailTo}`).join("\n");
+}
+function buildIntentClassifierSystem(config, agentClassifierInstructions) {
+  const table = buildIntentTableForPrompt(config.intents);
+  const extra = [agentClassifierInstructions?.trim(), config.classifierInstructions.trim()].filter(Boolean).join("\n\n");
+  const intentKeys = config.intents.map((i) => i.intent).join(", ");
+  return `You classify a chat visitor into exactly one lead intent for email routing.
+
+Available intents (pick the best match):
+${table}
+
+If the visitor is not ready for a lead email (general FAQ, greetings only, spam, off-topic, no clear business need), use intent "${NONE_INTENT}".
+
+Allowed intent values: ${intentKeys}, or ${NONE_INTENT}.
+
+${extra ? `Additional instructions:
+${extra}
+` : ""}
+Reply with ONLY valid JSON, no markdown:
+{"intent":"INTENT_KEY","reason":"short explanation"}
+Use "${NONE_INTENT}" when no intent applies.`;
+}
+function buildChatEmailAgentContext(settings) {
+  if (!settings.enabled) return "";
+  const classifier = settings.classifierInstructions.trim();
+  const extra = settings.toolPrompt?.trim() ?? "";
+  const parts = [];
+  if (settings.intents.length > 0) {
+    parts.push(
+      "## Lead email routing",
+      "When a visitor message clearly matches an intent below, the system sends one team notification email (per conversation). Continue the conversation normally in all cases."
+    );
+    if (classifier) parts.push(`### Routing rules
+${classifier}`);
+    parts.push(`### Intent catalog
+${buildIntentTableForPrompt(settings.intents)}`);
+  } else if (classifier) {
+    parts.push(`## Lead email routing
+${classifier}`);
+  }
+  if (extra) parts.push(`### Assistant behavior
+${extra}`);
+  return parts.join("\n\n");
+}
+function buildChatbotSystemPromptWithEmailTool(baseSystemInstruction, guardrailsForPrompt, emailSettings) {
+  let prompt = (baseSystemInstruction ?? "").trim();
+  const guard = guardrailsForPrompt?.trim();
+  if (guard) prompt = [prompt, guard].filter(Boolean).join("\n\n");
+  if (emailSettings.enabled) {
+    const emailCtx = buildChatEmailAgentContext(emailSettings);
+    if (emailCtx) prompt = [prompt, emailCtx].filter(Boolean).join("\n\n");
+  }
+  return prompt;
+}
+function formatTranscript(history, latestMessage, maxChars = 4e3) {
+  const lines = [];
+  for (const m of history) {
+    const role = m.role === "assistant" ? "Assistant" : m.role === "user" ? "Visitor" : "System";
+    lines.push(`${role}: ${m.content}`);
+  }
+  const last = history[history.length - 1];
+  if (!last || last.role !== "user" || last.content !== latestMessage) {
+    lines.push(`Visitor: ${latestMessage}`);
+  }
+  let text = lines.join("\n");
+  if (text.length > maxChars) text = text.slice(-maxChars);
+  return text;
+}
+function parseIntentJson(raw, intents) {
+  const trimmed = raw.trim();
+  const fence = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+  const candidate = (fence?.[1] ?? trimmed).trim();
+  const tryParse = (s) => {
+    const o = JSON.parse(s);
+    let intentRaw = null;
+    if (typeof o.intent === "string") intentRaw = o.intent;
+    else if (o.interested === false) intentRaw = NONE_INTENT;
+    else if (o.interested === true && intents[0]) intentRaw = intents[0].intent;
+    if (intentRaw == null) return null;
+    const reason = typeof o.reason === "string" && o.reason.trim() ? o.reason.trim() : "Classified from conversation";
+    return { intent: normalizeIntentKey(intentRaw), reason };
+  };
+  try {
+    return tryParse(candidate);
+  } catch {
+    const m = candidate.match(/\{[\s\S]*\}/);
+    if (!m) return null;
+    try {
+      return tryParse(m[0]);
+    } catch {
+      return null;
+    }
+  }
+}
+async function detectChatLeadIntent(llm, params) {
+  if (!params.settings.intents.length) {
+    logChatEmail("classify skipped", { reason: "no_intents_configured" });
+    return {
+      intent: null,
+      intentLabel: "NONE",
+      reason: "No lead intents configured",
+      emailTo: null
+    };
+  }
+  logChatEmail("classify start", {
+    intentCount: params.settings.intents.length,
+    intentKeys: params.settings.intents.map((i) => i.intent),
+    model: params.model?.trim() || "(gateway default)",
+    messageChars: params.message.length,
+    historyTurns: params.history.length,
+    hasClassifierInstructions: Boolean(
+      params.agentClassifierInstructions?.trim() || params.settings.classifierInstructions.trim()
+    )
+  });
+  const transcript = formatTranscript(params.history, params.message);
+  const contactLines = [
+    params.contact.name?.trim() ? `Name: ${params.contact.name.trim()}` : null,
+    params.contact.email?.trim() ? `Email: ${params.contact.email.trim()}` : null,
+    params.contact.phone?.trim() ? `Phone: ${params.contact.phone.trim()}` : null
+  ].filter(Boolean).join("\n");
+  const userPrompt = `Customer:
+${contactLines || "(unknown)"}
+
+Conversation:
+${transcript}
+
+Pick the single best intent for the visitor's latest message.`;
+  const res = await llm.chatAgent({
+    systemPrompt: buildIntentClassifierSystem(params.settings, params.agentClassifierInstructions),
+    userPrompt,
+    temperature: 0.1,
+    max_tokens: 256,
+    ...params.model?.trim() ? { model: params.model.trim() } : {}
+  });
+  const rawContent = res.content ?? "";
+  logChatEmail("classify llm response", {
+    responseChars: rawContent.length,
+    responsePreview: rawContent.slice(0, 280) + (rawContent.length > 280 ? "\u2026" : "")
+  });
+  const parsed = parseIntentJson(rawContent, params.settings.intents);
+  if (!parsed) {
+    logChatEmail("classify result", {
+      matched: false,
+      outcome: "parse_failed",
+      emailWillSend: false
+    });
+    return {
+      intent: null,
+      intentLabel: "Unclassified",
+      reason: "Could not parse intent classifier response",
+      emailTo: null
+    };
+  }
+  if (parsed.intent === NONE_INTENT) {
+    logChatEmail("classify result", {
+      matched: false,
+      outcome: NONE_INTENT,
+      reason: parsed.reason,
+      emailWillSend: false
+    });
+    return {
+      intent: null,
+      intentLabel: NONE_INTENT,
+      reason: parsed.reason,
+      emailTo: null
+    };
+  }
+  const matched = intentByKey(params.settings.intents, parsed.intent);
+  if (!matched) {
+    logChatEmail("classify result", {
+      matched: false,
+      outcome: "unknown_intent",
+      parsedIntent: parsed.intent,
+      reason: parsed.reason,
+      emailWillSend: false
+    });
+    return {
+      intent: null,
+      intentLabel: parsed.intent,
+      reason: `Unknown intent "${parsed.intent}": ${parsed.reason}`,
+      emailTo: null
+    };
+  }
+  logChatEmail("classify result", {
+    matched: true,
+    outcome: "intent_found",
+    intent: matched.intent,
+    emailTo: matched.emailTo,
+    reason: parsed.reason,
+    emailWillSend: true
+  });
+  return {
+    intent: matched.intent,
+    intentLabel: `${matched.intent} \u2014 ${matched.description}`,
+    reason: parsed.reason,
+    emailTo: matched.emailTo
+  };
+}
+function buildTranscriptForLeadEmail(history, latestMessage) {
+  return formatTranscript(history, latestMessage);
+}
+function parseIntentRecipientEmails(emailTo) {
+  return emailTo.split(/[,;]+/).map((s) => s.trim()).filter((s) => s.length > 0 && s.includes("@"));
+}
+
+// src/plugins/email/chat-lead-email.ts
+function resolveLeadRecipients(emailPlugin2, emailSettings) {
+  const fromCrm = parseEmailRecipientsFromConfig(
+    emailSettings.crmEmails ?? emailSettings.crmEmail ?? ""
+  );
+  if (fromCrm.length > 0) return fromCrm;
+  const fallback = emailPlugin2.getDefaultTo?.() ?? "";
+  if (fallback.trim()) return [fallback.trim()];
+  return [];
+}
+async function sendChatLeadEmail(cms, emailSettings, brandingSettings, input) {
+  console.info(CHAT_EMAIL_LOG, "send start", {
+    conversationId: input.conversationId,
+    intentCode: input.intentCode ?? null,
+    contactEmail: input.contactEmail,
+    contactName: input.contactName,
+    explicitRecipients: input.recipients?.length ?? 0
+  });
+  const email = cms.getPlugin("email");
+  if (!email?.send || !email.renderTemplate) {
+    console.warn(CHAT_EMAIL_LOG, "send failed", {
+      conversationId: input.conversationId,
+      reason: "email_plugin_disabled"
+    });
+    return { sent: false, recipients: [], error: "Email plugin is not enabled" };
+  }
+  const recipients = input.recipients?.filter((r) => r.trim().includes("@")).map((r) => r.trim()) ?? resolveLeadRecipients(email, emailSettings);
+  if (recipients.length === 0) {
+    console.warn(CHAT_EMAIL_LOG, "send failed", {
+      conversationId: input.conversationId,
+      reason: "no_recipients"
+    });
+    return {
+      sent: false,
+      recipients: [],
+      error: "No lead email recipients (configure intent Email To, CRM emails, or SMTP default To)"
+    };
+  }
+  console.info(CHAT_EMAIL_LOG, "send recipients resolved", {
+    conversationId: input.conversationId,
+    recipients,
+    source: input.recipients?.length ? "intent_email_to" : "crm_or_smtp_fallback"
+  });
+  const companyDetails = mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
+  const ctx = {
+    ...input,
+    companyDetails: input.companyDetails ?? companyDetails
+  };
+  let anySent = false;
+  for (const to of recipients) {
+    await queueEmail(cms, {
+      to,
+      templateName: "chatLead",
+      ctx
+    });
+    console.info(CHAT_EMAIL_LOG, "send queued", {
+      conversationId: input.conversationId,
+      to,
+      template: "chatLead"
+    });
+    anySent = true;
+  }
+  console.info(CHAT_EMAIL_LOG, "send complete", {
+    conversationId: input.conversationId,
+    sent: anySent,
+    recipientCount: recipients.length
+  });
+  return { sent: anySent, recipients };
+}
+
+// src/plugins/email/index.ts
 function emailPlugin(config) {
   return {
     name: "email",
@@ -3773,6 +4264,56 @@ ${context}`;
   }
 };
 
+// src/plugins/llm/llm-agent-scope.ts
+var LLM_AGENT_SCOPE_CHATBOT = "chatbot";
+var LLM_AGENT_SCOPE_BLOG_CREATION = "blog_creation";
+var LLM_AGENT_SCOPE_SOCIAL_MEDIA_POST = "social_media_post";
+var LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT = "email_intent_chatbot";
+var LLM_AGENT_SCOPE_BLOG_METADATA = "blog_metadata";
+var LLM_AGENT_SCOPES = [
+  LLM_AGENT_SCOPE_CHATBOT,
+  LLM_AGENT_SCOPE_BLOG_CREATION,
+  LLM_AGENT_SCOPE_SOCIAL_MEDIA_POST,
+  LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT,
+  LLM_AGENT_SCOPE_BLOG_METADATA
+];
+var LLM_AGENT_DEFAULT_SLUG_BY_SCOPE = {
+  [LLM_AGENT_SCOPE_CHATBOT]: "site-chat-assistant",
+  [LLM_AGENT_SCOPE_BLOG_CREATION]: "blog-generator",
+  [LLM_AGENT_SCOPE_SOCIAL_MEDIA_POST]: "blog-generator-social",
+  [LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT]: "email-intent-chatbot",
+  [LLM_AGENT_SCOPE_BLOG_METADATA]: "blog-generator-metadata"
+};
+var LLM_AGENT_DEFAULT_NAME_BY_SCOPE = {
+  [LLM_AGENT_SCOPE_CHATBOT]: "Site Chat Assistant",
+  [LLM_AGENT_SCOPE_BLOG_CREATION]: "Blog Generator",
+  [LLM_AGENT_SCOPE_SOCIAL_MEDIA_POST]: "Blog Generator (Social)",
+  [LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT]: "Chat Lead Intent Classifier",
+  [LLM_AGENT_SCOPE_BLOG_METADATA]: "Blog Generator (Metadata)"
+};
+var SITE_CHAT_ASSISTANT_SLUG = LLM_AGENT_DEFAULT_SLUG_BY_SCOPE[LLM_AGENT_SCOPE_CHATBOT];
+var SITE_CHAT_ASSISTANT_NAME = LLM_AGENT_DEFAULT_NAME_BY_SCOPE[LLM_AGENT_SCOPE_CHATBOT];
+function isLlmAgentScope(value) {
+  if (!value?.trim()) return false;
+  return LLM_AGENT_SCOPES.includes(value.trim());
+}
+var BLOG_LLM_AGENT_SLUGS = [
+  LLM_AGENT_DEFAULT_SLUG_BY_SCOPE[LLM_AGENT_SCOPE_BLOG_CREATION],
+  LLM_AGENT_DEFAULT_SLUG_BY_SCOPE[LLM_AGENT_SCOPE_BLOG_METADATA],
+  LLM_AGENT_DEFAULT_SLUG_BY_SCOPE[LLM_AGENT_SCOPE_SOCIAL_MEDIA_POST]
+];
+
+// src/plugins/llm/find-llm-agent-by-scope.ts
+async function findLlmAgentByScope(dataSource, entityMap, scope, options = {}) {
+  const { enabledOnly = true } = options;
+  const entity = entityMap.llm_agents;
+  if (!entity) return null;
+  const repo = dataSource.getRepository(entity);
+  const where = { scope, deleted: false };
+  if (enabledOnly) where.enabled = true;
+  return repo.findOne({ where });
+}
+
 // src/plugins/llm/index.ts
 function normalizeEmbeddingProvider(raw) {
   if (!raw) return "openai";
@@ -4142,6 +4683,7 @@ var LlmAgent = class {
   id;
   name;
   slug;
+  scope;
   systemInstruction;
   model;
   temperature;
@@ -4165,6 +4707,9 @@ __decorateClass([
 __decorateClass([
   (0, import_typeorm3.Column)("varchar")
 ], LlmAgent.prototype, "slug", 2);
+__decorateClass([
+  (0, import_typeorm3.Column)("varchar", { nullable: true })
+], LlmAgent.prototype, "scope", 2);
 __decorateClass([
   (0, import_typeorm3.Column)("text", { name: "system_instruction", default: "" })
 ], LlmAgent.prototype, "systemInstruction", 2);
@@ -4361,155 +4906,6 @@ async function persistAllGeneratedBlogDrafts(dataSource, maps, params) {
   return out;
 }
 
-// src/plugins/blog-generator/blog-generator-agent-defaults.ts
-var BLOG_GENERATOR_AGENT_NAME = "Blog Generator Agent";
-var BLOG_GENERATOR_LLM_AGENT_SLUG = "blog-generator";
-var BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR = "---BLOG_GENERATOR_NEXT---";
-var BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION = `You are a professional financial and business content writer.
-
-Your task is to generate completely original, high-quality blog article(s) from the latest RSS-derived source material in the user message (one block per feed). The user message is factual input only.
-
-IMPORTANT RULES:
-
-1. NEVER copy the RSS article directly.
-2. Rewrite the information into a fresh, human-like article.
-3. Expand the topic with professional insights and explanations.
-4. Maintain a natural editorial tone.
-5. Make the article SEO-friendly.
-6. Use engaging headings and subheadings.
-7. Avoid robotic AI phrasing.
-8. Do not mention that the content came from RSS or feeds.
-9. Preserve factual accuracy from the source material.
-10. The output should feel like a professionally written industry blog.
-
-MULTIPLE FEEDS:
-- If several feeds are provided, compare them: if they largely cover the same story or overlap heavily, produce ONE cohesive article.
-- If they cover clearly different topics or distinct stories, produce MULTIPLE articles (one per distinct story).
-- You may also produce one synthesis plus a short separate angle when that best serves the reader\u2014use your judgment.
-
-WRITING STYLE:
-- Professional
-- Clear
-- Informative
-- Business-focused
-- Human sounding
-- Modern editorial style
-
-ARTICLE STRUCTURE (each article \u2014 express in HTML):
-1. Engaging introduction
-2. Industry context
-3. Main developments
-4. Key implications
-5. Expert/business analysis
-6. Conclusion
-
-HTML STRUCTURE (STRICT \u2014 each article must be valid, semantic HTML only):
-- Output HTML only. Do not use Markdown (no # headings, no **bold**, no \`code fences\`).
-- Wrap each complete article in a single root: <article class="blog-post"> ... </article>
-- Inside <article>, use this outline:
-  - <header><h1 class="blog-post-title">\u2026main title\u2026</h1></header> (exactly one h1 per article)
-  - <section class="blog-post-body"> for all following content
-  - Use <h2> and <h3> for section and subsection titles (never skip levels: h1 \u2192 h2 \u2192 h3).
-  - Use <p> for paragraphs; keep paragraphs focused (avoid huge unbroken text).
-  - Use <ul>/<ol> with <li> for lists where appropriate.
-  - Use <strong> and <em> for emphasis sparingly; use <blockquote> only when quoting or callouts fit.
-- Do not include <html>, <head>, <body>, or document-level wrappers \u2014 only the fragment(s) described above.
-- Do not use <script>, <style>, <iframe>, or inline event handlers. Avoid inline style="" except when essential for accessibility (prefer none).
-- Escape angle brackets in body text if you must mention markup; keep output safe for embedding in a CMS.
-
-CONTENT REQUIREMENTS:
-- Minimum 800 words per article unless source material is very small.
-- Add context around industry trends where appropriate.
-- Explain why the topic matters.
-- Include practical implications for businesses/professionals.
-
-IF RSS CONTENT IS LIMITED:
-- Expand intelligently using general industry knowledge.
-- Keep the article relevant to the original topic.
-- Do not invent fake facts or statistics.
-
-OUTPUT FORMAT (STRICT \u2014 HTML only):
-- Return ONLY the article HTML fragment(s). No JSON, no preamble or postscript ("Here is your article\u2026"), no markdown.
-- If you output more than one article, output multiple <article class="blog-post">\u2026</article> blocks in sequence, and between articles put a single line containing exactly this (and nothing else on that line):
-${BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR}
-- If you output a single article, use one <article> only and do not use that separator line.`;
-var BLOG_GENERATOR_DEFAULT_VALIDATION_RULES = JSON.stringify(
-  {
-    maxUserChars: 5e5,
-    guardrails: `Your reply must be semantic HTML blog article(s) only, as in the system OUTPUT FORMAT (<article class="blog-post">\u2026). No JSON, no Markdown, no explanations before or after the HTML. If multiple articles, separate them with a line containing exactly ${BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR} alone. Do not mention RSS, feeds, or scraping. Preserve factual accuracy; do not invent statistics or quotes.`
-  },
-  null,
-  2
-);
-
-// src/plugins/blog-generator/blog-generator-metadata-defaults.ts
-var BLOG_METADATA_ENRICHER_AGENT_NAME = "Blog Generator Metadata";
-var BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG = "blog-generator-metadata";
-var BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION = `You are a careful CMS metadata assistant for a publishing system.
-
-You receive ONE complete blog post as HTML (title is usually in <h1 class="blog-post-title"> or the first <h1>). Your job is to propose structured fields so an editor can save the post: category, URL slug, SEO block, and topical tags.
-
-RULES:
-1. Read the whole article and infer the primary topic and audience.
-2. categoryName must be EXACTLY one string from AVAILABLE_BLOG_CATEGORIES in the user message, or "" if none fit.
-3. blogSlug: lowercase kebab-case, ASCII letters/digits/hyphens only, no leading/trailing hyphens, max ~80 chars. Derive from the main topic or title.
-4. seo.title: concise meta title (~50\u201360 characters when reasonable).
-5. seo.description: meta description (~150\u2013160 characters when reasonable), plain text.
-6. seo.keywords: comma-separated phrases, no stuffing.
-7. seo.ogTitle / seo.ogDescription: may mirror title/description or be slightly adapted for social.
-8. tags: 4\u201310 short labels (1\u20133 words each). Prefer exact matches from EXISTING_TAG_NAMES when they truly apply; otherwise invent precise new labels (they may be created in the CMS later).
-9. Do not invent statistics, quotes, or URLs not implied by the article.
-10. Output JSON only \u2014 no markdown outside the JSON, no commentary.
-
-OUTPUT FORMAT (STRICT):
-Return a single JSON object only. Do not wrap it in a markdown code fence.
-
-{
-  "categoryName": "string \u2014 exact match from list or empty string",
-  "blogSlug": "string \u2014 url-safe kebab-case",
-  "seo": {
-    "title": "string or empty",
-    "description": "string or empty",
-    "keywords": "string or empty",
-    "ogTitle": "string or empty",
-    "ogDescription": "string or empty"
-  },
-  "tags": ["tag-one", "tag-two"]
-}`;
-var BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES = JSON.stringify(
-  {
-    maxUserChars: 5e5,
-    guardrails: "Reply with one valid JSON object only (see system OUTPUT FORMAT). No markdown fences, no text before or after JSON. Keys: categoryName, blogSlug, seo { title, description, keywords, ogTitle, ogDescription }, tags (array of strings)."
-  },
-  null,
-  2
-);
-
-// src/plugins/blog-generator/blog-generator-social-defaults.ts
-var BLOG_SOCIAL_ENRICHER_LLM_AGENT_SLUG = "blog-generator-social";
-var BLOG_SOCIAL_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION = `You are a social copywriter for LinkedIn-style posts.
-
-You receive ONE blog post as HTML (title may appear in <h1> or the first heading). Write a short post body that can be published as the main text on LinkedIn: engaging, accurate, no clickbait, no invented facts or quotes.
-
-RULES:
-1. Plain text only in the JSON value (no HTML tags in socialMediaContent). Line breaks allowed as \\n if helpful.
-2. Length: aim for roughly 600\u20131300 characters (hard max 2900 characters) so it fits typical social feeds.
-3. Summarize the core insight; you may include 1\u20132 short hooks, but stay faithful to the article.
-4. Do not add URLs unless they appear explicitly in the article.
-5. Output JSON only \u2014 no markdown fences, no commentary outside JSON.
-
-OUTPUT FORMAT (STRICT):
-Return a single JSON object only:
-{ "socialMediaContent": "string \u2014 the post text" }`;
-var BLOG_SOCIAL_ENRICHER_DEFAULT_VALIDATION_RULES = JSON.stringify(
-  {
-    maxUserChars: 5e5,
-    guardrails: "Reply with one valid JSON object only. Key: socialMediaContent (string, plain text, max ~2900 chars). No markdown fences."
-  },
-  null,
-  2
-);
-
 // src/api/rss-feed-blog-api.ts
 function deriveRssFeedDisplayName(rssUrl) {
   try {
@@ -4620,18 +5016,14 @@ async function runBlogGenerateFromSchedule(dataSource, entityMap, schedule, cms,
   let socialLlmAgentChatOptions;
   let metadataRow = null;
   let socialRow = null;
+  let blogCreationRow = null;
   if (entityMap.llm_agents) {
-    const agentRepo = dataSource.getRepository(entityMap.llm_agents);
-    const agentRow = await agentRepo.findOne({
-      where: { slug: BLOG_GENERATOR_LLM_AGENT_SLUG, deleted: false, enabled: true }
-    });
-    if (agentRow) {
-      const o = llmAgentToChatAgentOptions(agentRow);
+    blogCreationRow = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_BLOG_CREATION);
+    if (blogCreationRow) {
+      const o = llmAgentToChatAgentOptions(blogCreationRow);
       llmAgentChatOptions = { model: o.model, temperature: o.temperature, max_tokens: o.max_tokens };
     }
-    metadataRow = await agentRepo.findOne({
-      where: { slug: BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, deleted: false, enabled: true }
-    });
+    metadataRow = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_BLOG_METADATA);
     if (metadataRow) {
       const mo = llmAgentToChatAgentOptions(metadataRow);
       metadataLlmAgentChatOptions = {
@@ -4640,9 +5032,7 @@ async function runBlogGenerateFromSchedule(dataSource, entityMap, schedule, cms,
         max_tokens: mo.max_tokens
       };
     }
-    socialRow = await agentRepo.findOne({
-      where: { slug: BLOG_SOCIAL_ENRICHER_LLM_AGENT_SLUG, deleted: false, enabled: true }
-    });
+    socialRow = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_SOCIAL_MEDIA_POST);
     if (socialRow) {
       const so = llmAgentToChatAgentOptions(socialRow);
       socialLlmAgentChatOptions = {
@@ -4687,6 +5077,8 @@ async function runBlogGenerateFromSchedule(dataSource, entityMap, schedule, cms,
   const out = await svc.generateBlogMarkdownFromRss({
     llm,
     rssUrls,
+    systemInstruction: blogCreationRow?.systemInstruction?.trim() || void 0,
+    validationRules: blogCreationRow?.validationRules?.trim() || void 0,
     categoryNamesHint: categoryRows.map((c) => c.name),
     tagNamesHint: tagNames,
     llmAgentChatOptions,
@@ -6782,16 +7174,19 @@ function normalizeChatModeSetting(raw) {
   if (raw === "external" || raw === "llm") return raw;
   return "whatsapp";
 }
-async function loadLlmSettingsMap(dataSource, entityMap) {
+async function loadSettingsGroupMap(dataSource, entityMap, group) {
   if (!entityMap.configs) return {};
   const repo = dataSource.getRepository(entityMap.configs);
-  const rows = await repo.find({ where: { settings: "llm", deleted: false } });
+  const rows = await repo.find({ where: { settings: group, deleted: false } });
   const out = {};
   for (const row of rows) {
     out[row.key] = row.value;
   }
   return out;
 }
+async function loadLlmSettingsMap(dataSource, entityMap) {
+  return loadSettingsGroupMap(dataSource, entityMap, "llm");
+}
 function createChatHandlers(config) {
   const { dataSource, entityMap, json, getCms } = config;
   const contactRepo = () => dataSource.getRepository(entityMap.contacts);
@@ -6803,10 +7198,13 @@ function createChatHandlers(config) {
       try {
         const map = await loadLlmSettingsMap(dataSource, entityMap);
         const mode = normalizeChatModeSetting(map.chatMode);
+        const chatbotAgent = mode === "llm" && entityMap.llm_agents ? await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_CHATBOT, {
+          enabledOnly: false
+        }) : null;
         const body = {
           enabled: map.enabled !== "false",
           chatMode: mode,
-          agentSlug: mode === "llm" ? (map.attachedAgentSlug ?? "").trim() : "",
+          agentSlug: mode === "llm" ? chatbotAgent?.slug?.trim() || LLM_AGENT_DEFAULT_SLUG_BY_SCOPE[LLM_AGENT_SCOPE_CHATBOT] : "",
           botName: map.botName ?? "",
           icon: map.icon ?? "",
           iconImageUrl: map.iconImageUrl ?? "",
@@ -6892,24 +7290,26 @@ function createChatHandlers(config) {
         if (!llm?.chat) return json({ error: "LLM not configured" }, { status: 503 });
         const llmSettings = await loadLlmSettingsMap(dataSource, entityMap);
         const supportMode = normalizeChatModeSetting(llmSettings.chatMode);
-        let effectiveSlug = (body?.agentSlug ?? "").trim();
-        if (!effectiveSlug && supportMode === "llm" && entityMap.llm_agents) {
-          effectiveSlug = (llmSettings.attachedAgentSlug ?? "").trim();
-        }
+        const bodyAgentSlug = (body?.agentSlug ?? "").trim();
         let agentRow = null;
-        if (effectiveSlug) {
-          if (!entityMap.llm_agents) {
-            return json({ error: "LLM agents are not configured on this deployment" }, { status: 400 });
-          }
-          const agentRepo = dataSource.getRepository(
-            entityMap.llm_agents
-          );
-          agentRow = await agentRepo.findOne({
-            where: { slug: effectiveSlug, deleted: false, enabled: true }
-          });
-          if (!agentRow && (body?.agentSlug ?? "").trim()) {
-            return json({ error: "Agent not found or disabled", agentSlug: effectiveSlug }, { status: 404 });
+        let effectiveSlug = bodyAgentSlug;
+        if (entityMap.llm_agents) {
+          if (bodyAgentSlug) {
+            const agentRepo = dataSource.getRepository(
+              entityMap.llm_agents
+            );
+            agentRow = await agentRepo.findOne({
+              where: { slug: bodyAgentSlug, deleted: false, enabled: true }
+            });
+            if (!agentRow) {
+              return json({ error: "Agent not found or disabled", agentSlug: bodyAgentSlug }, { status: 404 });
+            }
+          } else if (supportMode === "llm") {
+            agentRow = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_CHATBOT);
+            effectiveSlug = agentRow?.slug?.trim() || LLM_AGENT_DEFAULT_SLUG_BY_SCOPE[LLM_AGENT_SCOPE_CHATBOT];
           }
+        } else if (bodyAgentSlug) {
+          return json({ error: "LLM agents are not configured on this deployment" }, { status: 400 });
         }
         console.info(RAG_LOG, "step 1 | resolve agent", {
           agentSlug: effectiveSlug || "(none)",
@@ -7005,8 +7405,141 @@ function createChatHandlers(config) {
             });
           }
         }
-        const historyRaw = (conv.messages ?? []).sort((a, b) => new Date(a.createdAt ?? 0).getTime() - new Date(b.createdAt ?? 0).getTime()).map((m) => ({ role: m.role, content: m.content }));
-        const history = historyBeforeCurrentUser(historyRaw, message);
+        const historyRaw = (conv.messages ?? []).sort((a, b) => new Date(a.createdAt ?? 0).getTime() - new Date(b.createdAt ?? 0).getTime()).map((m) => ({ role: m.role, content: m.content }));
+        const history = historyBeforeCurrentUser(historyRaw, message);
+        const notifyEmailAgent = await findLlmAgentByScope(
+          dataSource,
+          entityMap,
+          LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT,
+          { enabledOnly: false }
+        );
+        const emailTool = resolveChatEmailToolSettings(llmSettings, {
+          chatbotValidationRules: agentRow?.validationRules ?? null,
+          notifyAgent: notifyEmailAgent ? {
+            systemInstruction: notifyEmailAgent.systemInstruction,
+            validationRules: notifyEmailAgent.validationRules
+          } : null
+        });
+        const emailPlugin2 = cms.getPlugin("email");
+        const convLeadSent = conv.leadEmailSentAt;
+        const chatAgentFn = llm.chatAgent?.bind(llm);
+        console.info(CHAT_EMAIL_LOG, "pipeline check", {
+          conversationId,
+          enabled: emailTool.enabled,
+          intentCount: emailTool.intents.length,
+          chatbotAgentId: agentRow?.id ?? null,
+          chatbotAgentSlug: agentRow?.slug ?? null,
+          notifyEmailAgentId: notifyEmailAgent?.id ?? null,
+          notifyEmailAgentSlug: notifyEmailAgent?.slug ?? null,
+          emailPluginPresent: Boolean(emailPlugin2),
+          chatAgentFnPresent: Boolean(chatAgentFn),
+          leadEmailAlreadySent: Boolean(convLeadSent),
+          mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
+        });
+        if (!emailTool.enabled) {
+          console.info(CHAT_EMAIL_LOG, "pipeline skipped", {
+            conversationId,
+            reason: "email_tool_disabled"
+          });
+        } else if (emailTool.intents.length === 0) {
+          console.info(CHAT_EMAIL_LOG, "pipeline skipped", {
+            conversationId,
+            reason: "no_intents_configured"
+          });
+        } else if (!emailPlugin2) {
+          console.info(CHAT_EMAIL_LOG, "pipeline skipped", {
+            conversationId,
+            reason: "email_plugin_missing"
+          });
+        } else if (!chatAgentFn) {
+          console.info(CHAT_EMAIL_LOG, "pipeline skipped", {
+            conversationId,
+            reason: "llm_chat_agent_unavailable"
+          });
+        } else if (convLeadSent) {
+          console.info(CHAT_EMAIL_LOG, "pipeline skipped", {
+            conversationId,
+            reason: "lead_email_already_sent",
+            leadEmailSentAt: convLeadSent
+          });
+        } else {
+          const contactId = conv.contactId;
+          const contactRow = await contactRepo().findOne({
+            where: { id: contactId }
+          });
+          if (!contactRow) {
+            console.warn(CHAT_EMAIL_LOG, "pipeline skipped", {
+              conversationId,
+              reason: "contact_not_found",
+              contactId
+            });
+          } else {
+            const c = contactRow;
+            try {
+              const intent = await detectChatLeadIntent({ chatAgent: chatAgentFn }, {
+                settings: emailTool,
+                message,
+                history,
+                contact: { name: c.name, email: c.email, phone: c.phone },
+                model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
+              });
+              if (!intent.intent || !intent.emailTo) {
+                console.info(CHAT_EMAIL_LOG, "no email sent", {
+                  conversationId,
+                  reason: intent.intent ? "missing_email_to" : "no_intent_match",
+                  intentLabel: intent.intentLabel,
+                  classifierReason: intent.reason
+                });
+              } else {
+                const intentRecipients = parseIntentRecipientEmails(intent.emailTo);
+                console.info(CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                  conversationId,
+                  intent: intent.intent,
+                  emailTo: intent.emailTo,
+                  parsedRecipientCount: intentRecipients.length,
+                  recipients: intentRecipients
+                });
+                const emailSettings = await loadSettingsGroupMap(dataSource, entityMap, "email");
+                const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
+                const companyDetails = mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
+                const leadResult = await sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                  contactName: String(c.name ?? "").trim() || "Visitor",
+                  contactEmail: String(c.email ?? "").trim(),
+                  contactPhone: c.phone ?? null,
+                  conversationId,
+                  latestMessage: message,
+                  intentCode: intent.intent,
+                  intentReason: intent.intentLabel || intent.reason,
+                  transcript: buildTranscriptForLeadEmail(history, message),
+                  companyDetails,
+                  recipients: intentRecipients.length > 0 ? intentRecipients : void 0
+                });
+                if (leadResult.sent) {
+                  await convRepo().update(conversationId, {
+                    leadEmailSentAt: /* @__PURE__ */ new Date()
+                  });
+                  console.info(CHAT_EMAIL_LOG, "lead email recorded", {
+                    conversationId,
+                    sent: true,
+                    recipients: leadResult.recipients
+                  });
+                } else {
+                  console.warn(CHAT_EMAIL_LOG, "lead email not sent", {
+                    conversationId,
+                    sent: false,
+                    error: leadResult.error ?? "unknown",
+                    recipients: leadResult.recipients
+                  });
+                }
+              }
+            } catch (intentErr) {
+              console.warn(CHAT_EMAIL_LOG, "pipeline error", {
+                conversationId,
+                error: intentErr instanceof Error ? intentErr.message : String(intentErr)
+              });
+            }
+          }
+        }
         let content;
         const ragContext = contextParts.length > 0 ? contextParts.join("\n\n") : void 0;
         console.info(RAG_LOG, "step 7 | final context", {
@@ -7017,9 +7550,10 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = mergeGuardrailsIntoSystemPrompt(
+          const systemPrompt = buildChatbotSystemPromptWithEmailTool(
             fromAgent.systemPrompt,
-            parsedValidation.guardrailsForPrompt
+            parsedValidation.guardrailsForPrompt,
+            emailTool
           );
           const res = await llm.chatAgent({
             ...fromAgent,
@@ -7037,11 +7571,12 @@ ${contextParts.join("\n\n")}` : "";
           const defaultSystem = "You are a helpful assistant for the company. If you do not have specific information, say so.";
           let systemContent;
           if (agentRow) {
-            const base = agentRow.systemInstruction?.trim() || "";
-            systemContent = mergeGuardrailsIntoSystemPrompt(
-              [base, ragSystem].filter(Boolean).join("\n\n") || defaultSystem,
-              parsedValidation.guardrailsForPrompt
-            );
+            const mergedBase = [agentRow.systemInstruction?.trim(), ragSystem].filter(Boolean).join("\n\n");
+            systemContent = buildChatbotSystemPromptWithEmailTool(
+              mergedBase || defaultSystem,
+              parsedValidation.guardrailsForPrompt,
+              emailTool
+            ) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -7068,6 +7603,154 @@ ${contextParts.join("\n\n")}` : "";
   };
 }
 
+// src/plugins/blog-generator/blog-generator-agent-defaults.ts
+var BLOG_GENERATOR_AGENT_NAME = "Blog Generator Agent";
+var BLOG_GENERATOR_LLM_AGENT_SLUG = "blog-generator";
+var BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR = "---BLOG_GENERATOR_NEXT---";
+var BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION = `You are a professional financial and business content writer.
+
+Your task is to generate completely original, high-quality blog article(s) from the latest RSS-derived source material in the user message (one block per feed). The user message is factual input only.
+
+IMPORTANT RULES:
+
+1. NEVER copy the RSS article directly.
+2. Rewrite the information into a fresh, human-like article.
+3. Expand the topic with professional insights and explanations.
+4. Maintain a natural editorial tone.
+5. Make the article SEO-friendly.
+6. Use engaging headings and subheadings.
+7. Avoid robotic AI phrasing.
+8. Do not mention that the content came from RSS or feeds.
+9. Preserve factual accuracy from the source material.
+10. The output should feel like a professionally written industry blog.
+
+MULTIPLE FEEDS:
+- If several feeds are provided, compare them: if they largely cover the same story or overlap heavily, produce ONE cohesive article.
+- If they cover clearly different topics or distinct stories, produce MULTIPLE articles (one per distinct story).
+- You may also produce one synthesis plus a short separate angle when that best serves the reader\u2014use your judgment.
+
+WRITING STYLE:
+- Professional
+- Clear
+- Informative
+- Business-focused
+- Human sounding
+- Modern editorial style
+
+ARTICLE STRUCTURE (each article \u2014 express in HTML):
+1. Engaging introduction
+2. Industry context
+3. Main developments
+4. Key implications
+5. Expert/business analysis
+6. Conclusion
+
+HTML STRUCTURE (STRICT \u2014 each article must be valid, semantic HTML only):
+- Output HTML only. Do not use Markdown (no # headings, no **bold**, no \`code fences\`).
+- Wrap each complete article in a single root: <article class="blog-post"> ... </article>
+- Inside <article>, use this outline:
+  - <header><h1 class="blog-post-title">\u2026main title\u2026</h1></header> (exactly one h1 per article)
+  - <section class="blog-post-body"> for all following content
+  - Use <h2> and <h3> for section and subsection titles (never skip levels: h1 \u2192 h2 \u2192 h3).
+  - Use <p> for paragraphs; keep paragraphs focused (avoid huge unbroken text).
+  - Use <ul>/<ol> with <li> for lists where appropriate.
+  - Use <strong> and <em> for emphasis sparingly; use <blockquote> only when quoting or callouts fit.
+- Do not include <html>, <head>, <body>, or document-level wrappers \u2014 only the fragment(s) described above.
+- Do not use <script>, <style>, <iframe>, or inline event handlers. Avoid inline style="" except when essential for accessibility (prefer none).
+- Escape angle brackets in body text if you must mention markup; keep output safe for embedding in a CMS.
+
+CONTENT REQUIREMENTS:
+- Minimum 800 words per article unless source material is very small.
+- Add context around industry trends where appropriate.
+- Explain why the topic matters.
+- Include practical implications for businesses/professionals.
+
+IF RSS CONTENT IS LIMITED:
+- Expand intelligently using general industry knowledge.
+- Keep the article relevant to the original topic.
+- Do not invent fake facts or statistics.
+
+OUTPUT FORMAT (STRICT \u2014 HTML only):
+- Return ONLY the article HTML fragment(s). No JSON, no preamble or postscript ("Here is your article\u2026"), no markdown.
+- If you output more than one article, output multiple <article class="blog-post">\u2026</article> blocks in sequence, and between articles put a single line containing exactly this (and nothing else on that line):
+${BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR}
+- If you output a single article, use one <article> only and do not use that separator line.`;
+var BLOG_GENERATOR_DEFAULT_VALIDATION_RULES = JSON.stringify(
+  {
+    maxUserChars: 5e5,
+    guardrails: `Your reply must be semantic HTML blog article(s) only, as in the system OUTPUT FORMAT (<article class="blog-post">\u2026). No JSON, no Markdown, no explanations before or after the HTML. If multiple articles, separate them with a line containing exactly ${BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR} alone. Do not mention RSS, feeds, or scraping. Preserve factual accuracy; do not invent statistics or quotes.`
+  },
+  null,
+  2
+);
+
+// src/plugins/blog-generator/blog-generator-metadata-defaults.ts
+var BLOG_METADATA_ENRICHER_AGENT_NAME = "Blog Generator Metadata";
+var BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG = "blog-generator-metadata";
+var BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION = `You are a careful CMS metadata assistant for a publishing system.
+
+You receive ONE complete blog post as HTML (title is usually in <h1 class="blog-post-title"> or the first <h1>). Your job is to propose structured fields so an editor can save the post: category, URL slug, SEO block, and topical tags.
+
+RULES:
+1. Read the whole article and infer the primary topic and audience.
+2. categoryName must be EXACTLY one string from AVAILABLE_BLOG_CATEGORIES in the user message, or "" if none fit.
+3. blogSlug: lowercase kebab-case, ASCII letters/digits/hyphens only, no leading/trailing hyphens, max ~80 chars. Derive from the main topic or title.
+4. seo.title: concise meta title (~50\u201360 characters when reasonable).
+5. seo.description: meta description (~150\u2013160 characters when reasonable), plain text.
+6. seo.keywords: comma-separated phrases, no stuffing.
+7. seo.ogTitle / seo.ogDescription: may mirror title/description or be slightly adapted for social.
+8. tags: 4\u201310 short labels (1\u20133 words each). Prefer exact matches from EXISTING_TAG_NAMES when they truly apply; otherwise invent precise new labels (they may be created in the CMS later).
+9. Do not invent statistics, quotes, or URLs not implied by the article.
+10. Output JSON only \u2014 no markdown outside the JSON, no commentary.
+
+OUTPUT FORMAT (STRICT):
+Return a single JSON object only. Do not wrap it in a markdown code fence.
+
+{
+  "categoryName": "string \u2014 exact match from list or empty string",
+  "blogSlug": "string \u2014 url-safe kebab-case",
+  "seo": {
+    "title": "string or empty",
+    "description": "string or empty",
+    "keywords": "string or empty",
+    "ogTitle": "string or empty",
+    "ogDescription": "string or empty"
+  },
+  "tags": ["tag-one", "tag-two"]
+}`;
+var BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES = JSON.stringify(
+  {
+    maxUserChars: 5e5,
+    guardrails: "Reply with one valid JSON object only (see system OUTPUT FORMAT). No markdown fences, no text before or after JSON. Keys: categoryName, blogSlug, seo { title, description, keywords, ogTitle, ogDescription }, tags (array of strings)."
+  },
+  null,
+  2
+);
+
+// src/plugins/blog-generator/blog-generator-social-defaults.ts
+var BLOG_SOCIAL_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION = `You are a social copywriter for LinkedIn-style posts.
+
+You receive ONE blog post as HTML (title may appear in <h1> or the first heading). Write a short post body that can be published as the main text on LinkedIn: engaging, accurate, no clickbait, no invented facts or quotes.
+
+RULES:
+1. Plain text only in the JSON value (no HTML tags in socialMediaContent). Line breaks allowed as \\n if helpful.
+2. Length: aim for roughly 600\u20131300 characters (hard max 2900 characters) so it fits typical social feeds.
+3. Summarize the core insight; you may include 1\u20132 short hooks, but stay faithful to the article.
+4. Do not add URLs unless they appear explicitly in the article.
+5. Output JSON only \u2014 no markdown fences, no commentary outside JSON.
+
+OUTPUT FORMAT (STRICT):
+Return a single JSON object only:
+{ "socialMediaContent": "string \u2014 the post text" }`;
+var BLOG_SOCIAL_ENRICHER_DEFAULT_VALIDATION_RULES = JSON.stringify(
+  {
+    maxUserChars: 5e5,
+    guardrails: "Reply with one valid JSON object only. Key: socialMediaContent (string, plain text, max ~2900 chars). No markdown fences."
+  },
+  null,
+  2
+);
+
 // src/plugins/blog-generator/blog-generator-service.ts
 var parser = new import_rss_parser.default({
   defaultRSS: 2
@@ -8803,29 +9486,6 @@ async function resolvePublicMetadata(args) {
   return out;
 }
 
-// src/lib/email-recipients.ts
-function parseEmailRecipientsFromConfig(raw) {
-  if (raw == null || raw === "") return [];
-  const trimmed = raw.trim();
-  if (trimmed.startsWith("[")) {
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (Array.isArray(parsed)) {
-        return parsed.map((e) => String(e).trim()).filter(Boolean);
-      }
-    } catch {
-    }
-  }
-  return trimmed.split(/[,;]+/).map((s) => s.trim()).filter(Boolean);
-}
-function serializeEmailRecipients(emails) {
-  return JSON.stringify(emails);
-}
-function joinRecipientsForSend(emails) {
-  if (!emails.length) return null;
-  return emails.join(", ");
-}
-
 // src/lib/otp-challenge.ts
 var import_crypto3 = require("crypto");
 var import_typeorm8 = require("typeorm");
@@ -10461,6 +11121,7 @@ var Order = class {
   id;
   vendorId;
   orderNumber;
+  qrToken;
   orderKind;
   parentOrderId;
   contactId;
@@ -10498,6 +11159,9 @@ __decorateClass([
 __decorateClass([
   (0, import_typeorm26.Column)("varchar")
 ], Order.prototype, "orderNumber", 2);
+__decorateClass([
+  (0, import_typeorm26.Column)("varchar", { unique: true, nullable: true })
+], Order.prototype, "qrToken", 2);
 __decorateClass([
   (0, import_typeorm26.Column)("varchar", { default: "sale" })
 ], Order.prototype, "orderKind", 2);
@@ -10726,6 +11390,7 @@ var ChatConversation = class {
   contactId;
   createdAt;
   updatedAt;
+  leadEmailSentAt;
   contact;
   messages;
 };
@@ -10741,6 +11406,9 @@ __decorateClass([
 __decorateClass([
   (0, import_typeorm29.Column)({ type: "timestamp", default: () => "CURRENT_TIMESTAMP" })
 ], ChatConversation.prototype, "updatedAt", 2);
+__decorateClass([
+  (0, import_typeorm29.Column)({ type: "timestamp", nullable: true })
+], ChatConversation.prototype, "leadEmailSentAt", 2);
 __decorateClass([
   (0, import_typeorm29.ManyToOne)(() => Contact, (c) => c.chatConversations, { onDelete: "CASCADE" }),
   (0, import_typeorm29.JoinColumn)({ name: "contactId" })
@@ -12951,6 +13619,59 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
   }
 }
 
+// src/auth/middleware.ts
+var import_jwt = require("next-auth/jwt");
+
+// src/auth/auth-debug.ts
+var LOG_PREFIX2 = "[cms-auth]";
+function isAuthDebugEnabled() {
+  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function isAuthDebugClientEnabled() {
+  if (typeof window === "undefined") return false;
+  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function logAuth(message, data) {
+  if (!isAuthDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function logAuthClient(message, data) {
+  if (!isAuthDebugClientEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function summarizeSessionUserForLog(user) {
+  if (!user || typeof user !== "object") return { present: false };
+  const u = user;
+  return {
+    present: true,
+    email: u.email ?? null,
+    id: u.id ?? null,
+    adminAccess: u.adminAccess ?? null,
+    isRBACAdmin: u.isRBACAdmin ?? null,
+    isVendorPortal: u.isVendorPortal ?? null,
+    groupName: u.groupName ?? null
+  };
+}
+function nextAuthCookieDebugInfo() {
+  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
+  const isHttps = nextAuthUrl.startsWith("https");
+  return {
+    nextAuthUrl,
+    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
+    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
+    cookieSecure: isHttps,
+    nodeEnv: process.env.NODE_ENV ?? "(unset)"
+  };
+}
+
 // src/auth/middleware.ts
 var defaultPublicApiMethods = {
   "/api/contacts": ["POST"],
@@ -12963,8 +13684,21 @@ var defaultPublicApiMethods = {
   "/api/users/set-password": ["POST"],
   "/api/users/invite": ["POST"]
 };
-function defaultGetSessionToken(request) {
-  return request.cookies.get("__Secure-next-auth.session-token")?.value ?? request.cookies.get("next-auth.session-token")?.value;
+function legacyGetSessionToken(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  return secure ?? regular;
+}
+function sessionCookiePresence(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
+  return {
+    hasSecureToken: Boolean(secure),
+    hasRegularToken: Boolean(regular),
+    hasChunkedToken: hasChunked,
+    resolved: Boolean(secure ?? regular)
+  };
 }
 function isPublicMethod2(pathname, method, publicApiMethods) {
   for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
@@ -12972,31 +13706,59 @@ function isPublicMethod2(pathname, method, publicApiMethods) {
   }
   return false;
 }
+async function hasValidSession(request, secret, legacyGetToken) {
+  if (request.req) {
+    const token = await (0, import_jwt.getToken)({ req: request.req, secret });
+    return token != null;
+  }
+  return Boolean(legacyGetToken(request));
+}
 function createCmsMiddleware(config = {}) {
   const {
     publicAdminPaths = ["/admin/signin", "/admin/forgot-password", "/admin/reset-password", "/admin/invite"],
     publicApiMethods = defaultPublicApiMethods,
     signInPath = "/admin/signin",
-    getSessionToken = defaultGetSessionToken
+    getSessionToken = legacyGetSessionToken,
+    secret = process.env.NEXTAUTH_SECRET
   } = config;
-  return function cmsMiddleware(request) {
+  return async function cmsMiddleware(request) {
     const pathname = request.nextUrl.pathname;
     const method = request.method;
     if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
       return { type: "next" };
     }
     if (pathname.startsWith("/admin")) {
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      const cookies = sessionCookiePresence(request);
+      if (!authenticated) {
+        logAuth("middleware: admin redirect to signin (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...cookies,
+          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
+        });
         return { type: "redirect", url: new URL(signInPath, request.url).toString() };
       }
+      logAuth("middleware: admin allowed", {
+        pathname,
+        method,
+        usesGetToken: Boolean(request.req),
+        ...cookies
+      });
     }
     if (pathname.startsWith("/api")) {
       if (isPublicMethod2(pathname, method, publicApiMethods)) {
         return { type: "next" };
       }
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      if (!authenticated) {
+        logAuth("middleware: api 401 (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...sessionCookiePresence(request)
+        });
         return { type: "json", status: 401, body: { error: "Unauthorized" } };
       }
     }
@@ -13051,6 +13813,7 @@ function getNextAuthOptions(config) {
     enableOtpLogin = false,
     authorizeOtp
   } = config;
+  logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
     providers.push(
@@ -13061,15 +13824,43 @@ function getNextAuthOptions(config) {
           password: { label: "Password", type: "password" }
         },
         async authorize(credentials) {
-          if (!credentials?.email || !credentials?.password) return null;
+          const email = credentials?.email?.trim() ?? "";
+          if (!email || !credentials?.password) {
+            logAuth("authorize(credentials) rejected", { reason: "missing_email_or_password" });
+            return null;
+          }
           try {
-            const user = await getUserByEmail(credentials.email);
-            if (!user || user.blocked || user.deleted || !user.password) return null;
+            const user = await getUserByEmail(email);
+            if (!user) {
+              logAuth("authorize(credentials) rejected", { reason: "user_not_found", email });
+              return null;
+            }
+            if (user.blocked) {
+              logAuth("authorize(credentials) rejected", { reason: "blocked", email, userId: user.id });
+              return null;
+            }
+            if (user.deleted) {
+              logAuth("authorize(credentials) rejected", { reason: "deleted", email, userId: user.id });
+              return null;
+            }
+            if (!user.password) {
+              logAuth("authorize(credentials) rejected", { reason: "no_password", email, userId: user.id });
+              return null;
+            }
             const valid = await comparePassword(credentials.password, user.password);
-            if (!valid) return null;
-            return sessionUserFromNextAuthUser(user);
+            if (!valid) {
+              logAuth("authorize(credentials) rejected", { reason: "invalid_password", email, userId: user.id });
+              return null;
+            }
+            const sessionUser = sessionUserFromNextAuthUser(user);
+            logAuth("authorize(credentials) ok", summarizeSessionUserForLog(sessionUser));
+            return sessionUser;
           } catch (err) {
             console.error("[cms-auth] authorize error (credentials):", err instanceof Error ? err.message : err);
+            logAuth("authorize(credentials) error", {
+              email,
+              message: err instanceof Error ? err.message : String(err)
+            });
             return null;
           }
         }
@@ -13122,6 +13913,10 @@ function getNextAuthOptions(config) {
     callbacks: {
       async jwt({ token, user, trigger, session }) {
         if (user) {
+          logAuth("jwt callback: new sign-in", {
+            trigger,
+            user: summarizeSessionUserForLog(user)
+          });
           const u = user;
           token.id = u.id;
           token.groupId = u.groupId;
@@ -13136,6 +13931,7 @@ function getNextAuthOptions(config) {
           token.isVendorOwner = u.isVendorOwner;
         }
         if (trigger === "update" && session && typeof session === "object") {
+          logAuth("jwt callback: session update", { trigger });
           const s = session;
           const t = token;
           if (typeof s.name === "string") t.name = s.name;
@@ -13145,8 +13941,13 @@ function getNextAuthOptions(config) {
         return token;
       },
       async session({ session, token }) {
+        const t = token;
+        logAuth("session callback", {
+          tokenHasId: t.id != null,
+          tokenEmail: typeof t.email === "string" ? t.email : null,
+          sessionUser: summarizeSessionUserForLog(session.user)
+        });
         if (session.user) {
-          const t = token;
           if (typeof t.name === "string") session.user.name = t.name;
           if (typeof t.email === "string") session.user.email = t.email;
           session.user.id = t.id;
@@ -13309,6 +14110,26 @@ function validateAndNormalizeAddressRow(row) {
   return null;
 }
 
+// src/api/crud.ts
+var import_crypto4 = __toESM(require("crypto"), 1);
+
+// src/plugins/llm/llm-agent-scope-crud.ts
+async function validateLlmAgentScopeForWrite(dataSource, entityMap, scope, excludeId) {
+  if (scope == null || scope === "") return null;
+  if (typeof scope !== "string" || !isLlmAgentScope(scope)) {
+    return `Invalid agent scope. Allowed: chatbot, blog_creation, social_media_post, email_intent_chatbot, blog_metadata.`;
+  }
+  const entity = entityMap.llm_agents;
+  if (!entity) return null;
+  const repo = dataSource.getRepository(entity);
+  const existing = await repo.findOne({
+    where: { scope, deleted: false }
+  });
+  if (!existing) return null;
+  if (excludeId != null && existing.id === excludeId) return null;
+  return `An active agent already uses scope "${scope}".`;
+}
+
 // src/api/crud.ts
 var CRUD_LOG = "[cms-crud]";
 function logCrudClientError(op, detail) {
@@ -13525,6 +14346,7 @@ function buildListFilterAndFromSearchParams(repo, searchParams) {
     if (name === "deleted" || name === "deletedAt" || name === "deletedBy") continue;
     if (!isListStringColumn(col)) continue;
     if (Object.prototype.hasOwnProperty.call(and, name)) continue;
+    if (name === "scope") continue;
     const raw = searchParams.get(name)?.trim();
     if (!raw) continue;
     and[name] = (0, import_typeorm61.ILike)(`%${raw}%`);
@@ -13554,6 +14376,10 @@ function buildExactListParamWhere(repo, searchParams) {
       extraWhere[name] = raw === "true";
     }
   }
+  const scopeParam = searchParams.get("scope")?.trim();
+  if (scopeParam && columnNames.has("scope")) {
+    extraWhere.scope = scopeParam;
+  }
   return extraWhere;
 }
 function mergeDeletedFalseWhere(repo, where) {
@@ -13765,6 +14591,12 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
     case "minAmount":
       return discountCompare(cartTotal, rule.comparisonOperator, ruleValue);
     case "quantity": {
+      if (rule.subType === "productId" && rule.value?.productId) {
+        const targetProductId = Number(rule.value.productId);
+        const requiredQty = Number(rule.value.v);
+        const productQty = cartLines.filter((l) => l.productId === targetProductId).reduce((s, l) => s + l.quantity, 0);
+        return discountCompare(productQty, rule.comparisonOperator, requiredQty);
+      }
       const totalQty = cartLines.reduce((s, l) => s + l.quantity, 0);
       return discountCompare(totalQty, rule.comparisonOperator, ruleValue);
     }
@@ -13828,6 +14660,10 @@ function discountExtractBuyProductId(nodes) {
       const n = Number(v);
       if (Number.isFinite(n) && n > 0) return n;
     }
+    if (node.conditionType === "rule" && node.type === "quantity" && node.subType === "productId") {
+      const n = Number(node.value?.productId);
+      if (Number.isFinite(n) && n > 0) return n;
+    }
     if (node.children?.length) {
       const found = discountExtractBuyProductId(node.children);
       if (found !== null) return found;
@@ -14538,6 +15374,25 @@ function createCrudHandler(dataSource, entityMap, options) {
     if (pe) return pe;
     return null;
   }
+  async function tryAssignSingleVendorOnAdminCreate(resource, scope, persistBody) {
+    if (!resourceUsesVendorScope(resource) || scope.type !== "all") return;
+    const currentVendorId = Number(persistBody.vendorId);
+    if (Number.isFinite(currentVendorId) && currentVendorId > 0) return;
+    if (!entityMap.vendors) return;
+    const vendorRepo = dataSource.getRepository(entityMap.vendors);
+    const where = mergeDeletedFalseWhere(vendorRepo, {});
+    const rows = await vendorRepo.find({
+      where,
+      order: { id: "ASC" },
+      take: 2
+    });
+    if (rows.length === 1) {
+      const onlyVendorId = Number(rows[0].id);
+      if (Number.isFinite(onlyVendorId) && onlyVendorId > 0) {
+        persistBody.vendorId = onlyVendorId;
+      }
+    }
+  }
   return {
     async GET(req, resource) {
       const authError = await authz(req, resource, "read");
@@ -15053,6 +15908,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         const couponCode = String(body.couponCode).trim().toUpperCase();
         const persistBody2 = pickColumnUpdates(repo2, { ...body, couponCode });
         const scopeDiscount = await resolveScope();
+        await tryAssignSingleVendorOnAdminCreate(resource, scopeDiscount, persistBody2);
         const vendorIdCheck2 = requireVendorIdForScopedCreate(
           resource,
           persistBody2,
@@ -15130,6 +15986,10 @@ function createCrudHandler(dataSource, entityMap, options) {
         });
         return json({ error: "Invalid request payload" }, { status: 400 });
       }
+      if (resource === "llm_agents" && "scope" in persistBody) {
+        const scopeErr = await validateLlmAgentScopeForWrite(dataSource, entityMap, persistBody.scope);
+        if (scopeErr) return json({ error: scopeErr }, { status: 400 });
+      }
       if (resource === "products") {
         if ("sku" in persistBody) {
           const skuNorm = normalizeProductSku(persistBody.sku);
@@ -15245,6 +16105,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         );
       }
       const scopeCreate = await resolveScope();
+      await tryAssignSingleVendorOnAdminCreate(resource, scopeCreate, persistBody);
       const vendorIdCheck = requireVendorIdForScopedCreate(resource, persistBody, scopeCreate, repo, body);
       if (!vendorIdCheck.ok) {
         return json({ error: vendorIdCheck.error }, { status: vendorIdCheck.status });
@@ -15287,6 +16148,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           const randomPart = Math.floor(1e4 + Math.random() * 9e4);
           persistBody.contactId = contact.id;
           persistBody.orderNumber = `ORD00${randomPart}`;
+          persistBody.qrToken = import_crypto4.default.randomBytes(16).toString("hex");
         }
         created = await repo.save(repo.create(persistBody));
         if (resource === "orders") {
@@ -16055,6 +16917,15 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         const t = updatePayload.type;
         if (t === "" || t === "none" || t == null) updatePayload.type = null;
       }
+      if (resource === "llm_agents" && "scope" in updatePayload) {
+        const scopeErr = await validateLlmAgentScopeForWrite(
+          dataSource,
+          entityMap,
+          updatePayload.scope,
+          numericId
+        );
+        if (scopeErr) return json({ error: scopeErr }, { status: 400 });
+      }
       if ((resource === "orders" || resource === "payments") && "contactId" in updatePayload && updatePayload.contactId != null && entityMap.vendor_customers) {
         const existingRow = await repo.findOne({
           where: { id: numericId }
@@ -16254,8 +17125,8 @@ function createForgotPasswordHandler(config) {
       const user = await userRepo.findOne({ where: { email }, select: ["email"] });
       const msg = "If an account exists with this email, you will receive a reset link shortly.";
       if (!user) return json({ message: msg }, { status: 200 });
-      const crypto3 = await import("crypto");
-      const token = crypto3.randomBytes(32).toString("hex");
+      const crypto4 = await import("crypto");
+      const token = crypto4.randomBytes(32).toString("hex");
       const expiresAt = new Date(Date.now() + resetExpiryHours * 60 * 60 * 1e3);
       const tokenRepo = dataSource.getRepository(entityMap.password_reset_tokens);
       await tokenRepo.save(tokenRepo.create({ email: user.email, token, expiresAt }));
@@ -18193,28 +19064,24 @@ function createCmsApiHandler(config) {
         let socialLlmAgentResolution = null;
         let metadataRow = null;
         let socialRow = null;
+        let blogCreationRow = null;
         if (entityMap.llm_agents) {
-          const agentRepo = dataSource.getRepository(entityMap.llm_agents);
-          const agentRow = await agentRepo.findOne({
-            where: { slug: BLOG_GENERATOR_LLM_AGENT_SLUG, deleted: false, enabled: true }
-          });
-          if (agentRow) {
-            const o = llmAgentToChatAgentOptions(agentRow);
+          blogCreationRow = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_BLOG_CREATION);
+          if (blogCreationRow) {
+            const o = llmAgentToChatAgentOptions(blogCreationRow);
             llmAgentChatOptions = {
               model: o.model,
               temperature: o.temperature,
               max_tokens: o.max_tokens
             };
             llmAgentResolution = {
-              slug: BLOG_GENERATOR_LLM_AGENT_SLUG,
-              model: agentRow.model?.trim() || null,
-              temperature: agentRow.temperature ?? null,
-              maxTokens: agentRow.maxTokens ?? null
+              slug: blogCreationRow.slug,
+              model: blogCreationRow.model?.trim() || null,
+              temperature: blogCreationRow.temperature ?? null,
+              maxTokens: blogCreationRow.maxTokens ?? null
             };
           }
-          metadataRow = await agentRepo.findOne({
-            where: { slug: BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, deleted: false, enabled: true }
-          });
+          metadataRow = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_BLOG_METADATA);
           if (metadataRow) {
             const mo = llmAgentToChatAgentOptions(metadataRow);
             metadataLlmAgentChatOptions = {
@@ -18223,15 +19090,13 @@ function createCmsApiHandler(config) {
               max_tokens: mo.max_tokens
             };
             metadataLlmAgentResolution = {
-              slug: BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG,
+              slug: metadataRow.slug,
               model: metadataRow.model?.trim() || null,
               temperature: metadataRow.temperature ?? null,
               maxTokens: metadataRow.maxTokens ?? null
             };
           }
-          socialRow = await agentRepo.findOne({
-            where: { slug: BLOG_SOCIAL_ENRICHER_LLM_AGENT_SLUG, deleted: false, enabled: true }
-          });
+          socialRow = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_SOCIAL_MEDIA_POST);
           if (socialRow) {
             const so = llmAgentToChatAgentOptions(socialRow);
             socialLlmAgentChatOptions = {
@@ -18240,7 +19105,7 @@ function createCmsApiHandler(config) {
               max_tokens: so.max_tokens
             };
             socialLlmAgentResolution = {
-              slug: BLOG_SOCIAL_ENRICHER_LLM_AGENT_SLUG,
+              slug: socialRow.slug,
               model: socialRow.model?.trim() || null,
               temperature: socialRow.temperature ?? null,
               maxTokens: socialRow.maxTokens ?? null
@@ -18264,8 +19129,8 @@ function createCmsApiHandler(config) {
           const out = await svc.generateBlogMarkdownFromRss({
             llm,
             rssUrls,
-            systemInstruction,
-            validationRules,
+            systemInstruction: systemInstruction ?? blogCreationRow?.systemInstruction?.trim() ?? void 0,
+            validationRules: validationRules ?? blogCreationRow?.validationRules?.trim() ?? void 0,
             categoryNamesHint: categoryRows.map((c) => c.name),
             tagNamesHint: tagNames,
             llmAgentChatOptions,
@@ -18750,6 +19615,22 @@ function createCmsApiHandler(config) {
           return config.json({ error: message }, { status: 500 });
         }
       }
+      if (path2[0] === "track" && path2.length === 2 && m === "GET") {
+        const token = path2[1];
+        if (!token) return config.json({ error: "Token required" }, { status: 400 });
+        try {
+          const orderRepo = dataSource.getRepository(entityMap.orders);
+          const order = await orderRepo.findOne({
+            where: { qrToken: token, deleted: false },
+            relations: ["contact", "items", "items.product"]
+          });
+          if (!order) return config.json({ error: "Order not found" }, { status: 404 });
+          return config.json(order);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          return config.json({ error: message }, { status: 500 });
+        }
+      }
       if (path2.length === 0) return config.json({ error: "Not found" }, { status: 404 });
       const resource = resolveResource(path2[0]);
       if (!crudResources.includes(resource)) {
@@ -19618,8 +20499,8 @@ function createStorefrontApiHandler(config) {
           let emailVerificationSent = false;
           if (requireEmailVerification && getCms) {
             try {
-              const crypto3 = await import("crypto");
-              const rawToken = crypto3.randomBytes(32).toString("hex");
+              const crypto4 = await import("crypto");
+              const rawToken = crypto4.randomBytes(32).toString("hex");
               const expiresAt = new Date(Date.now() + SIGNUP_VERIFY_EXPIRY_HOURS * 60 * 60 * 1e3);
               await tokenRepo().save(
                 tokenRepo().create({ email, token: rawToken, expiresAt })
@@ -20388,6 +21269,8 @@ console.log("\u{1F525} USING LOCAL CMS CORE(index.ts loaded) \u{1F525}");
   hasEntityPermission,
   hashOtpCode,
   hydrateVendorSessionUser,
+  isAuthDebugClientEnabled,
+  isAuthDebugEnabled,
   isCustomerTypeContact,
   isOpenEndpoint,
   isPlatformAdministrator,
@@ -20406,6 +21289,8 @@ console.log("\u{1F525} USING LOCAL CMS CORE(index.ts loaded) \u{1F525}");
   loadPublicThemeSettings,
   loadUserVendorContext,
   localStoragePlugin,
+  logAuth,
+  logAuthClient,
   logEntityAccessDecision,
   logRbac,
   mergeEmailLayoutCompanyDetails,
@@ -20415,6 +21300,7 @@ console.log("\u{1F525} USING LOCAL CMS CORE(index.ts loaded) \u{1F525}");
   metaPostPageFeed,
   metaPostPagePhoto,
   metaResolvePageAccessToken,
+  nextAuthCookieDebugInfo,
   normalizePhoneE164,
   parseBlogGeneratorAgentContent,
   parseBlogGeneratorModelOutput,
@@ -20462,6 +21348,7 @@ console.log("\u{1F525} USING LOCAL CMS CORE(index.ts loaded) \u{1F525}");
   smsPlugin,
   socialMediaPlugin,
   summarizeEntityPerms,
+  summarizeSessionUserForLog,
   syncJobScheduleToPgBoss,
   truncateText,
   validateScheduleInput,