@infuro/cms-core 1.0.36 → 1.0.38

package/dist/{chunk-2AEVFOQP.cjs → chunk-VJDUKAJ3.cjs}

@@ -1,14 +1,14 @@
 'use strict';
 
-var chunkCOBORIJH_cjs = require('./chunk-COBORIJH.cjs');
+var chunk22FFHLTO_cjs = require('./chunk-22FFHLTO.cjs');
 var chunk7NMT3GBR_cjs = require('./chunk-7NMT3GBR.cjs');
 var chunkPNOKNSG2_cjs = require('./chunk-PNOKNSG2.cjs');
 var chunkXW5ATPRW_cjs = require('./chunk-XW5ATPRW.cjs');
 var chunk3DZRIZOD_cjs = require('./chunk-3DZRIZOD.cjs');
 var chunkSPQFNIYJ_cjs = require('./chunk-SPQFNIYJ.cjs');
 var chunkXQ3QUHWR_cjs = require('./chunk-XQ3QUHWR.cjs');
-var chunkWO2DW4AU_cjs = require('./chunk-WO2DW4AU.cjs');
-var chunkKPKFNLQQ_cjs = require('./chunk-KPKFNLQQ.cjs');
+var chunkOIGCAGH7_cjs = require('./chunk-OIGCAGH7.cjs');
+var chunkWMXPKKXU_cjs = require('./chunk-WMXPKKXU.cjs');
 var chunkD5FBNKQM_cjs = require('./chunk-D5FBNKQM.cjs');
 var chunkUPLVMVRX_cjs = require('./chunk-UPLVMVRX.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
@@ -87,7 +87,7 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
         `, [
         primary.vendorRoleId
       ]);
-      vendorEntityPerms = chunkKPKFNLQQ_cjs.permissionRowsToRecord(permRows);
+      vendorEntityPerms = chunkWMXPKKXU_cjs.permissionRowsToRecord(permRows);
     } catch (err) {
       if (!isMissingVendorRoleSchemaError(err)) throw err;
     }
@@ -120,7 +120,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     ]);
     const resolvedId = Number(byEmailRows[0]?.id);
     if (!Number.isFinite(resolvedId)) {
-      chunkKPKFNLQQ_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
+      chunkWMXPKKXU_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
         email: user.email,
         rawSessionId: user.id ?? null
       });
@@ -140,7 +140,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   const groupName = rows[0]?.groupName ?? user.groupName ?? null;
   const groupId = rows[0]?.groupId ?? user.groupId ?? void 0;
   const adminAccess = rows[0]?.adminAccess ?? user.adminAccess;
-  const isRBACAdmin = user.isRBACAdmin ?? chunkKPKFNLQQ_cjs.isSuperAdmin({
+  const isRBACAdmin = user.isRBACAdmin ?? chunkWMXPKKXU_cjs.isSuperAdmin({
     groupId,
     groupName,
     isRBACAdmin: user.isRBACAdmin
@@ -153,7 +153,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   };
   if (multiVendorEnabled) {
     ctx = await loadUserVendorContext(dataSource, id, user.activeVendorId);
-    flags = chunkKPKFNLQQ_cjs.vendorPortalFlagsFromUser({
+    flags = chunkWMXPKKXU_cjs.vendorPortalFlagsFromUser({
       email: user.email,
       isRBACAdmin,
       groupName,
@@ -188,7 +188,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     isVendorPortal: flags.isVendorPortal,
     isVendorOwner: flags.isVendorOwner
   };
-  chunkKPKFNLQQ_cjs.logRbac("hydrateVendorSessionUser", {
+  chunkWMXPKKXU_cjs.logRbac("hydrateVendorSessionUser", {
     email: user.email,
     userId: id,
     groupName,
@@ -332,7 +332,7 @@ function repoHasVendorIdColumn(repo) {
 }
 chunkUSNT2KNT_cjs.__name(repoHasVendorIdColumn, "repoHasVendorIdColumn");
 function resourceUsesVendorScope(resource) {
-  return resource === "vendors" || chunkKPKFNLQQ_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
+  return resource === "vendors" || chunkWMXPKKXU_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 chunkUSNT2KNT_cjs.__name(resourceUsesVendorScope, "resourceUsesVendorScope");
 function mergeVendorScopeIntoWhere(where, scope, resource) {
@@ -2617,10 +2617,11 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
         }
       });
       if (combo) {
-        const comboRows = await dataSource.query(`SELECT p."vendorId", ci."productId" as "firstProductId"
+        const comboVendorId = Number(combo.vendorId);
+        const comboRows = await dataSource.query(`SELECT ci."productId" as "firstProductId"
            FROM combo_items ci
            JOIN products p ON p.id = ci."productId"
-           WHERE ci."comboId" = $1 AND p.deleted = false AND p."vendorId" IS NOT NULL
+           WHERE ci."comboId" = $1 AND p.deleted = false
            LIMIT 1`, [
           productId
         ]);
@@ -2637,7 +2638,8 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
               ...childProduct,
               id: productId,
               price: combo.price,
-              name: combo.name
+              name: combo.name,
+              vendorId: Number.isFinite(comboVendorId) && comboVendorId > 0 ? comboVendorId : childProduct.vendorId
             };
           }
         }
@@ -5193,6 +5195,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         });
       }
       if (resource === "combos") {
+        const scope2 = await resolveScopeById();
         const combo = await repo.findOne({
           where: {
             id: Number(id),
@@ -5203,6 +5206,8 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product"
           ]
         });
+        const comboDenied = vendorScopeAccessJson(combo, scope2, resource);
+        if (comboDenied) return comboDenied;
         return combo ? json(combo) : json({
           message: "Not found"
         }, {
@@ -7408,7 +7413,7 @@ function createVendorDashboardHandler(config) {
       if (pe) return pe;
     }
     const user = await getSessionUser();
-    if (!user || !chunkKPKFNLQQ_cjs.isVendorPortalUser(user)) {
+    if (!user || !chunkWMXPKKXU_cjs.isVendorPortalUser(user)) {
       return json({
         error: "Forbidden"
       }, {
@@ -9632,7 +9637,7 @@ function createChatHandlers(config) {
         const notifyEmailAgent = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT, {
           enabledOnly: false
         });
-        const emailTool = chunkCOBORIJH_cjs.resolveChatEmailToolSettings(llmSettings, {
+        const emailTool = chunk22FFHLTO_cjs.resolveChatEmailToolSettings(llmSettings, {
           chatbotValidationRules: agentRow?.validationRules ?? null,
           notifyAgent: notifyEmailAgent ? {
             systemInstruction: notifyEmailAgent.systemInstruction,
@@ -9642,7 +9647,7 @@ function createChatHandlers(config) {
         const emailPlugin2 = cms.getPlugin("email");
         const convLeadSent = conv.leadEmailSentAt;
         const chatAgentFn = llm.chatAgent?.bind(llm);
-        console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline check", {
+        console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline check", {
           conversationId,
           enabled: emailTool.enabled,
           intentCount: emailTool.intents.length,
@@ -9656,27 +9661,27 @@ function createChatHandlers(config) {
           mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
         });
         if (!emailTool.enabled) {
-          console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_tool_disabled"
           });
         } else if (emailTool.intents.length === 0) {
-          console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "no_intents_configured"
           });
         } else if (!emailPlugin2) {
-          console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_plugin_missing"
           });
         } else if (!chatAgentFn) {
-          console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "llm_chat_agent_unavailable"
           });
         } else if (convLeadSent) {
-          console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "lead_email_already_sent",
             leadEmailSentAt: convLeadSent
@@ -9689,7 +9694,7 @@ function createChatHandlers(config) {
             }
           });
           if (!contactRow) {
-            console.warn(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+            console.warn(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
               conversationId,
               reason: "contact_not_found",
               contactId
@@ -9697,7 +9702,7 @@ function createChatHandlers(config) {
           } else {
             const c = contactRow;
             try {
-              const intent = await chunkCOBORIJH_cjs.detectChatLeadIntent({
+              const intent = await chunk22FFHLTO_cjs.detectChatLeadIntent({
                 chatAgent: chatAgentFn
               }, {
                 settings: emailTool,
@@ -9711,15 +9716,15 @@ function createChatHandlers(config) {
                 model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
               });
               if (!intent.intent || !intent.emailTo) {
-                console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "no email sent", {
+                console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "no email sent", {
                   conversationId,
                   reason: intent.intent ? "missing_email_to" : "no_intent_match",
                   intentLabel: intent.intentLabel,
                   classifierReason: intent.reason
                 });
               } else {
-                const intentRecipients = chunkCOBORIJH_cjs.parseIntentRecipientEmails(intent.emailTo);
-                console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                const intentRecipients = chunk22FFHLTO_cjs.parseIntentRecipientEmails(intent.emailTo);
+                console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
                   conversationId,
                   intent: intent.intent,
                   emailTo: intent.emailTo,
@@ -9728,8 +9733,8 @@ function createChatHandlers(config) {
                 });
                 const emailSettings = await loadSettingsGroupMap(dataSource, entityMap, "email");
                 const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
-                const companyDetails = chunkCOBORIJH_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
-                const leadResult = await chunkCOBORIJH_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                const companyDetails = chunk22FFHLTO_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
+                const leadResult = await chunk22FFHLTO_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
                   contactName: String(c.name ?? "").trim() || "Visitor",
                   contactEmail: String(c.email ?? "").trim(),
                   contactPhone: c.phone ?? null,
@@ -9737,7 +9742,7 @@ function createChatHandlers(config) {
                   latestMessage: message,
                   intentCode: intent.intent,
                   intentReason: intent.intentLabel || intent.reason,
-                  transcript: chunkCOBORIJH_cjs.buildTranscriptForLeadEmail(history, message),
+                  transcript: chunk22FFHLTO_cjs.buildTranscriptForLeadEmail(history, message),
                   companyDetails,
                   recipients: intentRecipients.length > 0 ? intentRecipients : void 0
                 });
@@ -9745,13 +9750,13 @@ function createChatHandlers(config) {
                   await convRepo().update(conversationId, {
                     leadEmailSentAt: /* @__PURE__ */ new Date()
                   });
-                  console.info(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
+                  console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
                     conversationId,
                     sent: true,
                     recipients: leadResult.recipients
                   });
                 } else {
-                  console.warn(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
+                  console.warn(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
                     conversationId,
                     sent: false,
                     error: leadResult.error ?? "unknown",
@@ -9760,7 +9765,7 @@ function createChatHandlers(config) {
                 }
               }
             } catch (intentErr) {
-              console.warn(chunkCOBORIJH_cjs.CHAT_EMAIL_LOG, "pipeline error", {
+              console.warn(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline error", {
                 conversationId,
                 error: intentErr instanceof Error ? intentErr.message : String(intentErr)
               });
@@ -9777,7 +9782,7 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = chunkCOBORIJH_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
+          const systemPrompt = chunk22FFHLTO_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
           const res = await llm.chatAgent({
             ...fromAgent,
             systemPrompt: systemPrompt || void 0,
@@ -9798,7 +9803,7 @@ ${contextParts.join("\n\n")}` : "";
               agentRow.systemInstruction?.trim(),
               ragSystem
             ].filter(Boolean).join("\n\n");
-            systemContent = chunkCOBORIJH_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
+            systemContent = chunk22FFHLTO_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -11209,7 +11214,7 @@ chunkUSNT2KNT_cjs.__name(findActiveRefundPolicyForVendor, "findActiveRefundPolic
 // src/api/admin-roles-handlers.ts
 function createAdminRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
-  const baseEntities = chunkKPKFNLQQ_cjs.getPermissionableEntityKeys(entityMap);
+  const baseEntities = chunkWMXPKKXU_cjs.getPermissionableEntityKeys(entityMap);
   const allowEntities = /* @__PURE__ */ new Set([
     ...baseEntities,
     "users"
@@ -11224,7 +11229,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkWO2DW4AU_cjs.canManageRoles(u) && !chunkKPKFNLQQ_cjs.canManageVendorRoles(u)) {
+    if (!chunkOIGCAGH7_cjs.canManageRoles(u) && !chunkWMXPKKXU_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -11235,11 +11240,11 @@ function createAdminRolesHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunkKPKFNLQQ_cjs.canManageVendorRoles(u) && !chunkWO2DW4AU_cjs.canManageRoles(u);
+    return chunkWMXPKKXU_cjs.canManageVendorRoles(u) && !chunkOIGCAGH7_cjs.canManageRoles(u);
   }
   chunkUSNT2KNT_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
-    ...chunkKPKFNLQQ_cjs.VENDOR_STORE_RBAC_ENTITIES,
+    ...chunkWMXPKKXU_cjs.VENDOR_STORE_RBAC_ENTITIES,
     "dashboard",
     "settings"
   ].sort();
@@ -11396,7 +11401,7 @@ function createAdminRolesHandlers(config) {
         }, {
           status: 404
         });
-        if (chunkKPKFNLQQ_cjs.isSuperAdminGroupName(g.name) && !chunkKPKFNLQQ_cjs.isSuperAdminGroupName(name)) {
+        if (chunkWMXPKKXU_cjs.isSuperAdminGroupName(g.name) && !chunkWMXPKKXU_cjs.isSuperAdminGroupName(name)) {
           return json({
             error: "Cannot rename the administrator group"
           }, {
@@ -11453,7 +11458,7 @@ function createAdminRolesHandlers(config) {
       }, {
         status: 404
       });
-      if (chunkKPKFNLQQ_cjs.isSuperAdminGroupName(g.name)) return json({
+      if (chunkWMXPKKXU_cjs.isSuperAdminGroupName(g.name)) return json({
         error: "Cannot delete the administrator group"
       }, {
         status: 400
@@ -11592,8 +11597,8 @@ async function sendVendorOnboardEmails(input, deps) {
       getSettingsGroup(deps, "branding"),
       getSettingsGroup(deps, "email")
     ]);
-    const companyDetails = chunkCOBORIJH_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings);
-    const notifyEmails = chunkCOBORIJH_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
+    const companyDetails = chunk22FFHLTO_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings);
+    const notifyEmails = chunk22FFHLTO_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const sendToOwner = input.sendToOwner !== false;
     const ownerEmail = input.ownerEmail?.trim() || "";
     const cms = await deps.getCms();
@@ -11621,7 +11626,7 @@ chunkUSNT2KNT_cjs.__name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
 async function insertRolePermissions(exec, vendorRoleId, permissions) {
-  for (const entity of chunkKPKFNLQQ_cjs.VENDOR_RBAC_ENTITIES) {
+  for (const entity of chunkWMXPKKXU_cjs.VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
     await exec.query(`
@@ -11652,7 +11657,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     for (const r of existing) {
       roleIdsByName2[r.name] = Number(r.id);
       if (r.isOwnerRole) ownerRoleId2 = Number(r.id);
-      if (r.name === chunkKPKFNLQQ_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
+      if (r.name === chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
     }
     return {
       roleIdsByName: roleIdsByName2,
@@ -11663,7 +11668,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
   const roleIdsByName = {};
   let ownerRoleId = 0;
   let viewerRoleId = 0;
-  for (const def of chunkKPKFNLQQ_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
+  for (const def of chunkWMXPKKXU_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
     const inserted = await exec.query(`
       INSERT INTO "vendor_roles"
         ("vendorId", "name", "description", "isSystem", "isOwnerRole")
@@ -11680,7 +11685,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     if (!roleId) continue;
     roleIdsByName[def.name] = roleId;
     if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === chunkKPKFNLQQ_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
+    if (def.name === chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
     await insertRolePermissions(exec, roleId, def.permissions);
   }
   return {
@@ -11701,7 +11706,7 @@ async function backfillVendorUserRoleIds(em, vendorId, seeded) {
       vendorId
     ]);
   }
-  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkKPKFNLQQ_cjs.VENDOR_VIEWER_ROLE_NAME];
+  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME];
   if (viewerId) {
     await em.query(`
       UPDATE "vendor_users"
@@ -11727,7 +11732,7 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
     LIMIT 1
     `, [
     vendorId,
-    chunkKPKFNLQQ_cjs.VENDOR_VIEWER_ROLE_NAME
+    chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME
   ]);
   const id = rows[0]?.id;
   return id != null ? Number(id) : null;
@@ -11825,7 +11830,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkKPKFNLQQ_cjs.isPlatformAdministrator(u)) return json({
+    if (!chunkWMXPKKXU_cjs.isPlatformAdministrator(u)) return json({
       error: "Forbidden",
       reason: "admin_only"
     }, {
@@ -11835,7 +11840,7 @@ function createVendorOnboardHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
-    const scope = chunkKPKFNLQQ_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -11851,7 +11856,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkKPKFNLQQ_cjs.canManageVendorTeam(u)) return json({
+    if (!chunkWMXPKKXU_cjs.canManageVendorTeam(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -11986,7 +11991,7 @@ function createVendorOnboardHandlers(config) {
           if (dupVendor) throw new Error("VENDOR_SLUG_EXISTS");
           const ownerGroup = await groupRepo.findOne({
             where: {
-              name: chunkKPKFNLQQ_cjs.VENDOR_OWNER_GROUP_NAME,
+              name: chunkWMXPKKXU_cjs.VENDOR_OWNER_GROUP_NAME,
               deleted: false
             }
           });
@@ -12368,7 +12373,7 @@ function createVendorOnboardHandlers(config) {
           if (!groupId) {
             const g = await groupRepo.findOne({
               where: {
-                name: chunkKPKFNLQQ_cjs.VENDOR_OWNER_GROUP_NAME,
+                name: chunkWMXPKKXU_cjs.VENDOR_OWNER_GROUP_NAME,
                 deleted: false
               }
             });
@@ -12678,10 +12683,10 @@ chunkUSNT2KNT_cjs.__name(createVendorOnboardHandlers, "createVendorOnboardHandle
 function createVendorRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
   const vendorRoleEntities = [
-    ...chunkKPKFNLQQ_cjs.VENDOR_RBAC_ENTITIES
+    ...chunkWMXPKKXU_cjs.VENDOR_RBAC_ENTITIES
   ].sort();
   async function resolveActiveVendorId(u) {
-    const scope = chunkKPKFNLQQ_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -12697,7 +12702,7 @@ function createVendorRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkKPKFNLQQ_cjs.canManageVendorRoles(u)) return json({
+    if (!chunkWMXPKKXU_cjs.canManageVendorRoles(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -20855,6 +20860,8 @@ exports.Combo = class Combo {
     chunkUSNT2KNT_cjs.__name(this, "Combo");
   }
   id;
+  vendorId;
+  vendor;
   name;
   desc;
   eventId;
@@ -20880,6 +20887,19 @@ _ts_decorate63([
   typeorm.PrimaryGeneratedColumn(),
   _ts_metadata63("design:type", Number)
 ], exports.Combo.prototype, "id", void 0);
+_ts_decorate63([
+  typeorm.Column("int"),
+  _ts_metadata63("design:type", Number)
+], exports.Combo.prototype, "vendorId", void 0);
+_ts_decorate63([
+  typeorm.ManyToOne(() => exports.Vendor, {
+    onDelete: "RESTRICT"
+  }),
+  typeorm.JoinColumn({
+    name: "vendorId"
+  }),
+  _ts_metadata63("design:type", typeof exports.Vendor === "undefined" ? Object : exports.Vendor)
+], exports.Combo.prototype, "vendor", void 0);
 _ts_decorate63([
   typeorm.Column({
     type: "varchar"
@@ -21224,12 +21244,18 @@ function _ts_metadata66(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 chunkUSNT2KNT_cjs.__name(_ts_metadata66, "_ts_metadata");
-exports.WhatsappTriggerBinding = class WhatsappTriggerBinding {
+var NotificationChannel = /* @__PURE__ */ (function(NotificationChannel2) {
+  NotificationChannel2["WHATSAPP"] = "whatsapp";
+  NotificationChannel2["EMAIL"] = "email";
+  return NotificationChannel2;
+})({});
+exports.OrderNotificationBinding = class OrderNotificationBinding {
   static {
-    chunkUSNT2KNT_cjs.__name(this, "WhatsappTriggerBinding");
+    chunkUSNT2KNT_cjs.__name(this, "OrderNotificationBinding");
   }
   id;
   triggerKey;
+  channel;
   messageTemplateId;
   enabled;
   createdAt;
@@ -21238,39 +21264,52 @@ exports.WhatsappTriggerBinding = class WhatsappTriggerBinding {
 _ts_decorate66([
   typeorm.PrimaryGeneratedColumn(),
   _ts_metadata66("design:type", Number)
-], exports.WhatsappTriggerBinding.prototype, "id", void 0);
+], exports.OrderNotificationBinding.prototype, "id", void 0);
 _ts_decorate66([
   typeorm.Column({
-    type: "varchar",
-    unique: true
+    type: "varchar"
   }),
   _ts_metadata66("design:type", String)
-], exports.WhatsappTriggerBinding.prototype, "triggerKey", void 0);
+], exports.OrderNotificationBinding.prototype, "triggerKey", void 0);
+_ts_decorate66([
+  typeorm.Column({
+    type: "enum",
+    enum: NotificationChannel,
+    default: "whatsapp"
+  }),
+  _ts_metadata66("design:type", String)
+], exports.OrderNotificationBinding.prototype, "channel", void 0);
 _ts_decorate66([
   typeorm.Column({
     type: "int",
     nullable: true
   }),
   _ts_metadata66("design:type", Object)
-], exports.WhatsappTriggerBinding.prototype, "messageTemplateId", void 0);
+], exports.OrderNotificationBinding.prototype, "messageTemplateId", void 0);
 _ts_decorate66([
   typeorm.Column({
     type: "boolean",
     default: true
   }),
   _ts_metadata66("design:type", Boolean)
-], exports.WhatsappTriggerBinding.prototype, "enabled", void 0);
+], exports.OrderNotificationBinding.prototype, "enabled", void 0);
 _ts_decorate66([
   typeorm.CreateDateColumn(),
   _ts_metadata66("design:type", typeof Date === "undefined" ? Object : Date)
-], exports.WhatsappTriggerBinding.prototype, "createdAt", void 0);
+], exports.OrderNotificationBinding.prototype, "createdAt", void 0);
 _ts_decorate66([
   typeorm.UpdateDateColumn(),
   _ts_metadata66("design:type", typeof Date === "undefined" ? Object : Date)
-], exports.WhatsappTriggerBinding.prototype, "updatedAt", void 0);
-exports.WhatsappTriggerBinding = _ts_decorate66([
-  typeorm.Entity("whatsapp_trigger_bindings")
-], exports.WhatsappTriggerBinding);
+], exports.OrderNotificationBinding.prototype, "updatedAt", void 0);
+exports.OrderNotificationBinding = _ts_decorate66([
+  typeorm.Entity("order_notification_bindings"),
+  typeorm.Index([
+    "triggerKey",
+    "channel"
+  ], {
+    unique: true
+  })
+], exports.OrderNotificationBinding);
 function _ts_decorate67(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -21420,7 +21459,7 @@ var CMS_ENTITY_MAP = {
   refund_policies: exports.RefundPolicy,
   refund_requests: exports.RefundRequest,
   attendees: exports.Attendee,
-  whatsapp_trigger_bindings: exports.WhatsappTriggerBinding,
+  order_notification_bindings: exports.OrderNotificationBinding,
   order_notification_triggers: exports.OrderNotificationTrigger
 };
 
@@ -24523,6 +24562,173 @@ function createWhatsappMessageTemplatesHandlers(config) {
   };
 }
 chunkUSNT2KNT_cjs.__name(createWhatsappMessageTemplatesHandlers, "createWhatsappMessageTemplatesHandlers");
+
+// src/api/email-message-templates-handlers.ts
+function slugify2(input) {
+  return input.toLowerCase().trim().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 64) || "template";
+}
+chunkUSNT2KNT_cjs.__name(slugify2, "slugify");
+function createEmailMessageTemplatesHandlers(config) {
+  const { dataSource, entityMap, json, requireAuth, requireEntityPermission } = config;
+  const templateRepo = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(() => dataSource.getRepository(entityMap.message_templates), "templateRepo");
+  async function requireRead(req, entity) {
+    const a = await requireAuth(req);
+    if (a) return a;
+    if (requireEntityPermission) {
+      const pe = await requireEntityPermission(req, entity, "read");
+      if (pe) return pe;
+    }
+    return null;
+  }
+  chunkUSNT2KNT_cjs.__name(requireRead, "requireRead");
+  async function requireUpdate(req, entity) {
+    const a = await requireAuth(req);
+    if (a) return a;
+    if (requireEntityPermission) {
+      const pe = await requireEntityPermission(req, entity, "update");
+      if (pe) return pe;
+    }
+    return null;
+  }
+  chunkUSNT2KNT_cjs.__name(requireUpdate, "requireUpdate");
+  return {
+    async listCached(req) {
+      const err = await requireRead(req, "settings");
+      if (err) return err;
+      try {
+        const rows = await templateRepo().find({
+          where: {
+            channel: "email",
+            deleted: false
+          },
+          order: {
+            name: "ASC"
+          }
+        });
+        return json({
+          items: rows
+        });
+      } catch {
+        return json({
+          error: "Failed to load templates"
+        }, {
+          status: 500
+        });
+      }
+    },
+    async create(req) {
+      const err = await requireUpdate(req, "settings");
+      if (err) return err;
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return json({
+          error: "Invalid JSON body"
+        }, {
+          status: 400
+        });
+      }
+      const name = typeof body.name === "string" ? body.name.trim() : "";
+      const subject = typeof body.subject === "string" ? body.subject : "";
+      const bodyText = typeof body.body === "string" ? body.body : "";
+      if (!name) return json({
+        error: "name is required"
+      }, {
+        status: 400
+      });
+      if (!bodyText.trim()) return json({
+        error: "body is required"
+      }, {
+        status: 400
+      });
+      const baseKey = slugify2(name);
+      let templateKey = baseKey;
+      let suffix = 1;
+      while (await templateRepo().findOne({
+        where: {
+          channel: "email",
+          templateKey,
+          deleted: false
+        }
+      })) {
+        suffix += 1;
+        templateKey = `${baseKey}_${suffix}`;
+      }
+      const row = await templateRepo().save(templateRepo().create({
+        channel: "email",
+        templateKey,
+        name,
+        subject,
+        body: bodyText,
+        externalTemplateRef: null,
+        providerMeta: null,
+        enabled: true,
+        deleted: false
+      }));
+      return json({
+        item: row
+      }, {
+        status: 201
+      });
+    },
+    async update(req, id) {
+      const err = await requireUpdate(req, "settings");
+      if (err) return err;
+      const numId = Number(id);
+      if (!Number.isFinite(numId)) return json({
+        error: "Invalid id"
+      }, {
+        status: 400
+      });
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return json({
+          error: "Invalid JSON body"
+        }, {
+          status: 400
+        });
+      }
+      const existing = await templateRepo().findOne({
+        where: {
+          id: numId,
+          channel: "email",
+          deleted: false
+        }
+      });
+      if (!existing) return json({
+        error: "Template not found"
+      }, {
+        status: 404
+      });
+      const patch = {
+        updatedAt: /* @__PURE__ */ new Date()
+      };
+      if (typeof body.name === "string" && body.name.trim()) patch.name = body.name.trim();
+      if (typeof body.subject === "string") patch.subject = body.subject;
+      if (typeof body.body === "string") {
+        if (!body.body.trim()) return json({
+          error: "body cannot be empty"
+        }, {
+          status: 400
+        });
+        patch.body = body.body;
+      }
+      await templateRepo().update(numId, patch);
+      const updated = await templateRepo().findOne({
+        where: {
+          id: numId
+        }
+      });
+      return json({
+        item: updated
+      });
+    }
+  };
+}
+chunkUSNT2KNT_cjs.__name(createEmailMessageTemplatesHandlers, "createEmailMessageTemplatesHandlers");
 function connectionFromUrl(redisUrl) {
   const u = new URL(redisUrl);
   return {
@@ -24680,16 +24886,16 @@ function whatsappPlugin(config = {}) {
         db = await getWhatsAppSettings?.() ?? {};
       } catch {
       }
-      if (!chunkCOBORIJH_cjs.isWhatsAppPluginEnabled(db)) {
+      if (!chunk22FFHLTO_cjs.isWhatsAppPluginEnabled(db)) {
         context.logger.warn("WhatsApp plugin skipped: disabled in Plugins \u2192 WhatsApp");
         return null;
       }
-      const merged = chunkCOBORIJH_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
-      if (!getWhatsAppSettings && !chunkCOBORIJH_cjs.whatsAppConfigured(merged)) {
+      const merged = chunk22FFHLTO_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
+      if (!getWhatsAppSettings && !chunk22FFHLTO_cjs.whatsAppConfigured(merged)) {
         context.logger.warn("WhatsApp plugin skipped: set WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID, or pass getWhatsAppSettings");
         return null;
       }
-      const svc = new chunkCOBORIJH_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
+      const svc = new chunk22FFHLTO_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
       return {
         send: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((opts) => svc.send(opts), "send")
       };
@@ -24763,7 +24969,7 @@ function createMessageTemplateRowLoader(dataSource, entityMap) {
 chunkUSNT2KNT_cjs.__name(createMessageTemplateRowLoader, "createMessageTemplateRowLoader");
 function registerMessagingQueueProcessors(cms) {
   chunkXW5ATPRW_cjs.registerEmailQueueProcessor(cms);
-  chunkCOBORIJH_cjs.registerWhatsAppQueueProcessor(cms);
+  chunk22FFHLTO_cjs.registerWhatsAppQueueProcessor(cms);
 }
 chunkUSNT2KNT_cjs.__name(registerMessagingQueueProcessors, "registerMessagingQueueProcessors");
 async function ensureMessagingPluginsOnCms(base, options) {
@@ -24792,7 +24998,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
   }
   if (!cms.getPlugin("email")) {
     try {
-      const instance = await chunkCOBORIJH_cjs.emailPlugin({
+      const instance = await chunk22FFHLTO_cjs.emailPlugin({
         type: "SMTP",
         from: config.SMTP_FROM ?? "no-reply@localhost",
         to: config.SMTP_TO ?? ""
@@ -24833,7 +25039,7 @@ function messagingPlugins(options) {
   const config = options.config ?? (typeof process !== "undefined" ? process.env : {});
   return [
     queuePlugin(),
-    chunkCOBORIJH_cjs.emailPlugin({
+    chunk22FFHLTO_cjs.emailPlugin({
       type: "SMTP",
       from: config.SMTP_FROM ?? "no-reply@localhost",
       to: config.SMTP_TO ?? ""
@@ -24880,7 +25086,7 @@ function withLlmKnowledgeEntityFallbacks(base) {
     "rss_feeds",
     "rss_articles",
     "order_notification_triggers",
-    "whatsapp_trigger_bindings",
+    "order_notification_bindings",
     "message_templates"
   ];
   const patch = {};
@@ -24967,7 +25173,7 @@ function createCmsApiHandler(config) {
   } : void 0;
   const entityMap = withLlmKnowledgeEntityFallbacks(rawEntityMap);
   if (getCms) {
-    chunkCOBORIJH_cjs.initWhatsappTriggerDispatcher({
+    chunk22FFHLTO_cjs.initWhatsappTriggerDispatcher({
       dataSource,
       entityMap,
       getCms
@@ -24980,7 +25186,7 @@ function createCmsApiHandler(config) {
   ] : baseCrudResources;
   const requireEntityPermissionEffective = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async (_req, entity, action) => {
     if (!resolveSessionUser) {
-      chunkKPKFNLQQ_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
+      chunkWMXPKKXU_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
         entity,
         action,
         hint: "Pass getSessionUser: auth.getAuthenticatedUser from createCmsAuthBundle()"
@@ -24990,7 +25196,7 @@ function createCmsApiHandler(config) {
       const raw = await resolveSessionUser();
       const u = await hydrateVendorSessionUser(dataSource, raw);
       if (!u?.email) {
-        chunkKPKFNLQQ_cjs.logRbac("requireEntityPermission: no session user", {
+        chunkWMXPKKXU_cjs.logRbac("requireEntityPermission: no session user", {
           entity,
           action
         });
@@ -25000,13 +25206,13 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunkWO2DW4AU_cjs.sessionHasEntityAccess(u, entity, action);
-      await chunkKPKFNLQQ_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
+      const allowed = chunkOIGCAGH7_cjs.sessionHasEntityAccess(u, entity, action);
+      await chunkWMXPKKXU_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
       });
       if (allowed) return null;
-      const { reason } = chunkKPKFNLQQ_cjs.explainSessionEntityAccess(u, entity, action);
+      const { reason } = chunkWMXPKKXU_cjs.explainSessionEntityAccess(u, entity, action);
       return config.json({
         error: "Forbidden",
         entity,
@@ -25017,7 +25223,7 @@ function createCmsApiHandler(config) {
       });
     }
     if (userRequireEntityPermission) {
-      chunkKPKFNLQQ_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
+      chunkWMXPKKXU_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
         entity,
         action
       });
@@ -25104,10 +25310,10 @@ function createCmsApiHandler(config) {
       getVendorScope: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
         if (!multiVendorEnabled) {
-          return chunkKPKFNLQQ_cjs.resolveDisabledMultiVendorScope(dataSource);
+          return chunkWMXPKKXU_cjs.resolveDisabledMultiVendorScope(dataSource);
         }
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-        return chunkKPKFNLQQ_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+        return chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
       }, "getVendorScope"),
       getHydratedSessionUser: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
@@ -25238,6 +25444,13 @@ function createCmsApiHandler(config) {
     requireEntityPermission: requireEntityPermissionEffective,
     settingsEncryptionKey: settingsConfig?.encryptionKey
   });
+  const emailMessageTemplatesHandlers = createEmailMessageTemplatesHandlers({
+    dataSource,
+    entityMap,
+    json: config.json,
+    requireAuth: config.requireAuth,
+    requireEntityPermission: requireEntityPermissionEffective
+  });
   const chatHandlers = chatConfig ? createChatHandlers(chatConfig) : null;
   const llmAgentKnowledgeMerged = llmAgentKnowledgeConfig ?? (chatConfig ? {
     dataSource: chatConfig.dataSource,
@@ -26210,6 +26423,13 @@ function createCmsApiHandler(config) {
       if (path2[0] === "message-templates" && path2[1] === "whatsapp" && path2.length === 3 && path2[2] !== "sync") {
         if (m === "PATCH") return whatsappMessageTemplatesHandlers.setParamOrder(req, path2[2]);
       }
+      if (path2[0] === "message-templates" && path2[1] === "email" && path2.length === 2) {
+        if (m === "GET") return emailMessageTemplatesHandlers.listCached(req);
+        if (m === "POST") return emailMessageTemplatesHandlers.create(req);
+      }
+      if (path2[0] === "message-templates" && path2[1] === "email" && path2.length === 3) {
+        if (m === "PATCH") return emailMessageTemplatesHandlers.update(req, path2[2]);
+      }
       if (path2[0] === "llm_agents") {
         if (!entityMap.llm_agents) {
           console.error(CMS_API_LOG, "llm_agents route: entity missing after merge", {
@@ -26338,7 +26558,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkKPKFNLQQ_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const result = await validateCoupon(dataSource, entityMap, couponCode, orderLinesNorm, currency, contactId, isAutomatic, discountId ?? void 0, vendorId);
@@ -26418,7 +26638,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkKPKFNLQQ_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
@@ -26624,7 +26844,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./whatsapp-trigger-dispatcher-ONHXI7UY.cjs');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-RU7BTGGX.cjs');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -27032,7 +27252,7 @@ function createCmsApiHandler(config) {
           if (resolveSessionUser) {
             const raw = await resolveSessionUser();
             const u = await hydrateVendorSessionUser(dataSource, raw);
-            const scope = chunkKPKFNLQQ_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") {
               scopedVendorIds = scope.vendorIds;
             }