@infuro/cms-core 1.0.36 → 1.0.39

package/dist/{chunk-JS2W7XZ4.js → chunk-SFDZMGHD.js}

@@ -1,12 +1,12 @@
-import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, mergeEmailLayoutCompanyDetails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-VMY2S32H.js';
+import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, mergeEmailLayoutCompanyDetails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-NNQBWDCI.js';
 import { inviteStatusForActivation } from './chunk-JXF23MPG.js';
 import { unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-WEMDMVHQ.js';
 import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-5ELSW2UP.js';
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MQBT33IV.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-KFFB6EMZ.js';
 import { JOB_RUNNER_QUEUE } from './chunk-GO7PPYNU.js';
-import { canManageRoles, sessionHasEntityAccess } from './chunk-LI2IXVAY.js';
-import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_OWNER_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-UF3BYUXY.js';
+import { canManageRoles, sessionHasEntityAccess } from './chunk-UXMDSNIG.js';
+import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_OWNER_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-P7QCLE5W.js';
 import { queueErp } from './chunk-SYBOCAWB.js';
 import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { __name } from './chunk-SHUYVCID.js';
@@ -2607,10 +2607,11 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
         }
       });
       if (combo) {
-        const comboRows = await dataSource.query(`SELECT p."vendorId", ci."productId" as "firstProductId"
+        const comboVendorId = Number(combo.vendorId);
+        const comboRows = await dataSource.query(`SELECT ci."productId" as "firstProductId"
            FROM combo_items ci
            JOIN products p ON p.id = ci."productId"
-           WHERE ci."comboId" = $1 AND p.deleted = false AND p."vendorId" IS NOT NULL
+           WHERE ci."comboId" = $1 AND p.deleted = false
            LIMIT 1`, [
           productId
         ]);
@@ -2627,7 +2628,8 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
               ...childProduct,
               id: productId,
               price: combo.price,
-              name: combo.name
+              name: combo.name,
+              vendorId: Number.isFinite(comboVendorId) && comboVendorId > 0 ? comboVendorId : childProduct.vendorId
             };
           }
         }
@@ -5183,6 +5185,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         });
       }
       if (resource === "combos") {
+        const scope2 = await resolveScopeById();
         const combo = await repo.findOne({
           where: {
             id: Number(id),
@@ -5193,6 +5196,8 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product"
           ]
         });
+        const comboDenied = vendorScopeAccessJson(combo, scope2, resource);
+        if (comboDenied) return comboDenied;
         return combo ? json(combo) : json({
           message: "Not found"
         }, {
@@ -11806,6 +11811,84 @@ function slugify(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 __name(slugify, "slugify");
+function vendorOnboardErrorResponse(json, err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  console.error("[vendor-onboard]", err);
+  if (msg === "VENDOR_SLUG_EXISTS") {
+    return json({
+      error: "Vendor slug already exists"
+    }, {
+      status: 400
+    });
+  }
+  if (msg === "USER_EMAIL_EXISTS") {
+    return json({
+      error: "User with this email already exists"
+    }, {
+      status: 400
+    });
+  }
+  if (msg === "VENDOR_OWNER_GROUP_MISSING") {
+    return json({
+      error: "Vendor Owner group not found. Run migrations (VendorOwnerRbacSeed)."
+    }, {
+      status: 500
+    });
+  }
+  if (msg === "VENDOR_ROLES_SEED_FAILED") {
+    return json({
+      error: "Failed to seed store roles for vendor. Run migrations."
+    }, {
+      status: 500
+    });
+  }
+  if (/vendor_roles|vendor_role_permissions/i.test(msg)) {
+    return json({
+      error: "Vendor roles tables missing. Run migrations."
+    }, {
+      status: 500
+    });
+  }
+  if (/relation .* does not exist|column .* does not exist/i.test(msg)) {
+    return json({
+      error: "Database schema is outdated on this environment. Run migrations.",
+      detail: msg
+    }, {
+      status: 500
+    });
+  }
+  if (/duplicate key|unique constraint/i.test(msg)) {
+    if (/email/i.test(msg)) {
+      return json({
+        error: "A user or record with this email already exists",
+        detail: msg
+      }, {
+        status: 409
+      });
+    }
+    if (/slug/i.test(msg)) {
+      return json({
+        error: "Vendor slug already exists",
+        detail: msg
+      }, {
+        status: 409
+      });
+    }
+    return json({
+      error: "Duplicate value conflicts with an existing record",
+      detail: msg
+    }, {
+      status: 409
+    });
+  }
+  return json({
+    error: "Server error",
+    detail: msg
+  }, {
+    status: 500
+  });
+}
+__name(vendorOnboardErrorResponse, "vendorOnboardErrorResponse");
 function createVendorOnboardHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser, baseUrl, getCms, hashPassword, minPasswordLength = 6 } = config;
   async function gateAdmin() {
@@ -11974,12 +12057,28 @@ function createVendorOnboardHandlers(config) {
             }
           });
           if (dupVendor) throw new Error("VENDOR_SLUG_EXISTS");
-          const ownerGroup = await groupRepo.findOne({
+          let ownerGroup = await groupRepo.findOne({
             where: {
               name: VENDOR_OWNER_GROUP_NAME,
               deleted: false
             }
           });
+          if (!ownerGroup) {
+            try {
+              await groupRepo.save(groupRepo.create({
+                name: VENDOR_OWNER_GROUP_NAME,
+                deleted: false
+              }));
+              ownerGroup = await groupRepo.findOne({
+                where: {
+                  name: VENDOR_OWNER_GROUP_NAME,
+                  deleted: false
+                }
+              });
+            } catch (seedErr) {
+              console.error("[vendor-onboard] failed to seed Vendor Owner group", seedErr);
+            }
+          }
           if (!ownerGroup) throw new Error("VENDOR_OWNER_GROUP_MISSING");
           const existingUser = await userRepo.findOne({
             where: {
@@ -12068,14 +12167,18 @@ function createVendorOnboardHandlers(config) {
             });
           }
           if (entityMap.customer) {
-            await ensureCustomerForUser(em, entityMap.customer, {
-              id: newUser.id,
-              name: userName,
-              email: userEmail,
-              phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
-            }, {
-              phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
-            });
+            try {
+              await ensureCustomerForUser(em, entityMap.customer, {
+                id: newUser.id,
+                name: userName,
+                email: userEmail,
+                phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
+              }, {
+                phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
+              });
+            } catch (customerErr) {
+              console.error("[vendor-onboard] ensureCustomerForUser skipped", customerErr);
+            }
           }
           return {
             vendor,
@@ -12125,46 +12228,7 @@ function createVendorOnboardHandlers(config) {
           status: 201
         });
       } catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        if (process.env.NODE_ENV === "development") {
-          console.error("[vendor-onboard]", e);
-        }
-        if (msg === "VENDOR_SLUG_EXISTS") return json({
-          error: "Vendor slug already exists"
-        }, {
-          status: 400
-        });
-        if (msg === "USER_EMAIL_EXISTS") return json({
-          error: "User with this email already exists"
-        }, {
-          status: 400
-        });
-        if (msg === "VENDOR_OWNER_GROUP_MISSING") {
-          return json({
-            error: "Vendor Owner group not found. Run migrations."
-          }, {
-            status: 500
-          });
-        }
-        if (msg === "VENDOR_ROLES_SEED_FAILED") {
-          return json({
-            error: "Failed to seed store roles for vendor. Run migrations."
-          }, {
-            status: 500
-          });
-        }
-        if (/vendor_roles|vendor_role_permissions/i.test(msg)) {
-          return json({
-            error: "Vendor roles tables missing. Run migrations."
-          }, {
-            status: 500
-          });
-        }
-        return json({
-          error: "Server error"
-        }, {
-          status: 500
-        });
+        return vendorOnboardErrorResponse(json, e);
       }
     },
     /** POST /api/admin/vendor/switch — set active vendor in session (JWT update via client) */
@@ -20845,6 +20909,8 @@ var Combo = class {
     __name(this, "Combo");
   }
   id;
+  vendorId;
+  vendor;
   name;
   desc;
   eventId;
@@ -20870,6 +20936,19 @@ _ts_decorate63([
   PrimaryGeneratedColumn(),
   _ts_metadata63("design:type", Number)
 ], Combo.prototype, "id", void 0);
+_ts_decorate63([
+  Column("int"),
+  _ts_metadata63("design:type", Number)
+], Combo.prototype, "vendorId", void 0);
+_ts_decorate63([
+  ManyToOne(() => Vendor, {
+    onDelete: "RESTRICT"
+  }),
+  JoinColumn({
+    name: "vendorId"
+  }),
+  _ts_metadata63("design:type", typeof Vendor === "undefined" ? Object : Vendor)
+], Combo.prototype, "vendor", void 0);
 _ts_decorate63([
   Column({
     type: "varchar"
@@ -21214,12 +21293,18 @@ function _ts_metadata66(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 __name(_ts_metadata66, "_ts_metadata");
-var WhatsappTriggerBinding = class {
+var NotificationChannel = /* @__PURE__ */ (function(NotificationChannel2) {
+  NotificationChannel2["WHATSAPP"] = "whatsapp";
+  NotificationChannel2["EMAIL"] = "email";
+  return NotificationChannel2;
+})({});
+var OrderNotificationBinding = class {
   static {
-    __name(this, "WhatsappTriggerBinding");
+    __name(this, "OrderNotificationBinding");
   }
   id;
   triggerKey;
+  channel;
   messageTemplateId;
   enabled;
   createdAt;
@@ -21228,39 +21313,52 @@ var WhatsappTriggerBinding = class {
 _ts_decorate66([
   PrimaryGeneratedColumn(),
   _ts_metadata66("design:type", Number)
-], WhatsappTriggerBinding.prototype, "id", void 0);
+], OrderNotificationBinding.prototype, "id", void 0);
 _ts_decorate66([
   Column({
-    type: "varchar",
-    unique: true
+    type: "varchar"
   }),
   _ts_metadata66("design:type", String)
-], WhatsappTriggerBinding.prototype, "triggerKey", void 0);
+], OrderNotificationBinding.prototype, "triggerKey", void 0);
+_ts_decorate66([
+  Column({
+    type: "enum",
+    enum: NotificationChannel,
+    default: "whatsapp"
+  }),
+  _ts_metadata66("design:type", String)
+], OrderNotificationBinding.prototype, "channel", void 0);
 _ts_decorate66([
   Column({
     type: "int",
     nullable: true
   }),
   _ts_metadata66("design:type", Object)
-], WhatsappTriggerBinding.prototype, "messageTemplateId", void 0);
+], OrderNotificationBinding.prototype, "messageTemplateId", void 0);
 _ts_decorate66([
   Column({
     type: "boolean",
     default: true
   }),
   _ts_metadata66("design:type", Boolean)
-], WhatsappTriggerBinding.prototype, "enabled", void 0);
+], OrderNotificationBinding.prototype, "enabled", void 0);
 _ts_decorate66([
   CreateDateColumn(),
   _ts_metadata66("design:type", typeof Date === "undefined" ? Object : Date)
-], WhatsappTriggerBinding.prototype, "createdAt", void 0);
+], OrderNotificationBinding.prototype, "createdAt", void 0);
 _ts_decorate66([
   UpdateDateColumn(),
   _ts_metadata66("design:type", typeof Date === "undefined" ? Object : Date)
-], WhatsappTriggerBinding.prototype, "updatedAt", void 0);
-WhatsappTriggerBinding = _ts_decorate66([
-  Entity("whatsapp_trigger_bindings")
-], WhatsappTriggerBinding);
+], OrderNotificationBinding.prototype, "updatedAt", void 0);
+OrderNotificationBinding = _ts_decorate66([
+  Entity("order_notification_bindings"),
+  Index([
+    "triggerKey",
+    "channel"
+  ], {
+    unique: true
+  })
+], OrderNotificationBinding);
 function _ts_decorate67(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -21410,7 +21508,7 @@ var CMS_ENTITY_MAP = {
   refund_policies: RefundPolicy,
   refund_requests: RefundRequest,
   attendees: Attendee,
-  whatsapp_trigger_bindings: WhatsappTriggerBinding,
+  order_notification_bindings: OrderNotificationBinding,
   order_notification_triggers: OrderNotificationTrigger
 };
 
@@ -24513,6 +24611,173 @@ function createWhatsappMessageTemplatesHandlers(config) {
   };
 }
 __name(createWhatsappMessageTemplatesHandlers, "createWhatsappMessageTemplatesHandlers");
+
+// src/api/email-message-templates-handlers.ts
+function slugify2(input) {
+  return input.toLowerCase().trim().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 64) || "template";
+}
+__name(slugify2, "slugify");
+function createEmailMessageTemplatesHandlers(config) {
+  const { dataSource, entityMap, json, requireAuth, requireEntityPermission } = config;
+  const templateRepo = /* @__PURE__ */ __name(() => dataSource.getRepository(entityMap.message_templates), "templateRepo");
+  async function requireRead(req, entity) {
+    const a = await requireAuth(req);
+    if (a) return a;
+    if (requireEntityPermission) {
+      const pe = await requireEntityPermission(req, entity, "read");
+      if (pe) return pe;
+    }
+    return null;
+  }
+  __name(requireRead, "requireRead");
+  async function requireUpdate(req, entity) {
+    const a = await requireAuth(req);
+    if (a) return a;
+    if (requireEntityPermission) {
+      const pe = await requireEntityPermission(req, entity, "update");
+      if (pe) return pe;
+    }
+    return null;
+  }
+  __name(requireUpdate, "requireUpdate");
+  return {
+    async listCached(req) {
+      const err = await requireRead(req, "settings");
+      if (err) return err;
+      try {
+        const rows = await templateRepo().find({
+          where: {
+            channel: "email",
+            deleted: false
+          },
+          order: {
+            name: "ASC"
+          }
+        });
+        return json({
+          items: rows
+        });
+      } catch {
+        return json({
+          error: "Failed to load templates"
+        }, {
+          status: 500
+        });
+      }
+    },
+    async create(req) {
+      const err = await requireUpdate(req, "settings");
+      if (err) return err;
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return json({
+          error: "Invalid JSON body"
+        }, {
+          status: 400
+        });
+      }
+      const name = typeof body.name === "string" ? body.name.trim() : "";
+      const subject = typeof body.subject === "string" ? body.subject : "";
+      const bodyText = typeof body.body === "string" ? body.body : "";
+      if (!name) return json({
+        error: "name is required"
+      }, {
+        status: 400
+      });
+      if (!bodyText.trim()) return json({
+        error: "body is required"
+      }, {
+        status: 400
+      });
+      const baseKey = slugify2(name);
+      let templateKey = baseKey;
+      let suffix = 1;
+      while (await templateRepo().findOne({
+        where: {
+          channel: "email",
+          templateKey,
+          deleted: false
+        }
+      })) {
+        suffix += 1;
+        templateKey = `${baseKey}_${suffix}`;
+      }
+      const row = await templateRepo().save(templateRepo().create({
+        channel: "email",
+        templateKey,
+        name,
+        subject,
+        body: bodyText,
+        externalTemplateRef: null,
+        providerMeta: null,
+        enabled: true,
+        deleted: false
+      }));
+      return json({
+        item: row
+      }, {
+        status: 201
+      });
+    },
+    async update(req, id) {
+      const err = await requireUpdate(req, "settings");
+      if (err) return err;
+      const numId = Number(id);
+      if (!Number.isFinite(numId)) return json({
+        error: "Invalid id"
+      }, {
+        status: 400
+      });
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return json({
+          error: "Invalid JSON body"
+        }, {
+          status: 400
+        });
+      }
+      const existing = await templateRepo().findOne({
+        where: {
+          id: numId,
+          channel: "email",
+          deleted: false
+        }
+      });
+      if (!existing) return json({
+        error: "Template not found"
+      }, {
+        status: 404
+      });
+      const patch = {
+        updatedAt: /* @__PURE__ */ new Date()
+      };
+      if (typeof body.name === "string" && body.name.trim()) patch.name = body.name.trim();
+      if (typeof body.subject === "string") patch.subject = body.subject;
+      if (typeof body.body === "string") {
+        if (!body.body.trim()) return json({
+          error: "body cannot be empty"
+        }, {
+          status: 400
+        });
+        patch.body = body.body;
+      }
+      await templateRepo().update(numId, patch);
+      const updated = await templateRepo().findOne({
+        where: {
+          id: numId
+        }
+      });
+      return json({
+        item: updated
+      });
+    }
+  };
+}
+__name(createEmailMessageTemplatesHandlers, "createEmailMessageTemplatesHandlers");
 function connectionFromUrl(redisUrl) {
   const u = new URL(redisUrl);
   return {
@@ -24870,7 +25135,7 @@ function withLlmKnowledgeEntityFallbacks(base) {
     "rss_feeds",
     "rss_articles",
     "order_notification_triggers",
-    "whatsapp_trigger_bindings",
+    "order_notification_bindings",
     "message_templates"
   ];
   const patch = {};
@@ -25228,6 +25493,13 @@ function createCmsApiHandler(config) {
     requireEntityPermission: requireEntityPermissionEffective,
     settingsEncryptionKey: settingsConfig?.encryptionKey
   });
+  const emailMessageTemplatesHandlers = createEmailMessageTemplatesHandlers({
+    dataSource,
+    entityMap,
+    json: config.json,
+    requireAuth: config.requireAuth,
+    requireEntityPermission: requireEntityPermissionEffective
+  });
   const chatHandlers = chatConfig ? createChatHandlers(chatConfig) : null;
   const llmAgentKnowledgeMerged = llmAgentKnowledgeConfig ?? (chatConfig ? {
     dataSource: chatConfig.dataSource,
@@ -26200,6 +26472,13 @@ function createCmsApiHandler(config) {
       if (path2[0] === "message-templates" && path2[1] === "whatsapp" && path2.length === 3 && path2[2] !== "sync") {
         if (m === "PATCH") return whatsappMessageTemplatesHandlers.setParamOrder(req, path2[2]);
       }
+      if (path2[0] === "message-templates" && path2[1] === "email" && path2.length === 2) {
+        if (m === "GET") return emailMessageTemplatesHandlers.listCached(req);
+        if (m === "POST") return emailMessageTemplatesHandlers.create(req);
+      }
+      if (path2[0] === "message-templates" && path2[1] === "email" && path2.length === 3) {
+        if (m === "PATCH") return emailMessageTemplatesHandlers.update(req, path2[2]);
+      }
       if (path2[0] === "llm_agents") {
         if (!entityMap.llm_agents) {
           console.error(CMS_API_LOG, "llm_agents route: entity missing after merge", {
@@ -26614,7 +26893,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./whatsapp-trigger-dispatcher-PWFI4FKP.js');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-XWIJYDGA.js');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -30309,4 +30588,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, WhatsappTriggerBinding, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyVendorCustomersContactFilter, assertCaptchaOk, assertContactAllowedForVendorOrder, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRssArticleSummaryFromItem, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyVendorCustomersContactFilter, assertCaptchaOk, assertContactAllowedForVendorOrder, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRssArticleSummaryFromItem, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };

package/dist/{chunk-LI2IXVAY.js → chunk-UXMDSNIG.js}

@@ -1,4 +1,4 @@
-import { explainSessionEntityAccess, isVendorPortalUser, logRbac } from './chunk-UF3BYUXY.js';
+import { explainSessionEntityAccess, isVendorPortalUser, logRbac } from './chunk-P7QCLE5W.js';
 import { __name } from './chunk-SHUYVCID.js';
 
 // src/auth/helpers.ts

package/dist/{chunk-KPKFNLQQ.cjs → chunk-WMXPKKXU.cjs}

@@ -18,7 +18,7 @@ var PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
   "wishlist_items",
   "message_templates",
   "order_notification_triggers",
-  "whatsapp_trigger_bindings",
+  "order_notification_bindings",
   "vendor_users",
   "vendor_roles",
   "vendor_role_permissions"
@@ -129,7 +129,8 @@ var VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
   "vendor_customers",
   "discounts",
   "events",
-  "refund_policies"
+  "refund_policies",
+  "combos"
 ]);
 var VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
   ...VENDOR_SCOPED_STORE_ENTITIES,
@@ -594,7 +595,7 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
     const id = Number(user.id);
     if (Number.isFinite(id)) {
       try {
-        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-HWP65A4O.cjs');
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-KHG4FJC3.cjs');
         dbPermissions = await loadDbPermissionsForUser(dataSource, id);
       } catch (e) {
         dbPermissions = {