@infuro/cms-core 1.0.38 → 1.0.40

package/dist/admin.cjs

@@ -492,7 +492,7 @@ var init_admin_config_context = __esm({
 var CMS_VERSION;
 var init_cms_version = __esm({
   "src/lib/cms-version.ts"() {
-    CMS_VERSION = "1.0.38" ;
+    CMS_VERSION = "1.0.40" ;
   }
 });
 function useCatalogCategories(enabled = true) {
@@ -9145,11 +9145,40 @@ function InvitePageContent() {
     confirmPassword: ""
   });
   const [loading, setLoading] = React26.useState(false);
+  const [checking, setChecking] = React26.useState(Boolean(token));
+  const [inviteValid, setInviteValid] = React26.useState(false);
   const [message, setMessage] = React26.useState("");
   React26.useEffect(() => {
     if (!token) {
       setMessage("Invalid invite link. Token is missing.");
+      setChecking(false);
+      return;
     }
+    let cancelled = false;
+    void (async () => {
+      try {
+        const res = await fetch(`/api/users/invite?token=${encodeURIComponent(token)}`);
+        const result = await res.json();
+        if (cancelled) return;
+        if (res.ok && result.valid === true) {
+          setInviteValid(true);
+          setMessage("");
+        } else {
+          setInviteValid(false);
+          setMessage(result.error || "This invitation is no longer valid.");
+        }
+      } catch {
+        if (!cancelled) {
+          setInviteValid(false);
+          setMessage("Could not verify this invite link. Please try again.");
+        }
+      } finally {
+        if (!cancelled) setChecking(false);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
   }, [
     token
   ]);
@@ -9192,12 +9221,21 @@ function InvitePageContent() {
       setLoading(false);
     }
   }, "handleSubmit");
-  if (!token) {
+  if (!token || checking) {
     return /* @__PURE__ */ React26__namespace.default.createElement(AuthPageLayout, null, /* @__PURE__ */ React26__namespace.default.createElement("div", {
       className: "w-full space-y-4 p-5 sm:p-6 bg-white rounded-lg shadow-md text-center"
     }, /* @__PURE__ */ React26__namespace.default.createElement("h2", {
       className: "text-xl font-bold text-gray-900"
-    }, "Invalid invite"), /* @__PURE__ */ React26__namespace.default.createElement("p", {
+    }, checking ? "Checking invite\u2026" : "Invalid invite"), !checking && /* @__PURE__ */ React26__namespace.default.createElement("p", {
+      className: "text-sm text-gray-600"
+    }, message)));
+  }
+  if (!inviteValid) {
+    return /* @__PURE__ */ React26__namespace.default.createElement(AuthPageLayout, null, /* @__PURE__ */ React26__namespace.default.createElement("div", {
+      className: "w-full space-y-4 p-5 sm:p-6 bg-white rounded-lg shadow-md text-center"
+    }, /* @__PURE__ */ React26__namespace.default.createElement("h2", {
+      className: "text-xl font-bold text-gray-900"
+    }, "Invite unavailable"), /* @__PURE__ */ React26__namespace.default.createElement("p", {
       className: "text-sm text-gray-600"
     }, message)));
   }
@@ -12705,7 +12743,7 @@ function SettingsPage() {
     onCheckedChange: setMultiVendorEnabled
   }), /* @__PURE__ */ React.createElement("div", null, /* @__PURE__ */ React.createElement(Label3, {
     className: "text-sm font-medium text-gray-700"
-  }, "Multi Vendor Support"), /* @__PURE__ */ React.createElement("p", {
+  }, "Multi Vendor"), /* @__PURE__ */ React.createElement("p", {
     className: "text-xs text-gray-500"
   }, "Enable vendor portals, vendor logins, and vendor-scoped store data. Disabling this blocks vendor-only accounts from signing in."))), storeEnabled && /* @__PURE__ */ React.createElement("div", {
     className: "mt-4 flex items-center gap-3 p-4 bg-gray-50 rounded-lg border border-gray-200"
@@ -31534,6 +31572,7 @@ function VendorEditPage({ vendorId }) {
   const [sendOwnerEmail, setSendOwnerEmail] = React26.useState(true);
   const [ownerPassword, setOwnerPassword] = React26.useState("");
   const [ownerPasswordConfirm, setOwnerPasswordConfirm] = React26.useState("");
+  const [reinviting, setReinviting] = React26.useState(false);
   const vendorPayload = /* @__PURE__ */ __name(() => ({
     name: name.trim(),
     legalName: legalName.trim() || null,
@@ -31613,6 +31652,57 @@ function VendorEditPage({ vendorId }) {
     vendorId,
     create
   ]);
+  const canReinviteOwner = !create && (inviteStatus === "pending" || inviteStatus === "expired");
+  const handleReinviteOwner = /* @__PURE__ */ __name(async () => {
+    setReinviting(true);
+    setErrors([]);
+    try {
+      const res = await fetch(`/api/admin/vendors/${vendorId}/resend-invite`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          sendEmail: true
+        })
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        setErrors([
+          data.error || data.message || "Failed to resend invite"
+        ]);
+        return;
+      }
+      const refreshRes = await fetch(`/api/vendors/${vendorId}`);
+      if (refreshRes.ok) {
+        const refreshed = await refreshRes.json();
+        setInviteStatus(refreshed.inviteStatus ?? "pending");
+        setMetadata(refreshed.metadata && typeof refreshed.metadata === "object" ? refreshed.metadata : null);
+      } else {
+        setInviteStatus("pending");
+      }
+      const inviteLink = typeof data.inviteLink === "string" ? data.inviteLink.trim() : "";
+      if (inviteLink) {
+        try {
+          await navigator.clipboard.writeText(inviteLink);
+          sonner.toast.success(data.message || "Invite resent. New link copied \u2014 previous invite links no longer work.");
+        } catch {
+          sonner.toast.success(data.message || "Invite resent.");
+          sonner.toast.message("New invite link (previous links are invalid)", {
+            description: inviteLink
+          });
+        }
+      } else {
+        sonner.toast.success(data.message || "Invite resent.");
+      }
+    } catch {
+      setErrors([
+        "Failed to resend invite"
+      ]);
+    } finally {
+      setReinviting(false);
+    }
+  }, "handleReinviteOwner");
   if (!canOnboardVendors(session?.user)) {
     return /* @__PURE__ */ React26__namespace.default.createElement(VendorAccessDenied, {
       groupName: sessionUser?.groupName
@@ -32044,7 +32134,20 @@ function VendorEditPage({ vendorId }) {
       readOnly: true,
       value: inviteStatus,
       className: `mt-1 ${fieldClass} bg-gray-100`
-    })), /* @__PURE__ */ React26__namespace.default.createElement("div", null, /* @__PURE__ */ React26__namespace.default.createElement(FieldLabel, null, "Active"), /* @__PURE__ */ React26__namespace.default.createElement(Input, {
+    })), canReinviteOwner && /* @__PURE__ */ React26__namespace.default.createElement("div", {
+      className: "pt-1"
+    }, /* @__PURE__ */ React26__namespace.default.createElement(Button, {
+      type: "button",
+      variant: "outline",
+      size: "sm",
+      className: "w-full",
+      disabled: reinviting || saving,
+      onClick: /* @__PURE__ */ __name(() => void handleReinviteOwner(), "onClick")
+    }, /* @__PURE__ */ React26__namespace.default.createElement(LucideIcons.Mail, {
+      className: "h-4 w-4 mr-2"
+    }), reinviting ? "Sending invite\u2026" : "Re-invite owner"), /* @__PURE__ */ React26__namespace.default.createElement("p", {
+      className: "mt-2 text-xs text-gray-500"
+    }, "Sends a new invite email and invalidates any previous invite link immediately.")), /* @__PURE__ */ React26__namespace.default.createElement("div", null, /* @__PURE__ */ React26__namespace.default.createElement(FieldLabel, null, "Active"), /* @__PURE__ */ React26__namespace.default.createElement(Input, {
       readOnly: true,
       value: active ? "Yes" : "No",
       className: `mt-1 ${fieldClass} bg-gray-100`

package/dist/admin.js

@@ -10,7 +10,7 @@ import { Slot } from '@radix-ui/react-slot';
 import { cva } from 'class-variance-authority';
 import * as DropdownMenuPrimitive from '@radix-ui/react-dropdown-menu';
 import * as LucideIcons from 'lucide-react';
-import { ChevronDown, User, Settings, LogOut, LayoutDashboard, Store, FolderTree, Layers, Building2, CalendarDays, ShoppingBag, Package, Receipt, BadgePercent, ShoppingCart, CreditCard, Users, Inbox, File, LinkIcon, ClipboardList, MessageSquare, Image as Image$1, FileText, Shield, Puzzle, X, Plus, MoreVertical, Upload, Download, Edit, Copy, RefreshCw, Trash2, Save, Check, Search, AlertCircle, MapPin, BarChart3, TrendingUp, UserCheck, Activity, Globe, Eye, MousePointer, ArrowLeftRight, RotateCcw, KeyRound, Loader2, CalendarClock, Rss, ArrowLeft, Pencil, FolderPlus, LayoutGrid, List, Move, Archive, Edit2, ExternalLink, Power, Star, ChevronUp, Zap, Filter, CheckCircle2, ImageIcon, GripVertical, ChevronRight, ArrowRight, ArrowUpRight, IndianRupee, XCircle, Clock, Play, MessageCircle, Mail, Bot, FileUp, Tag, Box, SlidersHorizontal, Calculator, Link2 as Link2$1, Unlink, Gift, MoreHorizontal, Bell, QrCode, Car, Circle, Settings2, DollarSign, Hash, ChevronLeft, Share2, Smartphone, HardDrive, Folder, Film } from 'lucide-react';
+import { ChevronDown, User, Settings, LogOut, LayoutDashboard, Store, FolderTree, Layers, Building2, CalendarDays, ShoppingBag, Package, Receipt, BadgePercent, ShoppingCart, CreditCard, Users, Inbox, File, LinkIcon, ClipboardList, MessageSquare, Image as Image$1, FileText, Shield, Puzzle, X, Plus, MoreVertical, Upload, Download, Edit, Copy, RefreshCw, Trash2, Save, Check, Search, AlertCircle, MapPin, BarChart3, TrendingUp, UserCheck, Activity, Globe, Eye, MousePointer, ArrowLeftRight, RotateCcw, KeyRound, Loader2, CalendarClock, Rss, ArrowLeft, Pencil, FolderPlus, LayoutGrid, List, Move, Archive, Edit2, ExternalLink, Power, Star, ChevronUp, Mail, Zap, Filter, CheckCircle2, ImageIcon, GripVertical, ChevronRight, ArrowRight, ArrowUpRight, IndianRupee, XCircle, Clock, Play, MessageCircle, Bot, FileUp, Tag, Box, SlidersHorizontal, Calculator, Link2 as Link2$1, Unlink, Gift, MoreHorizontal, Bell, QrCode, Car, Circle, Settings2, DollarSign, Hash, ChevronLeft, Share2, Smartphone, HardDrive, Folder, Film } from 'lucide-react';
 import Image from 'next/image';
 import Link2 from 'next/link';
 import { usePathname, useSearchParams, useRouter } from 'next/navigation';
@@ -457,7 +457,7 @@ var init_admin_config_context = __esm({
 var CMS_VERSION;
 var init_cms_version = __esm({
   "src/lib/cms-version.ts"() {
-    CMS_VERSION = "1.0.38" ;
+    CMS_VERSION = "1.0.40" ;
   }
 });
 function useCatalogCategories(enabled = true) {
@@ -9110,11 +9110,40 @@ function InvitePageContent() {
     confirmPassword: ""
   });
   const [loading, setLoading] = useState(false);
+  const [checking, setChecking] = useState(Boolean(token));
+  const [inviteValid, setInviteValid] = useState(false);
   const [message, setMessage] = useState("");
   useEffect(() => {
     if (!token) {
       setMessage("Invalid invite link. Token is missing.");
+      setChecking(false);
+      return;
     }
+    let cancelled = false;
+    void (async () => {
+      try {
+        const res = await fetch(`/api/users/invite?token=${encodeURIComponent(token)}`);
+        const result = await res.json();
+        if (cancelled) return;
+        if (res.ok && result.valid === true) {
+          setInviteValid(true);
+          setMessage("");
+        } else {
+          setInviteValid(false);
+          setMessage(result.error || "This invitation is no longer valid.");
+        }
+      } catch {
+        if (!cancelled) {
+          setInviteValid(false);
+          setMessage("Could not verify this invite link. Please try again.");
+        }
+      } finally {
+        if (!cancelled) setChecking(false);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
   }, [
     token
   ]);
@@ -9157,12 +9186,21 @@ function InvitePageContent() {
       setLoading(false);
     }
   }, "handleSubmit");
-  if (!token) {
+  if (!token || checking) {
     return /* @__PURE__ */ React26__default.createElement(AuthPageLayout, null, /* @__PURE__ */ React26__default.createElement("div", {
       className: "w-full space-y-4 p-5 sm:p-6 bg-white rounded-lg shadow-md text-center"
     }, /* @__PURE__ */ React26__default.createElement("h2", {
       className: "text-xl font-bold text-gray-900"
-    }, "Invalid invite"), /* @__PURE__ */ React26__default.createElement("p", {
+    }, checking ? "Checking invite\u2026" : "Invalid invite"), !checking && /* @__PURE__ */ React26__default.createElement("p", {
+      className: "text-sm text-gray-600"
+    }, message)));
+  }
+  if (!inviteValid) {
+    return /* @__PURE__ */ React26__default.createElement(AuthPageLayout, null, /* @__PURE__ */ React26__default.createElement("div", {
+      className: "w-full space-y-4 p-5 sm:p-6 bg-white rounded-lg shadow-md text-center"
+    }, /* @__PURE__ */ React26__default.createElement("h2", {
+      className: "text-xl font-bold text-gray-900"
+    }, "Invite unavailable"), /* @__PURE__ */ React26__default.createElement("p", {
       className: "text-sm text-gray-600"
     }, message)));
   }
@@ -12670,7 +12708,7 @@ function SettingsPage() {
     onCheckedChange: setMultiVendorEnabled
   }), /* @__PURE__ */ React.createElement("div", null, /* @__PURE__ */ React.createElement(Label3, {
     className: "text-sm font-medium text-gray-700"
-  }, "Multi Vendor Support"), /* @__PURE__ */ React.createElement("p", {
+  }, "Multi Vendor"), /* @__PURE__ */ React.createElement("p", {
     className: "text-xs text-gray-500"
   }, "Enable vendor portals, vendor logins, and vendor-scoped store data. Disabling this blocks vendor-only accounts from signing in."))), storeEnabled && /* @__PURE__ */ React.createElement("div", {
     className: "mt-4 flex items-center gap-3 p-4 bg-gray-50 rounded-lg border border-gray-200"
@@ -31499,6 +31537,7 @@ function VendorEditPage({ vendorId }) {
   const [sendOwnerEmail, setSendOwnerEmail] = useState(true);
   const [ownerPassword, setOwnerPassword] = useState("");
   const [ownerPasswordConfirm, setOwnerPasswordConfirm] = useState("");
+  const [reinviting, setReinviting] = useState(false);
   const vendorPayload = /* @__PURE__ */ __name(() => ({
     name: name.trim(),
     legalName: legalName.trim() || null,
@@ -31578,6 +31617,57 @@ function VendorEditPage({ vendorId }) {
     vendorId,
     create
   ]);
+  const canReinviteOwner = !create && (inviteStatus === "pending" || inviteStatus === "expired");
+  const handleReinviteOwner = /* @__PURE__ */ __name(async () => {
+    setReinviting(true);
+    setErrors([]);
+    try {
+      const res = await fetch(`/api/admin/vendors/${vendorId}/resend-invite`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          sendEmail: true
+        })
+      });
+      const data = await res.json();
+      if (!res.ok) {
+        setErrors([
+          data.error || data.message || "Failed to resend invite"
+        ]);
+        return;
+      }
+      const refreshRes = await fetch(`/api/vendors/${vendorId}`);
+      if (refreshRes.ok) {
+        const refreshed = await refreshRes.json();
+        setInviteStatus(refreshed.inviteStatus ?? "pending");
+        setMetadata(refreshed.metadata && typeof refreshed.metadata === "object" ? refreshed.metadata : null);
+      } else {
+        setInviteStatus("pending");
+      }
+      const inviteLink = typeof data.inviteLink === "string" ? data.inviteLink.trim() : "";
+      if (inviteLink) {
+        try {
+          await navigator.clipboard.writeText(inviteLink);
+          toast.success(data.message || "Invite resent. New link copied \u2014 previous invite links no longer work.");
+        } catch {
+          toast.success(data.message || "Invite resent.");
+          toast.message("New invite link (previous links are invalid)", {
+            description: inviteLink
+          });
+        }
+      } else {
+        toast.success(data.message || "Invite resent.");
+      }
+    } catch {
+      setErrors([
+        "Failed to resend invite"
+      ]);
+    } finally {
+      setReinviting(false);
+    }
+  }, "handleReinviteOwner");
   if (!canOnboardVendors(session?.user)) {
     return /* @__PURE__ */ React26__default.createElement(VendorAccessDenied, {
       groupName: sessionUser?.groupName
@@ -32009,7 +32099,20 @@ function VendorEditPage({ vendorId }) {
       readOnly: true,
       value: inviteStatus,
       className: `mt-1 ${fieldClass} bg-gray-100`
-    })), /* @__PURE__ */ React26__default.createElement("div", null, /* @__PURE__ */ React26__default.createElement(FieldLabel, null, "Active"), /* @__PURE__ */ React26__default.createElement(Input, {
+    })), canReinviteOwner && /* @__PURE__ */ React26__default.createElement("div", {
+      className: "pt-1"
+    }, /* @__PURE__ */ React26__default.createElement(Button, {
+      type: "button",
+      variant: "outline",
+      size: "sm",
+      className: "w-full",
+      disabled: reinviting || saving,
+      onClick: /* @__PURE__ */ __name(() => void handleReinviteOwner(), "onClick")
+    }, /* @__PURE__ */ React26__default.createElement(Mail, {
+      className: "h-4 w-4 mr-2"
+    }), reinviting ? "Sending invite\u2026" : "Re-invite owner"), /* @__PURE__ */ React26__default.createElement("p", {
+      className: "mt-2 text-xs text-gray-500"
+    }, "Sends a new invite email and invalidates any previous invite link immediately.")), /* @__PURE__ */ React26__default.createElement("div", null, /* @__PURE__ */ React26__default.createElement(FieldLabel, null, "Active"), /* @__PURE__ */ React26__default.createElement(Input, {
       readOnly: true,
       value: active ? "Yes" : "No",
       className: `mt-1 ${fieldClass} bg-gray-100`

package/dist/api.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkVJDUKAJ3_cjs = require('./chunk-VJDUKAJ3.cjs');
+var chunkT7GCOO5Y_cjs = require('./chunk-T7GCOO5Y.cjs');
 require('./chunk-22FFHLTO.cjs');
 require('./chunk-UCKN4BBY.cjs');
 require('./chunk-7NMT3GBR.cjs');
@@ -20,127 +20,127 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "createAnalyticsHandlers", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createAnalyticsHandlers; }
+  get: function () { return chunkT7GCOO5Y_cjs.createAnalyticsHandlers; }
 });
 Object.defineProperty(exports, "createBlogBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createBlogBySlugHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createBlogBySlugHandler; }
 });
 Object.defineProperty(exports, "createChangePasswordHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createChangePasswordHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createChangePasswordHandler; }
 });
 Object.defineProperty(exports, "createCmsApiHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createCmsApiHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createCmsApiHandler; }
 });
 Object.defineProperty(exports, "createCrudByIdHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createCrudByIdHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createCrudByIdHandler; }
 });
 Object.defineProperty(exports, "createCrudHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createCrudHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createCrudHandler; }
 });
 Object.defineProperty(exports, "createDashboardStatsHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createDashboardStatsHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createDashboardStatsHandler; }
 });
 Object.defineProperty(exports, "createEcommerceAnalyticsHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createEcommerceAnalyticsHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createEcommerceAnalyticsHandler; }
 });
 Object.defineProperty(exports, "createForgotPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createForgotPasswordHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createForgotPasswordHandler; }
 });
 Object.defineProperty(exports, "createFormBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createFormBySlugHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createFormBySlugHandler; }
 });
 Object.defineProperty(exports, "createInviteAcceptHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createInviteAcceptHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createInviteAcceptHandler; }
 });
 Object.defineProperty(exports, "createJobScheduleHandlers", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createJobScheduleHandlers; }
+  get: function () { return chunkT7GCOO5Y_cjs.createJobScheduleHandlers; }
 });
 Object.defineProperty(exports, "createLlmAgentKnowledgeHandlers", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createLlmAgentKnowledgeHandlers; }
+  get: function () { return chunkT7GCOO5Y_cjs.createLlmAgentKnowledgeHandlers; }
 });
 Object.defineProperty(exports, "createMediaZipExtractHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createMediaZipExtractHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createMediaZipExtractHandler; }
 });
 Object.defineProperty(exports, "createSetPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createSetPasswordHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createSetPasswordHandler; }
 });
 Object.defineProperty(exports, "createSettingsApiHandlers", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createSettingsApiHandlers; }
+  get: function () { return chunkT7GCOO5Y_cjs.createSettingsApiHandlers; }
 });
 Object.defineProperty(exports, "createStorefrontApiHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createStorefrontApiHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createStorefrontApiHandler; }
 });
 Object.defineProperty(exports, "createUploadHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createUploadHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createUploadHandler; }
 });
 Object.defineProperty(exports, "createUserAuthApiRouter", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createUserAuthApiRouter; }
+  get: function () { return chunkT7GCOO5Y_cjs.createUserAuthApiRouter; }
 });
 Object.defineProperty(exports, "createUserAvatarHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createUserAvatarHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createUserAvatarHandler; }
 });
 Object.defineProperty(exports, "createUserProfileHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createUserProfileHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createUserProfileHandler; }
 });
 Object.defineProperty(exports, "createUsersApiHandlers", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createUsersApiHandlers; }
+  get: function () { return chunkT7GCOO5Y_cjs.createUsersApiHandlers; }
 });
 Object.defineProperty(exports, "createVendorDashboardHandler", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createVendorDashboardHandler; }
+  get: function () { return chunkT7GCOO5Y_cjs.createVendorDashboardHandler; }
 });
 Object.defineProperty(exports, "createVendorOnboardHandlers", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.createVendorOnboardHandlers; }
+  get: function () { return chunkT7GCOO5Y_cjs.createVendorOnboardHandlers; }
 });
 Object.defineProperty(exports, "getPublicSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.getPublicSettingsGroup; }
+  get: function () { return chunkT7GCOO5Y_cjs.getPublicSettingsGroup; }
 });
 Object.defineProperty(exports, "mergeGuardrailsIntoSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.mergeGuardrailsIntoSystemPrompt; }
+  get: function () { return chunkT7GCOO5Y_cjs.mergeGuardrailsIntoSystemPrompt; }
 });
 Object.defineProperty(exports, "parseLlmAgentValidationRules", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.parseLlmAgentValidationRules; }
+  get: function () { return chunkT7GCOO5Y_cjs.parseLlmAgentValidationRules; }
 });
 Object.defineProperty(exports, "simpleDecrypt", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.simpleDecrypt; }
+  get: function () { return chunkT7GCOO5Y_cjs.simpleDecrypt; }
 });
 Object.defineProperty(exports, "simpleEncrypt", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.simpleEncrypt; }
+  get: function () { return chunkT7GCOO5Y_cjs.simpleEncrypt; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstAgentRules", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.validateUserMessageAgainstAgentRules; }
+  get: function () { return chunkT7GCOO5Y_cjs.validateUserMessageAgainstAgentRules; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstStructuredRules", {
   enumerable: true,
-  get: function () { return chunkVJDUKAJ3_cjs.validateUserMessageAgainstStructuredRules; }
+  get: function () { return chunkT7GCOO5Y_cjs.validateUserMessageAgainstStructuredRules; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,

package/dist/api.d.cts

@@ -137,7 +137,7 @@ interface InviteAcceptConfig extends AuthHandlersConfig {
     entityMap: EntityMap;
     beforeActivate?: (email: string, userId: number) => Promise<void>;
 }
-/** Decode invite token (base64 email) and set password + unblock user */
+/** Accept invite: vendor rotating token (preferred) or legacy base64 email token */
 declare function createInviteAcceptHandler(config: InviteAcceptConfig): (request: Request) => Promise<Response>;
 interface ChangePasswordConfig extends AuthHandlersConfig {
     dataSource: DataSource;
@@ -165,6 +165,7 @@ interface UserAuthApiConfig extends ForgotPasswordConfig, Omit<SetPasswordConfig
  * Path is the segment after the mount (e.g. "forgot-password"). Returns 404 for unknown paths.
  */
 declare function createUserAuthApiRouter(config: UserAuthApiConfig): {
+    GET(req: Request, pathname: string): Promise<Response>;
     POST(req: Request, pathname: string): Promise<Response>;
 };
 
@@ -564,6 +565,8 @@ interface VendorOnboardHandlersConfig {
 declare function createVendorOnboardHandlers(config: VendorOnboardHandlersConfig): {
     /** POST /api/admin/vendors/onboard — create vendor + owner user + vendor_users + invite */
     onboard(req: Request): Promise<Response>;
+    /** POST /api/admin/vendors/:id/resend-invite — rotate owner invite token and resend email */
+    resendInvite(req: Request, vendorIdStr: string): Promise<Response>;
     /** POST /api/admin/vendor/switch — set active vendor in session (JWT update via client) */
     switchVendor(req: Request): Promise<Response>;
     /** GET /api/admin/vendor/team */

package/dist/api.d.ts

@@ -137,7 +137,7 @@ interface InviteAcceptConfig extends AuthHandlersConfig {
     entityMap: EntityMap;
     beforeActivate?: (email: string, userId: number) => Promise<void>;
 }
-/** Decode invite token (base64 email) and set password + unblock user */
+/** Accept invite: vendor rotating token (preferred) or legacy base64 email token */
 declare function createInviteAcceptHandler(config: InviteAcceptConfig): (request: Request) => Promise<Response>;
 interface ChangePasswordConfig extends AuthHandlersConfig {
     dataSource: DataSource;
@@ -165,6 +165,7 @@ interface UserAuthApiConfig extends ForgotPasswordConfig, Omit<SetPasswordConfig
  * Path is the segment after the mount (e.g. "forgot-password"). Returns 404 for unknown paths.
  */
 declare function createUserAuthApiRouter(config: UserAuthApiConfig): {
+    GET(req: Request, pathname: string): Promise<Response>;
     POST(req: Request, pathname: string): Promise<Response>;
 };
 
@@ -564,6 +565,8 @@ interface VendorOnboardHandlersConfig {
 declare function createVendorOnboardHandlers(config: VendorOnboardHandlersConfig): {
     /** POST /api/admin/vendors/onboard — create vendor + owner user + vendor_users + invite */
     onboard(req: Request): Promise<Response>;
+    /** POST /api/admin/vendors/:id/resend-invite — rotate owner invite token and resend email */
+    resendInvite(req: Request, vendorIdStr: string): Promise<Response>;
     /** POST /api/admin/vendor/switch — set active vendor in session (JWT update via client) */
     switchVendor(req: Request): Promise<Response>;
     /** GET /api/admin/vendor/team */

package/dist/api.js

@@ -1,4 +1,4 @@
-export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-PYUXVU75.js';
+export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-RCMUL6SZ.js';
 import './chunk-NNQBWDCI.js';
 import './chunk-HCIRL37O.js';
 import './chunk-JXF23MPG.js';

package/dist/auth.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkE6WVP7BK_cjs = require('./chunk-E6WVP7BK.cjs');
+var chunkETZN4OQI_cjs = require('./chunk-ETZN4OQI.cjs');
 var chunkOIGCAGH7_cjs = require('./chunk-OIGCAGH7.cjs');
 var chunkWMXPKKXU_cjs = require('./chunk-WMXPKKXU.cjs');
 require('./chunk-USNT2KNT.cjs');
@@ -9,47 +9,47 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "createCmsMiddleware", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.createCmsMiddleware; }
+  get: function () { return chunkETZN4OQI_cjs.createCmsMiddleware; }
 });
 Object.defineProperty(exports, "defaultPublicApiMethods", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.defaultPublicApiMethods; }
+  get: function () { return chunkETZN4OQI_cjs.defaultPublicApiMethods; }
 });
 Object.defineProperty(exports, "getNextAuthOptions", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.getNextAuthOptions; }
+  get: function () { return chunkETZN4OQI_cjs.getNextAuthOptions; }
 });
 Object.defineProperty(exports, "getStorefrontNextAuthOptions", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.getStorefrontNextAuthOptions; }
+  get: function () { return chunkETZN4OQI_cjs.getStorefrontNextAuthOptions; }
 });
 Object.defineProperty(exports, "isAuthDebugClientEnabled", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.isAuthDebugClientEnabled; }
+  get: function () { return chunkETZN4OQI_cjs.isAuthDebugClientEnabled; }
 });
 Object.defineProperty(exports, "isAuthDebugEnabled", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.isAuthDebugEnabled; }
+  get: function () { return chunkETZN4OQI_cjs.isAuthDebugEnabled; }
 });
 Object.defineProperty(exports, "logAuth", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.logAuth; }
+  get: function () { return chunkETZN4OQI_cjs.logAuth; }
 });
 Object.defineProperty(exports, "logAuthClient", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.logAuthClient; }
+  get: function () { return chunkETZN4OQI_cjs.logAuthClient; }
 });
 Object.defineProperty(exports, "nextAuthCookieDebugInfo", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.nextAuthCookieDebugInfo; }
+  get: function () { return chunkETZN4OQI_cjs.nextAuthCookieDebugInfo; }
 });
 Object.defineProperty(exports, "seedAdministratorPermissions", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.seedAdministratorPermissions; }
+  get: function () { return chunkETZN4OQI_cjs.seedAdministratorPermissions; }
 });
 Object.defineProperty(exports, "summarizeSessionUserForLog", {
   enumerable: true,
-  get: function () { return chunkE6WVP7BK_cjs.summarizeSessionUserForLog; }
+  get: function () { return chunkETZN4OQI_cjs.summarizeSessionUserForLog; }
 });
 Object.defineProperty(exports, "OPEN_ENDPOINTS", {
   enumerable: true,

package/dist/auth.js

@@ -1,4 +1,4 @@
-export { createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeSessionUserForLog } from './chunk-SBRBR3VO.js';
+export { createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeSessionUserForLog } from './chunk-4BG7XYSH.js';
 export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, getRequiredPermission, isOpenEndpoint, isPublicMethod, sessionHasEntityAccess } from './chunk-UXMDSNIG.js';
 export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-P7QCLE5W.js';
 import './chunk-SHUYVCID.js';