@infuro/cms-core 1.0.38 → 1.0.40

package/dist/{chunk-PYUXVU75.js → chunk-RCMUL6SZ.js}

@@ -12,7 +12,7 @@ import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { __name } from './chunk-SHUYVCID.js';
 import { PrimaryGeneratedColumn, Column, Entity, ManyToOne, JoinColumn, OneToMany, Index, ManyToMany, JoinTable, Unique, CreateDateColumn, UpdateDateColumn, In, IsNull, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan } from 'typeorm';
 import { Country, State, City } from 'country-state-city';
-import crypto2, { randomUUID, createHmac, timingSafeEqual, randomInt } from 'crypto';
+import crypto2, { randomBytes, randomUUID, createHmac, timingSafeEqual, randomInt } from 'crypto';
 import Parser from 'rss-parser';
 import fs from 'fs/promises';
 import path from 'path';
@@ -6179,6 +6179,225 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
   };
 }
 __name(createCrudByIdHandler, "createCrudByIdHandler");
+var VENDOR_INVITE_METADATA_TOKEN = "inviteToken";
+var VENDOR_INVITE_METADATA_EXPIRES = "inviteExpiresAt";
+var VENDOR_INVITE_METADATA_SENT = "inviteSentAt";
+async function loadOwnerVendorForUser(dataSource, vendorEntity, userId) {
+  const repo = dataSource.getRepository(vendorEntity);
+  const row = await repo.findOne({
+    where: {
+      userId,
+      deleted: false
+    }
+  });
+  if (!row) return null;
+  const v = row;
+  return {
+    id: v.id,
+    inviteStatus: v.inviteStatus,
+    metadata: v.metadata && typeof v.metadata === "object" && !Array.isArray(v.metadata) ? v.metadata : null
+  };
+}
+__name(loadOwnerVendorForUser, "loadOwnerVendorForUser");
+function invalidatedInviteMessage() {
+  return "This invitation is no longer valid. Ask an admin to resend the invite.";
+}
+__name(invalidatedInviteMessage, "invalidatedInviteMessage");
+async function validateInviteTokenForActivation(dataSource, entityMap, token) {
+  const trimmedToken = String(token ?? "").trim();
+  if (!trimmedToken) {
+    return {
+      ok: false,
+      error: "Invalid invite link. Token is missing."
+    };
+  }
+  const userRepo = entityMap.users ? dataSource.getRepository(entityMap.users) : null;
+  if (entityMap.vendors && userRepo) {
+    const vendorMatch = await findVendorByInviteToken(dataSource, entityMap.vendors, trimmedToken);
+    if (vendorMatch) {
+      const vendorRepo = dataSource.getRepository(entityMap.vendors);
+      const freshVendor = await vendorRepo.findOne({
+        where: {
+          id: vendorMatch.id,
+          deleted: false
+        }
+      });
+      const v = freshVendor;
+      if (!v?.userId) {
+        return {
+          ok: false,
+          error: invalidatedInviteMessage()
+        };
+      }
+      if (v.inviteStatus === "accepted") {
+        return {
+          ok: false,
+          error: "This invitation has already been accepted"
+        };
+      }
+      if (v.inviteStatus === "expired") {
+        await vendorRepo.update(v.id, {
+          inviteStatus: "pending"
+        });
+        v.inviteStatus = "pending";
+      }
+      const user2 = await userRepo.findOne({
+        where: {
+          id: v.userId
+        },
+        select: [
+          "id",
+          "email",
+          "blocked",
+          "password"
+        ]
+      });
+      if (!user2) return {
+        ok: false,
+        error: "User not found"
+      };
+      const hasPassword2 = !!user2.password;
+      if (!user2.blocked && hasPassword2) {
+        return {
+          ok: false,
+          error: "User is already active"
+        };
+      }
+      return {
+        ok: true,
+        target: {
+          userId: user2.id,
+          email: String(user2.email),
+          vendorId: v.id
+        }
+      };
+    }
+  }
+  let email;
+  try {
+    email = Buffer.from(trimmedToken, "base64").toString("utf8").trim();
+  } catch {
+    return {
+      ok: false,
+      error: invalidatedInviteMessage()
+    };
+  }
+  if (!email.includes("@")) {
+    return {
+      ok: false,
+      error: invalidatedInviteMessage()
+    };
+  }
+  if (!userRepo) {
+    return {
+      ok: false,
+      error: "User not found"
+    };
+  }
+  const user = await userRepo.findOne({
+    where: {
+      email
+    },
+    select: [
+      "id",
+      "email",
+      "blocked",
+      "password"
+    ]
+  });
+  if (!user) return {
+    ok: false,
+    error: "User not found"
+  };
+  const hasPassword = !!user.password;
+  if (!user.blocked && hasPassword) {
+    return {
+      ok: false,
+      error: "User is already active"
+    };
+  }
+  if (entityMap.vendors) {
+    const ownerVendor = await loadOwnerVendorForUser(dataSource, entityMap.vendors, user.id);
+    if (ownerVendor && readVendorInviteToken(ownerVendor.metadata)) {
+      return {
+        ok: false,
+        error: invalidatedInviteMessage()
+      };
+    }
+  }
+  return {
+    ok: true,
+    target: {
+      userId: user.id,
+      email: String(user.email)
+    }
+  };
+}
+__name(validateInviteTokenForActivation, "validateInviteTokenForActivation");
+function buildVendorInviteLink(baseUrl, token) {
+  const base = baseUrl.replace(/\/+$/, "");
+  return `${base}/admin/invite?token=${encodeURIComponent(token)}`;
+}
+__name(buildVendorInviteLink, "buildVendorInviteLink");
+function applyRotatingVendorInvite(existing) {
+  const next = {
+    ...existing ?? {}
+  };
+  next[VENDOR_INVITE_METADATA_TOKEN] = randomBytes(32).toString("hex");
+  next[VENDOR_INVITE_METADATA_SENT] = (/* @__PURE__ */ new Date()).toISOString();
+  delete next[VENDOR_INVITE_METADATA_EXPIRES];
+  return next;
+}
+__name(applyRotatingVendorInvite, "applyRotatingVendorInvite");
+function clearVendorInviteMetadata(existing) {
+  const next = {
+    ...existing ?? {}
+  };
+  delete next[VENDOR_INVITE_METADATA_TOKEN];
+  delete next[VENDOR_INVITE_METADATA_EXPIRES];
+  delete next[VENDOR_INVITE_METADATA_SENT];
+  return Object.keys(next).length > 0 ? next : null;
+}
+__name(clearVendorInviteMetadata, "clearVendorInviteMetadata");
+function readVendorInviteToken(metadata) {
+  const raw = metadata?.[VENDOR_INVITE_METADATA_TOKEN];
+  return typeof raw === "string" && raw.trim() ? raw.trim() : null;
+}
+__name(readVendorInviteToken, "readVendorInviteToken");
+async function findVendorByInviteToken(dataSource, vendorEntity, token) {
+  const trimmed = token.trim();
+  if (!trimmed) return null;
+  const repo = dataSource.getRepository(vendorEntity);
+  const row = await repo.createQueryBuilder("v").where("v.deleted = false").andWhere(`v.metadata->>'${VENDOR_INVITE_METADATA_TOKEN}' = :token`, {
+    token: trimmed
+  }).getOne();
+  if (!row) return null;
+  const v = row;
+  return {
+    id: v.id,
+    userId: v.userId ?? null,
+    inviteStatus: v.inviteStatus,
+    metadata: v.metadata && typeof v.metadata === "object" && !Array.isArray(v.metadata) ? v.metadata : null
+  };
+}
+__name(findVendorByInviteToken, "findVendorByInviteToken");
+async function completeVendorInviteAccept(dataSource, vendorEntity, vendorId) {
+  const repo = dataSource.getRepository(vendorEntity);
+  const row = await repo.findOne({
+    where: {
+      id: vendorId,
+      deleted: false
+    }
+  });
+  if (!row) return;
+  const metadata = row.metadata;
+  const cleared = clearVendorInviteMetadata(metadata);
+  await repo.update(vendorId, {
+    metadata: cleared,
+    inviteStatus: "accepted"
+  });
+}
+__name(completeVendorInviteAccept, "completeVendorInviteAccept");
 
 // src/api/auth-handlers.ts
 function createForgotPasswordHandler(config) {
@@ -6314,49 +6533,27 @@ function createInviteAcceptHandler(config) {
       }, {
         status: 400
       });
-      let email;
-      try {
-        email = Buffer.from(token, "base64").toString("utf8");
-      } catch {
-        return json({
-          error: "Invalid or expired invite token"
-        }, {
-          status: 400
-        });
-      }
-      const userRepo = dataSource.getRepository(entityMap.users);
-      const user = await userRepo.findOne({
-        where: {
-          email
-        },
-        select: [
-          "id",
-          "blocked",
-          "password"
-        ]
-      });
-      if (!user) return json({
-        error: "User not found"
-      }, {
-        status: 400
-      });
-      const hasPassword = !!user.password;
-      if (!user.blocked && hasPassword) {
+      const validation = await validateInviteTokenForActivation(dataSource, entityMap, token);
+      if (!validation.ok) {
         return json({
-          error: "User is already active"
+          error: validation.error
         }, {
           status: 400
         });
       }
+      const { userId, email, vendorId } = validation.target;
       if (entityMap.contacts) {
-        await linkUnclaimedContactToUser(dataSource, entityMap.contacts, user.id, email);
+        await linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
       }
-      if (beforeActivate) await beforeActivate(email, user.id);
+      if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
-      await userRepo.update(user.id, {
+      await dataSource.getRepository(entityMap.users).update(userId, {
         password: hashedPassword,
         blocked: false
       });
+      if (vendorId != null && entityMap.vendors) {
+        await completeVendorInviteAccept(dataSource, entityMap.vendors, vendorId);
+      }
       return json({
         message: "User account activated successfully"
       }, {
@@ -6372,6 +6569,35 @@ function createInviteAcceptHandler(config) {
   }, "POST");
 }
 __name(createInviteAcceptHandler, "createInviteAcceptHandler");
+function createInviteValidateHandler(config) {
+  const { dataSource, entityMap, json } = config;
+  return /* @__PURE__ */ __name(async function GET(request) {
+    try {
+      const token = new URL(request.url).searchParams.get("token");
+      const validation = await validateInviteTokenForActivation(dataSource, entityMap, token ?? "");
+      if (!validation.ok) {
+        return json({
+          valid: false,
+          error: validation.error
+        }, {
+          status: 400
+        });
+      }
+      return json({
+        valid: true
+      });
+    } catch (err) {
+      console.error("[users/invite GET] validate failed", err);
+      return json({
+        valid: false,
+        error: "Server Error"
+      }, {
+        status: 500
+      });
+    }
+  }, "GET");
+}
+__name(createInviteValidateHandler, "createInviteValidateHandler");
 function createChangePasswordHandler(config) {
   const { dataSource, entityMap, json, comparePassword, hashPassword, getSession, minPasswordLength = 6, beforeUpdate } = config;
   return /* @__PURE__ */ __name(async function POST(request) {
@@ -6450,12 +6676,22 @@ function createUserAuthApiRouter(config) {
   const forgot = createForgotPasswordHandler(config);
   const setPass = createSetPasswordHandler(config);
   const invite = createInviteAcceptHandler(config);
+  const inviteValidate = createInviteValidateHandler(config);
   const changePass = config.getSession ? createChangePasswordHandler({
     ...config,
     getSession: config.getSession,
     beforeUpdate: config.beforeChangePasswordUpdate
   }) : null;
   return {
+    async GET(req, pathname) {
+      const path2 = pathname.replace(/\/$/, "");
+      if (path2 === "invite") return inviteValidate(req);
+      return config.json({
+        error: "Not found"
+      }, {
+        status: 404
+      });
+    },
     async POST(req, pathname) {
       const path2 = pathname.replace(/\/$/, "");
       if (!USER_AUTH_PATHS.includes(path2)) {
@@ -8861,13 +9097,31 @@ function createUsersApiHandlers(config) {
         }, {
           status: 404
         });
-        const emailToken = Buffer.from(user.email).toString("base64");
-        const inviteLink = `${baseUrl}/admin/invite?token=${emailToken}`;
-        await trySendInviteEmail(user.email, inviteLink, user.name ?? "");
+        let inviteLink = `${baseUrl}/admin/invite?token=${Buffer.from(user.email).toString("base64")}`;
         if (entityMap.vendors) {
+          const vendorRepo = dataSource.getRepository(entityMap.vendors);
+          const vendor = await vendorRepo.findOne({
+            where: {
+              userId: user.id,
+              deleted: false
+            }
+          });
+          const v = vendor;
+          if (v && (v.inviteStatus === "pending" || v.inviteStatus === "expired")) {
+            const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
+            await vendorRepo.update(v.id, {
+              metadata: rotatedMetadata,
+              inviteStatus: "pending"
+            });
+            const token = readVendorInviteToken(rotatedMetadata);
+            if (token) {
+              inviteLink = buildVendorInviteLink(baseUrl, token);
+            }
+          }
           const { markVendorInvitePendingForUser } = await import('./vendor-invite-status-PWJ3DE76.js');
           await markVendorInvitePendingForUser(dataSource, entityMap.vendors, user.id);
         }
+        await trySendInviteEmail(user.email, inviteLink, user.name ?? "");
         return json({
           message: "New invite link generated successfully",
           inviteLink
@@ -11811,6 +12065,84 @@ function slugify(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 __name(slugify, "slugify");
+function vendorOnboardErrorResponse(json, err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  console.error("[vendor-onboard]", err);
+  if (msg === "VENDOR_SLUG_EXISTS") {
+    return json({
+      error: "Vendor slug already exists"
+    }, {
+      status: 400
+    });
+  }
+  if (msg === "USER_EMAIL_EXISTS") {
+    return json({
+      error: "User with this email already exists"
+    }, {
+      status: 400
+    });
+  }
+  if (msg === "VENDOR_OWNER_GROUP_MISSING") {
+    return json({
+      error: "Vendor Owner group not found. Run migrations (VendorOwnerRbacSeed)."
+    }, {
+      status: 500
+    });
+  }
+  if (msg === "VENDOR_ROLES_SEED_FAILED") {
+    return json({
+      error: "Failed to seed store roles for vendor. Run migrations."
+    }, {
+      status: 500
+    });
+  }
+  if (/vendor_roles|vendor_role_permissions/i.test(msg)) {
+    return json({
+      error: "Vendor roles tables missing. Run migrations."
+    }, {
+      status: 500
+    });
+  }
+  if (/relation .* does not exist|column .* does not exist/i.test(msg)) {
+    return json({
+      error: "Database schema is outdated on this environment. Run migrations.",
+      detail: msg
+    }, {
+      status: 500
+    });
+  }
+  if (/duplicate key|unique constraint/i.test(msg)) {
+    if (/email/i.test(msg)) {
+      return json({
+        error: "A user or record with this email already exists",
+        detail: msg
+      }, {
+        status: 409
+      });
+    }
+    if (/slug/i.test(msg)) {
+      return json({
+        error: "Vendor slug already exists",
+        detail: msg
+      }, {
+        status: 409
+      });
+    }
+    return json({
+      error: "Duplicate value conflicts with an existing record",
+      detail: msg
+    }, {
+      status: 409
+    });
+  }
+  return json({
+    error: "Server error",
+    detail: msg
+  }, {
+    status: 500
+  });
+}
+__name(vendorOnboardErrorResponse, "vendorOnboardErrorResponse");
 function createVendorOnboardHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser, baseUrl, getCms, hashPassword, minPasswordLength = 6 } = config;
   async function gateAdmin() {
@@ -11979,12 +12311,28 @@ function createVendorOnboardHandlers(config) {
             }
           });
           if (dupVendor) throw new Error("VENDOR_SLUG_EXISTS");
-          const ownerGroup = await groupRepo.findOne({
+          let ownerGroup = await groupRepo.findOne({
             where: {
               name: VENDOR_OWNER_GROUP_NAME,
               deleted: false
             }
           });
+          if (!ownerGroup) {
+            try {
+              await groupRepo.save(groupRepo.create({
+                name: VENDOR_OWNER_GROUP_NAME,
+                deleted: false
+              }));
+              ownerGroup = await groupRepo.findOne({
+                where: {
+                  name: VENDOR_OWNER_GROUP_NAME,
+                  deleted: false
+                }
+              });
+            } catch (seedErr) {
+              console.error("[vendor-onboard] failed to seed Vendor Owner group", seedErr);
+            }
+          }
           if (!ownerGroup) throw new Error("VENDOR_OWNER_GROUP_MISSING");
           const existingUser = await userRepo.findOne({
             where: {
@@ -12022,6 +12370,11 @@ function createVendorOnboardHandlers(config) {
             groupId: ownerGroup.id,
             adminAccess: true
           }));
+          const baseMetadata = buildVendorMetadata(null, {
+            ownerDesignation,
+            termsAccepted: true
+          });
+          const metadata = activation === "invite" ? applyRotatingVendorInvite(baseMetadata) : baseMetadata;
           const vendor = await vendorRepo.save(vendorRepo.create({
             name: vendorName,
             slug,
@@ -12041,10 +12394,7 @@ function createVendorOnboardHandlers(config) {
             gstin: profile.gstin,
             pan: profile.pan,
             registrationStatus: profile.registrationStatus,
-            metadata: buildVendorMetadata(null, {
-              ownerDesignation,
-              termsAccepted: true
-            }),
+            metadata,
             active: body.vendor?.active !== false,
             deleted: false,
             userId: newUser.id,
@@ -12073,14 +12423,18 @@ function createVendorOnboardHandlers(config) {
             });
           }
           if (entityMap.customer) {
-            await ensureCustomerForUser(em, entityMap.customer, {
-              id: newUser.id,
-              name: userName,
-              email: userEmail,
-              phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
-            }, {
-              phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
-            });
+            try {
+              await ensureCustomerForUser(em, entityMap.customer, {
+                id: newUser.id,
+                name: userName,
+                email: userEmail,
+                phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
+              }, {
+                phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
+              });
+            } catch (customerErr) {
+              console.error("[vendor-onboard] ensureCustomerForUser skipped", customerErr);
+            }
           }
           return {
             vendor,
@@ -12090,8 +12444,10 @@ function createVendorOnboardHandlers(config) {
         let inviteLink;
         let emailSent = false;
         if (activation === "invite") {
-          const emailToken = Buffer.from(result.user.email).toString("base64");
-          inviteLink = `${baseUrl}/admin/invite?token=${emailToken}`;
+          const token = readVendorInviteToken(result.vendor.metadata);
+          if (token) {
+            inviteLink = buildVendorInviteLink(baseUrl, token);
+          }
         }
         if (sendOwnerEmail) {
           emailSent = await trySendVendorOnboardEmails({
@@ -12130,46 +12486,131 @@ function createVendorOnboardHandlers(config) {
           status: 201
         });
       } catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        if (process.env.NODE_ENV === "development") {
-          console.error("[vendor-onboard]", e);
-        }
-        if (msg === "VENDOR_SLUG_EXISTS") return json({
-          error: "Vendor slug already exists"
+        return vendorOnboardErrorResponse(json, e);
+      }
+    },
+    /** POST /api/admin/vendors/:id/resend-invite — rotate owner invite token and resend email */
+    async resendInvite(req, vendorIdStr) {
+      const err = await gateAdmin();
+      if (err) return err;
+      if (!entityMap.vendors || !entityMap.users) {
+        return json({
+          error: "Vendor entities not configured"
         }, {
-          status: 400
+          status: 500
         });
-        if (msg === "USER_EMAIL_EXISTS") return json({
-          error: "User with this email already exists"
+      }
+      const vendorId = Number(vendorIdStr);
+      if (!Number.isFinite(vendorId) || vendorId <= 0) {
+        return json({
+          error: "Invalid vendor id"
         }, {
           status: 400
         });
-        if (msg === "VENDOR_OWNER_GROUP_MISSING") {
+      }
+      let sendEmail = true;
+      try {
+        const body = await req.json().catch(() => ({}));
+        if (body.sendEmail === false) sendEmail = false;
+      } catch {
+      }
+      try {
+        const vendorRepo = dataSource.getRepository(entityMap.vendors);
+        const vendor = await vendorRepo.findOne({
+          where: {
+            id: vendorId,
+            deleted: false
+          }
+        });
+        if (!vendor) return json({
+          error: "Vendor not found"
+        }, {
+          status: 404
+        });
+        const v = vendor;
+        if (v.inviteStatus === "accepted") {
           return json({
-            error: "Vendor Owner group not found. Run migrations."
+            error: "Owner has already accepted the invite"
           }, {
-            status: 500
+            status: 400
           });
         }
-        if (msg === "VENDOR_ROLES_SEED_FAILED") {
+        if (v.inviteStatus === "none") {
           return json({
-            error: "Failed to seed store roles for vendor. Run migrations."
+            error: "This vendor was not created with an invite link"
           }, {
-            status: 500
+            status: 400
+          });
+        }
+        if (v.inviteStatus !== "pending" && v.inviteStatus !== "expired") {
+          return json({
+            error: "Invite cannot be resent for this vendor"
+          }, {
+            status: 400
+          });
+        }
+        if (!v.userId) {
+          return json({
+            error: "Vendor has no owner user linked"
+          }, {
+            status: 400
+          });
+        }
+        const userRepo = dataSource.getRepository(entityMap.users);
+        const owner = await userRepo.findOne({
+          where: {
+            id: v.userId,
+            deleted: false
+          }
+        });
+        if (!owner) return json({
+          error: "Owner user not found"
+        }, {
+          status: 404
+        });
+        const ownerRow = owner;
+        const hasPassword = !!(ownerRow.password && String(ownerRow.password).trim());
+        if (!ownerRow.blocked && hasPassword) {
+          return json({
+            error: "Owner account is already active"
+          }, {
+            status: 400
           });
         }
-        if (/vendor_roles|vendor_role_permissions/i.test(msg)) {
+        const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
+        await vendorRepo.update(vendorId, {
+          metadata: rotatedMetadata,
+          inviteStatus: "pending"
+        });
+        const token = readVendorInviteToken(rotatedMetadata);
+        if (!token) {
           return json({
-            error: "Vendor roles tables missing. Run migrations."
+            error: "Failed to generate invite token"
           }, {
             status: 500
           });
         }
+        const inviteLink = buildVendorInviteLink(baseUrl, token);
+        let emailSent = false;
+        if (sendEmail) {
+          emailSent = await trySendVendorOnboardEmails({
+            vendorName: v.name,
+            vendorSlug: v.slug,
+            ownerName: ownerRow.name,
+            ownerEmail: ownerRow.email,
+            activation: "invite",
+            inviteLink,
+            sendToOwner: true
+          });
+        }
         return json({
-          error: "Server error"
-        }, {
-          status: 500
+          message: emailSent ? "Invite resent. Previous invite link is no longer valid." : sendEmail ? "New invite link created (email may not have been sent \u2014 check email plugin). Previous link is invalid." : "New invite link created. Previous invite link is no longer valid.",
+          emailSent,
+          inviteLink,
+          inviteStatus: "pending"
         });
+      } catch (e) {
+        return vendorOnboardErrorResponse(json, e);
       }
     },
     /** POST /api/admin/vendor/switch — set active vendor in session (JWT update via client) */
@@ -25533,6 +25974,14 @@ function createCmsApiHandler(config) {
         });
         return vendorHandlers.onboard(req);
       }
+      if (path2[0] === "admin" && path2[1] === "vendors" && path2.length === 4 && path2[3] === "resend-invite" && m === "POST") {
+        if (!vendorHandlers) return config.json({
+          error: "Not found"
+        }, {
+          status: 404
+        });
+        return vendorHandlers.resendInvite(req, path2[2]);
+      }
       if (path2[0] === "admin" && path2[1] === "vendor" && path2[2] === "switch" && path2.length === 3 && m === "POST") {
         if (!vendorHandlers) return config.json({
           error: "Not found"
@@ -26124,6 +26573,15 @@ function createCmsApiHandler(config) {
           if (m === "PUT" || m === "PATCH") return formSaveHandlers.PUT(req, path2[1]);
         }
       }
+      if (path2[0] === "users" && path2.length === 2 && userAuthRouter) {
+        const authSegment = path2[1];
+        if (m === "GET" && authSegment === "invite" && userAuthRouter.GET) {
+          return userAuthRouter.GET(req, authSegment);
+        }
+        if (m === "POST" && (authSegment === "invite" || authSegment === "forgot-password" || authSegment === "set-password" || authSegment === "reset-password")) {
+          return userAuthRouter.POST(req, authSegment);
+        }
+      }
       if (path2[0] === "users" && usersHandlers) {
         if (path2.length === 1) {
           if (m === "GET") return usersHandlers.list(req);
@@ -26144,9 +26602,6 @@ function createCmsApiHandler(config) {
           return usersHandlers.regenerateInvite(req, path2[1]);
         }
       }
-      if (path2[0] === "users" && path2.length === 2 && userAuthRouter && m === "POST") {
-        return userAuthRouter.POST(req, path2[1]);
-      }
       if (path2[0] === "social-media" && path2[1] === "linkedin" && socialMediaHandlers && path2.length === 3) {
         const tail = path2[2];
         if (tail === "status" && m === "GET") {
@@ -30529,4 +30984,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyVendorCustomersContactFilter, assertCaptchaOk, assertContactAllowedForVendorOrder, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRssArticleSummaryFromItem, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyRotatingVendorInvite, applyVendorCustomersContactFilter, assertCaptchaOk, assertContactAllowedForVendorOrder, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRssArticleSummaryFromItem, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };