@infuro/cms-core 1.0.40 → 1.0.41

package/dist/api.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkT7GCOO5Y_cjs = require('./chunk-T7GCOO5Y.cjs');
+var chunkQU554KAZ_cjs = require('./chunk-QU554KAZ.cjs');
 require('./chunk-22FFHLTO.cjs');
 require('./chunk-UCKN4BBY.cjs');
 require('./chunk-7NMT3GBR.cjs');
@@ -20,127 +20,127 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "createAnalyticsHandlers", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createAnalyticsHandlers; }
+  get: function () { return chunkQU554KAZ_cjs.createAnalyticsHandlers; }
 });
 Object.defineProperty(exports, "createBlogBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createBlogBySlugHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createBlogBySlugHandler; }
 });
 Object.defineProperty(exports, "createChangePasswordHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createChangePasswordHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createChangePasswordHandler; }
 });
 Object.defineProperty(exports, "createCmsApiHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createCmsApiHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createCmsApiHandler; }
 });
 Object.defineProperty(exports, "createCrudByIdHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createCrudByIdHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createCrudByIdHandler; }
 });
 Object.defineProperty(exports, "createCrudHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createCrudHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createCrudHandler; }
 });
 Object.defineProperty(exports, "createDashboardStatsHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createDashboardStatsHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createDashboardStatsHandler; }
 });
 Object.defineProperty(exports, "createEcommerceAnalyticsHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createEcommerceAnalyticsHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createEcommerceAnalyticsHandler; }
 });
 Object.defineProperty(exports, "createForgotPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createForgotPasswordHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createForgotPasswordHandler; }
 });
 Object.defineProperty(exports, "createFormBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createFormBySlugHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createFormBySlugHandler; }
 });
 Object.defineProperty(exports, "createInviteAcceptHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createInviteAcceptHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createInviteAcceptHandler; }
 });
 Object.defineProperty(exports, "createJobScheduleHandlers", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createJobScheduleHandlers; }
+  get: function () { return chunkQU554KAZ_cjs.createJobScheduleHandlers; }
 });
 Object.defineProperty(exports, "createLlmAgentKnowledgeHandlers", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createLlmAgentKnowledgeHandlers; }
+  get: function () { return chunkQU554KAZ_cjs.createLlmAgentKnowledgeHandlers; }
 });
 Object.defineProperty(exports, "createMediaZipExtractHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createMediaZipExtractHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createMediaZipExtractHandler; }
 });
 Object.defineProperty(exports, "createSetPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createSetPasswordHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createSetPasswordHandler; }
 });
 Object.defineProperty(exports, "createSettingsApiHandlers", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createSettingsApiHandlers; }
+  get: function () { return chunkQU554KAZ_cjs.createSettingsApiHandlers; }
 });
 Object.defineProperty(exports, "createStorefrontApiHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createStorefrontApiHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createStorefrontApiHandler; }
 });
 Object.defineProperty(exports, "createUploadHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createUploadHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createUploadHandler; }
 });
 Object.defineProperty(exports, "createUserAuthApiRouter", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createUserAuthApiRouter; }
+  get: function () { return chunkQU554KAZ_cjs.createUserAuthApiRouter; }
 });
 Object.defineProperty(exports, "createUserAvatarHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createUserAvatarHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createUserAvatarHandler; }
 });
 Object.defineProperty(exports, "createUserProfileHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createUserProfileHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createUserProfileHandler; }
 });
 Object.defineProperty(exports, "createUsersApiHandlers", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createUsersApiHandlers; }
+  get: function () { return chunkQU554KAZ_cjs.createUsersApiHandlers; }
 });
 Object.defineProperty(exports, "createVendorDashboardHandler", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createVendorDashboardHandler; }
+  get: function () { return chunkQU554KAZ_cjs.createVendorDashboardHandler; }
 });
 Object.defineProperty(exports, "createVendorOnboardHandlers", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.createVendorOnboardHandlers; }
+  get: function () { return chunkQU554KAZ_cjs.createVendorOnboardHandlers; }
 });
 Object.defineProperty(exports, "getPublicSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.getPublicSettingsGroup; }
+  get: function () { return chunkQU554KAZ_cjs.getPublicSettingsGroup; }
 });
 Object.defineProperty(exports, "mergeGuardrailsIntoSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.mergeGuardrailsIntoSystemPrompt; }
+  get: function () { return chunkQU554KAZ_cjs.mergeGuardrailsIntoSystemPrompt; }
 });
 Object.defineProperty(exports, "parseLlmAgentValidationRules", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.parseLlmAgentValidationRules; }
+  get: function () { return chunkQU554KAZ_cjs.parseLlmAgentValidationRules; }
 });
 Object.defineProperty(exports, "simpleDecrypt", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.simpleDecrypt; }
+  get: function () { return chunkQU554KAZ_cjs.simpleDecrypt; }
 });
 Object.defineProperty(exports, "simpleEncrypt", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.simpleEncrypt; }
+  get: function () { return chunkQU554KAZ_cjs.simpleEncrypt; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstAgentRules", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.validateUserMessageAgainstAgentRules; }
+  get: function () { return chunkQU554KAZ_cjs.validateUserMessageAgainstAgentRules; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstStructuredRules", {
   enumerable: true,
-  get: function () { return chunkT7GCOO5Y_cjs.validateUserMessageAgainstStructuredRules; }
+  get: function () { return chunkQU554KAZ_cjs.validateUserMessageAgainstStructuredRules; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,

package/dist/api.js

@@ -1,4 +1,4 @@
-export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-RCMUL6SZ.js';
+export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-EG4ICILK.js';
 import './chunk-NNQBWDCI.js';
 import './chunk-HCIRL37O.js';
 import './chunk-JXF23MPG.js';

package/dist/{chunk-RCMUL6SZ.js → chunk-EG4ICILK.js}

@@ -12256,6 +12256,13 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
+        if (body.activation === "password" || body.user?.password) {
+          return json({
+            error: "Setting a password during vendor onboard is no longer supported. Create the vendor, then send an invite or copy the invite link so the owner can set their own password."
+          }, {
+            status: 400
+          });
+        }
         const profile = parseVendorProfileFromBody(body.vendor, {
           defaultRegistrationStatus: "approved"
         });
@@ -12265,34 +12272,8 @@ function createVendorOnboardHandlers(config) {
         }, {
           status: 400
         });
-        const activation = body.activation === "password" ? "password" : "invite";
-        const sendOwnerEmail = body.sendOwnerEmail !== false && body.sendInviteEmail !== false;
-        let ownerPasswordHash = null;
-        if (activation === "password") {
-          const plain = body.user?.password?.trim();
-          if (!plain) {
-            return json({
-              error: "Password is required when activating with a set password"
-            }, {
-              status: 400
-            });
-          }
-          if (plain.length < minPasswordLength) {
-            return json({
-              error: `Password must be at least ${minPasswordLength} characters`
-            }, {
-              status: 400
-            });
-          }
-          if (!hashPassword) {
-            return json({
-              error: "Password hashing is not configured on the server"
-            }, {
-              status: 501
-            });
-          }
-          ownerPasswordHash = await hashPassword(plain);
-        }
+        const activation = "invite";
+        const ownerPasswordHash = null;
         const slug = trimOrNull(body.vendor?.slug) || slugify(vendorName);
         if (!slug) return json({
           error: "Could not derive vendor slug"
@@ -12349,7 +12330,7 @@ function createVendorOnboardHandlers(config) {
               email: userEmail,
               phone: ownerPhone,
               password: ownerPasswordHash,
-              blocked: activation === "invite",
+              blocked: true,
               groupId: ownerGroup.id,
               adminAccess: true,
               updatedAt: /* @__PURE__ */ new Date()
@@ -12366,15 +12347,14 @@ function createVendorOnboardHandlers(config) {
             email: userEmail,
             phone: ownerPhone,
             password: ownerPasswordHash,
-            blocked: activation === "invite",
+            blocked: true,
             groupId: ownerGroup.id,
             adminAccess: true
           }));
-          const baseMetadata = buildVendorMetadata(null, {
+          const metadata = applyRotatingVendorInvite(buildVendorMetadata(null, {
             ownerDesignation,
             termsAccepted: true
-          });
-          const metadata = activation === "invite" ? applyRotatingVendorInvite(baseMetadata) : baseMetadata;
+          }));
           const vendor = await vendorRepo.save(vendorRepo.create({
             name: vendorName,
             slug,
@@ -12442,39 +12422,14 @@ function createVendorOnboardHandlers(config) {
           };
         });
         let inviteLink;
-        let emailSent = false;
-        if (activation === "invite") {
-          const token = readVendorInviteToken(result.vendor.metadata);
-          if (token) {
-            inviteLink = buildVendorInviteLink(baseUrl, token);
-          }
-        }
-        if (sendOwnerEmail) {
-          emailSent = await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: true
-          });
-        } else if (getCms) {
-          await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: false
-          });
+        const token = readVendorInviteToken(result.vendor.metadata);
+        if (token) {
+          inviteLink = buildVendorInviteLink(baseUrl, token);
         }
-        const message = activation === "password" ? emailSent ? "Vendor onboarded successfully. Welcome email sent to the owner." : sendOwnerEmail ? "Vendor onboarded successfully. Owner can sign in with the password you set (welcome email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Owner can sign in with the password you set." : emailSent ? "Vendor onboarded successfully. Invite email sent." : sendOwnerEmail ? "Vendor onboarded successfully. Invite link created (email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Share the invite link with the owner.";
         return json({
-          message,
+          message: "Vendor created successfully.",
           activation,
-          emailSent,
+          emailSent: false,
           vendor: result.vendor,
           user: {
             id: result.user.id,
@@ -12509,9 +12464,11 @@ function createVendorOnboardHandlers(config) {
         });
       }
       let sendEmail = true;
+      let rotate = true;
       try {
         const body = await req.json().catch(() => ({}));
         if (body.sendEmail === false) sendEmail = false;
+        if (body.rotate === false) rotate = false;
       } catch {
       }
       try {
@@ -12577,12 +12534,16 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
-        const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
-        await vendorRepo.update(vendorId, {
-          metadata: rotatedMetadata,
-          inviteStatus: "pending"
-        });
-        const token = readVendorInviteToken(rotatedMetadata);
+        const nextMetadata = rotate ? applyRotatingVendorInvite(v.metadata) : {
+          ...v.metadata ?? {}
+        };
+        if (rotate || v.inviteStatus !== "pending") {
+          await vendorRepo.update(vendorId, {
+            metadata: nextMetadata,
+            inviteStatus: "pending"
+          });
+        }
+        const token = readVendorInviteToken(nextMetadata);
         if (!token) {
           return json({
             error: "Failed to generate invite token"
@@ -12603,8 +12564,9 @@ function createVendorOnboardHandlers(config) {
             sendToOwner: true
           });
         }
+        const rotatedNote = rotate ? " Previous invite link is no longer valid." : "";
         return json({
-          message: emailSent ? "Invite resent. Previous invite link is no longer valid." : sendEmail ? "New invite link created (email may not have been sent \u2014 check email plugin). Previous link is invalid." : "New invite link created. Previous invite link is no longer valid.",
+          message: emailSent ? `Invite email sent.${rotatedNote}` : sendEmail ? `Invite link ready (email may not have been sent \u2014 check email plugin).${rotatedNote}` : rotate ? "New invite link created. Previous invite link is no longer valid." : "Invite link ready.",
           emailSent,
           inviteLink,
           inviteStatus: "pending"

package/dist/{chunk-T7GCOO5Y.cjs → chunk-QU554KAZ.cjs}

@@ -12266,6 +12266,13 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
+        if (body.activation === "password" || body.user?.password) {
+          return json({
+            error: "Setting a password during vendor onboard is no longer supported. Create the vendor, then send an invite or copy the invite link so the owner can set their own password."
+          }, {
+            status: 400
+          });
+        }
         const profile = parseVendorProfileFromBody(body.vendor, {
           defaultRegistrationStatus: "approved"
         });
@@ -12275,34 +12282,8 @@ function createVendorOnboardHandlers(config) {
         }, {
           status: 400
         });
-        const activation = body.activation === "password" ? "password" : "invite";
-        const sendOwnerEmail = body.sendOwnerEmail !== false && body.sendInviteEmail !== false;
-        let ownerPasswordHash = null;
-        if (activation === "password") {
-          const plain = body.user?.password?.trim();
-          if (!plain) {
-            return json({
-              error: "Password is required when activating with a set password"
-            }, {
-              status: 400
-            });
-          }
-          if (plain.length < minPasswordLength) {
-            return json({
-              error: `Password must be at least ${minPasswordLength} characters`
-            }, {
-              status: 400
-            });
-          }
-          if (!hashPassword) {
-            return json({
-              error: "Password hashing is not configured on the server"
-            }, {
-              status: 501
-            });
-          }
-          ownerPasswordHash = await hashPassword(plain);
-        }
+        const activation = "invite";
+        const ownerPasswordHash = null;
         const slug = trimOrNull(body.vendor?.slug) || slugify(vendorName);
         if (!slug) return json({
           error: "Could not derive vendor slug"
@@ -12359,7 +12340,7 @@ function createVendorOnboardHandlers(config) {
               email: userEmail,
               phone: ownerPhone,
               password: ownerPasswordHash,
-              blocked: activation === "invite",
+              blocked: true,
               groupId: ownerGroup.id,
               adminAccess: true,
               updatedAt: /* @__PURE__ */ new Date()
@@ -12376,15 +12357,14 @@ function createVendorOnboardHandlers(config) {
             email: userEmail,
             phone: ownerPhone,
             password: ownerPasswordHash,
-            blocked: activation === "invite",
+            blocked: true,
             groupId: ownerGroup.id,
             adminAccess: true
           }));
-          const baseMetadata = buildVendorMetadata(null, {
+          const metadata = applyRotatingVendorInvite(buildVendorMetadata(null, {
             ownerDesignation,
             termsAccepted: true
-          });
-          const metadata = activation === "invite" ? applyRotatingVendorInvite(baseMetadata) : baseMetadata;
+          }));
           const vendor = await vendorRepo.save(vendorRepo.create({
             name: vendorName,
             slug,
@@ -12452,39 +12432,14 @@ function createVendorOnboardHandlers(config) {
           };
         });
         let inviteLink;
-        let emailSent = false;
-        if (activation === "invite") {
-          const token = readVendorInviteToken(result.vendor.metadata);
-          if (token) {
-            inviteLink = buildVendorInviteLink(baseUrl, token);
-          }
-        }
-        if (sendOwnerEmail) {
-          emailSent = await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: true
-          });
-        } else if (getCms) {
-          await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: false
-          });
+        const token = readVendorInviteToken(result.vendor.metadata);
+        if (token) {
+          inviteLink = buildVendorInviteLink(baseUrl, token);
         }
-        const message = activation === "password" ? emailSent ? "Vendor onboarded successfully. Welcome email sent to the owner." : sendOwnerEmail ? "Vendor onboarded successfully. Owner can sign in with the password you set (welcome email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Owner can sign in with the password you set." : emailSent ? "Vendor onboarded successfully. Invite email sent." : sendOwnerEmail ? "Vendor onboarded successfully. Invite link created (email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Share the invite link with the owner.";
         return json({
-          message,
+          message: "Vendor created successfully.",
           activation,
-          emailSent,
+          emailSent: false,
           vendor: result.vendor,
           user: {
             id: result.user.id,
@@ -12519,9 +12474,11 @@ function createVendorOnboardHandlers(config) {
         });
       }
       let sendEmail = true;
+      let rotate = true;
       try {
         const body = await req.json().catch(() => ({}));
         if (body.sendEmail === false) sendEmail = false;
+        if (body.rotate === false) rotate = false;
       } catch {
       }
       try {
@@ -12587,12 +12544,16 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
-        const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
-        await vendorRepo.update(vendorId, {
-          metadata: rotatedMetadata,
-          inviteStatus: "pending"
-        });
-        const token = readVendorInviteToken(rotatedMetadata);
+        const nextMetadata = rotate ? applyRotatingVendorInvite(v.metadata) : {
+          ...v.metadata ?? {}
+        };
+        if (rotate || v.inviteStatus !== "pending") {
+          await vendorRepo.update(vendorId, {
+            metadata: nextMetadata,
+            inviteStatus: "pending"
+          });
+        }
+        const token = readVendorInviteToken(nextMetadata);
         if (!token) {
           return json({
             error: "Failed to generate invite token"
@@ -12613,8 +12574,9 @@ function createVendorOnboardHandlers(config) {
             sendToOwner: true
           });
         }
+        const rotatedNote = rotate ? " Previous invite link is no longer valid." : "";
         return json({
-          message: emailSent ? "Invite resent. Previous invite link is no longer valid." : sendEmail ? "New invite link created (email may not have been sent \u2014 check email plugin). Previous link is invalid." : "New invite link created. Previous invite link is no longer valid.",
+          message: emailSent ? `Invite email sent.${rotatedNote}` : sendEmail ? `Invite link ready (email may not have been sent \u2014 check email plugin).${rotatedNote}` : rotate ? "New invite link created. Previous invite link is no longer valid." : "Invite link ready.",
           emailSent,
           inviteLink,
           inviteStatus: "pending"