@infuro/cms-core 1.0.44 → 1.0.46

package/dist/{chunk-P2IWWBJV.cjs → chunk-UDVLFVEC.cjs}

@@ -1,13 +1,16 @@
 'use strict';
 
-var chunk22FFHLTO_cjs = require('./chunk-22FFHLTO.cjs');
+var chunkHY3AXLOI_cjs = require('./chunk-HY3AXLOI.cjs');
+var chunkOY2YTBMP_cjs = require('./chunk-OY2YTBMP.cjs');
+var chunk7PMHZRF3_cjs = require('./chunk-7PMHZRF3.cjs');
+var chunkTCSGFAWB_cjs = require('./chunk-TCSGFAWB.cjs');
 var chunk7NMT3GBR_cjs = require('./chunk-7NMT3GBR.cjs');
-var chunkPNOKNSG2_cjs = require('./chunk-PNOKNSG2.cjs');
-var chunkXW5ATPRW_cjs = require('./chunk-XW5ATPRW.cjs');
+var chunkV25RDUOU_cjs = require('./chunk-V25RDUOU.cjs');
+var chunkBXYZDMTZ_cjs = require('./chunk-BXYZDMTZ.cjs');
 var chunk3DZRIZOD_cjs = require('./chunk-3DZRIZOD.cjs');
 var chunkSPQFNIYJ_cjs = require('./chunk-SPQFNIYJ.cjs');
 var chunkXQ3QUHWR_cjs = require('./chunk-XQ3QUHWR.cjs');
-var chunkZMRQ72F6_cjs = require('./chunk-ZMRQ72F6.cjs');
+var chunkNBY4NVTY_cjs = require('./chunk-NBY4NVTY.cjs');
 var chunkX6UQFV4X_cjs = require('./chunk-X6UQFV4X.cjs');
 var chunkD5FBNKQM_cjs = require('./chunk-D5FBNKQM.cjs');
 var chunkUPLVMVRX_cjs = require('./chunk-UPLVMVRX.cjs');
@@ -46,6 +49,7 @@ async function queryVendorLinks(dataSource, userId) {
         vr."name" AS "vendorRoleName",
         vr."isOwnerRole" AS "isOwnerRole"
       FROM "vendor_users" vu
+      INNER JOIN "vendors" v ON v.id = vu."vendorId" AND v.deleted = false
       LEFT JOIN "vendor_roles" vr ON vr.id = vu."vendorRoleId" AND vr.deleted = false
       WHERE vu."userId" = $1
       ORDER BY vu.id ASC
@@ -55,10 +59,11 @@ async function queryVendorLinks(dataSource, userId) {
   } catch (err) {
     if (!isMissingVendorRoleSchemaError(err)) throw err;
     const legacy = await dataSource.query(`
-      SELECT "vendorId", "role"
-      FROM "vendor_users"
-      WHERE "userId" = $1
-      ORDER BY id ASC
+      SELECT vu."vendorId" AS "vendorId", vu."role" AS "role"
+      FROM "vendor_users" vu
+      INNER JOIN "vendors" v ON v.id = vu."vendorId" AND v.deleted = false
+      WHERE vu."userId" = $1
+      ORDER BY vu.id ASC
       `, [
       userId
     ]);
@@ -72,8 +77,36 @@ async function queryVendorLinks(dataSource, userId) {
   }
 }
 chunkUSNT2KNT_cjs.__name(queryVendorLinks, "queryVendorLinks");
+async function queryOwnedVendorIds(dataSource, userId) {
+  try {
+    const rows = await dataSource.query(`
+      SELECT id
+      FROM "vendors"
+      WHERE "userId" = $1 AND deleted = false
+      ORDER BY id ASC
+      `, [
+      userId
+    ]);
+    return rows.map((r) => Number(r.id)).filter((id) => Number.isFinite(id) && id > 0);
+  } catch {
+    return [];
+  }
+}
+chunkUSNT2KNT_cjs.__name(queryOwnedVendorIds, "queryOwnedVendorIds");
 async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
   const rows = await queryVendorLinks(dataSource, userId);
+  const linkIds = new Set(rows.map((r) => Number(r.vendorId)));
+  for (const ownedId of await queryOwnedVendorIds(dataSource, userId)) {
+    if (linkIds.has(ownedId)) continue;
+    rows.push({
+      vendorId: ownedId,
+      role: "owner",
+      vendorRoleId: null,
+      vendorRoleName: null,
+      isOwnerRole: true
+    });
+    linkIds.add(ownedId);
+  }
   const vendorIds = rows.map((r) => Number(r.vendorId));
   const activeRow = preferredVendorId != null ? rows.find((r) => Number(r.vendorId) === preferredVendorId) : void 0;
   const primary = activeRow ?? rows[0];
@@ -626,6 +659,144 @@ function applyEventApprovalStatusSideEffects(updatePayload, opts) {
 }
 chunkUSNT2KNT_cjs.__name(applyEventApprovalStatusSideEffects, "applyEventApprovalStatusSideEffects");
 
+// src/lib/discount-usage.ts
+async function countDiscountOrdersForContact(dataSource, discountId, contactId) {
+  try {
+    const rows = await dataSource.query(`SELECT COUNT(DISTINCT od."orderId")::int AS count
+       FROM order_discounts od
+       WHERE od."discountId" = $1 AND od."userId" = $2`, [
+      discountId,
+      contactId
+    ]);
+    return Number(rows?.[0]?.count ?? 0);
+  } catch {
+    return 0;
+  }
+}
+chunkUSNT2KNT_cjs.__name(countDiscountOrdersForContact, "countDiscountOrdersForContact");
+function isMaxTotalUsageReached(discount) {
+  if (discount.maxTotalUsage == null) return false;
+  return Number(discount.usedCount ?? 0) >= Number(discount.maxTotalUsage);
+}
+chunkUSNT2KNT_cjs.__name(isMaxTotalUsageReached, "isMaxTotalUsageReached");
+async function isMaxPerUserUsageReached(dataSource, discount, contactId) {
+  if (discount.maxUsagePerUser == null || contactId == null) return false;
+  const count = await countDiscountOrdersForContact(dataSource, discount.id, contactId);
+  return count >= Number(discount.maxUsagePerUser);
+}
+chunkUSNT2KNT_cjs.__name(isMaxPerUserUsageReached, "isMaxPerUserUsageReached");
+async function checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId) {
+  if (!entityMap.discounts) return null;
+  const discountRepo = dataSource.getRepository(entityMap.discounts);
+  const discount = await discountRepo.findOne({
+    where: {
+      id: discountId
+    }
+  });
+  if (!discount) return `Discount #${discountId} not found`;
+  const d = discount;
+  if (d.maxUsagePerUser != null) {
+    const usageCount = await countDiscountOrdersForContact(dataSource, discountId, contactId);
+    if (usageCount >= Number(d.maxUsagePerUser)) {
+      return "You have reached the maximum usage limit for this discount";
+    }
+  }
+  const updated = await dataSource.query(`UPDATE discounts
+     SET "usedCount" = "usedCount" + 1
+     WHERE id = $1
+       AND ("maxTotalUsage" IS NULL OR "usedCount" < "maxTotalUsage")
+     RETURNING id`, [
+    discountId
+  ]);
+  if (!Array.isArray(updated) || updated.length === 0) {
+    return "Discount usage limit has been reached";
+  }
+  return null;
+}
+chunkUSNT2KNT_cjs.__name(checkAndIncrementDiscountUsage, "checkAndIncrementDiscountUsage");
+async function decrementDiscountUsage(dataSource, entityMap, discountId, orderId) {
+  if (!entityMap.discounts) return;
+  try {
+    await dataSource.query(`UPDATE discounts SET "usedCount" = GREATEST("usedCount" - 1, 0) WHERE id = $1`, [
+      discountId
+    ]);
+    if (entityMap.order_discounts) {
+      await dataSource.getRepository(entityMap.order_discounts).delete({
+        orderId,
+        discountId
+      });
+    }
+  } catch (err) {
+    console.error("[discountEngine] decrementDiscountUsage failed:", err);
+  }
+}
+chunkUSNT2KNT_cjs.__name(decrementDiscountUsage, "decrementDiscountUsage");
+async function recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
+  if (!entityMap.order_discounts) return;
+  try {
+    let discountCode = "";
+    if (entityMap.discounts) {
+      const discountRow = await dataSource.getRepository(entityMap.discounts).findOne({
+        where: {
+          id: discountId
+        }
+      });
+      discountCode = discountRow?.couponCode ?? "";
+    }
+    const odRepo = dataSource.getRepository(entityMap.order_discounts);
+    const orderItemRepo = dataSource.getRepository(entityMap.order_items);
+    const items = await orderItemRepo.find({
+      where: {
+        orderId
+      }
+    });
+    const discountedItems = items.filter((item) => Number(item.discount ?? 0) > 0);
+    if (discountedItems.length === 0) {
+      const firstItem = items[0];
+      if (!firstItem) return;
+      await odRepo.save(odRepo.create({
+        orderId,
+        orderItemId: firstItem.id,
+        discountId,
+        discountCode,
+        discountAmount,
+        userId: contactId
+      }));
+      return;
+    }
+    for (const item of discountedItems) {
+      const i = item;
+      await odRepo.save(odRepo.create({
+        orderId,
+        orderItemId: i.id,
+        discountId,
+        discountCode,
+        discountAmount: Number(i.discount ?? 0),
+        userId: contactId
+      }));
+    }
+  } catch (err) {
+    console.error("[discountEngine] recordDiscountUsage failed:", err);
+  }
+}
+chunkUSNT2KNT_cjs.__name(recordDiscountUsage, "recordDiscountUsage");
+async function consumeAppliedDiscountUsages(dataSource, entityMap, orderId, contactId, applied) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const row of applied) {
+    const id = Number(row.id);
+    if (!Number.isFinite(id) || id < 1) continue;
+    const amount = Math.max(0, Number(row.calculatedDiscount) || 0);
+    unique.set(id, (unique.get(id) ?? 0) + amount);
+  }
+  for (const [discountId, discountAmount] of unique) {
+    const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId);
+    if (usageErr) return usageErr;
+    await recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount);
+  }
+  return null;
+}
+chunkUSNT2KNT_cjs.__name(consumeAppliedDiscountUsages, "consumeAppliedDiscountUsages");
+
 // src/lib/default-vendor-id.ts
 function getDefaultVendorId() {
   const raw = process.env.DEFAULT_VENDOR_ID;
@@ -1100,11 +1271,118 @@ function pgErrorCode(err) {
   return driver?.code ?? err.code;
 }
 chunkUSNT2KNT_cjs.__name(pgErrorCode, "pgErrorCode");
-function customerPhoneForUser(userId, phone) {
+function normalizeCustomerPhone(phone) {
   const p = typeof phone === "string" ? phone.trim() : "";
-  return p || `u-${userId}`;
+  return p || null;
+}
+chunkUSNT2KNT_cjs.__name(normalizeCustomerPhone, "normalizeCustomerPhone");
+function isSyntheticCustomerPhone(phone) {
+  const p = String(phone ?? "").trim();
+  if (!p) return true;
+  if (p.startsWith("e-") || p.startsWith("u-")) return true;
+  if (p.includes("@")) return true;
+  return false;
+}
+chunkUSNT2KNT_cjs.__name(isSyntheticCustomerPhone, "isSyntheticCustomerPhone");
+function customerPhoneForUser(_userId, phone) {
+  return normalizeCustomerPhone(phone);
 }
 chunkUSNT2KNT_cjs.__name(customerPhoneForUser, "customerPhoneForUser");
+function customerPhoneForEmail(_email, phone) {
+  return normalizeCustomerPhone(phone);
+}
+chunkUSNT2KNT_cjs.__name(customerPhoneForEmail, "customerPhoneForEmail");
+function resolveNextPhone(inputPhone, existingPhone) {
+  if (inputPhone) return inputPhone;
+  const existing = normalizeCustomerPhone(existingPhone);
+  if (!existing || isSyntheticCustomerPhone(existing)) return null;
+  return existing;
+}
+chunkUSNT2KNT_cjs.__name(resolveNextPhone, "resolveNextPhone");
+async function ensureCustomerRecord(dsOrEm, customerEntity, input) {
+  const repo = dsOrEm.getRepository(customerEntity);
+  const email = normalizeEmail(input.email);
+  if (!email) return null;
+  const name = String(input.name ?? "").trim() || email.split("@")[0] || "Customer";
+  const userId = input.userId != null && Number.isFinite(Number(input.userId)) && Number(input.userId) > 0 ? Number(input.userId) : null;
+  const phone = normalizeCustomerPhone(input.phone);
+  let row = await repo.findOne({
+    where: {
+      email,
+      deleted: false
+    }
+  });
+  if (!row) {
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+  }
+  if (row) {
+    const existingUserId = row.userId;
+    if (userId != null && existingUserId != null && existingUserId !== userId) {
+      return null;
+    }
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    const patch = {
+      name,
+      phone: nextPhone,
+      deleted: false,
+      deletedAt: null,
+      deletedBy: null,
+      updatedAt: /* @__PURE__ */ new Date()
+    };
+    if (userId != null && existingUserId == null) {
+      patch.userId = userId;
+    }
+    await repo.update(row.id, patch);
+    return {
+      id: row.id
+    };
+  }
+  try {
+    const created = await repo.save(repo.create({
+      userId,
+      name,
+      email,
+      phone,
+      deleted: false
+    }));
+    return {
+      id: created.id
+    };
+  } catch (err) {
+    const code = pgErrorCode(err);
+    if (code === "25P02") throw err;
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+    if (row) {
+      const existingUserId = row.userId;
+      if (userId != null && existingUserId != null && existingUserId !== userId) return null;
+      await repo.update(row.id, {
+        name,
+        phone: resolveNextPhone(phone, row.phone),
+        ...userId != null && existingUserId == null ? {
+          userId
+        } : {},
+        deleted: false,
+        deletedAt: null,
+        deletedBy: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return {
+        id: row.id
+      };
+    }
+    if (code === "23505") return null;
+    throw err;
+  }
+}
+chunkUSNT2KNT_cjs.__name(ensureCustomerRecord, "ensureCustomerRecord");
 async function restoreCustomerRow(repo, row, user, name, email, phone) {
   const id = row.id;
   await repo.update(id, {
@@ -1126,7 +1404,7 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
   const repo = dsOrEm.getRepository(customerEntity);
   const email = normalizeEmail(user.email);
   const name = String(user.name ?? "").trim() || email.split("@")[0] || "User";
-  const phone = customerPhoneForUser(user.id, overrides?.phone ?? user.phone);
+  const phone = normalizeCustomerPhone(overrides?.phone ?? user.phone);
   let row = await repo.findOne({
     where: {
       userId: user.id,
@@ -1134,10 +1412,11 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
     }
   });
   if (row) {
+    const nextPhone = resolveNextPhone(phone, row.phone);
     await repo.update(row.id, {
       name,
       email,
-      phone,
+      phone: nextPhone,
       updatedAt: /* @__PURE__ */ new Date()
     });
     return {
@@ -1155,10 +1434,11 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
     if (existingUserId != null && existingUserId !== user.id) {
       return null;
     }
+    const nextPhone = resolveNextPhone(phone, row.phone);
     await repo.update(row.id, {
       userId: user.id,
       name,
-      phone,
+      phone: nextPhone,
       updatedAt: /* @__PURE__ */ new Date()
     });
     return {
@@ -1173,21 +1453,23 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
   if (deletedByEmail) {
     const existingUserId = deletedByEmail.userId;
     if (existingUserId != null && existingUserId !== user.id) return null;
-    return restoreCustomerRow(repo, deletedByEmail, user, name, email, phone);
+    return restoreCustomerRow(repo, deletedByEmail, user, name, email, resolveNextPhone(phone, deletedByEmail.phone));
   }
-  const deletedByPhone = await repo.findOne({
-    where: {
-      phone
-    }
-  });
-  if (deletedByPhone) {
-    const existingUserId = deletedByPhone.userId;
-    if (existingUserId != null && existingUserId !== user.id) {
-      return ensureCustomerForUser(dsOrEm, customerEntity, user, {
-        phone: `u-${user.id}-${Date.now()}`
-      });
+  if (phone) {
+    const deletedByPhone = await repo.findOne({
+      where: {
+        phone
+      }
+    });
+    if (deletedByPhone) {
+      const existingUserId = deletedByPhone.userId;
+      if (existingUserId != null && existingUserId !== user.id) {
+        return ensureCustomerForUser(dsOrEm, customerEntity, user, {
+          phone: null
+        });
+      }
+      return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
     }
-    return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
   }
   try {
     const created = await repo.save(repo.create({
@@ -1208,34 +1490,22 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
         userId: user.id
       }
     });
-    if (row) return restoreCustomerRow(repo, row, user, name, email, phone);
+    if (row) {
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
+    }
     row = await repo.findOne({
       where: {
         email
       }
     });
     if (row && (row.userId ?? user.id) === user.id) {
-      return restoreCustomerRow(repo, row, user, name, email, phone);
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
     }
     if (code === "23505") return null;
     throw err;
   }
 }
 chunkUSNT2KNT_cjs.__name(ensureCustomerForUser, "ensureCustomerForUser");
-async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
-  const repo = dataSource.getRepository(contactsEntity);
-  const found = await repo.findOne({
-    where: {
-      email,
-      userId: typeorm.IsNull(),
-      deleted: false
-    }
-  });
-  if (found) await repo.update(found.id, {
-    userId
-  });
-}
-chunkUSNT2KNT_cjs.__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
 
 // src/lib/vendor-customer-contacts.ts
 function isCustomerTypeContact(type) {
@@ -1328,8 +1598,27 @@ function resolveVendorIdForContactCheck(scope, bodyOrRow) {
   return Number.isFinite(n) ? n : null;
 }
 chunkUSNT2KNT_cjs.__name(resolveVendorIdForContactCheck, "resolveVendorIdForContactCheck");
+function uniquePositiveIds(ids) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of ids) {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0 || seen.has(n)) continue;
+    seen.add(n);
+    out.push(n);
+  }
+  return out;
+}
+chunkUSNT2KNT_cjs.__name(uniquePositiveIds, "uniquePositiveIds");
 async function ensureVendorCustomerForOrderContact(dataSource, entityMap, vendorId, contactId, details) {
-  if (!Number.isFinite(vendorId) || !Number.isFinite(contactId)) return;
+  await ensureVendorCustomersForOrder(dataSource, entityMap, [
+    vendorId
+  ], contactId, details);
+}
+chunkUSNT2KNT_cjs.__name(ensureVendorCustomerForOrderContact, "ensureVendorCustomerForOrderContact");
+async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, contactId, details) {
+  const vendors = uniquePositiveIds(vendorIds);
+  if (vendors.length === 0 || !Number.isFinite(contactId) || contactId <= 0) return;
   const vcEntity = entityMap.vendor_customers;
   const contactEntity = entityMap.contacts;
   if (!vcEntity || !contactEntity) return;
@@ -1355,96 +1644,61 @@ async function ensureVendorCustomerForOrderContact(dataSource, entityMap, vendor
   }
   let customerId = null;
   if (entityMap.customer) {
-    const customerRepo = dataSource.getRepository(entityMap.customer);
-    const existingCustomer = await customerRepo.findOne({
-      where: {
-        email,
-        deleted: false
-      }
+    const ensured = await ensureCustomerRecord(dataSource, entityMap.customer, {
+      name,
+      email,
+      phone,
+      userId: null
     });
-    if (existingCustomer) {
-      customerId = Number(existingCustomer.id);
-    } else if (entityMap.users) {
-      const userRepo = dataSource.getRepository(entityMap.users);
-      let user = await userRepo.findOne({
+    if (ensured) customerId = ensured.id;
+  }
+  for (const vendorId of vendors) {
+    if (customerId != null) {
+      const byCustomer = await vcRepo.findOne({
         where: {
-          email,
-          deleted: false
+          vendorId,
+          customerId
         }
       });
-      if (!user) {
-        let groupId = null;
-        if (entityMap.user_groups) {
-          const userGroupRepo = dataSource.getRepository(entityMap.user_groups);
-          const customerGroup = await userGroupRepo.findOne({
-            where: {
-              name: "Customer",
-              deleted: false
-            }
+      if (byCustomer) {
+        const existingContactId = byCustomer.contactId;
+        if (existingContactId == null) {
+          await vcRepo.update(byCustomer.id, {
+            contactId
           });
-          if (customerGroup) groupId = Number(customerGroup.id);
         }
-        user = await userRepo.save(userRepo.create({
-          name,
-          email,
-          phone,
-          password: null,
-          blocked: false,
-          groupId,
-          adminAccess: false
-        }));
+        continue;
       }
-      const userId = Number(user.id);
-      await linkUnclaimedContactToUser(dataSource, contactEntity, userId, email);
-      const ensured = await ensureCustomerForUser(dataSource, entityMap.customer, {
-        id: userId,
-        name,
-        email,
-        phone
-      }, {
-        phone
-      });
-      if (ensured) customerId = ensured.id;
     }
-  }
-  if (customerId != null) {
-    const byCustomer = await vcRepo.findOne({
+    const byContact = await vcRepo.findOne({
       where: {
         vendorId,
-        customerId
+        contactId
       }
     });
-    if (byCustomer) {
-      const existingContactId = byCustomer.contactId;
-      if (existingContactId == null) {
-        await vcRepo.update(byCustomer.id, {
-          contactId
+    if (byContact) {
+      if (customerId != null && byContact.customerId == null) {
+        await vcRepo.update(byContact.id, {
+          customerId
         });
       }
-      return;
+      continue;
     }
-  }
-  const byContact = await vcRepo.findOne({
-    where: {
-      vendorId,
-      contactId
+    if (customerId != null) {
+      await vcRepo.save(vcRepo.create({
+        vendorId,
+        customerId,
+        contactId
+      }));
+    } else {
+      await vcRepo.save(vcRepo.create({
+        vendorId,
+        contactId
+      }));
     }
-  });
-  if (byContact) return;
-  if (customerId != null) {
-    await vcRepo.save(vcRepo.create({
-      vendorId,
-      customerId,
-      contactId
-    }));
-    return;
   }
-  await vcRepo.save(vcRepo.create({
-    vendorId,
-    contactId
-  }));
 }
-chunkUSNT2KNT_cjs.__name(ensureVendorCustomerForOrderContact, "ensureVendorCustomerForOrderContact");
+chunkUSNT2KNT_cjs.__name(ensureVendorCustomersForOrder, "ensureVendorCustomersForOrder");
 
 // src/lib/currency-prices.ts
 function normalizeCurrencyCode(code) {
@@ -1886,6 +2140,7 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   let slug = baseSlug;
   let suffix = 0;
   while (true) {
+    await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(repo, "slug", slug);
     const where = excludeId != null ? {
       slug,
       vendorId,
@@ -1905,6 +2160,21 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   }
 }
 chunkUSNT2KNT_cjs.__name(ensureUniqueProductSlug, "ensureUniqueProductSlug");
+async function normalizeComboNameAndSlug(repo, body, vendorId, existing, excludeId) {
+  const incomingName = typeof body.name === "string" ? body.name.trim() : "";
+  const incomingSlugRaw = typeof body.slug === "string" ? body.slug.trim() : "";
+  const existingName = typeof existing?.name === "string" ? existing.name.trim() : "";
+  const existingSlug = typeof existing?.slug === "string" ? existing.slug.trim() : "";
+  const name = incomingName || existingName;
+  if (!name) return "Name is required";
+  if (incomingName) body.name = name;
+  const nameBasedSlug = slugifyProductLabel(name);
+  const typedSlug = incomingSlugRaw ? slugifyProductLabel(incomingSlugRaw) : "";
+  const slug = typedSlug || (excludeId != null ? existingSlug : "") || nameBasedSlug;
+  body.slug = await ensureUniqueProductSlug(repo, slug, vendorId, excludeId);
+  return null;
+}
+chunkUSNT2KNT_cjs.__name(normalizeComboNameAndSlug, "normalizeComboNameAndSlug");
 async function hydrateProductEventNames(dataSource, entityMap, products) {
   if (!products.length) return products;
   if (!entityMap.event_products || !entityMap.events) {
@@ -2151,6 +2421,20 @@ async function normalizeProductNameAndSlug(repo, body, vendorId, existing, exclu
   return null;
 }
 chunkUSNT2KNT_cjs.__name(normalizeProductNameAndSlug, "normalizeProductNameAndSlug");
+async function retireSoftDeletedUniquesFromBody(repo, body) {
+  const cols = new Set(repo.metadata.columns.map((c) => c.propertyName));
+  if (!cols.has("deleted")) return;
+  for (const col of [
+    "slug",
+    "email"
+  ]) {
+    if (!cols.has(col)) continue;
+    const raw = body[col];
+    if (typeof raw !== "string" || !raw.trim()) continue;
+    await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(repo, col, raw.trim());
+  }
+}
+chunkUSNT2KNT_cjs.__name(retireSoftDeletedUniquesFromBody, "retireSoftDeletedUniquesFromBody");
 function buildSoftDeletePayload(meta, deletedBy) {
   const payload = {
     deleted: true
@@ -2387,6 +2671,7 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
     case "category":
     case "cart":
     case "paymentMethod":
+    case "deviceType":
     case "order": {
       if (rule.subType === "nthOrder") {
         return true;
@@ -2570,87 +2855,22 @@ function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
   return totalDiscountApplied;
 }
 chunkUSNT2KNT_cjs.__name(applyDiscountToOrderLines, "applyDiscountToOrderLines");
-async function checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId) {
-  if (!entityMap["discounts"]) return null;
-  const discountRepo = dataSource.getRepository(entityMap["discounts"]);
-  const discount = await discountRepo.findOne({
-    where: {
-      id: discountId
-    }
-  });
-  if (!discount) return `Discount #${discountId} not found`;
-  await dataSource.query(`UPDATE discounts SET "usedCount" = "usedCount" + 1 WHERE id = $1`, [
-    discountId
-  ]);
-  return null;
+function asDiscountUsageEntityMap(entityMap) {
+  return entityMap;
 }
-chunkUSNT2KNT_cjs.__name(checkAndIncrementDiscountUsage, "checkAndIncrementDiscountUsage");
-async function decrementDiscountUsage(dataSource, entityMap, discountId, orderId) {
-  if (!entityMap["discounts"]) return;
-  try {
-    await dataSource.query(`UPDATE discounts SET "usedCount" = GREATEST("usedCount" - 1, 0) WHERE id = $1`, [
-      discountId
-    ]);
-    if (entityMap["order_discounts"]) {
-      await dataSource.getRepository(entityMap["order_discounts"]).delete({
-        orderId,
-        discountId
-      });
-    }
-  } catch (err) {
-    console.error("[discountEngine] decrementDiscountUsage failed:", err);
-  }
+chunkUSNT2KNT_cjs.__name(asDiscountUsageEntityMap, "asDiscountUsageEntityMap");
+async function checkAndIncrementDiscountUsage2(dataSource, entityMap, discountId, contactId) {
+  return checkAndIncrementDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), discountId, contactId);
 }
-chunkUSNT2KNT_cjs.__name(decrementDiscountUsage, "decrementDiscountUsage");
-async function recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
-  if (!entityMap["order_discounts"]) return;
-  try {
-    let discountCode = "";
-    if (entityMap["discounts"]) {
-      const discountRow = await dataSource.getRepository(entityMap["discounts"]).findOne({
-        where: {
-          id: discountId
-        }
-      });
-      discountCode = discountRow?.couponCode ?? "";
-    }
-    const odRepo = dataSource.getRepository(entityMap["order_discounts"]);
-    const orderItemRepo = dataSource.getRepository(entityMap.order_items);
-    const items = await orderItemRepo.find({
-      where: {
-        orderId
-      }
-    });
-    const discountedItems = items.filter((item) => Number(item.discount ?? 0) > 0);
-    if (discountedItems.length === 0) {
-      const firstItem = items[0];
-      if (!firstItem) return;
-      await odRepo.save(odRepo.create({
-        orderId,
-        orderItemId: firstItem.id,
-        discountId,
-        discountCode,
-        discountAmount,
-        userId: contactId
-      }));
-      return;
-    }
-    for (const item of discountedItems) {
-      const i = item;
-      await odRepo.save(odRepo.create({
-        orderId,
-        orderItemId: i.id,
-        discountId,
-        discountCode,
-        discountAmount: Number(i.discount ?? 0),
-        userId: contactId
-      }));
-    }
-  } catch (err) {
-    console.error("[discountEngine] recordDiscountUsage failed:", err);
-  }
+chunkUSNT2KNT_cjs.__name(checkAndIncrementDiscountUsage2, "checkAndIncrementDiscountUsage");
+async function decrementDiscountUsage2(dataSource, entityMap, discountId, orderId) {
+  return decrementDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), discountId, orderId);
 }
-chunkUSNT2KNT_cjs.__name(recordDiscountUsage, "recordDiscountUsage");
+chunkUSNT2KNT_cjs.__name(decrementDiscountUsage2, "decrementDiscountUsage");
+async function recordDiscountUsage2(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
+  return recordDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), orderId, discountId, contactId, discountAmount);
+}
+chunkUSNT2KNT_cjs.__name(recordDiscountUsage2, "recordDiscountUsage");
 async function validateCoupon(dataSource, entityMap, couponCode, orderLines, currency = "INR", contactId, isAutomatic, discountId, vendorId) {
   if (!entityMap["discounts"]) return {
     valid: false,
@@ -2695,21 +2915,12 @@ async function validateCoupon(dataSource, entityMap, couponCode, orderLines, cur
     };
   }
   if (contactId != null && d.maxUsagePerUser != null) {
-    try {
-      const userUsage = await dataSource.query(`SELECT COUNT(DISTINCT od."orderId") as count FROM order_discounts od
-         WHERE od."discountId" = $1 
-         AND od."userId" = $2`, [
-        d.id,
-        contactId
-      ]);
-      const usageCount = Number(userUsage?.[0]?.count ?? 0);
-      if (usageCount >= d.maxUsagePerUser) {
-        return {
-          valid: false,
-          error: "You have reached the maximum usage limit for this discount"
-        };
-      }
-    } catch {
+    const usageCount = await countDiscountOrdersForContact(dataSource, d.id, contactId);
+    if (usageCount >= d.maxUsagePerUser) {
+      return {
+        valid: false,
+        error: "You have reached the maximum usage limit for this discount"
+      };
     }
   }
   const flatRules = entityMap["discount_rules"] ? await dataSource.getRepository(entityMap["discount_rules"]).find({
@@ -2787,128 +2998,32 @@ function normalizeOrderLinesInput(raw) {
     if (!Number.isFinite(productId) || productId <= 0) continue;
     const qRaw = Number(r.quantity ?? 1);
     const q = Number.isFinite(qRaw) ? Math.min(99999, Math.max(1, Math.floor(qRaw))) : 1;
-    merged.set(productId, (merged.get(productId) ?? 0) + q);
+    const vidRaw = r.variantId ?? r.variant_id;
+    const vid = vidRaw != null && String(vidRaw).trim() !== "" ? Number(vidRaw) : NaN;
+    const variantId = Number.isFinite(vid) && vid > 0 ? vid : null;
+    const key = `${productId}:${variantId ?? 0}`;
+    const prev = merged.get(key);
+    if (prev) prev.quantity += q;
+    else merged.set(key, {
+      productId,
+      quantity: q,
+      variantId
+    });
   }
   return [
-    ...merged.entries()
-  ].map(([productId, quantity]) => ({
-    productId,
-    quantity
-  }));
+    ...merged.values()
+  ];
 }
 chunkUSNT2KNT_cjs.__name(normalizeOrderLinesInput, "normalizeOrderLinesInput");
-var ORDER_STATUS_CONFIRMED = "confirmed";
-function orderInventorySnapshotFromRow(order) {
-  return {
-    status: order.status ?? "pending",
-    lines: (order.items ?? []).map((i) => ({
-      productId: Number(i.productId),
-      quantity: Math.max(0, Math.floor(Number(i.quantity) || 0))
-    })).filter((l) => l.productId > 0 && l.quantity > 0)
-  };
-}
-chunkUSNT2KNT_cjs.__name(orderInventorySnapshotFromRow, "orderInventorySnapshotFromRow");
-function mergeInventoryLinesByProduct(lines) {
-  const m = /* @__PURE__ */ new Map();
-  for (const { productId, quantity } of lines) {
-    if (!Number.isFinite(productId) || productId <= 0 || quantity <= 0) continue;
-    m.set(productId, (m.get(productId) ?? 0) + quantity);
-  }
-  return m;
-}
-chunkUSNT2KNT_cjs.__name(mergeInventoryLinesByProduct, "mergeInventoryLinesByProduct");
-async function validateInventoryForConfirmedOrderLines(dataSource, entityMap, calcLines) {
-  const productRepo = dataSource.getRepository(entityMap.products);
-  const merged = mergeInventoryLinesByProduct(calcLines.filter((l) => l.found && l.productId != null).map((l) => ({
-    productId: l.productId,
-    quantity: l.quantity
-  })));
-  for (const [productId, qty] of merged) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    const cur = Number(row.quantity ?? 0);
-    if (cur < qty) {
-      const name = row.name ?? String(productId);
-      return `Insufficient stock for ${name}: available ${cur}, required ${qty}`;
-    }
-  }
-  return null;
-}
-chunkUSNT2KNT_cjs.__name(validateInventoryForConfirmedOrderLines, "validateInventoryForConfirmedOrderLines");
-async function applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, sign, validateDeduct) {
-  const productRepo = dataSource.getRepository(entityMap.products);
-  for (const [productId, qty] of merged) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    const cur = Number(row.quantity ?? 0);
-    if (sign === -1) {
-      if (validateDeduct && cur < qty) {
-        const name = row.name ?? String(productId);
-        return `Insufficient stock for ${name}: available ${cur}, required ${qty}`;
-      }
-      await productRepo.update(productId, {
-        quantity: Math.max(0, cur - qty)
-      });
-    } else {
-      await productRepo.update(productId, {
-        quantity: cur + qty
-      });
-    }
-  }
-  return null;
-}
-chunkUSNT2KNT_cjs.__name(applyInventoryDeltaForMergedLines, "applyInventoryDeltaForMergedLines");
-async function validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, prevSnap, nextLines) {
-  const mergedNext = mergeInventoryLinesByProduct(nextLines);
-  const productRepo = dataSource.getRepository(entityMap.products);
-  const prevByProduct = prevSnap?.status === ORDER_STATUS_CONFIRMED ? mergeInventoryLinesByProduct(prevSnap.lines) : /* @__PURE__ */ new Map();
-  for (const [productId, need] of mergedNext) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    let available = Number(row.quantity ?? 0);
-    available += prevByProduct.get(productId) ?? 0;
-    if (available < need) {
-      const name = row.name ?? String(productId);
-      return `Insufficient stock for ${name}: available ${available}, required ${need}`;
-    }
-  }
-  return null;
-}
-chunkUSNT2KNT_cjs.__name(validateInventoryForOrderBecomingConfirmed, "validateInventoryForOrderBecomingConfirmed");
-async function reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, prev, next) {
-  const wasConfirmed = prev.status === ORDER_STATUS_CONFIRMED;
-  const isConfirmed = next.status === ORDER_STATUS_CONFIRMED;
-  if (wasConfirmed) {
-    const merged = mergeInventoryLinesByProduct(prev.lines);
-    const err = await applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, 1, false);
-    if (err) return err;
-  }
-  if (isConfirmed) {
-    const merged = mergeInventoryLinesByProduct(next.lines);
-    const err = await applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, -1, true);
-    if (err) return err;
-  }
-  return null;
+var ORDER_STATUS_CONFIRMED = "confirmed";
+async function validateInventoryForConfirmedOrderLines2(dataSource, entityMap, calcLines) {
+  const lines = calcLines.filter((l) => l.found && l.productId != null).map((l) => ({
+    productId: l.productId,
+    quantity: l.quantity
+  }));
+  return chunkHY3AXLOI_cjs.validateInventoryForConfirmedOrderLines(dataSource, entityMap, lines);
 }
-chunkUSNT2KNT_cjs.__name(reconcileOrderInventoryBetweenSnapshots, "reconcileOrderInventoryBetweenSnapshots");
+chunkUSNT2KNT_cjs.__name(validateInventoryForConfirmedOrderLines2, "validateInventoryForConfirmedOrderLines");
 async function resolveProductTaxRate(dataSource, entityMap, productId, productVendorId) {
   if (!entityMap.product_config || !entityMap.taxes) {
     return {
@@ -3810,23 +3925,24 @@ function createCrudHandler(dataSource, entityMap, options) {
       if (resource === "vendor_customers" && entityMap["customer"]) {
         const scope = await resolveVendorCustomersScope(dataSource, entityMap, resolveScope);
         const repo2 = dataSource.getRepository(entity);
-        const qb = repo2.createQueryBuilder("vc").leftJoinAndSelect("vc.customer", "customer").leftJoinAndSelect("customer.user", "user").orderBy("vc.createdAt", sortOrder === "DESC" ? "DESC" : "ASC").skip(skip).take(limit);
+        const qb = repo2.createQueryBuilder("vc").leftJoinAndSelect("vc.customer", "customer").leftJoinAndSelect("customer.user", "user").leftJoinAndSelect("vc.contact", "contact").orderBy("vc.createdAt", sortOrder === "DESC" ? "DESC" : "ASC").skip(skip).take(limit);
         applyVendorScopeToQueryBuilder(qb, "vc", scope);
         if (search && typeof search === "string" && search.trim()) {
           const term = `%${search.trim()}%`;
-          qb.andWhere("(customer.name ILIKE :term OR customer.email ILIKE :term OR customer.phone ILIKE :term)", {
+          qb.andWhere("(customer.name ILIKE :term OR customer.email ILIKE :term OR customer.phone ILIKE :term OR contact.name ILIKE :term OR contact.email ILIKE :term OR contact.phone ILIKE :term)", {
             term
           });
         }
         const [rows, total2] = await qb.getManyAndCount();
         const data2 = rows.map((row) => {
           const customer = row.customer;
+          const contact = row.contact;
           return {
             ...row,
-            name: customer?.name ?? null,
-            email: customer?.email ?? null,
-            phone: customer?.phone ?? null,
-            company: customer?.company ?? null
+            name: customer?.name ?? contact?.name ?? null,
+            email: customer?.email ?? contact?.email ?? null,
+            phone: customer?.phone ?? contact?.phone ?? null,
+            company: customer?.company ?? contact?.company ?? null
           };
         });
         return json({
@@ -4160,7 +4276,11 @@ function createCrudHandler(dataSource, entityMap, options) {
         } else if (resource === "collections") {
           if (scope.type === "vendor") {
             where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
-          } else if (searchParams.get("isCatalog") !== "true") {
+          } else if (searchParams.get("isCatalog") === "true") {
+            where = mergeListWhereAnd(where, {
+              isCatalog: true
+            });
+          } else if (searchParams.get("isCatalog") === "false") {
             where = mergeListWhereAnd(where, {
               isCatalog: false
             });
@@ -4357,41 +4477,17 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 503
           });
         }
-        if (!entityMap["users"]) {
-          return json({
-            error: "Users entity not configured"
-          }, {
-            status: 503
-          });
-        }
-        let customerGroupId = null;
-        if (entityMap["user_groups"]) {
-          const userGroupRepo = dataSource.getRepository(entityMap["user_groups"]);
-          const customerGroup = await userGroupRepo.findOne({
-            where: {
-              name: "Customer",
-              deleted: false
-            }
-          });
-          if (!customerGroup) {
-            return json({
-              error: "User group 'customer' not found"
-            }, {
-              status: 500
-            });
-          }
-          customerGroupId = Number(customerGroup.id);
-        } else {
+        if (!entityMap["contacts"]) {
           return json({
-            error: "user_groups entity not configured"
+            error: "Contacts entity not configured"
           }, {
             status: 503
           });
         }
         const name = String(body.name ?? "").trim();
-        const email = String(body.email ?? "").trim();
-        const phone = String(body.phone ?? "").trim();
-        const rawPw = String(body._password ?? "").trim();
+        const email = String(body.email ?? "").trim().toLowerCase();
+        const phoneRaw = String(body.phone ?? "").trim();
+        const phone = phoneRaw || null;
         if (!name) return json({
           error: "name is required"
         }, {
@@ -4402,25 +4498,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         }, {
           status: 400
         });
-        if (!phone) return json({
-          error: "phone is required"
-        }, {
-          status: 400
-        });
-        if (!rawPw) return json({
-          error: "password is required"
-        }, {
-          status: 400
-        });
-        if (rawPw.length < 6) {
-          return json({
-            error: "Password must be at least 6 characters"
-          }, {
-            status: 400
-          });
-        }
         const customerRepo = dataSource.getRepository(entityMap["customer"]);
-        const userRepo = dataSource.getRepository(entityMap["users"]);
         const dupCustEmail = await customerRepo.findOne({
           where: {
             email,
@@ -4434,49 +4512,26 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 409
           });
         }
-        const dupCustPhone = await customerRepo.findOne({
-          where: {
-            phone,
-            deleted: false
-          }
-        });
-        if (dupCustPhone) {
-          return json({
-            error: "A customer with this phone number already exists"
-          }, {
-            status: 409
+        if (phone) {
+          const dupCustPhone = await customerRepo.findOne({
+            where: {
+              phone,
+              deleted: false
+            }
           });
-        }
-        let userId;
-        const dupUser = await userRepo.findOne({
-          where: {
-            email,
-            deleted: false
+          if (dupCustPhone) {
+            return json({
+              error: "A customer with this phone number already exists"
+            }, {
+              status: 409
+            });
           }
-        });
-        if (dupUser) {
-          userId = Number(dupUser.id);
-        } else {
-          const bcrypt = await import('bcryptjs');
-          const hashedPassword = await bcrypt.hash(rawPw, 10);
-          const savedUser = await userRepo.save(userRepo.create({
-            name,
-            email,
-            phone,
-            password: hashedPassword,
-            groupId: customerGroupId,
-            adminAccess: false,
-            blocked: false
-          }));
-          userId = Number(savedUser.id);
         }
-        const savedCustomer = await ensureCustomerForUser(dataSource, entityMap["customer"], {
-          id: userId,
+        const savedCustomer = await ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
-          phone
-        }, {
-          phone
+          phone,
+          userId: null
         });
         if (!savedCustomer) {
           return json({
@@ -4485,37 +4540,37 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 409
           });
         }
-        const customerRepo2 = dataSource.getRepository(entityMap["customer"]);
-        const customerRow = await customerRepo2.findOne({
+        const contactRepo = dataSource.getRepository(entityMap["contacts"]);
+        let contact = await contactRepo.findOne({
           where: {
-            id: savedCustomer.id,
+            email,
             deleted: false
           }
-        }) ?? savedCustomer;
-        if (entityMap["contacts"]) {
-          const contactRepo = dataSource.getRepository(entityMap["contacts"]);
-          const existingContact = await contactRepo.findOne({
-            where: {
-              email,
-              deleted: false
-            }
-          });
-          if (!existingContact) {
-            await contactRepo.save(contactRepo.create({
-              name,
-              email,
-              phone: phone || null,
-              type: "customer"
-            }));
-          } else {
-            const t = existingContact.type;
-            if (t == null || t === "" || String(t).toLowerCase() !== "customer") {
-              await contactRepo.update(existingContact.id, {
-                type: "customer"
-              });
-            }
-          }
+        });
+        if (!contact) {
+          contact = await contactRepo.save(contactRepo.create({
+            name,
+            email,
+            phone: phone || null,
+            type: "customer"
+          }));
+        } else {
+          const t = contact.type;
+          const patch = {
+            name,
+            phone: phone || contact.phone || null
+          };
+          if (t == null || t === "" || String(t).toLowerCase() !== "customer") {
+            patch.type = "customer";
+          }
+          await contactRepo.update(contact.id, patch);
+          contact = {
+            ...contact,
+            ...patch,
+            id: contact.id
+          };
         }
+        const contactId = Number(contact.id);
         const scope = await resolveVendorCustomersScope(dataSource, entityMap, resolveScope);
         let vendorId = null;
         if (scope.type === "vendor") {
@@ -4531,19 +4586,25 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 400
           });
         }
-        const vcRepo = dataSource.getRepository(entity);
-        const existingLink = await vcRepo.findOne({
+        await ensureVendorCustomersForOrder(dataSource, entityMap, [
+          vendorId
+        ], contactId, {
+          name,
+          email,
+          phone
+        });
+        const customerRow = await customerRepo.findOne({
           where: {
-            customerId: savedCustomer.id
+            id: savedCustomer.id,
+            deleted: false
           }
         });
-        if (!existingLink) {
-          await vcRepo.save(vcRepo.create({
-            customerId: savedCustomer.id,
-            vendorId
-          }));
-        }
-        return json(customerRow, {
+        return json(customerRow ?? {
+          id: savedCustomer.id,
+          name,
+          email,
+          phone
+        }, {
           status: 201
         });
       }
@@ -4948,6 +5009,22 @@ function createCrudHandler(dataSource, entityMap, options) {
           status: 400
         });
       }
+      if (resource === "combos") {
+        const vendorIdForSlug = scopeCreate.type === "vendor" ? scopeCreate.vendorId : Number(persistBody.vendorId);
+        if (!Number.isFinite(vendorIdForSlug) || vendorIdForSlug <= 0) {
+          return json({
+            error: "vendorId is required"
+          }, {
+            status: 400
+          });
+        }
+        const comboSlugErr = await normalizeComboNameAndSlug(repo, persistBody, vendorIdForSlug);
+        if (comboSlugErr) return json({
+          error: comboSlugErr
+        }, {
+          status: 400
+        });
+      }
       sanitizeBodyForEntity(repo, persistBody);
       let created;
       try {
@@ -4991,6 +5068,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           const nameRaw = String(body["contact.name"] ?? contact.name ?? "").trim();
           const phoneRaw = body["contact.phone"] ?? contact.phone;
+          const emailForVc = (emailRaw || String(contact.email ?? "")).trim().toLowerCase();
           const phoneToSave = phoneRaw == null || phoneRaw === "" ? null : String(phoneRaw).trim();
           if (phoneToSave && contact.phone !== phoneToSave) {
             await contactRepo.update(contact.id, {
@@ -4999,21 +5077,45 @@ function createCrudHandler(dataSource, entityMap, options) {
             contact.phone = phoneToSave;
           }
           const vendorIdForCustomer = resolveVendorIdForContactCheck(scopeCreate, persistBody);
-          const selectedExistingCustomer = Number(body.customerId);
-          if (vendorIdForCustomer != null && (!Number.isFinite(selectedExistingCustomer) || selectedExistingCustomer <= 0)) {
-            await ensureVendorCustomerForOrderContact(dataSource, entityMap, vendorIdForCustomer, contact.id, {
-              name: nameRaw || emailRaw.split("@")[0] || "Customer",
-              email: emailRaw,
+          const orderLinesForVendors = normalizeOrderLinesInput(body.orderLines);
+          const vendorIdsForVc = [];
+          if (vendorIdForCustomer != null) vendorIdsForVc.push(vendorIdForCustomer);
+          if (orderLinesForVendors?.length && entityMap.products) {
+            const productRepoForVc = dataSource.getRepository(entityMap.products);
+            for (const line of orderLinesForVendors) {
+              const pid = Number(line.productId);
+              if (!Number.isFinite(pid)) continue;
+              const product = await productRepoForVc.findOne({
+                where: {
+                  id: pid
+                }
+              });
+              const pVid = Number(product?.vendorId);
+              if (Number.isFinite(pVid) && pVid > 0) vendorIdsForVc.push(pVid);
+            }
+          }
+          if (vendorIdsForVc.length > 0 && emailForVc) {
+            await ensureVendorCustomersForOrder(dataSource, entityMap, vendorIdsForVc, contact.id, {
+              name: nameRaw || emailForVc.split("@")[0] || "Customer",
+              email: emailForVc,
               phone: phoneRaw == null || phoneRaw === "" ? null : String(phoneRaw)
             });
-          } else if (vendorIdForCustomer != null) {
-            const contactErr = await assertContactAllowedForVendorOrder(dataSource, entityMap, vendorIdForCustomer, contact.id);
-            if (contactErr) {
-              return json({
-                error: contactErr
-              }, {
-                status: 400
-              });
+          }
+          const accountCustomerId = Number(body.accountCustomerId);
+          if (entityMap.customer_contacts && Number.isFinite(accountCustomerId) && accountCustomerId > 0) {
+            const ccRepo = dataSource.getRepository(entityMap.customer_contacts);
+            const orderContactId = contact.id;
+            const existingLink = await ccRepo.findOne({
+              where: {
+                customerId: accountCustomerId,
+                contactId: orderContactId
+              }
+            });
+            if (!existingLink) {
+              await ccRepo.save(ccRepo.create({
+                customerId: accountCustomerId,
+                contactId: orderContactId
+              }));
             }
           }
           const randomPart = Math.floor(1e4 + Math.random() * 9e4);
@@ -5021,6 +5123,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           persistBody.orderNumber = `ORD00${randomPart}`;
           persistBody.qrToken = crypto2__default.default.randomBytes(16).toString("hex");
         }
+        await retireSoftDeletedUniquesFromBody(repo, persistBody);
         created = await repo.save(repo.create(persistBody));
         if (resource === "orders") {
           const orderItemRepo = dataSource.getRepository(entityMap.order_items);
@@ -5062,8 +5165,8 @@ function createCrudHandler(dataSource, entityMap, options) {
             }
           }
           const createdStatus = String(persistBody.status ?? "pending");
-          if (createdStatus === ORDER_STATUS_CONFIRMED) {
-            const stockErr = await validateInventoryForConfirmedOrderLines(dataSource, entityMap, lines);
+          if (chunkHY3AXLOI_cjs.orderStatusHoldsStock(createdStatus)) {
+            const stockErr = await validateInventoryForConfirmedOrderLines2(dataSource, entityMap, lines);
             if (stockErr) {
               await repo.delete(created.id);
               return json({
@@ -5085,6 +5188,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             await orderItemRepo.save(orderItemRepo.create({
               orderId: created.id,
               productId: line.productId,
+              variantId: null,
               quantity: line.quantity,
               unitPrice: line.unitPrice,
               subTotal: line.subtotal,
@@ -5160,10 +5264,10 @@ function createCrudHandler(dataSource, entityMap, options) {
             ]
           });
           if (reloadedOrder) {
-            const invErr = await reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, {
+            const invErr = await chunkHY3AXLOI_cjs.reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, {
               status: "pending",
               lines: []
-            }, orderInventorySnapshotFromRow(reloadedOrder));
+            }, chunkHY3AXLOI_cjs.orderInventorySnapshotFromRow(reloadedOrder));
             if (invErr) {
               logCrudServerError("POST order inventory reconcile failed", {
                 message: invErr,
@@ -5178,7 +5282,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           if (orderDiscountId) {
             if (createdStatus === ORDER_STATUS_CONFIRMED) {
-              const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, orderDiscountId, persistBody.contactId);
+              const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, orderDiscountId, persistBody.contactId);
               if (usageErr) {
                 await repo.delete(created.id);
                 return json({
@@ -5188,7 +5292,7 @@ function createCrudHandler(dataSource, entityMap, options) {
                 });
               }
             }
-            await recordDiscountUsage(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
+            await recordDiscountUsage2(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
           }
           const orderIdForNotify = created.id;
           void import('./emit-order-notification-trigger-D2N3KFHL.cjs').then(({ fireOrderNotificationTrigger }) => {
@@ -5197,6 +5301,16 @@ function createCrudHandler(dataSource, entityMap, options) {
               entityMap
             });
           });
+          if (getCms) {
+            void import('./send-order-placed-emails-B5ZVJT7T.cjs').then(({ sendOrderPlacedEmailsAfterConfirmation }) => {
+              return sendOrderPlacedEmailsAfterConfirmation(orderIdForNotify, {
+                getDataSource: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => dataSource, "getDataSource"),
+                entityMap,
+                getCms: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => await getCms(), "getCms")
+              });
+            }).catch(() => {
+            });
+          }
         }
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -5842,6 +5956,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         sanitizeBodyForEntity(repo, updatePayload2);
+        await retireSoftDeletedUniquesFromBody(repo, updatePayload2);
         await repo.update(numericId, updatePayload2);
         if (Array.isArray(rawBody.tags)) {
           const tagNames = rawBody.tags.map((t) => String(t).trim()).filter(Boolean);
@@ -5903,7 +6018,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           status: 404
         });
         if (resource === "orders") {
-          orderInvPrev = orderInventorySnapshotFromRow(cur);
+          orderInvPrev = chunkHY3AXLOI_cjs.orderInventorySnapshotFromRow(cur);
         }
       }
       if (resource === "orders" && rawBody && typeof rawBody === "object" && Array.isArray(rawBody.orderLines)) {
@@ -5930,8 +6045,8 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           } : await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, effectiveCurrency, putDiscountId, Number.isFinite(putOrderVendorId) ? putOrderVendorId : null);
           const scalarUpdate = pickColumnUpdates(repo, rawBody);
           const nextStatus = typeof scalarUpdate.status === "string" && scalarUpdate.status ? String(scalarUpdate.status) : orderInvPrev?.status ?? "pending";
-          if (nextStatus === ORDER_STATUS_CONFIRMED && lines.length > 0) {
-            const verr = await validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, lines.filter((l) => l.found && l.productId != null).map((l) => ({
+          if (chunkHY3AXLOI_cjs.orderStatusHoldsStock(nextStatus) && lines.length > 0) {
+            const verr = await chunkHY3AXLOI_cjs.validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, lines.filter((l) => l.found && l.productId != null).map((l) => ({
               productId: l.productId,
               quantity: l.quantity
             })));
@@ -6035,7 +6150,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             status: 404
           });
           if (orderInvPrev) {
-            const invErr = await reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, orderInvPrev, orderInventorySnapshotFromRow(updatedOrder));
+            const invErr = await chunkHY3AXLOI_cjs.reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, orderInvPrev, chunkHY3AXLOI_cjs.orderInventorySnapshotFromRow(updatedOrder));
             if (invErr) return json({
               error: invErr
             }, {
@@ -6059,17 +6174,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
               }) : null;
               const existingDiscountId = existingOd ? existingOd.discountId : null;
               if (!putDiscountId && existingDiscountId && wasConfirmed) {
-                await decrementDiscountUsage(dataSource, entityMap, existingDiscountId, numericId);
+                await decrementDiscountUsage2(dataSource, entityMap, existingDiscountId, numericId);
                 if (entityMap["order_discounts"] && existingOd) {
                   await dataSource.getRepository(entityMap["order_discounts"]).delete(existingOd.id);
                 }
               }
               if (putDiscountId && existingDiscountId && putDiscountId !== existingDiscountId) {
                 if (wasConfirmed) {
-                  await decrementDiscountUsage(dataSource, entityMap, existingDiscountId, numericId);
+                  await decrementDiscountUsage2(dataSource, entityMap, existingDiscountId, numericId);
                 }
                 if (isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
@@ -6082,12 +6197,12 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                     discountAmount: discount
                   });
                 } else {
-                  await recordDiscountUsage(dataSource, entityMap, numericId, putDiscountId, cid, discount);
+                  await recordDiscountUsage2(dataSource, entityMap, numericId, putDiscountId, cid, discount);
                 }
               }
               if (putDiscountId && existingDiscountId && putDiscountId === existingDiscountId) {
                 if (!wasConfirmed && isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
@@ -6095,7 +6210,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                   });
                 }
                 if (wasConfirmed && !isNowConfirmed) {
-                  await decrementDiscountUsage(dataSource, entityMap, putDiscountId, numericId);
+                  await decrementDiscountUsage2(dataSource, entityMap, putDiscountId, numericId);
                 }
                 if (existingOd && entityMap["order_discounts"]) {
                   await dataSource.getRepository(entityMap["order_discounts"]).update(existingOd.id, {
@@ -6105,14 +6220,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
               }
               if (putDiscountId && !existingDiscountId) {
                 if (isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
                     status: 400
                   });
                 }
-                await recordDiscountUsage(dataSource, entityMap, numericId, putDiscountId, cid, discount);
+                await recordDiscountUsage2(dataSource, entityMap, numericId, putDiscountId, cid, discount);
               }
             }
           }
@@ -6583,8 +6698,8 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       if (resource === "orders" && orderInvPrev) {
         const nextSt = typeof updatePayload.status === "string" && updatePayload.status ? String(updatePayload.status) : orderInvPrev.status;
-        if (nextSt === ORDER_STATUS_CONFIRMED && orderInvPrev.lines.length > 0) {
-          const verr = await validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, orderInvPrev.lines);
+        if (chunkHY3AXLOI_cjs.orderStatusHoldsStock(nextSt) && orderInvPrev.lines.length > 0) {
+          const verr = await chunkHY3AXLOI_cjs.validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, orderInvPrev.lines);
           if (verr) return json({
             error: verr
           }, {
@@ -6592,6 +6707,33 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           });
         }
       }
+      if (resource === "combos") {
+        const currentCombo = await repo.findOne({
+          where: {
+            id: numericId,
+            deleted: false
+          }
+        });
+        if (!currentCombo) return json({
+          message: "Not found"
+        }, {
+          status: 404
+        });
+        const vendorIdForSlug = scopePut.type === "vendor" ? scopePut.vendorId : Number(currentCombo.vendorId);
+        if (!Number.isFinite(vendorIdForSlug) || vendorIdForSlug <= 0) {
+          return json({
+            error: "vendorId is required"
+          }, {
+            status: 400
+          });
+        }
+        const comboSlugErr = await normalizeComboNameAndSlug(repo, updatePayload, vendorIdForSlug, currentCombo, numericId);
+        if (comboSlugErr) return json({
+          error: comboSlugErr
+        }, {
+          status: 400
+        });
+      }
       if (Object.keys(updatePayload).length > 0) {
         if (resource === "payments" && updatePayload.status === "paid" && updatePayload.paidAt == null) {
           const existingPayment = await repo.findOne({
@@ -6605,6 +6747,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         sanitizeBodyForEntity(repo, updatePayload);
+        await retireSoftDeletedUniquesFromBody(repo, updatePayload);
         await repo.update(numericId, updatePayload);
       }
       if (resource === "orders" && rawBody && entityMap["order_addresses"]) {
@@ -6657,7 +6800,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         }
       });
       if (resource === "orders" && orderInvPrev && updated) {
-        const invErr = await reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, orderInvPrev, orderInventorySnapshotFromRow(updated));
+        const invErr = await chunkHY3AXLOI_cjs.reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, orderInvPrev, chunkHY3AXLOI_cjs.orderInventorySnapshotFromRow(updated));
         if (invErr) return json({
           error: invErr
         }, {
@@ -6780,7 +6923,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             });
             if (od) {
               const odRow = od;
-              await decrementDiscountUsage(dataSource, entityMap, odRow.discountId, numericId);
+              await decrementDiscountUsage2(dataSource, entityMap, odRow.discountId, numericId);
             }
           }
         }
@@ -6793,6 +6936,22 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         await repo.update(numericId, buildSoftDeletePayload(repo.metadata, deletedBy));
+        const softDeletedCols = repo.metadata.columns.map((c) => c.propertyName);
+        const uniqueColsToRetire = [
+          "slug",
+          "email"
+        ].filter((col) => softDeletedCols.includes(col));
+        if (existing && uniqueColsToRetire.length > 0) {
+          for (const col of uniqueColsToRetire) {
+            const raw = existing[col];
+            if (typeof raw !== "string") continue;
+            const value = raw.trim();
+            if (!value || value.includes("__deleted_")) continue;
+            await repo.update(numericId, {
+              [col]: `${value}__deleted_${numericId}`
+            });
+          }
+        }
         return json({
           message: "Deleted successfully"
         }, {
@@ -6823,6 +6982,63 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
   };
 }
 chunkUSNT2KNT_cjs.__name(createCrudByIdHandler, "createCrudByIdHandler");
+async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
+  const repo = dataSource.getRepository(contactsEntity);
+  const found = await repo.findOne({
+    where: {
+      email,
+      userId: typeorm.IsNull(),
+      deleted: false
+    }
+  });
+  if (found) await repo.update(found.id, {
+    userId
+  });
+}
+chunkUSNT2KNT_cjs.__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
+function buildUserInviteLink(baseUrl, token) {
+  const base = baseUrl.replace(/\/+$/, "");
+  return `${base}/admin/invite?token=${encodeURIComponent(token)}`;
+}
+chunkUSNT2KNT_cjs.__name(buildUserInviteLink, "buildUserInviteLink");
+function newUserInviteToken() {
+  return crypto2.randomBytes(32).toString("hex");
+}
+chunkUSNT2KNT_cjs.__name(newUserInviteToken, "newUserInviteToken");
+async function findUserByInviteToken(dataSource, userEntity, token) {
+  const trimmed = token.trim();
+  if (!trimmed) return null;
+  const repo = dataSource.getRepository(userEntity);
+  const row = await repo.findOne({
+    where: {
+      inviteToken: trimmed,
+      deleted: false
+    },
+    select: [
+      "id",
+      "email",
+      "blocked",
+      "password",
+      "inviteStatus",
+      "inviteToken"
+    ]
+  });
+  if (!row) return null;
+  const u = row;
+  return u;
+}
+chunkUSNT2KNT_cjs.__name(findUserByInviteToken, "findUserByInviteToken");
+async function completeUserInviteAccept(dataSource, userEntity, userId, passwordHash) {
+  await dataSource.getRepository(userEntity).update(userId, {
+    password: passwordHash,
+    blocked: false,
+    inviteStatus: "active",
+    inviteToken: null
+  });
+}
+chunkUSNT2KNT_cjs.__name(completeUserInviteAccept, "completeUserInviteAccept");
+
+// src/lib/vendor-invite-token.ts
 var VENDOR_INVITE_METADATA_TOKEN = "inviteToken";
 var VENDOR_INVITE_METADATA_EXPIRES = "inviteExpiresAt";
 var VENDOR_INVITE_METADATA_SENT = "inviteSentAt";
@@ -6847,6 +7063,13 @@ function invalidatedInviteMessage() {
   return "This invitation is no longer valid. Ask an admin to resend the invite.";
 }
 chunkUSNT2KNT_cjs.__name(invalidatedInviteMessage, "invalidatedInviteMessage");
+function userAlreadyActive(user) {
+  const hasPassword = !!(user.password && String(user.password).trim());
+  if (user.inviteStatus === "active" && hasPassword) return true;
+  if (user.inviteStatus === "pending") return false;
+  return !user.blocked && hasPassword;
+}
+chunkUSNT2KNT_cjs.__name(userAlreadyActive, "userAlreadyActive");
 async function validateInviteTokenForActivation(dataSource, entityMap, token) {
   const trimmedToken = String(token ?? "").trim();
   if (!trimmedToken) {
@@ -6893,15 +7116,15 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
           "id",
           "email",
           "blocked",
-          "password"
+          "password",
+          "inviteStatus"
         ]
       });
       if (!user2) return {
         ok: false,
         error: "User not found"
       };
-      const hasPassword2 = !!user2.password;
-      if (!user2.blocked && hasPassword2) {
+      if (userAlreadyActive(user2)) {
         return {
           ok: false,
           error: "User is already active"
@@ -6917,6 +7140,24 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
       };
     }
   }
+  if (userRepo && entityMap.users) {
+    const userMatch = await findUserByInviteToken(dataSource, entityMap.users, trimmedToken);
+    if (userMatch) {
+      if (userMatch.inviteStatus === "active" || userAlreadyActive(userMatch)) {
+        return {
+          ok: false,
+          error: "This invitation has already been accepted"
+        };
+      }
+      return {
+        ok: true,
+        target: {
+          userId: userMatch.id,
+          email: userMatch.email
+        }
+      };
+    }
+  }
   let email;
   try {
     email = Buffer.from(trimmedToken, "base64").toString("utf8").trim();
@@ -6946,22 +7187,30 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
       "id",
       "email",
       "blocked",
-      "password"
+      "password",
+      "inviteStatus",
+      "inviteToken"
     ]
   });
   if (!user) return {
     ok: false,
     error: "User not found"
   };
-  const hasPassword = !!user.password;
-  if (!user.blocked && hasPassword) {
+  const u = user;
+  if (userAlreadyActive(u)) {
     return {
       ok: false,
       error: "User is already active"
     };
   }
+  if (u.inviteToken && String(u.inviteToken).trim()) {
+    return {
+      ok: false,
+      error: invalidatedInviteMessage()
+    };
+  }
   if (entityMap.vendors) {
-    const ownerVendor = await loadOwnerVendorForUser(dataSource, entityMap.vendors, user.id);
+    const ownerVendor = await loadOwnerVendorForUser(dataSource, entityMap.vendors, u.id);
     if (ownerVendor && readVendorInviteToken(ownerVendor.metadata)) {
       return {
         ok: false,
@@ -6972,8 +7221,8 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
   return {
     ok: true,
     target: {
-      userId: user.id,
-      email: String(user.email)
+      userId: u.id,
+      email: String(u.email)
     }
   };
 }
@@ -7191,10 +7440,7 @@ function createInviteAcceptHandler(config) {
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
-      await dataSource.getRepository(entityMap.users).update(userId, {
-        password: hashedPassword,
-        blocked: false
-      });
+      await completeUserInviteAccept(dataSource, entityMap.users, userId, hashedPassword);
       if (vendorId != null && entityMap.vendors) {
         await completeVendorInviteAccept(dataSource, entityMap.vendors, vendorId);
       }
@@ -8621,6 +8867,9 @@ function createUploadHandler(config) {
     "image/png",
     "image/gif",
     "image/webp",
+    "video/mp4",
+    "video/webm",
+    "video/quicktime",
     "application/pdf",
     "text/plain",
     "application/zip",
@@ -8648,8 +8897,11 @@ function createUploadHandler(config) {
       });
       const defaultMax = 10 * 1024 * 1024;
       const maxZipBytes = 80 * 1024 * 1024;
+      const maxVideoBytes = 100 * 1024 * 1024;
       const baseMax = maxSizeBytes ?? defaultMax;
-      const effectiveMax = file.type === "application/zip" || file.type === "application/x-zip-compressed" ? Math.max(baseMax, maxZipBytes) : baseMax;
+      const isZip = file.type === "application/zip" || file.type === "application/x-zip-compressed";
+      const isVideo = file.type === "video/mp4" || file.type === "video/webm" || file.type === "video/quicktime";
+      const effectiveMax = isZip ? Math.max(baseMax, maxZipBytes) : isVideo ? Math.max(baseMax, maxVideoBytes) : baseMax;
       if (file.size > effectiveMax) return json({
         error: "File size exceeds limit"
       }, {
@@ -8722,12 +8974,20 @@ function createUploadHandler(config) {
         parentId
       });
     } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
       console.error("[upload] File upload failed", {
-        error: err instanceof Error ? err.message : String(err),
+        error: message,
         stack: err instanceof Error ? err.stack : void 0,
         name: err instanceof Error ? err.name : void 0,
         metadata: err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0
       });
+      if (/Failed to parse body as FormData/i.test(message)) {
+        return json({
+          error: "File upload failed: request body could not be read as FormData. Exclude /api/upload from middleware matcher and raise proxyClientMaxBodySize."
+        }, {
+          status: 500
+        });
+      }
       return json({
         error: "File upload failed"
       }, {
@@ -8948,6 +9208,17 @@ function createFormSaveHandlers(config) {
         });
         const fields = Array.isArray(body.fields) ? body.fields : [];
         const { fields: _f, ...formRow } = body;
+        const slug = typeof formRow.slug === "string" ? formRow.slug.trim() : "";
+        if (slug) {
+          if (await chunkOY2YTBMP_cjs.activeUniqueValueExists(formRepo(), "slug", slug)) {
+            return json({
+              error: "A form with this slug already exists"
+            }, {
+              status: 400
+            });
+          }
+          await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(formRepo(), "slug", slug);
+        }
         const form = await formRepo().save(formRepo().create(formRow));
         for (let i = 0; i < fields.length; i++) {
           const row = normalizeFieldRow(fields[i], form.id);
@@ -8971,6 +9242,14 @@ function createFormSaveHandlers(config) {
           status: 201
         });
       } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg)) {
+          return json({
+            error: "A form with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         return json({
           error: "Server Error"
         }, {
@@ -9019,6 +9298,20 @@ function createFormSaveHandlers(config) {
         ]) {
           if (body[key] !== void 0) formRow[key] = body[key];
         }
+        if (typeof formRow.slug === "string") {
+          const slug = formRow.slug.trim();
+          formRow.slug = slug;
+          if (slug) {
+            if (await chunkOY2YTBMP_cjs.activeUniqueValueExists(formRepo(), "slug", slug, formId)) {
+              return json({
+                error: "A form with this slug already exists"
+              }, {
+                status: 400
+              });
+            }
+            await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(formRepo(), "slug", slug);
+          }
+        }
         if (Object.keys(formRow).length > 0) await formRepo().update(formId, formRow);
         await fieldRepo().delete({
           formId
@@ -9047,6 +9340,14 @@ function createFormSaveHandlers(config) {
           status: 404
         });
       } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg)) {
+          return json({
+            error: "A form with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         return json({
           error: "Server Error"
         }, {
@@ -9351,7 +9652,7 @@ function createFormSubmissionHandler(config) {
                 label: f.label && String(f.label).trim() || `Field ${f.id}`,
                 value: formatSubmissionFieldValue(data[String(f.id)])
               }));
-              await chunkXW5ATPRW_cjs.queueEmail(cms, {
+              await chunkV25RDUOU_cjs.queueEmail(cms, {
                 to,
                 templateName: "formSubmission",
                 ctx: {
@@ -9405,7 +9706,7 @@ function createUsersApiHandlers(config) {
     try {
       const cms = await getCms();
       const companyDetails = getCompanyDetails ? await getCompanyDetails() : {};
-      await chunkXW5ATPRW_cjs.queueEmail(cms, {
+      await chunkV25RDUOU_cjs.queueEmail(cms, {
         to: toEmail,
         templateName: "invite",
         ctx: {
@@ -9440,7 +9741,8 @@ function createUsersApiHandlers(config) {
           "name",
           "email",
           "id",
-          "blocked"
+          "blocked",
+          "inviteStatus"
         ]);
         const sortField = allowedSort.has(sortFieldRaw) ? sortFieldRaw : "createdAt";
         const sortOrder = url.searchParams.get("sortOrder") === "desc" ? "DESC" : "ASC";
@@ -9453,6 +9755,7 @@ function createUsersApiHandlers(config) {
           "u.name",
           "u.email",
           "u.blocked",
+          "u.inviteStatus",
           "u.createdAt",
           "u.updatedAt",
           "u.groupId",
@@ -9548,6 +9851,7 @@ function createUsersApiHandlers(config) {
         const isCustomer = !!(customerG && gid === customerG.id);
         const adminAccess = isCustomer ? false : body.adminAccess === false ? false : true;
         const blocked = body.blocked === true || body.blocked === "true" || body.blocked === 1 || body.blocked === "1";
+        const inviteToken = newUserInviteToken();
         const newUser = existing?.deleted ? await (async () => {
           await userRepo().update(existing.id, {
             deleted: false,
@@ -9557,6 +9861,8 @@ function createUsersApiHandlers(config) {
             email,
             password: null,
             blocked,
+            inviteStatus: "pending",
+            inviteToken,
             groupId: gid,
             adminAccess,
             updatedAt: /* @__PURE__ */ new Date()
@@ -9573,6 +9879,8 @@ function createUsersApiHandlers(config) {
           email,
           password: null,
           blocked,
+          inviteStatus: "pending",
+          inviteToken,
           groupId: gid,
           adminAccess
         }));
@@ -9590,13 +9898,12 @@ function createUsersApiHandlers(config) {
             phone
           });
         }
-        const emailToken = Buffer.from(newUser.email).toString("base64");
-        const inviteLink = `${baseUrl}/admin/invite?token=${emailToken}`;
-        await trySendInviteEmail(newUser.email, inviteLink, newUser.name ?? "");
+        const inviteLink = buildUserInviteLink(baseUrl, inviteToken);
         return json({
-          message: blocked ? "User created successfully (blocked until password is set)" : "User created successfully",
+          message: "User created successfully. Invite is pending until they set a password.",
           user: newUser,
-          inviteLink
+          inviteLink,
+          emailSent: false
         }, {
           status: 201
         });
@@ -9628,7 +9935,9 @@ function createUsersApiHandlers(config) {
             "id",
             "name",
             "email",
+            "phone",
             "blocked",
+            "inviteStatus",
             "createdAt",
             "updatedAt",
             "groupId"
@@ -9657,6 +9966,11 @@ function createUsersApiHandlers(config) {
       }
       try {
         const uid = parseInt(id, 10);
+        if (!Number.isFinite(uid)) return json({
+          error: "Invalid id"
+        }, {
+          status: 400
+        });
         const existing = await userRepo().findOne({
           where: {
             id: uid,
@@ -9669,8 +9983,59 @@ function createUsersApiHandlers(config) {
           status: 404
         });
         const body = await req.json();
-        const { password: _p, ...safe } = body;
-        await userRepo().update(uid, safe);
+        const patch = {
+          updatedAt: /* @__PURE__ */ new Date()
+        };
+        if (typeof body.name === "string") patch.name = body.name.trim();
+        if (typeof body.email === "string") patch.email = body.email.trim().toLowerCase();
+        if (body.blocked !== void 0) {
+          patch.blocked = body.blocked === true || body.blocked === "true" || body.blocked === 1 || body.blocked === "1";
+        }
+        if (body.adminAccess !== void 0) {
+          patch.adminAccess = body.adminAccess === true || body.adminAccess === "true" || body.adminAccess === 1 || body.adminAccess === "1";
+        }
+        if (body.groupId !== void 0) {
+          if (body.groupId === null || body.groupId === "") {
+            patch.groupId = null;
+          } else {
+            const gid = Number(body.groupId);
+            if (!Number.isFinite(gid)) {
+              return json({
+                error: "Invalid groupId"
+              }, {
+                status: 400
+              });
+            }
+            patch.groupId = gid;
+          }
+        }
+        if (body.phone !== void 0) {
+          const phone = body.phone == null ? null : String(body.phone).trim();
+          patch.phone = phone || null;
+        }
+        if (Object.keys(patch).length <= 1) {
+          return json({
+            error: "No valid fields to update"
+          }, {
+            status: 400
+          });
+        }
+        if (typeof patch.email === "string" && patch.email !== existing.email) {
+          const emailTaken = await userRepo().findOne({
+            where: {
+              email: patch.email,
+              deleted: false
+            }
+          });
+          if (emailTaken && Number(emailTaken.id) !== uid) {
+            return json({
+              error: "Email already in use"
+            }, {
+              status: 400
+            });
+          }
+        }
+        await userRepo().update(uid, patch);
         const updated = await userRepo().findOne({
           where: {
             id: uid,
@@ -9683,7 +10048,9 @@ function createUsersApiHandlers(config) {
             "id",
             "name",
             "email",
+            "phone",
             "blocked",
+            "inviteStatus",
             "createdAt",
             "updatedAt",
             "groupId"
@@ -9694,7 +10061,8 @@ function createUsersApiHandlers(config) {
         }, {
           status: 404
         });
-      } catch {
+      } catch (err) {
+        console.error("[users.update]", err);
         return json({
           error: "Server Error"
         }, {
@@ -9750,13 +10118,21 @@ function createUsersApiHandlers(config) {
         });
       }
     },
-    async regenerateInvite(_req, id) {
-      const authErr = await requireAuth(new Request(_req.url));
+    async regenerateInvite(req, id) {
+      const authErr = await requireAuth(new Request(req.url));
       if (authErr) return authErr;
       if (requireEntityPermission) {
-        const pe = await requireEntityPermission(_req, "users", "update");
+        const pe = await requireEntityPermission(req, "users", "update");
         if (pe) return pe;
       }
+      let sendEmail = true;
+      let rotate = true;
+      try {
+        const body = await req.json().catch(() => ({}));
+        if (body.sendEmail === false) sendEmail = false;
+        if (body.rotate === false) rotate = false;
+      } catch {
+      }
       try {
         const user = await userRepo().findOne({
           where: {
@@ -9766,7 +10142,11 @@ function createUsersApiHandlers(config) {
           select: [
             "id",
             "email",
-            "name"
+            "name",
+            "password",
+            "inviteStatus",
+            "inviteToken",
+            "blocked"
           ]
         });
         if (!user) return json({
@@ -9774,34 +10154,75 @@ function createUsersApiHandlers(config) {
         }, {
           status: 404
         });
-        let inviteLink = `${baseUrl}/admin/invite?token=${Buffer.from(user.email).toString("base64")}`;
+        const u = user;
+        const hasPassword = !!(u.password && String(u.password).trim());
+        if (u.inviteStatus === "active" && hasPassword) {
+          return json({
+            error: "User has already accepted the invite"
+          }, {
+            status: 400
+          });
+        }
+        let inviteLink = "";
         if (entityMap.vendors) {
           const vendorRepo = dataSource.getRepository(entityMap.vendors);
           const vendor = await vendorRepo.findOne({
             where: {
-              userId: user.id,
+              userId: u.id,
               deleted: false
             }
           });
           const v = vendor;
           if (v && (v.inviteStatus === "pending" || v.inviteStatus === "expired")) {
-            const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
-            await vendorRepo.update(v.id, {
-              metadata: rotatedMetadata,
-              inviteStatus: "pending"
-            });
-            const token = readVendorInviteToken(rotatedMetadata);
+            const nextMetadata = rotate ? applyRotatingVendorInvite(v.metadata) : {
+              ...v.metadata ?? {}
+            };
+            if (rotate || v.inviteStatus !== "pending") {
+              await vendorRepo.update(v.id, {
+                metadata: nextMetadata,
+                inviteStatus: "pending"
+              });
+            }
+            const token = readVendorInviteToken(nextMetadata);
             if (token) {
               inviteLink = buildVendorInviteLink(baseUrl, token);
             }
+            const { markVendorInvitePendingForUser } = await import('./vendor-invite-status-77O7ZQ3U.cjs');
+            await markVendorInvitePendingForUser(dataSource, entityMap.vendors, u.id);
+          }
+        }
+        if (!inviteLink) {
+          let token = u.inviteToken?.trim() || "";
+          if (rotate || !token) {
+            token = newUserInviteToken();
+            await userRepo().update(u.id, {
+              inviteToken: token,
+              inviteStatus: "pending",
+              password: null
+            });
+          } else if (u.inviteStatus !== "pending") {
+            await userRepo().update(u.id, {
+              inviteStatus: "pending"
+            });
           }
-          const { markVendorInvitePendingForUser } = await import('./vendor-invite-status-77O7ZQ3U.cjs');
-          await markVendorInvitePendingForUser(dataSource, entityMap.vendors, user.id);
+          inviteLink = buildUserInviteLink(baseUrl, token);
+        } else if (rotate) {
+          await userRepo().update(u.id, {
+            inviteStatus: "pending",
+            password: null
+          });
         }
-        await trySendInviteEmail(user.email, inviteLink, user.name ?? "");
+        let emailSent = false;
+        if (sendEmail && inviteLink) {
+          await trySendInviteEmail(u.email, inviteLink, u.name ?? "");
+          emailSent = true;
+        }
+        const rotatedNote = rotate ? " Previous invite link is no longer valid." : "";
         return json({
-          message: "New invite link generated successfully",
-          inviteLink
+          message: emailSent ? `Invite email sent.${rotatedNote}` : sendEmail ? `Invite link ready (email may not have been sent \u2014 check email plugin).${rotatedNote}` : rotate ? "New invite link created. Previous invite link is no longer valid." : "Invite link ready.",
+          emailSent,
+          inviteLink,
+          inviteStatus: "pending"
         });
       } catch {
         return json({
@@ -10558,7 +10979,7 @@ function createChatHandlers(config) {
         const notifyEmailAgent = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT, {
           enabledOnly: false
         });
-        const emailTool = chunk22FFHLTO_cjs.resolveChatEmailToolSettings(llmSettings, {
+        const emailTool = chunkTCSGFAWB_cjs.resolveChatEmailToolSettings(llmSettings, {
           chatbotValidationRules: agentRow?.validationRules ?? null,
           notifyAgent: notifyEmailAgent ? {
             systemInstruction: notifyEmailAgent.systemInstruction,
@@ -10568,7 +10989,7 @@ function createChatHandlers(config) {
         const emailPlugin2 = cms.getPlugin("email");
         const convLeadSent = conv.leadEmailSentAt;
         const chatAgentFn = llm.chatAgent?.bind(llm);
-        console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline check", {
+        console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline check", {
           conversationId,
           enabled: emailTool.enabled,
           intentCount: emailTool.intents.length,
@@ -10582,27 +11003,27 @@ function createChatHandlers(config) {
           mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
         });
         if (!emailTool.enabled) {
-          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_tool_disabled"
           });
         } else if (emailTool.intents.length === 0) {
-          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "no_intents_configured"
           });
         } else if (!emailPlugin2) {
-          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_plugin_missing"
           });
         } else if (!chatAgentFn) {
-          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "llm_chat_agent_unavailable"
           });
         } else if (convLeadSent) {
-          console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "lead_email_already_sent",
             leadEmailSentAt: convLeadSent
@@ -10615,7 +11036,7 @@ function createChatHandlers(config) {
             }
           });
           if (!contactRow) {
-            console.warn(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+            console.warn(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
               conversationId,
               reason: "contact_not_found",
               contactId
@@ -10623,7 +11044,7 @@ function createChatHandlers(config) {
           } else {
             const c = contactRow;
             try {
-              const intent = await chunk22FFHLTO_cjs.detectChatLeadIntent({
+              const intent = await chunkTCSGFAWB_cjs.detectChatLeadIntent({
                 chatAgent: chatAgentFn
               }, {
                 settings: emailTool,
@@ -10637,15 +11058,15 @@ function createChatHandlers(config) {
                 model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
               });
               if (!intent.intent || !intent.emailTo) {
-                console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "no email sent", {
+                console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "no email sent", {
                   conversationId,
                   reason: intent.intent ? "missing_email_to" : "no_intent_match",
                   intentLabel: intent.intentLabel,
                   classifierReason: intent.reason
                 });
               } else {
-                const intentRecipients = chunk22FFHLTO_cjs.parseIntentRecipientEmails(intent.emailTo);
-                console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                const intentRecipients = chunkTCSGFAWB_cjs.parseIntentRecipientEmails(intent.emailTo);
+                console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
                   conversationId,
                   intent: intent.intent,
                   emailTo: intent.emailTo,
@@ -10654,8 +11075,8 @@ function createChatHandlers(config) {
                 });
                 const emailSettings = await loadSettingsGroupMap(dataSource, entityMap, "email");
                 const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
-                const companyDetails = chunk22FFHLTO_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
-                const leadResult = await chunk22FFHLTO_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                const companyDetails = chunkBXYZDMTZ_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
+                const leadResult = await chunkTCSGFAWB_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
                   contactName: String(c.name ?? "").trim() || "Visitor",
                   contactEmail: String(c.email ?? "").trim(),
                   contactPhone: c.phone ?? null,
@@ -10663,7 +11084,7 @@ function createChatHandlers(config) {
                   latestMessage: message,
                   intentCode: intent.intent,
                   intentReason: intent.intentLabel || intent.reason,
-                  transcript: chunk22FFHLTO_cjs.buildTranscriptForLeadEmail(history, message),
+                  transcript: chunkTCSGFAWB_cjs.buildTranscriptForLeadEmail(history, message),
                   companyDetails,
                   recipients: intentRecipients.length > 0 ? intentRecipients : void 0
                 });
@@ -10671,13 +11092,13 @@ function createChatHandlers(config) {
                   await convRepo().update(conversationId, {
                     leadEmailSentAt: /* @__PURE__ */ new Date()
                   });
-                  console.info(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
+                  console.info(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
                     conversationId,
                     sent: true,
                     recipients: leadResult.recipients
                   });
                 } else {
-                  console.warn(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
+                  console.warn(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
                     conversationId,
                     sent: false,
                     error: leadResult.error ?? "unknown",
@@ -10686,7 +11107,7 @@ function createChatHandlers(config) {
                 }
               }
             } catch (intentErr) {
-              console.warn(chunk22FFHLTO_cjs.CHAT_EMAIL_LOG, "pipeline error", {
+              console.warn(chunkTCSGFAWB_cjs.CHAT_EMAIL_LOG, "pipeline error", {
                 conversationId,
                 error: intentErr instanceof Error ? intentErr.message : String(intentErr)
               });
@@ -10703,7 +11124,7 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = chunk22FFHLTO_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
+          const systemPrompt = chunkTCSGFAWB_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
           const res = await llm.chatAgent({
             ...fromAgent,
             systemPrompt: systemPrompt || void 0,
@@ -10724,7 +11145,7 @@ ${contextParts.join("\n\n")}` : "";
               agentRow.systemInstruction?.trim(),
               ragSystem
             ].filter(Boolean).join("\n\n");
-            systemContent = chunk22FFHLTO_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
+            systemContent = chunkTCSGFAWB_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -12150,7 +12571,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkZMRQ72F6_cjs.canManageRoles(u) && !chunkX6UQFV4X_cjs.canManageVendorRoles(u)) {
+    if (!chunkNBY4NVTY_cjs.canManageRoles(u) && !chunkX6UQFV4X_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -12161,7 +12582,7 @@ function createAdminRolesHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunkX6UQFV4X_cjs.canManageVendorRoles(u) && !chunkZMRQ72F6_cjs.canManageRoles(u);
+    return chunkX6UQFV4X_cjs.canManageVendorRoles(u) && !chunkNBY4NVTY_cjs.canManageRoles(u);
   }
   chunkUSNT2KNT_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
@@ -12518,12 +12939,12 @@ async function sendVendorOnboardEmails(input, deps) {
       getSettingsGroup(deps, "branding"),
       getSettingsGroup(deps, "email")
     ]);
-    const companyDetails = chunk22FFHLTO_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings);
-    const notifyEmails = chunk22FFHLTO_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
+    const companyDetails = chunkBXYZDMTZ_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings);
+    const notifyEmails = chunkTCSGFAWB_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const sendToOwner = input.sendToOwner !== false;
     const ownerEmail = input.ownerEmail?.trim() || "";
     const cms = await deps.getCms();
-    await chunkXW5ATPRW_cjs.queueVendorOnboardEmails(cms, {
+    await chunkV25RDUOU_cjs.queueVendorOnboardEmails(cms, {
       vendorName: input.vendorName,
       vendorSlug: input.vendorSlug,
       ownerName: input.ownerName,
@@ -12742,6 +13163,39 @@ function slugify(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 chunkUSNT2KNT_cjs.__name(slugify, "slugify");
+async function userHasActiveVendor(em, entityMap, userId) {
+  const vendorRepo = em.getRepository(entityMap.vendors);
+  const owned = await vendorRepo.findOne({
+    where: {
+      userId,
+      deleted: false
+    }
+  });
+  if (owned) return true;
+  if (!entityMap.vendor_users) return false;
+  const link = await em.getRepository(entityMap.vendor_users).createQueryBuilder("vu").innerJoin("vendors", "v", 'v.id = vu."vendorId" AND v.deleted = false').where('vu."userId" = :userId', {
+    userId
+  }).getOne();
+  return !!link;
+}
+chunkUSNT2KNT_cjs.__name(userHasActiveVendor, "userHasActiveVendor");
+async function userHadAnyVendor(em, entityMap, userId) {
+  const vendorRepo = em.getRepository(entityMap.vendors);
+  const owned = await vendorRepo.findOne({
+    where: {
+      userId
+    }
+  });
+  if (owned) return true;
+  if (!entityMap.vendor_users) return false;
+  const link = await em.getRepository(entityMap.vendor_users).findOne({
+    where: {
+      userId
+    }
+  });
+  return !!link;
+}
+chunkUSNT2KNT_cjs.__name(userHadAnyVendor, "userHadAnyVendor");
 function vendorOnboardErrorResponse(json, err) {
   const msg = err instanceof Error ? err.message : String(err);
   console.error("[vendor-onboard]", err);
@@ -12840,14 +13294,80 @@ function createVendorOnboardHandlers(config) {
   chunkUSNT2KNT_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
     const scope = chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser(u);
-    if (scope.type === "vendor") return scope.vendorId;
-    if (scope.type === "all") {
-      const id = u.activeVendorId ?? u.vendorIds?.[0];
-      return id != null && Number.isFinite(id) ? id : null;
+    const candidates = [];
+    if (scope.type === "vendor") candidates.push(scope.vendorId);
+    if (scope.type === "all" || scope.type === "vendor") {
+      const preferred = u.activeVendorId ?? u.vendorIds?.[0];
+      if (preferred != null && Number.isFinite(preferred)) candidates.push(Number(preferred));
+      for (const id of u.vendorIds ?? []) {
+        if (Number.isFinite(id)) candidates.push(Number(id));
+      }
+    }
+    if (entityMap.vendors && candidates.length > 0) {
+      const unique = [
+        ...new Set(candidates.filter((id) => id > 0))
+      ];
+      for (const id of unique) {
+        try {
+          const row = await dataSource.getRepository(entityMap.vendors).findOne({
+            where: {
+              id,
+              deleted: false
+            }
+          });
+          if (row) return id;
+        } catch {
+        }
+      }
+    }
+    const uid = u.id != null ? Number(u.id) : NaN;
+    if (Number.isFinite(uid) && entityMap.vendors) {
+      try {
+        const owned = await dataSource.getRepository(entityMap.vendors).findOne({
+          where: {
+            userId: uid,
+            deleted: false
+          },
+          order: {
+            id: "ASC"
+          }
+        });
+        const vid = owned ? Number(owned.id) : NaN;
+        if (Number.isFinite(vid) && vid > 0) return vid;
+      } catch {
+      }
     }
     return null;
   }
   chunkUSNT2KNT_cjs.__name(resolveActiveVendorId, "resolveActiveVendorId");
+  async function gateVendorPortal() {
+    const u = await getSessionUser();
+    if (!u?.email) return json({
+      error: "Unauthorized"
+    }, {
+      status: 401
+    });
+    if (!chunkX6UQFV4X_cjs.isVendorPortalUser(u) && !chunkX6UQFV4X_cjs.isPlatformAdministrator(u)) {
+      return json({
+        error: "Forbidden"
+      }, {
+        status: 403
+      });
+    }
+    const vendorId = await resolveActiveVendorId(u);
+    if (vendorId == null) {
+      return json({
+        error: "No vendor is linked to your account."
+      }, {
+        status: 400
+      });
+    }
+    return {
+      user: u,
+      vendorId
+    };
+  }
+  chunkUSNT2KNT_cjs.__name(gateVendorPortal, "gateVendorPortal");
   async function gateVendorTeam() {
     const u = await getSessionUser();
     if (!u?.email) return json({
@@ -12901,6 +13421,40 @@ function createVendorOnboardHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(trySendVendorOnboardEmails, "trySendVendorOnboardEmails");
   return {
+    /** GET /api/admin/vendor/profile — current user's store (server-resolved vendor id). */
+    async getProfile() {
+      const gated = await gateVendorPortal();
+      if (gated instanceof Response) return gated;
+      const { vendorId } = gated;
+      if (!entityMap.vendors) {
+        return json({
+          error: "Vendors not configured"
+        }, {
+          status: 500
+        });
+      }
+      try {
+        const row = await dataSource.getRepository(entityMap.vendors).findOne({
+          where: {
+            id: vendorId,
+            deleted: false
+          }
+        });
+        if (!row) return json({
+          error: "Vendor not found"
+        }, {
+          status: 404
+        });
+        return json(row);
+      } catch (e) {
+        console.error("[vendor.profile]", e);
+        return json({
+          error: "Failed to load vendor profile"
+        }, {
+          status: 500
+        });
+      }
+    },
     /** POST /api/admin/vendors/onboard — create vendor + owner user + vendor_users + invite */
     async onboard(req) {
       const err = await gateAdmin();
@@ -12969,6 +13523,7 @@ function createVendorOnboardHandlers(config) {
             }
           });
           if (dupVendor) throw new Error("VENDOR_SLUG_EXISTS");
+          await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
               name: chunkX6UQFV4X_cjs.VENDOR_OWNER_GROUP_NAME,
@@ -12997,8 +13552,15 @@ function createVendorOnboardHandlers(config) {
               email: userEmail
             }
           });
-          if (existingUser && !existingUser.deleted) throw new Error("USER_EMAIL_EXISTS");
-          const newUser = existingUser?.deleted ? await (async () => {
+          if (existingUser && !existingUser.deleted) {
+            if (await userHasActiveVendor(em, entityMap, existingUser.id)) {
+              throw new Error("USER_EMAIL_EXISTS");
+            }
+            if (!await userHadAnyVendor(em, entityMap, existingUser.id)) {
+              throw new Error("USER_EMAIL_EXISTS");
+            }
+          }
+          const newUser = existingUser ? await (async () => {
             await userRepo.update(existingUser.id, {
               deleted: false,
               deletedAt: null,
@@ -14365,6 +14927,13 @@ exports.User = class User {
   phoneVerifiedAt;
   emailVerifiedAt;
   password;
+  /**
+  * `pending` = invite outstanding (cannot sign in until password is set).
+  * `active` = invite accepted / account usable (subject to `blocked`).
+  */
+  inviteStatus;
+  /** Rotating invite token; null when active or no invite outstanding. */
+  inviteToken;
   blocked;
   adminAccess;
   groupId;
@@ -14417,6 +14986,24 @@ _ts_decorate4([
   }),
   _ts_metadata4("design:type", Object)
 ], exports.User.prototype, "password", void 0);
+_ts_decorate4([
+  typeorm.Column({
+    type: "enum",
+    enum: [
+      "pending",
+      "active"
+    ],
+    enumName: "users_invitestatus_enum",
+    default: "active"
+  }),
+  _ts_metadata4("design:type", typeof UserInviteStatus === "undefined" ? Object : UserInviteStatus)
+], exports.User.prototype, "inviteStatus", void 0);
+_ts_decorate4([
+  typeorm.Column("varchar", {
+    nullable: true
+  }),
+  _ts_metadata4("design:type", Object)
+], exports.User.prototype, "inviteToken", void 0);
 _ts_decorate4([
   typeorm.Column("boolean", {
     default: false
@@ -16081,10 +16668,12 @@ exports.Customer = class Customer {
     chunkUSNT2KNT_cjs.__name(this, "Customer");
   }
   id;
+  /** Set only when the customer can log in (linked `users` row). Admin/guest customers stay null. */
   userId;
   user;
   name;
   email;
+  /** Optional; multiple customers may have null (PostgreSQL UNIQUE allows multiple NULLs). */
   phone;
   createdAt;
   updatedAt;
@@ -16099,8 +16688,10 @@ _ts_decorate18([
   _ts_metadata18("design:type", Number)
 ], exports.Customer.prototype, "id", void 0);
 _ts_decorate18([
-  typeorm.Column("int"),
-  _ts_metadata18("design:type", Number)
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata18("design:type", Object)
 ], exports.Customer.prototype, "userId", void 0);
 _ts_decorate18([
   typeorm.ManyToOne(() => exports.User, {
@@ -16123,9 +16714,10 @@ _ts_decorate18([
 ], exports.Customer.prototype, "email", void 0);
 _ts_decorate18([
   typeorm.Column("varchar", {
-    unique: true
+    unique: true,
+    nullable: true
   }),
-  _ts_metadata18("design:type", String)
+  _ts_metadata18("design:type", Object)
 ], exports.Customer.prototype, "phone", void 0);
 _ts_decorate18([
   typeorm.Column({
@@ -19145,6 +19737,8 @@ exports.OrderItem = class OrderItem {
   id;
   orderId;
   productId;
+  /** Selected product variant at order time (optional). */
+  variantId;
   discountIds;
   vendorId;
   vendor;
@@ -19180,6 +19774,12 @@ _ts_decorate39([
   typeorm.Column("int"),
   _ts_metadata39("design:type", Number)
 ], exports.OrderItem.prototype, "productId", void 0);
+_ts_decorate39([
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata39("design:type", Object)
+], exports.OrderItem.prototype, "variantId", void 0);
 _ts_decorate39([
   typeorm.Column({
     type: "int",
@@ -19989,6 +20589,7 @@ var Type = /* @__PURE__ */ (function(Type2) {
   Type2["CATEGORY"] = "category";
   Type2["CART"] = "cart";
   Type2["PAYMENT_METHOD"] = "paymentMethod";
+  Type2["DEVICE_TYPE"] = "deviceType";
   Type2["ORDER"] = "order";
   Type2["QUANTITY"] = "quantity";
   Type2["TIME"] = "time";
@@ -22011,6 +22612,7 @@ exports.Combo = class Combo {
   vendorId;
   vendor;
   name;
+  slug;
   desc;
   eventId;
   event;
@@ -22054,6 +22656,12 @@ _ts_decorate63([
   }),
   _ts_metadata63("design:type", String)
 ], exports.Combo.prototype, "name", void 0);
+_ts_decorate63([
+  typeorm.Column({
+    type: "varchar"
+  }),
+  _ts_metadata63("design:type", String)
+], exports.Combo.prototype, "slug", void 0);
 _ts_decorate63([
   typeorm.Column({
     type: "text",
@@ -22191,7 +22799,11 @@ _ts_decorate63([
   _ts_metadata63("design:type", Number)
 ], exports.Combo.prototype, "deletedBy", void 0);
 exports.Combo = _ts_decorate63([
-  typeorm.Entity("combos")
+  typeorm.Entity("combos"),
+  typeorm.Unique("UQ_combos_vendor_slug", [
+    "vendorId",
+    "slug"
+  ])
 ], exports.Combo);
 function _ts_decorate64(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -26036,16 +26648,16 @@ function whatsappPlugin(config = {}) {
         db = await getWhatsAppSettings?.() ?? {};
       } catch {
       }
-      if (!chunk22FFHLTO_cjs.isWhatsAppPluginEnabled(db)) {
+      if (!chunk7PMHZRF3_cjs.isWhatsAppPluginEnabled(db)) {
         context.logger.warn("WhatsApp plugin skipped: disabled in Plugins \u2192 WhatsApp");
         return null;
       }
-      const merged = chunk22FFHLTO_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
-      if (!getWhatsAppSettings && !chunk22FFHLTO_cjs.whatsAppConfigured(merged)) {
+      const merged = chunk7PMHZRF3_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
+      if (!getWhatsAppSettings && !chunk7PMHZRF3_cjs.whatsAppConfigured(merged)) {
         context.logger.warn("WhatsApp plugin skipped: set WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID, or pass getWhatsAppSettings");
         return null;
       }
-      const svc = new chunk22FFHLTO_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
+      const svc = new chunk7PMHZRF3_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
       return {
         send: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((opts) => svc.send(opts), "send")
       };
@@ -26117,9 +26729,12 @@ function createMessageTemplateRowLoader(dataSource, entityMap) {
   };
 }
 chunkUSNT2KNT_cjs.__name(createMessageTemplateRowLoader, "createMessageTemplateRowLoader");
-function registerMessagingQueueProcessors(cms) {
-  chunkXW5ATPRW_cjs.registerEmailQueueProcessor(cms);
-  chunk22FFHLTO_cjs.registerWhatsAppQueueProcessor(cms);
+function registerMessagingQueueProcessors(cms, entityMap) {
+  chunkV25RDUOU_cjs.registerEmailQueueProcessor(cms, {
+    getDataSource: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => cms.dataSource, "getDataSource"),
+    entityMap
+  });
+  chunk7PMHZRF3_cjs.registerWhatsAppQueueProcessor(cms);
 }
 chunkUSNT2KNT_cjs.__name(registerMessagingQueueProcessors, "registerMessagingQueueProcessors");
 async function ensureMessagingPluginsOnCms(base, options) {
@@ -26148,7 +26763,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
   }
   if (!cms.getPlugin("email")) {
     try {
-      const instance = await chunk22FFHLTO_cjs.emailPlugin({
+      const instance = await chunkTCSGFAWB_cjs.emailPlugin({
         type: "SMTP",
         from: config.SMTP_FROM ?? "no-reply@localhost",
         to: config.SMTP_TO ?? ""
@@ -26170,7 +26785,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
     }
   }
   const merged = Object.keys(overlay).length > 0 ? overlayCmsPlugins(cms, overlay) : cms;
-  registerMessagingQueueProcessors(merged);
+  registerMessagingQueueProcessors(merged, entityMap);
   return merged;
 }
 chunkUSNT2KNT_cjs.__name(ensureMessagingPluginsOnCms, "ensureMessagingPluginsOnCms");
@@ -26189,7 +26804,7 @@ function messagingPlugins(options) {
   const config = options.config ?? (typeof process !== "undefined" ? process.env : {});
   return [
     queuePlugin(),
-    chunk22FFHLTO_cjs.emailPlugin({
+    chunkTCSGFAWB_cjs.emailPlugin({
       type: "SMTP",
       from: config.SMTP_FROM ?? "no-reply@localhost",
       to: config.SMTP_TO ?? ""
@@ -26219,7 +26834,7 @@ async function createCmsAppWithMessaging(options) {
     logger,
     plugins: mergedPlugins
   });
-  registerMessagingQueueProcessors(cms);
+  registerMessagingQueueProcessors(cms, entityMap);
   return cms;
 }
 chunkUSNT2KNT_cjs.__name(createCmsAppWithMessaging, "createCmsAppWithMessaging");
@@ -26323,7 +26938,7 @@ function createCmsApiHandler(config) {
   } : void 0;
   const entityMap = withLlmKnowledgeEntityFallbacks(rawEntityMap);
   if (getCms) {
-    chunk22FFHLTO_cjs.initWhatsappTriggerDispatcher({
+    chunk7PMHZRF3_cjs.initWhatsappTriggerDispatcher({
       dataSource,
       entityMap,
       getCms
@@ -26356,7 +26971,7 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunkZMRQ72F6_cjs.sessionHasEntityAccess(u, entity, action);
+      const allowed = chunkNBY4NVTY_cjs.sessionHasEntityAccess(u, entity, action);
       await chunkX6UQFV4X_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
@@ -26416,7 +27031,7 @@ function createCmsApiHandler(config) {
         companyDetails
       };
       if (queue) {
-        const { queueEmail: queueEmail2 } = await import('./email-queue-TPZWLTIV.cjs');
+        const { queueEmail: queueEmail2 } = await import('./email-queue-6NJY6HNM.cjs');
         await queueEmail2(cms, {
           to: opts.to,
           templateName: "passwordReset",
@@ -26709,6 +27324,14 @@ function createCmsApiHandler(config) {
         });
         return vendorHandlers.switchVendor(req);
       }
+      if (path2[0] === "admin" && path2[1] === "vendor" && path2[2] === "profile" && path2.length === 3 && m === "GET") {
+        if (!vendorHandlers) return config.json({
+          error: "Not found"
+        }, {
+          status: 404
+        });
+        return vendorHandlers.getProfile();
+      }
       if (path2[0] === "admin" && path2[1] === "vendor" && path2[2] === "roles" && vendorRolesHandlers) {
         if (path2.length === 3 && m === "GET") return vendorRolesHandlers.list();
         if (path2.length === 3 && m === "POST") return vendorRolesHandlers.create(req);
@@ -27662,14 +28285,27 @@ function createCmsApiHandler(config) {
         const pe = await requireEntityPermissionEffective(req, "orders", "read");
         if (pe) return pe;
         const cms = await getCms();
-        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-ZR5F2KTA.cjs');
+        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-EYYNR526.cjs');
         const oid = Number(path2[1]);
         if (!Number.isFinite(oid)) return config.json({
           error: "Invalid id"
         }, {
           status: 400
         });
-        return streamOrderInvoicePdf2(cms, dataSource, entityMap, oid, {});
+        try {
+          return await streamOrderInvoicePdf2(cms, dataSource, entityMap, oid, {});
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.error("[invoice] route failed", {
+            orderId: oid,
+            error: msg
+          });
+          return config.json({
+            error: `Invoice failed: ${msg}`
+          }, {
+            status: 500
+          });
+        }
       }
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "repost-erp" && getCms) {
         const a = await config.requireAuth(req);
@@ -28016,7 +28652,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-RU7BTGGX.cjs');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-SBQAMM5V.cjs');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -28088,6 +28724,30 @@ function createCmsApiHandler(config) {
             paymentId = Number(payment.id);
           }
         }
+        const orderWithItems = await orderRepo.findOne({
+          where: {
+            id: orderId,
+            deleted: false
+          },
+          relations: [
+            "items"
+          ]
+        });
+        if (orderWithItems) {
+          const { reconcileOrderInventoryBetweenSnapshots: reconcileOrderInventoryBetweenSnapshots2, orderInventorySnapshotFromRow: orderInventorySnapshotFromRow2 } = await import('./order-inventory-2MYRKEPC.cjs');
+          const prevSnap = orderInventorySnapshotFromRow2(orderWithItems);
+          const invErr = await reconcileOrderInventoryBetweenSnapshots2(dataSource, entityMap, prevSnap, {
+            status: "cancelled",
+            lines: prevSnap.lines
+          });
+          if (invErr) {
+            return config.json({
+              error: invErr
+            }, {
+              status: 400
+            });
+          }
+        }
         await orderRepo.update(orderId, {
           status: "cancelled"
         });
@@ -28747,12 +29407,12 @@ async function refreshOrderFromErp(cms, dataSource, entityMap, submission, order
     const r1 = await submission.postErpReadAction("get-order-status", {
       platformOrderId: refId
     });
-    const d1 = r1.ok ? chunkPNOKNSG2_cjs.unwrapErpReadData(r1.json) : null;
+    const d1 = r1.ok ? chunkBXYZDMTZ_cjs.unwrapErpReadData(r1.json) : null;
     if (d1) {
       const mapped = mapErpSaleStatusToOrderStatus(typeof d1.status === "string" ? d1.status : typeof d1.orderStatus === "string" ? d1.orderStatus : typeof d1.state === "string" ? d1.state : void 0);
       if (mapped) newStatus = mapped;
-      fulfillment = chunkPNOKNSG2_cjs.mapErpPayloadToFulfillment(d1);
-      const refs = chunkPNOKNSG2_cjs.extractChildOrderRefsFromSalePayload(d1);
+      fulfillment = chunkBXYZDMTZ_cjs.mapErpPayloadToFulfillment(d1);
+      const refs = chunkBXYZDMTZ_cjs.extractChildOrderRefsFromSalePayload(d1);
       if (refs.length) {
         await ensureChildOrdersFromRefs(orderRepo, order, refs, order.contactId, String(order.currency || "INR"));
       }
@@ -28760,16 +29420,16 @@ async function refreshOrderFromErp(cms, dataSource, entityMap, submission, order
     const r2 = await submission.postErpReadAction("get-fulfillment-status", {
       platformOrderId: refId
     });
-    const d2 = r2.ok ? chunkPNOKNSG2_cjs.unwrapErpReadData(r2.json) : null;
+    const d2 = r2.ok ? chunkBXYZDMTZ_cjs.unwrapErpReadData(r2.json) : null;
     if (d2) {
-      fulfillment = deepMergeFulfillment(fulfillment, chunkPNOKNSG2_cjs.mapErpPayloadToFulfillment(d2));
+      fulfillment = deepMergeFulfillment(fulfillment, chunkBXYZDMTZ_cjs.mapErpPayloadToFulfillment(d2));
     }
     const r3 = await submission.postErpReadAction("get-invoice", {
       platformOrderId: refId
     });
-    const d3 = r3.ok ? chunkPNOKNSG2_cjs.unwrapErpReadData(r3.json) : null;
+    const d3 = r3.ok ? chunkBXYZDMTZ_cjs.unwrapErpReadData(r3.json) : null;
     if (d3) {
-      invoiceNumber = chunkPNOKNSG2_cjs.mapErpPayloadToInvoiceNumber(d3);
+      invoiceNumber = chunkBXYZDMTZ_cjs.mapErpPayloadToInvoiceNumber(d3);
       invoiceId = pickInvoiceId(d3);
     }
     const oid = order.id;
@@ -28805,10 +29465,10 @@ async function refreshOrderFromErp(cms, dataSource, entityMap, submission, order
     const r = await submission.postErpReadAction("get-return-status", {
       platformReturnId
     });
-    const d = r.ok ? chunkPNOKNSG2_cjs.unwrapErpReadData(r.json) : null;
+    const d = r.ok ? chunkBXYZDMTZ_cjs.unwrapErpReadData(r.json) : null;
     if (!d) return;
     const mapped = mapErpSaleStatusToOrderStatus(typeof d.status === "string" ? d.status : typeof d.returnStatus === "string" ? d.returnStatus : void 0);
-    const fulfillment = chunkPNOKNSG2_cjs.mapErpPayloadToFulfillment(d);
+    const fulfillment = chunkBXYZDMTZ_cjs.mapErpPayloadToFulfillment(d);
     const patch = {};
     if (fulfillment !== void 0) patch.fulfillment = fulfillment;
     const nextMeta = Object.keys(patch).length ? mergeOrderMetadataPatch(meta, patch) : meta;
@@ -29131,6 +29791,14 @@ function createStorefrontApiHandler(config) {
         entityMap
       });
     }).catch((err) => console.error("[notification-triggers] import failed", err));
+    if (!getCms) return;
+    void import('./send-order-placed-emails-B5ZVJT7T.cjs').then(({ sendOrderPlacedEmailsAfterConfirmation }) => {
+      return sendOrderPlacedEmailsAfterConfirmation(orderId, {
+        getDataSource: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => dataSource, "getDataSource"),
+        entityMap,
+        getCms
+      });
+    }).catch((err) => console.error("[order-emails] sendOrderPlacedEmailsAfterConfirmation failed", err));
   }
   chunkUSNT2KNT_cjs.__name(fireOrderPlacedNotification, "fireOrderPlacedNotification");
   const otpAllowPhoneLogin = config.otpAllowPhoneLogin !== false;
@@ -29178,13 +29846,36 @@ function createStorefrontApiHandler(config) {
         status: 400
       };
     }
+    const list = [
+      ...vendorIds
+    ];
     return {
-      vendorId: [
-        ...vendorIds
-      ][0]
+      vendorId: list[0],
+      vendorIds: list
     };
   }
   chunkUSNT2KNT_cjs.__name(resolveSingleVendorIdFromCart, "resolveSingleVendorIdFromCart");
+  async function linkOrderContactToVendors(contactId, vendorIds) {
+    try {
+      const contact = await contactRepo().findOne({
+        where: {
+          id: contactId,
+          deleted: false
+        }
+      });
+      if (!contact) return;
+      const email = String(contact.email ?? "").trim().toLowerCase();
+      if (!email) return;
+      await ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, contactId, {
+        name: String(contact.name ?? "").trim() || email.split("@")[0] || "Customer",
+        email,
+        phone: contact.phone ?? null
+      });
+    } catch (err) {
+      console.error("[storefront] vendor_customers link failed", err);
+    }
+  }
+  chunkUSNT2KNT_cjs.__name(linkOrderContactToVendors, "linkOrderContactToVendors");
   function roundMoney3(n) {
     return Math.round(n * 100) / 100;
   }
@@ -30709,7 +31400,7 @@ function createStorefrontApiHandler(config) {
                 status: 503
               });
               const companyDetails = getCompanyDetails ? await getCompanyDetails() : {};
-              await chunkXW5ATPRW_cjs.queueEmail(cms, {
+              await chunkV25RDUOU_cjs.queueEmail(cms, {
                 to: identifier,
                 templateName: "otp",
                 ctx: {
@@ -30876,9 +31567,12 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 400
           });
+          const { retireSoftDeletedUniqueValue: retireSoftDeletedUniqueValue2 } = await import('./retire-soft-deleted-unique-5VXBA5XX.cjs');
+          await retireSoftDeletedUniqueValue2(userRepo(), "email", email);
           const existing = await userRepo().findOne({
             where: {
-              email
+              email,
+              deleted: false
             }
           });
           if (existing) return json({
@@ -30931,7 +31625,7 @@ function createStorefrontApiHandler(config) {
               const companyDetails = getCompanyDetails ? await getCompanyDetails() : {};
               const base = (publicSiteUrl || "").replace(/\/$/, "").trim() || "http://localhost:3000";
               const verifyEmailUrl = `${base}/verify-email?token=${encodeURIComponent(rawToken)}`;
-              await chunkXW5ATPRW_cjs.queueEmail(cms, {
+              await chunkV25RDUOU_cjs.queueEmail(cms, {
                 to: email,
                 templateName: "signup",
                 ctx: {
@@ -31506,6 +32200,7 @@ function createStorefrontApiHandler(config) {
               taxCode: line.taxCode
             }));
           }
+          await linkOrderContactToVendors(contactId, vendorRes.vendorIds);
           fireOrderPlacedNotification(oid);
           return json({
             orderId: oid,
@@ -31578,6 +32273,7 @@ function createStorefrontApiHandler(config) {
               taxCode: line.taxCode
             }));
           }
+          await linkOrderContactToVendors(contactId, vendorResChk.vendorIds);
           await cartItemRepo().delete({
             cartId: cart.id
           });
@@ -31687,7 +32383,7 @@ function createStorefrontApiHandler(config) {
             status: 400
           });
           const cms = await getCms();
-          return chunkPNOKNSG2_cjs.streamOrderInvoicePdf(cms, dataSource, entityMap, orderId, {
+          return chunkBXYZDMTZ_cjs.streamOrderInvoicePdf(cms, dataSource, entityMap, orderId, {
             ownerContactId: contact.id
           });
         }
@@ -31757,6 +32453,7 @@ function createStorefrontApiHandler(config) {
               unitPrice: line.unitPrice,
               tax: line.tax,
               total: line.total,
+              metadata: line.metadata ?? null,
               product: p ? {
                 name: p.name,
                 slug: p.slug,
@@ -31849,12 +32546,17 @@ exports.assertProductApprovalUpdate = assertProductApprovalUpdate;
 exports.buildBlogMetadataUserPrompt = buildBlogMetadataUserPrompt;
 exports.buildCronFromSchedule = buildCronFromSchedule;
 exports.buildRssUserPromptFromFeeds = buildRssUserPromptFromFeeds;
+exports.buildUserInviteLink = buildUserInviteLink;
 exports.buildVendorInviteLink = buildVendorInviteLink;
 exports.calculateOrderRefundPreview = calculateOrderRefundPreview;
 exports.calculateRefundFromPolicy = calculateRefundFromPolicy;
+exports.checkAndIncrementDiscountUsage = checkAndIncrementDiscountUsage;
 exports.checkEventsEnabled = checkEventsEnabled;
 exports.checkMultiVendorEnabled = checkMultiVendorEnabled;
+exports.completeUserInviteAccept = completeUserInviteAccept;
+exports.consumeAppliedDiscountUsages = consumeAppliedDiscountUsages;
 exports.contactIsVendorCustomer = contactIsVendorCustomer;
+exports.countDiscountOrdersForContact = countDiscountOrdersForContact;
 exports.countRecentOtpSends = countRecentOtpSends;
 exports.createAnalyticsHandlers = createAnalyticsHandlers;
 exports.createBlogBySlugHandler = createBlogBySlugHandler;
@@ -31886,14 +32588,19 @@ exports.createUserProfileHandler = createUserProfileHandler;
 exports.createUsersApiHandlers = createUsersApiHandlers;
 exports.createVendorDashboardHandler = createVendorDashboardHandler;
 exports.createVendorOnboardHandlers = createVendorOnboardHandlers;
+exports.customerPhoneForEmail = customerPhoneForEmail;
 exports.customerPhoneForUser = customerPhoneForUser;
 exports.daysBeforeEventStart = daysBeforeEventStart;
+exports.decrementDiscountUsage = decrementDiscountUsage;
 exports.describeEventTierPolicy = describeEventTierPolicy;
 exports.ensureCustomerForUser = ensureCustomerForUser;
+exports.ensureCustomerRecord = ensureCustomerRecord;
 exports.ensureMessagingPluginsOnCms = ensureMessagingPluginsOnCms;
 exports.ensureScheduleQueueWorker = ensureScheduleQueueWorker;
 exports.ensureVendorCustomerForOrderContact = ensureVendorCustomerForOrderContact;
+exports.ensureVendorCustomersForOrder = ensureVendorCustomersForOrder;
 exports.findActiveRefundPolicyForVendor = findActiveRefundPolicyForVendor;
+exports.findUserByInviteToken = findUserByInviteToken;
 exports.findVendorByInviteToken = findVendorByInviteToken;
 exports.formatTierRange = formatTierRange;
 exports.generateNumericOtp = generateNumericOtp;
@@ -31910,6 +32617,9 @@ exports.invalidateRequireEventApprovalCache = invalidateRequireEventApprovalCach
 exports.invalidateRequireProductApprovalCache = invalidateRequireProductApprovalCache;
 exports.invalidateVendorCatalogCreateFlagsCache = invalidateVendorCatalogCreateFlagsCache;
 exports.isCustomerTypeContact = isCustomerTypeContact;
+exports.isMaxPerUserUsageReached = isMaxPerUserUsageReached;
+exports.isMaxTotalUsageReached = isMaxTotalUsageReached;
+exports.isSyntheticCustomerPhone = isSyntheticCustomerPhone;
 exports.isZipMedia = isZipMedia;
 exports.linkUnclaimedContactToUser = linkUnclaimedContactToUser;
 exports.llmAgentToChatAgentOptions = llmAgentToChatAgentOptions;
@@ -31921,6 +32631,8 @@ exports.metaFetchUserManagedPages = metaFetchUserManagedPages;
 exports.metaPostPageFeed = metaPostPageFeed;
 exports.metaPostPagePhoto = metaPostPagePhoto;
 exports.metaResolvePageAccessToken = metaResolvePageAccessToken;
+exports.newUserInviteToken = newUserInviteToken;
+exports.normalizeCustomerPhone = normalizeCustomerPhone;
 exports.normalizePhoneE164 = normalizePhoneE164;
 exports.normalizeRefundTiers = normalizeRefundTiers;
 exports.overlayCmsPlugins = overlayCmsPlugins;
@@ -31933,6 +32645,7 @@ exports.queueErpCreateContactIfEnabled = queueErpCreateContactIfEnabled;
 exports.queueJobScheduleNow = queueJobScheduleNow;
 exports.queuePlugin = queuePlugin;
 exports.queueSms = queueSms;
+exports.recordDiscountUsage = recordDiscountUsage;
 exports.registerJobRunnerWorker = registerJobRunnerWorker;
 exports.registerMessagingQueueProcessors = registerMessagingQueueProcessors;
 exports.registerSmsQueueProcessor = registerSmsQueueProcessor;