@infuro/cms-core 1.0.44 → 1.0.46

package/dist/{chunk-SQGBHYJF.js → chunk-UKC3HYXI.js}

@@ -1,16 +1,19 @@
-import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, mergeEmailLayoutCompanyDetails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-NNQBWDCI.js';
+import { validateInventoryForConfirmedOrderLines, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, orderInventorySnapshotFromRow, validateInventoryForOrderBecomingConfirmed } from './chunk-3K5AIEIZ.js';
+import { retireSoftDeletedUniqueValue, activeUniqueValueExists } from './chunk-DBPSJYLZ.js';
+import { isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, initWhatsappTriggerDispatcher } from './chunk-GUSHM5HN.js';
+import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, parseEmailRecipientsFromConfig, emailPlugin } from './chunk-CRYKVJTO.js';
 import { inviteStatusForActivation } from './chunk-JXF23MPG.js';
-import { unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-WEMDMVHQ.js';
-import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-5ELSW2UP.js';
+import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-L3525VXI.js';
+import { mergeEmailLayoutCompanyDetails, unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-2KUCQVAQ.js';
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MQBT33IV.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-KFFB6EMZ.js';
 import { JOB_RUNNER_QUEUE } from './chunk-GO7PPYNU.js';
-import { canManageRoles, sessionHasEntityAccess } from './chunk-BLR6H5GL.js';
+import { canManageRoles, sessionHasEntityAccess } from './chunk-SF2XKMCI.js';
 import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_OWNER_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-DN65KDIA.js';
 import { queueErp } from './chunk-SYBOCAWB.js';
 import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { __name } from './chunk-SHUYVCID.js';
-import { PrimaryGeneratedColumn, Column, Entity, ManyToOne, JoinColumn, OneToMany, Index, ManyToMany, JoinTable, Unique, CreateDateColumn, UpdateDateColumn, In, IsNull, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan } from 'typeorm';
+import { PrimaryGeneratedColumn, Column, Entity, ManyToOne, JoinColumn, OneToMany, Index, ManyToMany, JoinTable, Unique, CreateDateColumn, UpdateDateColumn, In, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan, IsNull } from 'typeorm';
 import { Country, State, City } from 'country-state-city';
 import crypto2, { randomBytes, randomUUID, createHmac, timingSafeEqual, randomInt } from 'crypto';
 import Parser from 'rss-parser';
@@ -36,6 +39,7 @@ async function queryVendorLinks(dataSource, userId) {
         vr."name" AS "vendorRoleName",
         vr."isOwnerRole" AS "isOwnerRole"
       FROM "vendor_users" vu
+      INNER JOIN "vendors" v ON v.id = vu."vendorId" AND v.deleted = false
       LEFT JOIN "vendor_roles" vr ON vr.id = vu."vendorRoleId" AND vr.deleted = false
       WHERE vu."userId" = $1
       ORDER BY vu.id ASC
@@ -45,10 +49,11 @@ async function queryVendorLinks(dataSource, userId) {
   } catch (err) {
     if (!isMissingVendorRoleSchemaError(err)) throw err;
     const legacy = await dataSource.query(`
-      SELECT "vendorId", "role"
-      FROM "vendor_users"
-      WHERE "userId" = $1
-      ORDER BY id ASC
+      SELECT vu."vendorId" AS "vendorId", vu."role" AS "role"
+      FROM "vendor_users" vu
+      INNER JOIN "vendors" v ON v.id = vu."vendorId" AND v.deleted = false
+      WHERE vu."userId" = $1
+      ORDER BY vu.id ASC
       `, [
       userId
     ]);
@@ -62,8 +67,36 @@ async function queryVendorLinks(dataSource, userId) {
   }
 }
 __name(queryVendorLinks, "queryVendorLinks");
+async function queryOwnedVendorIds(dataSource, userId) {
+  try {
+    const rows = await dataSource.query(`
+      SELECT id
+      FROM "vendors"
+      WHERE "userId" = $1 AND deleted = false
+      ORDER BY id ASC
+      `, [
+      userId
+    ]);
+    return rows.map((r) => Number(r.id)).filter((id) => Number.isFinite(id) && id > 0);
+  } catch {
+    return [];
+  }
+}
+__name(queryOwnedVendorIds, "queryOwnedVendorIds");
 async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
   const rows = await queryVendorLinks(dataSource, userId);
+  const linkIds = new Set(rows.map((r) => Number(r.vendorId)));
+  for (const ownedId of await queryOwnedVendorIds(dataSource, userId)) {
+    if (linkIds.has(ownedId)) continue;
+    rows.push({
+      vendorId: ownedId,
+      role: "owner",
+      vendorRoleId: null,
+      vendorRoleName: null,
+      isOwnerRole: true
+    });
+    linkIds.add(ownedId);
+  }
   const vendorIds = rows.map((r) => Number(r.vendorId));
   const activeRow = preferredVendorId != null ? rows.find((r) => Number(r.vendorId) === preferredVendorId) : void 0;
   const primary = activeRow ?? rows[0];
@@ -616,6 +649,144 @@ function applyEventApprovalStatusSideEffects(updatePayload, opts) {
 }
 __name(applyEventApprovalStatusSideEffects, "applyEventApprovalStatusSideEffects");
 
+// src/lib/discount-usage.ts
+async function countDiscountOrdersForContact(dataSource, discountId, contactId) {
+  try {
+    const rows = await dataSource.query(`SELECT COUNT(DISTINCT od."orderId")::int AS count
+       FROM order_discounts od
+       WHERE od."discountId" = $1 AND od."userId" = $2`, [
+      discountId,
+      contactId
+    ]);
+    return Number(rows?.[0]?.count ?? 0);
+  } catch {
+    return 0;
+  }
+}
+__name(countDiscountOrdersForContact, "countDiscountOrdersForContact");
+function isMaxTotalUsageReached(discount) {
+  if (discount.maxTotalUsage == null) return false;
+  return Number(discount.usedCount ?? 0) >= Number(discount.maxTotalUsage);
+}
+__name(isMaxTotalUsageReached, "isMaxTotalUsageReached");
+async function isMaxPerUserUsageReached(dataSource, discount, contactId) {
+  if (discount.maxUsagePerUser == null || contactId == null) return false;
+  const count = await countDiscountOrdersForContact(dataSource, discount.id, contactId);
+  return count >= Number(discount.maxUsagePerUser);
+}
+__name(isMaxPerUserUsageReached, "isMaxPerUserUsageReached");
+async function checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId) {
+  if (!entityMap.discounts) return null;
+  const discountRepo = dataSource.getRepository(entityMap.discounts);
+  const discount = await discountRepo.findOne({
+    where: {
+      id: discountId
+    }
+  });
+  if (!discount) return `Discount #${discountId} not found`;
+  const d = discount;
+  if (d.maxUsagePerUser != null) {
+    const usageCount = await countDiscountOrdersForContact(dataSource, discountId, contactId);
+    if (usageCount >= Number(d.maxUsagePerUser)) {
+      return "You have reached the maximum usage limit for this discount";
+    }
+  }
+  const updated = await dataSource.query(`UPDATE discounts
+     SET "usedCount" = "usedCount" + 1
+     WHERE id = $1
+       AND ("maxTotalUsage" IS NULL OR "usedCount" < "maxTotalUsage")
+     RETURNING id`, [
+    discountId
+  ]);
+  if (!Array.isArray(updated) || updated.length === 0) {
+    return "Discount usage limit has been reached";
+  }
+  return null;
+}
+__name(checkAndIncrementDiscountUsage, "checkAndIncrementDiscountUsage");
+async function decrementDiscountUsage(dataSource, entityMap, discountId, orderId) {
+  if (!entityMap.discounts) return;
+  try {
+    await dataSource.query(`UPDATE discounts SET "usedCount" = GREATEST("usedCount" - 1, 0) WHERE id = $1`, [
+      discountId
+    ]);
+    if (entityMap.order_discounts) {
+      await dataSource.getRepository(entityMap.order_discounts).delete({
+        orderId,
+        discountId
+      });
+    }
+  } catch (err) {
+    console.error("[discountEngine] decrementDiscountUsage failed:", err);
+  }
+}
+__name(decrementDiscountUsage, "decrementDiscountUsage");
+async function recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
+  if (!entityMap.order_discounts) return;
+  try {
+    let discountCode = "";
+    if (entityMap.discounts) {
+      const discountRow = await dataSource.getRepository(entityMap.discounts).findOne({
+        where: {
+          id: discountId
+        }
+      });
+      discountCode = discountRow?.couponCode ?? "";
+    }
+    const odRepo = dataSource.getRepository(entityMap.order_discounts);
+    const orderItemRepo = dataSource.getRepository(entityMap.order_items);
+    const items = await orderItemRepo.find({
+      where: {
+        orderId
+      }
+    });
+    const discountedItems = items.filter((item) => Number(item.discount ?? 0) > 0);
+    if (discountedItems.length === 0) {
+      const firstItem = items[0];
+      if (!firstItem) return;
+      await odRepo.save(odRepo.create({
+        orderId,
+        orderItemId: firstItem.id,
+        discountId,
+        discountCode,
+        discountAmount,
+        userId: contactId
+      }));
+      return;
+    }
+    for (const item of discountedItems) {
+      const i = item;
+      await odRepo.save(odRepo.create({
+        orderId,
+        orderItemId: i.id,
+        discountId,
+        discountCode,
+        discountAmount: Number(i.discount ?? 0),
+        userId: contactId
+      }));
+    }
+  } catch (err) {
+    console.error("[discountEngine] recordDiscountUsage failed:", err);
+  }
+}
+__name(recordDiscountUsage, "recordDiscountUsage");
+async function consumeAppliedDiscountUsages(dataSource, entityMap, orderId, contactId, applied) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const row of applied) {
+    const id = Number(row.id);
+    if (!Number.isFinite(id) || id < 1) continue;
+    const amount = Math.max(0, Number(row.calculatedDiscount) || 0);
+    unique.set(id, (unique.get(id) ?? 0) + amount);
+  }
+  for (const [discountId, discountAmount] of unique) {
+    const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId);
+    if (usageErr) return usageErr;
+    await recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount);
+  }
+  return null;
+}
+__name(consumeAppliedDiscountUsages, "consumeAppliedDiscountUsages");
+
 // src/lib/default-vendor-id.ts
 function getDefaultVendorId() {
   const raw = process.env.DEFAULT_VENDOR_ID;
@@ -1090,11 +1261,118 @@ function pgErrorCode(err) {
   return driver?.code ?? err.code;
 }
 __name(pgErrorCode, "pgErrorCode");
-function customerPhoneForUser(userId, phone) {
+function normalizeCustomerPhone(phone) {
   const p = typeof phone === "string" ? phone.trim() : "";
-  return p || `u-${userId}`;
+  return p || null;
+}
+__name(normalizeCustomerPhone, "normalizeCustomerPhone");
+function isSyntheticCustomerPhone(phone) {
+  const p = String(phone ?? "").trim();
+  if (!p) return true;
+  if (p.startsWith("e-") || p.startsWith("u-")) return true;
+  if (p.includes("@")) return true;
+  return false;
+}
+__name(isSyntheticCustomerPhone, "isSyntheticCustomerPhone");
+function customerPhoneForUser(_userId, phone) {
+  return normalizeCustomerPhone(phone);
 }
 __name(customerPhoneForUser, "customerPhoneForUser");
+function customerPhoneForEmail(_email, phone) {
+  return normalizeCustomerPhone(phone);
+}
+__name(customerPhoneForEmail, "customerPhoneForEmail");
+function resolveNextPhone(inputPhone, existingPhone) {
+  if (inputPhone) return inputPhone;
+  const existing = normalizeCustomerPhone(existingPhone);
+  if (!existing || isSyntheticCustomerPhone(existing)) return null;
+  return existing;
+}
+__name(resolveNextPhone, "resolveNextPhone");
+async function ensureCustomerRecord(dsOrEm, customerEntity, input) {
+  const repo = dsOrEm.getRepository(customerEntity);
+  const email = normalizeEmail(input.email);
+  if (!email) return null;
+  const name = String(input.name ?? "").trim() || email.split("@")[0] || "Customer";
+  const userId = input.userId != null && Number.isFinite(Number(input.userId)) && Number(input.userId) > 0 ? Number(input.userId) : null;
+  const phone = normalizeCustomerPhone(input.phone);
+  let row = await repo.findOne({
+    where: {
+      email,
+      deleted: false
+    }
+  });
+  if (!row) {
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+  }
+  if (row) {
+    const existingUserId = row.userId;
+    if (userId != null && existingUserId != null && existingUserId !== userId) {
+      return null;
+    }
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    const patch = {
+      name,
+      phone: nextPhone,
+      deleted: false,
+      deletedAt: null,
+      deletedBy: null,
+      updatedAt: /* @__PURE__ */ new Date()
+    };
+    if (userId != null && existingUserId == null) {
+      patch.userId = userId;
+    }
+    await repo.update(row.id, patch);
+    return {
+      id: row.id
+    };
+  }
+  try {
+    const created = await repo.save(repo.create({
+      userId,
+      name,
+      email,
+      phone,
+      deleted: false
+    }));
+    return {
+      id: created.id
+    };
+  } catch (err) {
+    const code = pgErrorCode(err);
+    if (code === "25P02") throw err;
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+    if (row) {
+      const existingUserId = row.userId;
+      if (userId != null && existingUserId != null && existingUserId !== userId) return null;
+      await repo.update(row.id, {
+        name,
+        phone: resolveNextPhone(phone, row.phone),
+        ...userId != null && existingUserId == null ? {
+          userId
+        } : {},
+        deleted: false,
+        deletedAt: null,
+        deletedBy: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return {
+        id: row.id
+      };
+    }
+    if (code === "23505") return null;
+    throw err;
+  }
+}
+__name(ensureCustomerRecord, "ensureCustomerRecord");
 async function restoreCustomerRow(repo, row, user, name, email, phone) {
   const id = row.id;
   await repo.update(id, {
@@ -1116,7 +1394,7 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
   const repo = dsOrEm.getRepository(customerEntity);
   const email = normalizeEmail(user.email);
   const name = String(user.name ?? "").trim() || email.split("@")[0] || "User";
-  const phone = customerPhoneForUser(user.id, overrides?.phone ?? user.phone);
+  const phone = normalizeCustomerPhone(overrides?.phone ?? user.phone);
   let row = await repo.findOne({
     where: {
       userId: user.id,
@@ -1124,10 +1402,11 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
     }
   });
   if (row) {
+    const nextPhone = resolveNextPhone(phone, row.phone);
     await repo.update(row.id, {
       name,
       email,
-      phone,
+      phone: nextPhone,
       updatedAt: /* @__PURE__ */ new Date()
     });
     return {
@@ -1145,10 +1424,11 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
     if (existingUserId != null && existingUserId !== user.id) {
       return null;
     }
+    const nextPhone = resolveNextPhone(phone, row.phone);
     await repo.update(row.id, {
       userId: user.id,
       name,
-      phone,
+      phone: nextPhone,
       updatedAt: /* @__PURE__ */ new Date()
     });
     return {
@@ -1163,21 +1443,23 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
   if (deletedByEmail) {
     const existingUserId = deletedByEmail.userId;
     if (existingUserId != null && existingUserId !== user.id) return null;
-    return restoreCustomerRow(repo, deletedByEmail, user, name, email, phone);
+    return restoreCustomerRow(repo, deletedByEmail, user, name, email, resolveNextPhone(phone, deletedByEmail.phone));
   }
-  const deletedByPhone = await repo.findOne({
-    where: {
-      phone
-    }
-  });
-  if (deletedByPhone) {
-    const existingUserId = deletedByPhone.userId;
-    if (existingUserId != null && existingUserId !== user.id) {
-      return ensureCustomerForUser(dsOrEm, customerEntity, user, {
-        phone: `u-${user.id}-${Date.now()}`
-      });
+  if (phone) {
+    const deletedByPhone = await repo.findOne({
+      where: {
+        phone
+      }
+    });
+    if (deletedByPhone) {
+      const existingUserId = deletedByPhone.userId;
+      if (existingUserId != null && existingUserId !== user.id) {
+        return ensureCustomerForUser(dsOrEm, customerEntity, user, {
+          phone: null
+        });
+      }
+      return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
     }
-    return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
   }
   try {
     const created = await repo.save(repo.create({
@@ -1198,34 +1480,22 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
         userId: user.id
       }
     });
-    if (row) return restoreCustomerRow(repo, row, user, name, email, phone);
+    if (row) {
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
+    }
     row = await repo.findOne({
       where: {
         email
       }
     });
     if (row && (row.userId ?? user.id) === user.id) {
-      return restoreCustomerRow(repo, row, user, name, email, phone);
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
     }
     if (code === "23505") return null;
     throw err;
   }
 }
 __name(ensureCustomerForUser, "ensureCustomerForUser");
-async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
-  const repo = dataSource.getRepository(contactsEntity);
-  const found = await repo.findOne({
-    where: {
-      email,
-      userId: IsNull(),
-      deleted: false
-    }
-  });
-  if (found) await repo.update(found.id, {
-    userId
-  });
-}
-__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
 
 // src/lib/vendor-customer-contacts.ts
 function isCustomerTypeContact(type) {
@@ -1318,8 +1588,27 @@ function resolveVendorIdForContactCheck(scope, bodyOrRow) {
   return Number.isFinite(n) ? n : null;
 }
 __name(resolveVendorIdForContactCheck, "resolveVendorIdForContactCheck");
+function uniquePositiveIds(ids) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of ids) {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0 || seen.has(n)) continue;
+    seen.add(n);
+    out.push(n);
+  }
+  return out;
+}
+__name(uniquePositiveIds, "uniquePositiveIds");
 async function ensureVendorCustomerForOrderContact(dataSource, entityMap, vendorId, contactId, details) {
-  if (!Number.isFinite(vendorId) || !Number.isFinite(contactId)) return;
+  await ensureVendorCustomersForOrder(dataSource, entityMap, [
+    vendorId
+  ], contactId, details);
+}
+__name(ensureVendorCustomerForOrderContact, "ensureVendorCustomerForOrderContact");
+async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, contactId, details) {
+  const vendors = uniquePositiveIds(vendorIds);
+  if (vendors.length === 0 || !Number.isFinite(contactId) || contactId <= 0) return;
   const vcEntity = entityMap.vendor_customers;
   const contactEntity = entityMap.contacts;
   if (!vcEntity || !contactEntity) return;
@@ -1345,96 +1634,61 @@ async function ensureVendorCustomerForOrderContact(dataSource, entityMap, vendor
   }
   let customerId = null;
   if (entityMap.customer) {
-    const customerRepo = dataSource.getRepository(entityMap.customer);
-    const existingCustomer = await customerRepo.findOne({
-      where: {
-        email,
-        deleted: false
-      }
+    const ensured = await ensureCustomerRecord(dataSource, entityMap.customer, {
+      name,
+      email,
+      phone,
+      userId: null
     });
-    if (existingCustomer) {
-      customerId = Number(existingCustomer.id);
-    } else if (entityMap.users) {
-      const userRepo = dataSource.getRepository(entityMap.users);
-      let user = await userRepo.findOne({
+    if (ensured) customerId = ensured.id;
+  }
+  for (const vendorId of vendors) {
+    if (customerId != null) {
+      const byCustomer = await vcRepo.findOne({
         where: {
-          email,
-          deleted: false
+          vendorId,
+          customerId
         }
       });
-      if (!user) {
-        let groupId = null;
-        if (entityMap.user_groups) {
-          const userGroupRepo = dataSource.getRepository(entityMap.user_groups);
-          const customerGroup = await userGroupRepo.findOne({
-            where: {
-              name: "Customer",
-              deleted: false
-            }
+      if (byCustomer) {
+        const existingContactId = byCustomer.contactId;
+        if (existingContactId == null) {
+          await vcRepo.update(byCustomer.id, {
+            contactId
           });
-          if (customerGroup) groupId = Number(customerGroup.id);
         }
-        user = await userRepo.save(userRepo.create({
-          name,
-          email,
-          phone,
-          password: null,
-          blocked: false,
-          groupId,
-          adminAccess: false
-        }));
+        continue;
       }
-      const userId = Number(user.id);
-      await linkUnclaimedContactToUser(dataSource, contactEntity, userId, email);
-      const ensured = await ensureCustomerForUser(dataSource, entityMap.customer, {
-        id: userId,
-        name,
-        email,
-        phone
-      }, {
-        phone
-      });
-      if (ensured) customerId = ensured.id;
     }
-  }
-  if (customerId != null) {
-    const byCustomer = await vcRepo.findOne({
+    const byContact = await vcRepo.findOne({
       where: {
         vendorId,
-        customerId
+        contactId
       }
     });
-    if (byCustomer) {
-      const existingContactId = byCustomer.contactId;
-      if (existingContactId == null) {
-        await vcRepo.update(byCustomer.id, {
-          contactId
+    if (byContact) {
+      if (customerId != null && byContact.customerId == null) {
+        await vcRepo.update(byContact.id, {
+          customerId
         });
       }
-      return;
+      continue;
     }
-  }
-  const byContact = await vcRepo.findOne({
-    where: {
-      vendorId,
-      contactId
+    if (customerId != null) {
+      await vcRepo.save(vcRepo.create({
+        vendorId,
+        customerId,
+        contactId
+      }));
+    } else {
+      await vcRepo.save(vcRepo.create({
+        vendorId,
+        contactId
+      }));
     }
-  });
-  if (byContact) return;
-  if (customerId != null) {
-    await vcRepo.save(vcRepo.create({
-      vendorId,
-      customerId,
-      contactId
-    }));
-    return;
   }
-  await vcRepo.save(vcRepo.create({
-    vendorId,
-    contactId
-  }));
 }
-__name(ensureVendorCustomerForOrderContact, "ensureVendorCustomerForOrderContact");
+__name(ensureVendorCustomersForOrder, "ensureVendorCustomersForOrder");
 
 // src/lib/currency-prices.ts
 function normalizeCurrencyCode(code) {
@@ -1876,6 +2130,7 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   let slug = baseSlug;
   let suffix = 0;
   while (true) {
+    await retireSoftDeletedUniqueValue(repo, "slug", slug);
     const where = excludeId != null ? {
       slug,
       vendorId,
@@ -1895,6 +2150,21 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   }
 }
 __name(ensureUniqueProductSlug, "ensureUniqueProductSlug");
+async function normalizeComboNameAndSlug(repo, body, vendorId, existing, excludeId) {
+  const incomingName = typeof body.name === "string" ? body.name.trim() : "";
+  const incomingSlugRaw = typeof body.slug === "string" ? body.slug.trim() : "";
+  const existingName = typeof existing?.name === "string" ? existing.name.trim() : "";
+  const existingSlug = typeof existing?.slug === "string" ? existing.slug.trim() : "";
+  const name = incomingName || existingName;
+  if (!name) return "Name is required";
+  if (incomingName) body.name = name;
+  const nameBasedSlug = slugifyProductLabel(name);
+  const typedSlug = incomingSlugRaw ? slugifyProductLabel(incomingSlugRaw) : "";
+  const slug = typedSlug || (excludeId != null ? existingSlug : "") || nameBasedSlug;
+  body.slug = await ensureUniqueProductSlug(repo, slug, vendorId, excludeId);
+  return null;
+}
+__name(normalizeComboNameAndSlug, "normalizeComboNameAndSlug");
 async function hydrateProductEventNames(dataSource, entityMap, products) {
   if (!products.length) return products;
   if (!entityMap.event_products || !entityMap.events) {
@@ -2141,6 +2411,20 @@ async function normalizeProductNameAndSlug(repo, body, vendorId, existing, exclu
   return null;
 }
 __name(normalizeProductNameAndSlug, "normalizeProductNameAndSlug");
+async function retireSoftDeletedUniquesFromBody(repo, body) {
+  const cols = new Set(repo.metadata.columns.map((c) => c.propertyName));
+  if (!cols.has("deleted")) return;
+  for (const col of [
+    "slug",
+    "email"
+  ]) {
+    if (!cols.has(col)) continue;
+    const raw = body[col];
+    if (typeof raw !== "string" || !raw.trim()) continue;
+    await retireSoftDeletedUniqueValue(repo, col, raw.trim());
+  }
+}
+__name(retireSoftDeletedUniquesFromBody, "retireSoftDeletedUniquesFromBody");
 function buildSoftDeletePayload(meta, deletedBy) {
   const payload = {
     deleted: true
@@ -2377,6 +2661,7 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
     case "category":
     case "cart":
     case "paymentMethod":
+    case "deviceType":
     case "order": {
       if (rule.subType === "nthOrder") {
         return true;
@@ -2560,87 +2845,22 @@ function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
   return totalDiscountApplied;
 }
 __name(applyDiscountToOrderLines, "applyDiscountToOrderLines");
-async function checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId) {
-  if (!entityMap["discounts"]) return null;
-  const discountRepo = dataSource.getRepository(entityMap["discounts"]);
-  const discount = await discountRepo.findOne({
-    where: {
-      id: discountId
-    }
-  });
-  if (!discount) return `Discount #${discountId} not found`;
-  await dataSource.query(`UPDATE discounts SET "usedCount" = "usedCount" + 1 WHERE id = $1`, [
-    discountId
-  ]);
-  return null;
+function asDiscountUsageEntityMap(entityMap) {
+  return entityMap;
 }
-__name(checkAndIncrementDiscountUsage, "checkAndIncrementDiscountUsage");
-async function decrementDiscountUsage(dataSource, entityMap, discountId, orderId) {
-  if (!entityMap["discounts"]) return;
-  try {
-    await dataSource.query(`UPDATE discounts SET "usedCount" = GREATEST("usedCount" - 1, 0) WHERE id = $1`, [
-      discountId
-    ]);
-    if (entityMap["order_discounts"]) {
-      await dataSource.getRepository(entityMap["order_discounts"]).delete({
-        orderId,
-        discountId
-      });
-    }
-  } catch (err) {
-    console.error("[discountEngine] decrementDiscountUsage failed:", err);
-  }
+__name(asDiscountUsageEntityMap, "asDiscountUsageEntityMap");
+async function checkAndIncrementDiscountUsage2(dataSource, entityMap, discountId, contactId) {
+  return checkAndIncrementDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), discountId, contactId);
 }
-__name(decrementDiscountUsage, "decrementDiscountUsage");
-async function recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
-  if (!entityMap["order_discounts"]) return;
-  try {
-    let discountCode = "";
-    if (entityMap["discounts"]) {
-      const discountRow = await dataSource.getRepository(entityMap["discounts"]).findOne({
-        where: {
-          id: discountId
-        }
-      });
-      discountCode = discountRow?.couponCode ?? "";
-    }
-    const odRepo = dataSource.getRepository(entityMap["order_discounts"]);
-    const orderItemRepo = dataSource.getRepository(entityMap.order_items);
-    const items = await orderItemRepo.find({
-      where: {
-        orderId
-      }
-    });
-    const discountedItems = items.filter((item) => Number(item.discount ?? 0) > 0);
-    if (discountedItems.length === 0) {
-      const firstItem = items[0];
-      if (!firstItem) return;
-      await odRepo.save(odRepo.create({
-        orderId,
-        orderItemId: firstItem.id,
-        discountId,
-        discountCode,
-        discountAmount,
-        userId: contactId
-      }));
-      return;
-    }
-    for (const item of discountedItems) {
-      const i = item;
-      await odRepo.save(odRepo.create({
-        orderId,
-        orderItemId: i.id,
-        discountId,
-        discountCode,
-        discountAmount: Number(i.discount ?? 0),
-        userId: contactId
-      }));
-    }
-  } catch (err) {
-    console.error("[discountEngine] recordDiscountUsage failed:", err);
-  }
+__name(checkAndIncrementDiscountUsage2, "checkAndIncrementDiscountUsage");
+async function decrementDiscountUsage2(dataSource, entityMap, discountId, orderId) {
+  return decrementDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), discountId, orderId);
 }
-__name(recordDiscountUsage, "recordDiscountUsage");
+__name(decrementDiscountUsage2, "decrementDiscountUsage");
+async function recordDiscountUsage2(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
+  return recordDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), orderId, discountId, contactId, discountAmount);
+}
+__name(recordDiscountUsage2, "recordDiscountUsage");
 async function validateCoupon(dataSource, entityMap, couponCode, orderLines, currency = "INR", contactId, isAutomatic, discountId, vendorId) {
   if (!entityMap["discounts"]) return {
     valid: false,
@@ -2685,21 +2905,12 @@ async function validateCoupon(dataSource, entityMap, couponCode, orderLines, cur
     };
   }
   if (contactId != null && d.maxUsagePerUser != null) {
-    try {
-      const userUsage = await dataSource.query(`SELECT COUNT(DISTINCT od."orderId") as count FROM order_discounts od
-         WHERE od."discountId" = $1 
-         AND od."userId" = $2`, [
-        d.id,
-        contactId
-      ]);
-      const usageCount = Number(userUsage?.[0]?.count ?? 0);
-      if (usageCount >= d.maxUsagePerUser) {
-        return {
-          valid: false,
-          error: "You have reached the maximum usage limit for this discount"
-        };
-      }
-    } catch {
+    const usageCount = await countDiscountOrdersForContact(dataSource, d.id, contactId);
+    if (usageCount >= d.maxUsagePerUser) {
+      return {
+        valid: false,
+        error: "You have reached the maximum usage limit for this discount"
+      };
     }
   }
   const flatRules = entityMap["discount_rules"] ? await dataSource.getRepository(entityMap["discount_rules"]).find({
@@ -2777,128 +2988,32 @@ function normalizeOrderLinesInput(raw) {
     if (!Number.isFinite(productId) || productId <= 0) continue;
     const qRaw = Number(r.quantity ?? 1);
     const q = Number.isFinite(qRaw) ? Math.min(99999, Math.max(1, Math.floor(qRaw))) : 1;
-    merged.set(productId, (merged.get(productId) ?? 0) + q);
+    const vidRaw = r.variantId ?? r.variant_id;
+    const vid = vidRaw != null && String(vidRaw).trim() !== "" ? Number(vidRaw) : NaN;
+    const variantId = Number.isFinite(vid) && vid > 0 ? vid : null;
+    const key = `${productId}:${variantId ?? 0}`;
+    const prev = merged.get(key);
+    if (prev) prev.quantity += q;
+    else merged.set(key, {
+      productId,
+      quantity: q,
+      variantId
+    });
   }
   return [
-    ...merged.entries()
-  ].map(([productId, quantity]) => ({
-    productId,
-    quantity
-  }));
+    ...merged.values()
+  ];
 }
 __name(normalizeOrderLinesInput, "normalizeOrderLinesInput");
-var ORDER_STATUS_CONFIRMED = "confirmed";
-function orderInventorySnapshotFromRow(order) {
-  return {
-    status: order.status ?? "pending",
-    lines: (order.items ?? []).map((i) => ({
-      productId: Number(i.productId),
-      quantity: Math.max(0, Math.floor(Number(i.quantity) || 0))
-    })).filter((l) => l.productId > 0 && l.quantity > 0)
-  };
-}
-__name(orderInventorySnapshotFromRow, "orderInventorySnapshotFromRow");
-function mergeInventoryLinesByProduct(lines) {
-  const m = /* @__PURE__ */ new Map();
-  for (const { productId, quantity } of lines) {
-    if (!Number.isFinite(productId) || productId <= 0 || quantity <= 0) continue;
-    m.set(productId, (m.get(productId) ?? 0) + quantity);
-  }
-  return m;
-}
-__name(mergeInventoryLinesByProduct, "mergeInventoryLinesByProduct");
-async function validateInventoryForConfirmedOrderLines(dataSource, entityMap, calcLines) {
-  const productRepo = dataSource.getRepository(entityMap.products);
-  const merged = mergeInventoryLinesByProduct(calcLines.filter((l) => l.found && l.productId != null).map((l) => ({
-    productId: l.productId,
-    quantity: l.quantity
-  })));
-  for (const [productId, qty] of merged) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    const cur = Number(row.quantity ?? 0);
-    if (cur < qty) {
-      const name = row.name ?? String(productId);
-      return `Insufficient stock for ${name}: available ${cur}, required ${qty}`;
-    }
-  }
-  return null;
-}
-__name(validateInventoryForConfirmedOrderLines, "validateInventoryForConfirmedOrderLines");
-async function applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, sign, validateDeduct) {
-  const productRepo = dataSource.getRepository(entityMap.products);
-  for (const [productId, qty] of merged) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    const cur = Number(row.quantity ?? 0);
-    if (sign === -1) {
-      if (validateDeduct && cur < qty) {
-        const name = row.name ?? String(productId);
-        return `Insufficient stock for ${name}: available ${cur}, required ${qty}`;
-      }
-      await productRepo.update(productId, {
-        quantity: Math.max(0, cur - qty)
-      });
-    } else {
-      await productRepo.update(productId, {
-        quantity: cur + qty
-      });
-    }
-  }
-  return null;
-}
-__name(applyInventoryDeltaForMergedLines, "applyInventoryDeltaForMergedLines");
-async function validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, prevSnap, nextLines) {
-  const mergedNext = mergeInventoryLinesByProduct(nextLines);
-  const productRepo = dataSource.getRepository(entityMap.products);
-  const prevByProduct = prevSnap?.status === ORDER_STATUS_CONFIRMED ? mergeInventoryLinesByProduct(prevSnap.lines) : /* @__PURE__ */ new Map();
-  for (const [productId, need] of mergedNext) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    let available = Number(row.quantity ?? 0);
-    available += prevByProduct.get(productId) ?? 0;
-    if (available < need) {
-      const name = row.name ?? String(productId);
-      return `Insufficient stock for ${name}: available ${available}, required ${need}`;
-    }
-  }
-  return null;
-}
-__name(validateInventoryForOrderBecomingConfirmed, "validateInventoryForOrderBecomingConfirmed");
-async function reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, prev, next) {
-  const wasConfirmed = prev.status === ORDER_STATUS_CONFIRMED;
-  const isConfirmed = next.status === ORDER_STATUS_CONFIRMED;
-  if (wasConfirmed) {
-    const merged = mergeInventoryLinesByProduct(prev.lines);
-    const err = await applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, 1, false);
-    if (err) return err;
-  }
-  if (isConfirmed) {
-    const merged = mergeInventoryLinesByProduct(next.lines);
-    const err = await applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, -1, true);
-    if (err) return err;
-  }
-  return null;
+var ORDER_STATUS_CONFIRMED = "confirmed";
+async function validateInventoryForConfirmedOrderLines2(dataSource, entityMap, calcLines) {
+  const lines = calcLines.filter((l) => l.found && l.productId != null).map((l) => ({
+    productId: l.productId,
+    quantity: l.quantity
+  }));
+  return validateInventoryForConfirmedOrderLines(dataSource, entityMap, lines);
 }
-__name(reconcileOrderInventoryBetweenSnapshots, "reconcileOrderInventoryBetweenSnapshots");
+__name(validateInventoryForConfirmedOrderLines2, "validateInventoryForConfirmedOrderLines");
 async function resolveProductTaxRate(dataSource, entityMap, productId, productVendorId) {
   if (!entityMap.product_config || !entityMap.taxes) {
     return {
@@ -3800,23 +3915,24 @@ function createCrudHandler(dataSource, entityMap, options) {
       if (resource === "vendor_customers" && entityMap["customer"]) {
         const scope = await resolveVendorCustomersScope(dataSource, entityMap, resolveScope);
         const repo2 = dataSource.getRepository(entity);
-        const qb = repo2.createQueryBuilder("vc").leftJoinAndSelect("vc.customer", "customer").leftJoinAndSelect("customer.user", "user").orderBy("vc.createdAt", sortOrder === "DESC" ? "DESC" : "ASC").skip(skip).take(limit);
+        const qb = repo2.createQueryBuilder("vc").leftJoinAndSelect("vc.customer", "customer").leftJoinAndSelect("customer.user", "user").leftJoinAndSelect("vc.contact", "contact").orderBy("vc.createdAt", sortOrder === "DESC" ? "DESC" : "ASC").skip(skip).take(limit);
         applyVendorScopeToQueryBuilder(qb, "vc", scope);
         if (search && typeof search === "string" && search.trim()) {
           const term = `%${search.trim()}%`;
-          qb.andWhere("(customer.name ILIKE :term OR customer.email ILIKE :term OR customer.phone ILIKE :term)", {
+          qb.andWhere("(customer.name ILIKE :term OR customer.email ILIKE :term OR customer.phone ILIKE :term OR contact.name ILIKE :term OR contact.email ILIKE :term OR contact.phone ILIKE :term)", {
             term
           });
         }
         const [rows, total2] = await qb.getManyAndCount();
         const data2 = rows.map((row) => {
           const customer = row.customer;
+          const contact = row.contact;
           return {
             ...row,
-            name: customer?.name ?? null,
-            email: customer?.email ?? null,
-            phone: customer?.phone ?? null,
-            company: customer?.company ?? null
+            name: customer?.name ?? contact?.name ?? null,
+            email: customer?.email ?? contact?.email ?? null,
+            phone: customer?.phone ?? contact?.phone ?? null,
+            company: customer?.company ?? contact?.company ?? null
           };
         });
         return json({
@@ -4150,7 +4266,11 @@ function createCrudHandler(dataSource, entityMap, options) {
         } else if (resource === "collections") {
           if (scope.type === "vendor") {
             where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
-          } else if (searchParams.get("isCatalog") !== "true") {
+          } else if (searchParams.get("isCatalog") === "true") {
+            where = mergeListWhereAnd(where, {
+              isCatalog: true
+            });
+          } else if (searchParams.get("isCatalog") === "false") {
             where = mergeListWhereAnd(where, {
               isCatalog: false
             });
@@ -4347,41 +4467,17 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 503
           });
         }
-        if (!entityMap["users"]) {
-          return json({
-            error: "Users entity not configured"
-          }, {
-            status: 503
-          });
-        }
-        let customerGroupId = null;
-        if (entityMap["user_groups"]) {
-          const userGroupRepo = dataSource.getRepository(entityMap["user_groups"]);
-          const customerGroup = await userGroupRepo.findOne({
-            where: {
-              name: "Customer",
-              deleted: false
-            }
-          });
-          if (!customerGroup) {
-            return json({
-              error: "User group 'customer' not found"
-            }, {
-              status: 500
-            });
-          }
-          customerGroupId = Number(customerGroup.id);
-        } else {
+        if (!entityMap["contacts"]) {
           return json({
-            error: "user_groups entity not configured"
+            error: "Contacts entity not configured"
           }, {
             status: 503
           });
         }
         const name = String(body.name ?? "").trim();
-        const email = String(body.email ?? "").trim();
-        const phone = String(body.phone ?? "").trim();
-        const rawPw = String(body._password ?? "").trim();
+        const email = String(body.email ?? "").trim().toLowerCase();
+        const phoneRaw = String(body.phone ?? "").trim();
+        const phone = phoneRaw || null;
         if (!name) return json({
           error: "name is required"
         }, {
@@ -4392,25 +4488,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         }, {
           status: 400
         });
-        if (!phone) return json({
-          error: "phone is required"
-        }, {
-          status: 400
-        });
-        if (!rawPw) return json({
-          error: "password is required"
-        }, {
-          status: 400
-        });
-        if (rawPw.length < 6) {
-          return json({
-            error: "Password must be at least 6 characters"
-          }, {
-            status: 400
-          });
-        }
         const customerRepo = dataSource.getRepository(entityMap["customer"]);
-        const userRepo = dataSource.getRepository(entityMap["users"]);
         const dupCustEmail = await customerRepo.findOne({
           where: {
             email,
@@ -4424,49 +4502,26 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 409
           });
         }
-        const dupCustPhone = await customerRepo.findOne({
-          where: {
-            phone,
-            deleted: false
-          }
-        });
-        if (dupCustPhone) {
-          return json({
-            error: "A customer with this phone number already exists"
-          }, {
-            status: 409
+        if (phone) {
+          const dupCustPhone = await customerRepo.findOne({
+            where: {
+              phone,
+              deleted: false
+            }
           });
-        }
-        let userId;
-        const dupUser = await userRepo.findOne({
-          where: {
-            email,
-            deleted: false
+          if (dupCustPhone) {
+            return json({
+              error: "A customer with this phone number already exists"
+            }, {
+              status: 409
+            });
           }
-        });
-        if (dupUser) {
-          userId = Number(dupUser.id);
-        } else {
-          const bcrypt = await import('bcryptjs');
-          const hashedPassword = await bcrypt.hash(rawPw, 10);
-          const savedUser = await userRepo.save(userRepo.create({
-            name,
-            email,
-            phone,
-            password: hashedPassword,
-            groupId: customerGroupId,
-            adminAccess: false,
-            blocked: false
-          }));
-          userId = Number(savedUser.id);
         }
-        const savedCustomer = await ensureCustomerForUser(dataSource, entityMap["customer"], {
-          id: userId,
+        const savedCustomer = await ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
-          phone
-        }, {
-          phone
+          phone,
+          userId: null
         });
         if (!savedCustomer) {
           return json({
@@ -4475,37 +4530,37 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 409
           });
         }
-        const customerRepo2 = dataSource.getRepository(entityMap["customer"]);
-        const customerRow = await customerRepo2.findOne({
+        const contactRepo = dataSource.getRepository(entityMap["contacts"]);
+        let contact = await contactRepo.findOne({
           where: {
-            id: savedCustomer.id,
+            email,
             deleted: false
           }
-        }) ?? savedCustomer;
-        if (entityMap["contacts"]) {
-          const contactRepo = dataSource.getRepository(entityMap["contacts"]);
-          const existingContact = await contactRepo.findOne({
-            where: {
-              email,
-              deleted: false
-            }
-          });
-          if (!existingContact) {
-            await contactRepo.save(contactRepo.create({
-              name,
-              email,
-              phone: phone || null,
-              type: "customer"
-            }));
-          } else {
-            const t = existingContact.type;
-            if (t == null || t === "" || String(t).toLowerCase() !== "customer") {
-              await contactRepo.update(existingContact.id, {
-                type: "customer"
-              });
-            }
-          }
+        });
+        if (!contact) {
+          contact = await contactRepo.save(contactRepo.create({
+            name,
+            email,
+            phone: phone || null,
+            type: "customer"
+          }));
+        } else {
+          const t = contact.type;
+          const patch = {
+            name,
+            phone: phone || contact.phone || null
+          };
+          if (t == null || t === "" || String(t).toLowerCase() !== "customer") {
+            patch.type = "customer";
+          }
+          await contactRepo.update(contact.id, patch);
+          contact = {
+            ...contact,
+            ...patch,
+            id: contact.id
+          };
         }
+        const contactId = Number(contact.id);
         const scope = await resolveVendorCustomersScope(dataSource, entityMap, resolveScope);
         let vendorId = null;
         if (scope.type === "vendor") {
@@ -4521,19 +4576,25 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 400
           });
         }
-        const vcRepo = dataSource.getRepository(entity);
-        const existingLink = await vcRepo.findOne({
+        await ensureVendorCustomersForOrder(dataSource, entityMap, [
+          vendorId
+        ], contactId, {
+          name,
+          email,
+          phone
+        });
+        const customerRow = await customerRepo.findOne({
           where: {
-            customerId: savedCustomer.id
+            id: savedCustomer.id,
+            deleted: false
           }
         });
-        if (!existingLink) {
-          await vcRepo.save(vcRepo.create({
-            customerId: savedCustomer.id,
-            vendorId
-          }));
-        }
-        return json(customerRow, {
+        return json(customerRow ?? {
+          id: savedCustomer.id,
+          name,
+          email,
+          phone
+        }, {
           status: 201
         });
       }
@@ -4938,6 +4999,22 @@ function createCrudHandler(dataSource, entityMap, options) {
           status: 400
         });
       }
+      if (resource === "combos") {
+        const vendorIdForSlug = scopeCreate.type === "vendor" ? scopeCreate.vendorId : Number(persistBody.vendorId);
+        if (!Number.isFinite(vendorIdForSlug) || vendorIdForSlug <= 0) {
+          return json({
+            error: "vendorId is required"
+          }, {
+            status: 400
+          });
+        }
+        const comboSlugErr = await normalizeComboNameAndSlug(repo, persistBody, vendorIdForSlug);
+        if (comboSlugErr) return json({
+          error: comboSlugErr
+        }, {
+          status: 400
+        });
+      }
       sanitizeBodyForEntity(repo, persistBody);
       let created;
       try {
@@ -4981,6 +5058,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           const nameRaw = String(body["contact.name"] ?? contact.name ?? "").trim();
           const phoneRaw = body["contact.phone"] ?? contact.phone;
+          const emailForVc = (emailRaw || String(contact.email ?? "")).trim().toLowerCase();
           const phoneToSave = phoneRaw == null || phoneRaw === "" ? null : String(phoneRaw).trim();
           if (phoneToSave && contact.phone !== phoneToSave) {
             await contactRepo.update(contact.id, {
@@ -4989,21 +5067,45 @@ function createCrudHandler(dataSource, entityMap, options) {
             contact.phone = phoneToSave;
           }
           const vendorIdForCustomer = resolveVendorIdForContactCheck(scopeCreate, persistBody);
-          const selectedExistingCustomer = Number(body.customerId);
-          if (vendorIdForCustomer != null && (!Number.isFinite(selectedExistingCustomer) || selectedExistingCustomer <= 0)) {
-            await ensureVendorCustomerForOrderContact(dataSource, entityMap, vendorIdForCustomer, contact.id, {
-              name: nameRaw || emailRaw.split("@")[0] || "Customer",
-              email: emailRaw,
+          const orderLinesForVendors = normalizeOrderLinesInput(body.orderLines);
+          const vendorIdsForVc = [];
+          if (vendorIdForCustomer != null) vendorIdsForVc.push(vendorIdForCustomer);
+          if (orderLinesForVendors?.length && entityMap.products) {
+            const productRepoForVc = dataSource.getRepository(entityMap.products);
+            for (const line of orderLinesForVendors) {
+              const pid = Number(line.productId);
+              if (!Number.isFinite(pid)) continue;
+              const product = await productRepoForVc.findOne({
+                where: {
+                  id: pid
+                }
+              });
+              const pVid = Number(product?.vendorId);
+              if (Number.isFinite(pVid) && pVid > 0) vendorIdsForVc.push(pVid);
+            }
+          }
+          if (vendorIdsForVc.length > 0 && emailForVc) {
+            await ensureVendorCustomersForOrder(dataSource, entityMap, vendorIdsForVc, contact.id, {
+              name: nameRaw || emailForVc.split("@")[0] || "Customer",
+              email: emailForVc,
               phone: phoneRaw == null || phoneRaw === "" ? null : String(phoneRaw)
             });
-          } else if (vendorIdForCustomer != null) {
-            const contactErr = await assertContactAllowedForVendorOrder(dataSource, entityMap, vendorIdForCustomer, contact.id);
-            if (contactErr) {
-              return json({
-                error: contactErr
-              }, {
-                status: 400
-              });
+          }
+          const accountCustomerId = Number(body.accountCustomerId);
+          if (entityMap.customer_contacts && Number.isFinite(accountCustomerId) && accountCustomerId > 0) {
+            const ccRepo = dataSource.getRepository(entityMap.customer_contacts);
+            const orderContactId = contact.id;
+            const existingLink = await ccRepo.findOne({
+              where: {
+                customerId: accountCustomerId,
+                contactId: orderContactId
+              }
+            });
+            if (!existingLink) {
+              await ccRepo.save(ccRepo.create({
+                customerId: accountCustomerId,
+                contactId: orderContactId
+              }));
             }
           }
           const randomPart = Math.floor(1e4 + Math.random() * 9e4);
@@ -5011,6 +5113,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           persistBody.orderNumber = `ORD00${randomPart}`;
           persistBody.qrToken = crypto2.randomBytes(16).toString("hex");
         }
+        await retireSoftDeletedUniquesFromBody(repo, persistBody);
         created = await repo.save(repo.create(persistBody));
         if (resource === "orders") {
           const orderItemRepo = dataSource.getRepository(entityMap.order_items);
@@ -5052,8 +5155,8 @@ function createCrudHandler(dataSource, entityMap, options) {
             }
           }
           const createdStatus = String(persistBody.status ?? "pending");
-          if (createdStatus === ORDER_STATUS_CONFIRMED) {
-            const stockErr = await validateInventoryForConfirmedOrderLines(dataSource, entityMap, lines);
+          if (orderStatusHoldsStock(createdStatus)) {
+            const stockErr = await validateInventoryForConfirmedOrderLines2(dataSource, entityMap, lines);
             if (stockErr) {
               await repo.delete(created.id);
               return json({
@@ -5075,6 +5178,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             await orderItemRepo.save(orderItemRepo.create({
               orderId: created.id,
               productId: line.productId,
+              variantId: null,
               quantity: line.quantity,
               unitPrice: line.unitPrice,
               subTotal: line.subtotal,
@@ -5168,7 +5272,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           if (orderDiscountId) {
             if (createdStatus === ORDER_STATUS_CONFIRMED) {
-              const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, orderDiscountId, persistBody.contactId);
+              const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, orderDiscountId, persistBody.contactId);
               if (usageErr) {
                 await repo.delete(created.id);
                 return json({
@@ -5178,7 +5282,7 @@ function createCrudHandler(dataSource, entityMap, options) {
                 });
               }
             }
-            await recordDiscountUsage(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
+            await recordDiscountUsage2(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
           }
           const orderIdForNotify = created.id;
           void import('./emit-order-notification-trigger-IVLWKKJL.js').then(({ fireOrderNotificationTrigger }) => {
@@ -5187,6 +5291,16 @@ function createCrudHandler(dataSource, entityMap, options) {
               entityMap
             });
           });
+          if (getCms) {
+            void import('./send-order-placed-emails-WPI37KRZ.js').then(({ sendOrderPlacedEmailsAfterConfirmation }) => {
+              return sendOrderPlacedEmailsAfterConfirmation(orderIdForNotify, {
+                getDataSource: /* @__PURE__ */ __name(async () => dataSource, "getDataSource"),
+                entityMap,
+                getCms: /* @__PURE__ */ __name(async () => await getCms(), "getCms")
+              });
+            }).catch(() => {
+            });
+          }
         }
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -5832,6 +5946,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         sanitizeBodyForEntity(repo, updatePayload2);
+        await retireSoftDeletedUniquesFromBody(repo, updatePayload2);
         await repo.update(numericId, updatePayload2);
         if (Array.isArray(rawBody.tags)) {
           const tagNames = rawBody.tags.map((t) => String(t).trim()).filter(Boolean);
@@ -5920,7 +6035,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           } : await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, effectiveCurrency, putDiscountId, Number.isFinite(putOrderVendorId) ? putOrderVendorId : null);
           const scalarUpdate = pickColumnUpdates(repo, rawBody);
           const nextStatus = typeof scalarUpdate.status === "string" && scalarUpdate.status ? String(scalarUpdate.status) : orderInvPrev?.status ?? "pending";
-          if (nextStatus === ORDER_STATUS_CONFIRMED && lines.length > 0) {
+          if (orderStatusHoldsStock(nextStatus) && lines.length > 0) {
             const verr = await validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, lines.filter((l) => l.found && l.productId != null).map((l) => ({
               productId: l.productId,
               quantity: l.quantity
@@ -6049,17 +6164,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
               }) : null;
               const existingDiscountId = existingOd ? existingOd.discountId : null;
               if (!putDiscountId && existingDiscountId && wasConfirmed) {
-                await decrementDiscountUsage(dataSource, entityMap, existingDiscountId, numericId);
+                await decrementDiscountUsage2(dataSource, entityMap, existingDiscountId, numericId);
                 if (entityMap["order_discounts"] && existingOd) {
                   await dataSource.getRepository(entityMap["order_discounts"]).delete(existingOd.id);
                 }
               }
               if (putDiscountId && existingDiscountId && putDiscountId !== existingDiscountId) {
                 if (wasConfirmed) {
-                  await decrementDiscountUsage(dataSource, entityMap, existingDiscountId, numericId);
+                  await decrementDiscountUsage2(dataSource, entityMap, existingDiscountId, numericId);
                 }
                 if (isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
@@ -6072,12 +6187,12 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                     discountAmount: discount
                   });
                 } else {
-                  await recordDiscountUsage(dataSource, entityMap, numericId, putDiscountId, cid, discount);
+                  await recordDiscountUsage2(dataSource, entityMap, numericId, putDiscountId, cid, discount);
                 }
               }
               if (putDiscountId && existingDiscountId && putDiscountId === existingDiscountId) {
                 if (!wasConfirmed && isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
@@ -6085,7 +6200,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                   });
                 }
                 if (wasConfirmed && !isNowConfirmed) {
-                  await decrementDiscountUsage(dataSource, entityMap, putDiscountId, numericId);
+                  await decrementDiscountUsage2(dataSource, entityMap, putDiscountId, numericId);
                 }
                 if (existingOd && entityMap["order_discounts"]) {
                   await dataSource.getRepository(entityMap["order_discounts"]).update(existingOd.id, {
@@ -6095,14 +6210,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
               }
               if (putDiscountId && !existingDiscountId) {
                 if (isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
                     status: 400
                   });
                 }
-                await recordDiscountUsage(dataSource, entityMap, numericId, putDiscountId, cid, discount);
+                await recordDiscountUsage2(dataSource, entityMap, numericId, putDiscountId, cid, discount);
               }
             }
           }
@@ -6573,7 +6688,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       if (resource === "orders" && orderInvPrev) {
         const nextSt = typeof updatePayload.status === "string" && updatePayload.status ? String(updatePayload.status) : orderInvPrev.status;
-        if (nextSt === ORDER_STATUS_CONFIRMED && orderInvPrev.lines.length > 0) {
+        if (orderStatusHoldsStock(nextSt) && orderInvPrev.lines.length > 0) {
           const verr = await validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, orderInvPrev.lines);
           if (verr) return json({
             error: verr
@@ -6582,6 +6697,33 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           });
         }
       }
+      if (resource === "combos") {
+        const currentCombo = await repo.findOne({
+          where: {
+            id: numericId,
+            deleted: false
+          }
+        });
+        if (!currentCombo) return json({
+          message: "Not found"
+        }, {
+          status: 404
+        });
+        const vendorIdForSlug = scopePut.type === "vendor" ? scopePut.vendorId : Number(currentCombo.vendorId);
+        if (!Number.isFinite(vendorIdForSlug) || vendorIdForSlug <= 0) {
+          return json({
+            error: "vendorId is required"
+          }, {
+            status: 400
+          });
+        }
+        const comboSlugErr = await normalizeComboNameAndSlug(repo, updatePayload, vendorIdForSlug, currentCombo, numericId);
+        if (comboSlugErr) return json({
+          error: comboSlugErr
+        }, {
+          status: 400
+        });
+      }
       if (Object.keys(updatePayload).length > 0) {
         if (resource === "payments" && updatePayload.status === "paid" && updatePayload.paidAt == null) {
           const existingPayment = await repo.findOne({
@@ -6595,6 +6737,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         sanitizeBodyForEntity(repo, updatePayload);
+        await retireSoftDeletedUniquesFromBody(repo, updatePayload);
         await repo.update(numericId, updatePayload);
       }
       if (resource === "orders" && rawBody && entityMap["order_addresses"]) {
@@ -6770,7 +6913,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             });
             if (od) {
               const odRow = od;
-              await decrementDiscountUsage(dataSource, entityMap, odRow.discountId, numericId);
+              await decrementDiscountUsage2(dataSource, entityMap, odRow.discountId, numericId);
             }
           }
         }
@@ -6783,6 +6926,22 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         await repo.update(numericId, buildSoftDeletePayload(repo.metadata, deletedBy));
+        const softDeletedCols = repo.metadata.columns.map((c) => c.propertyName);
+        const uniqueColsToRetire = [
+          "slug",
+          "email"
+        ].filter((col) => softDeletedCols.includes(col));
+        if (existing && uniqueColsToRetire.length > 0) {
+          for (const col of uniqueColsToRetire) {
+            const raw = existing[col];
+            if (typeof raw !== "string") continue;
+            const value = raw.trim();
+            if (!value || value.includes("__deleted_")) continue;
+            await repo.update(numericId, {
+              [col]: `${value}__deleted_${numericId}`
+            });
+          }
+        }
         return json({
           message: "Deleted successfully"
         }, {
@@ -6813,6 +6972,63 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
   };
 }
 __name(createCrudByIdHandler, "createCrudByIdHandler");
+async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
+  const repo = dataSource.getRepository(contactsEntity);
+  const found = await repo.findOne({
+    where: {
+      email,
+      userId: IsNull(),
+      deleted: false
+    }
+  });
+  if (found) await repo.update(found.id, {
+    userId
+  });
+}
+__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
+function buildUserInviteLink(baseUrl, token) {
+  const base = baseUrl.replace(/\/+$/, "");
+  return `${base}/admin/invite?token=${encodeURIComponent(token)}`;
+}
+__name(buildUserInviteLink, "buildUserInviteLink");
+function newUserInviteToken() {
+  return randomBytes(32).toString("hex");
+}
+__name(newUserInviteToken, "newUserInviteToken");
+async function findUserByInviteToken(dataSource, userEntity, token) {
+  const trimmed = token.trim();
+  if (!trimmed) return null;
+  const repo = dataSource.getRepository(userEntity);
+  const row = await repo.findOne({
+    where: {
+      inviteToken: trimmed,
+      deleted: false
+    },
+    select: [
+      "id",
+      "email",
+      "blocked",
+      "password",
+      "inviteStatus",
+      "inviteToken"
+    ]
+  });
+  if (!row) return null;
+  const u = row;
+  return u;
+}
+__name(findUserByInviteToken, "findUserByInviteToken");
+async function completeUserInviteAccept(dataSource, userEntity, userId, passwordHash) {
+  await dataSource.getRepository(userEntity).update(userId, {
+    password: passwordHash,
+    blocked: false,
+    inviteStatus: "active",
+    inviteToken: null
+  });
+}
+__name(completeUserInviteAccept, "completeUserInviteAccept");
+
+// src/lib/vendor-invite-token.ts
 var VENDOR_INVITE_METADATA_TOKEN = "inviteToken";
 var VENDOR_INVITE_METADATA_EXPIRES = "inviteExpiresAt";
 var VENDOR_INVITE_METADATA_SENT = "inviteSentAt";
@@ -6837,6 +7053,13 @@ function invalidatedInviteMessage() {
   return "This invitation is no longer valid. Ask an admin to resend the invite.";
 }
 __name(invalidatedInviteMessage, "invalidatedInviteMessage");
+function userAlreadyActive(user) {
+  const hasPassword = !!(user.password && String(user.password).trim());
+  if (user.inviteStatus === "active" && hasPassword) return true;
+  if (user.inviteStatus === "pending") return false;
+  return !user.blocked && hasPassword;
+}
+__name(userAlreadyActive, "userAlreadyActive");
 async function validateInviteTokenForActivation(dataSource, entityMap, token) {
   const trimmedToken = String(token ?? "").trim();
   if (!trimmedToken) {
@@ -6883,15 +7106,15 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
           "id",
           "email",
           "blocked",
-          "password"
+          "password",
+          "inviteStatus"
         ]
       });
       if (!user2) return {
         ok: false,
         error: "User not found"
       };
-      const hasPassword2 = !!user2.password;
-      if (!user2.blocked && hasPassword2) {
+      if (userAlreadyActive(user2)) {
         return {
           ok: false,
           error: "User is already active"
@@ -6907,6 +7130,24 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
       };
     }
   }
+  if (userRepo && entityMap.users) {
+    const userMatch = await findUserByInviteToken(dataSource, entityMap.users, trimmedToken);
+    if (userMatch) {
+      if (userMatch.inviteStatus === "active" || userAlreadyActive(userMatch)) {
+        return {
+          ok: false,
+          error: "This invitation has already been accepted"
+        };
+      }
+      return {
+        ok: true,
+        target: {
+          userId: userMatch.id,
+          email: userMatch.email
+        }
+      };
+    }
+  }
   let email;
   try {
     email = Buffer.from(trimmedToken, "base64").toString("utf8").trim();
@@ -6936,22 +7177,30 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
       "id",
       "email",
       "blocked",
-      "password"
+      "password",
+      "inviteStatus",
+      "inviteToken"
     ]
   });
   if (!user) return {
     ok: false,
     error: "User not found"
   };
-  const hasPassword = !!user.password;
-  if (!user.blocked && hasPassword) {
+  const u = user;
+  if (userAlreadyActive(u)) {
     return {
       ok: false,
       error: "User is already active"
     };
   }
+  if (u.inviteToken && String(u.inviteToken).trim()) {
+    return {
+      ok: false,
+      error: invalidatedInviteMessage()
+    };
+  }
   if (entityMap.vendors) {
-    const ownerVendor = await loadOwnerVendorForUser(dataSource, entityMap.vendors, user.id);
+    const ownerVendor = await loadOwnerVendorForUser(dataSource, entityMap.vendors, u.id);
     if (ownerVendor && readVendorInviteToken(ownerVendor.metadata)) {
       return {
         ok: false,
@@ -6962,8 +7211,8 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
   return {
     ok: true,
     target: {
-      userId: user.id,
-      email: String(user.email)
+      userId: u.id,
+      email: String(u.email)
     }
   };
 }
@@ -7181,10 +7430,7 @@ function createInviteAcceptHandler(config) {
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
-      await dataSource.getRepository(entityMap.users).update(userId, {
-        password: hashedPassword,
-        blocked: false
-      });
+      await completeUserInviteAccept(dataSource, entityMap.users, userId, hashedPassword);
       if (vendorId != null && entityMap.vendors) {
         await completeVendorInviteAccept(dataSource, entityMap.vendors, vendorId);
       }
@@ -8611,6 +8857,9 @@ function createUploadHandler(config) {
     "image/png",
     "image/gif",
     "image/webp",
+    "video/mp4",
+    "video/webm",
+    "video/quicktime",
     "application/pdf",
     "text/plain",
     "application/zip",
@@ -8638,8 +8887,11 @@ function createUploadHandler(config) {
       });
       const defaultMax = 10 * 1024 * 1024;
       const maxZipBytes = 80 * 1024 * 1024;
+      const maxVideoBytes = 100 * 1024 * 1024;
       const baseMax = maxSizeBytes ?? defaultMax;
-      const effectiveMax = file.type === "application/zip" || file.type === "application/x-zip-compressed" ? Math.max(baseMax, maxZipBytes) : baseMax;
+      const isZip = file.type === "application/zip" || file.type === "application/x-zip-compressed";
+      const isVideo = file.type === "video/mp4" || file.type === "video/webm" || file.type === "video/quicktime";
+      const effectiveMax = isZip ? Math.max(baseMax, maxZipBytes) : isVideo ? Math.max(baseMax, maxVideoBytes) : baseMax;
       if (file.size > effectiveMax) return json({
         error: "File size exceeds limit"
       }, {
@@ -8712,12 +8964,20 @@ function createUploadHandler(config) {
         parentId
       });
     } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
       console.error("[upload] File upload failed", {
-        error: err instanceof Error ? err.message : String(err),
+        error: message,
         stack: err instanceof Error ? err.stack : void 0,
         name: err instanceof Error ? err.name : void 0,
         metadata: err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0
       });
+      if (/Failed to parse body as FormData/i.test(message)) {
+        return json({
+          error: "File upload failed: request body could not be read as FormData. Exclude /api/upload from middleware matcher and raise proxyClientMaxBodySize."
+        }, {
+          status: 500
+        });
+      }
       return json({
         error: "File upload failed"
       }, {
@@ -8938,6 +9198,17 @@ function createFormSaveHandlers(config) {
         });
         const fields = Array.isArray(body.fields) ? body.fields : [];
         const { fields: _f, ...formRow } = body;
+        const slug = typeof formRow.slug === "string" ? formRow.slug.trim() : "";
+        if (slug) {
+          if (await activeUniqueValueExists(formRepo(), "slug", slug)) {
+            return json({
+              error: "A form with this slug already exists"
+            }, {
+              status: 400
+            });
+          }
+          await retireSoftDeletedUniqueValue(formRepo(), "slug", slug);
+        }
         const form = await formRepo().save(formRepo().create(formRow));
         for (let i = 0; i < fields.length; i++) {
           const row = normalizeFieldRow(fields[i], form.id);
@@ -8961,6 +9232,14 @@ function createFormSaveHandlers(config) {
           status: 201
         });
       } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg)) {
+          return json({
+            error: "A form with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         return json({
           error: "Server Error"
         }, {
@@ -9009,6 +9288,20 @@ function createFormSaveHandlers(config) {
         ]) {
           if (body[key] !== void 0) formRow[key] = body[key];
         }
+        if (typeof formRow.slug === "string") {
+          const slug = formRow.slug.trim();
+          formRow.slug = slug;
+          if (slug) {
+            if (await activeUniqueValueExists(formRepo(), "slug", slug, formId)) {
+              return json({
+                error: "A form with this slug already exists"
+              }, {
+                status: 400
+              });
+            }
+            await retireSoftDeletedUniqueValue(formRepo(), "slug", slug);
+          }
+        }
         if (Object.keys(formRow).length > 0) await formRepo().update(formId, formRow);
         await fieldRepo().delete({
           formId
@@ -9037,6 +9330,14 @@ function createFormSaveHandlers(config) {
           status: 404
         });
       } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg)) {
+          return json({
+            error: "A form with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         return json({
           error: "Server Error"
         }, {
@@ -9430,7 +9731,8 @@ function createUsersApiHandlers(config) {
           "name",
           "email",
           "id",
-          "blocked"
+          "blocked",
+          "inviteStatus"
         ]);
         const sortField = allowedSort.has(sortFieldRaw) ? sortFieldRaw : "createdAt";
         const sortOrder = url.searchParams.get("sortOrder") === "desc" ? "DESC" : "ASC";
@@ -9443,6 +9745,7 @@ function createUsersApiHandlers(config) {
           "u.name",
           "u.email",
           "u.blocked",
+          "u.inviteStatus",
           "u.createdAt",
           "u.updatedAt",
           "u.groupId",
@@ -9538,6 +9841,7 @@ function createUsersApiHandlers(config) {
         const isCustomer = !!(customerG && gid === customerG.id);
         const adminAccess = isCustomer ? false : body.adminAccess === false ? false : true;
         const blocked = body.blocked === true || body.blocked === "true" || body.blocked === 1 || body.blocked === "1";
+        const inviteToken = newUserInviteToken();
         const newUser = existing?.deleted ? await (async () => {
           await userRepo().update(existing.id, {
             deleted: false,
@@ -9547,6 +9851,8 @@ function createUsersApiHandlers(config) {
             email,
             password: null,
             blocked,
+            inviteStatus: "pending",
+            inviteToken,
             groupId: gid,
             adminAccess,
             updatedAt: /* @__PURE__ */ new Date()
@@ -9563,6 +9869,8 @@ function createUsersApiHandlers(config) {
           email,
           password: null,
           blocked,
+          inviteStatus: "pending",
+          inviteToken,
           groupId: gid,
           adminAccess
         }));
@@ -9580,13 +9888,12 @@ function createUsersApiHandlers(config) {
             phone
           });
         }
-        const emailToken = Buffer.from(newUser.email).toString("base64");
-        const inviteLink = `${baseUrl}/admin/invite?token=${emailToken}`;
-        await trySendInviteEmail(newUser.email, inviteLink, newUser.name ?? "");
+        const inviteLink = buildUserInviteLink(baseUrl, inviteToken);
         return json({
-          message: blocked ? "User created successfully (blocked until password is set)" : "User created successfully",
+          message: "User created successfully. Invite is pending until they set a password.",
           user: newUser,
-          inviteLink
+          inviteLink,
+          emailSent: false
         }, {
           status: 201
         });
@@ -9618,7 +9925,9 @@ function createUsersApiHandlers(config) {
             "id",
             "name",
             "email",
+            "phone",
             "blocked",
+            "inviteStatus",
             "createdAt",
             "updatedAt",
             "groupId"
@@ -9647,6 +9956,11 @@ function createUsersApiHandlers(config) {
       }
       try {
         const uid = parseInt(id, 10);
+        if (!Number.isFinite(uid)) return json({
+          error: "Invalid id"
+        }, {
+          status: 400
+        });
         const existing = await userRepo().findOne({
           where: {
             id: uid,
@@ -9659,8 +9973,59 @@ function createUsersApiHandlers(config) {
           status: 404
         });
         const body = await req.json();
-        const { password: _p, ...safe } = body;
-        await userRepo().update(uid, safe);
+        const patch = {
+          updatedAt: /* @__PURE__ */ new Date()
+        };
+        if (typeof body.name === "string") patch.name = body.name.trim();
+        if (typeof body.email === "string") patch.email = body.email.trim().toLowerCase();
+        if (body.blocked !== void 0) {
+          patch.blocked = body.blocked === true || body.blocked === "true" || body.blocked === 1 || body.blocked === "1";
+        }
+        if (body.adminAccess !== void 0) {
+          patch.adminAccess = body.adminAccess === true || body.adminAccess === "true" || body.adminAccess === 1 || body.adminAccess === "1";
+        }
+        if (body.groupId !== void 0) {
+          if (body.groupId === null || body.groupId === "") {
+            patch.groupId = null;
+          } else {
+            const gid = Number(body.groupId);
+            if (!Number.isFinite(gid)) {
+              return json({
+                error: "Invalid groupId"
+              }, {
+                status: 400
+              });
+            }
+            patch.groupId = gid;
+          }
+        }
+        if (body.phone !== void 0) {
+          const phone = body.phone == null ? null : String(body.phone).trim();
+          patch.phone = phone || null;
+        }
+        if (Object.keys(patch).length <= 1) {
+          return json({
+            error: "No valid fields to update"
+          }, {
+            status: 400
+          });
+        }
+        if (typeof patch.email === "string" && patch.email !== existing.email) {
+          const emailTaken = await userRepo().findOne({
+            where: {
+              email: patch.email,
+              deleted: false
+            }
+          });
+          if (emailTaken && Number(emailTaken.id) !== uid) {
+            return json({
+              error: "Email already in use"
+            }, {
+              status: 400
+            });
+          }
+        }
+        await userRepo().update(uid, patch);
         const updated = await userRepo().findOne({
           where: {
             id: uid,
@@ -9673,7 +10038,9 @@ function createUsersApiHandlers(config) {
             "id",
             "name",
             "email",
+            "phone",
             "blocked",
+            "inviteStatus",
             "createdAt",
             "updatedAt",
             "groupId"
@@ -9684,7 +10051,8 @@ function createUsersApiHandlers(config) {
         }, {
           status: 404
         });
-      } catch {
+      } catch (err) {
+        console.error("[users.update]", err);
         return json({
           error: "Server Error"
         }, {
@@ -9740,13 +10108,21 @@ function createUsersApiHandlers(config) {
         });
       }
     },
-    async regenerateInvite(_req, id) {
-      const authErr = await requireAuth(new Request(_req.url));
+    async regenerateInvite(req, id) {
+      const authErr = await requireAuth(new Request(req.url));
       if (authErr) return authErr;
       if (requireEntityPermission) {
-        const pe = await requireEntityPermission(_req, "users", "update");
+        const pe = await requireEntityPermission(req, "users", "update");
         if (pe) return pe;
       }
+      let sendEmail = true;
+      let rotate = true;
+      try {
+        const body = await req.json().catch(() => ({}));
+        if (body.sendEmail === false) sendEmail = false;
+        if (body.rotate === false) rotate = false;
+      } catch {
+      }
       try {
         const user = await userRepo().findOne({
           where: {
@@ -9756,7 +10132,11 @@ function createUsersApiHandlers(config) {
           select: [
             "id",
             "email",
-            "name"
+            "name",
+            "password",
+            "inviteStatus",
+            "inviteToken",
+            "blocked"
           ]
         });
         if (!user) return json({
@@ -9764,34 +10144,75 @@ function createUsersApiHandlers(config) {
         }, {
           status: 404
         });
-        let inviteLink = `${baseUrl}/admin/invite?token=${Buffer.from(user.email).toString("base64")}`;
+        const u = user;
+        const hasPassword = !!(u.password && String(u.password).trim());
+        if (u.inviteStatus === "active" && hasPassword) {
+          return json({
+            error: "User has already accepted the invite"
+          }, {
+            status: 400
+          });
+        }
+        let inviteLink = "";
         if (entityMap.vendors) {
           const vendorRepo = dataSource.getRepository(entityMap.vendors);
           const vendor = await vendorRepo.findOne({
             where: {
-              userId: user.id,
+              userId: u.id,
               deleted: false
             }
           });
           const v = vendor;
           if (v && (v.inviteStatus === "pending" || v.inviteStatus === "expired")) {
-            const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
-            await vendorRepo.update(v.id, {
-              metadata: rotatedMetadata,
-              inviteStatus: "pending"
-            });
-            const token = readVendorInviteToken(rotatedMetadata);
+            const nextMetadata = rotate ? applyRotatingVendorInvite(v.metadata) : {
+              ...v.metadata ?? {}
+            };
+            if (rotate || v.inviteStatus !== "pending") {
+              await vendorRepo.update(v.id, {
+                metadata: nextMetadata,
+                inviteStatus: "pending"
+              });
+            }
+            const token = readVendorInviteToken(nextMetadata);
             if (token) {
               inviteLink = buildVendorInviteLink(baseUrl, token);
             }
+            const { markVendorInvitePendingForUser } = await import('./vendor-invite-status-PWJ3DE76.js');
+            await markVendorInvitePendingForUser(dataSource, entityMap.vendors, u.id);
+          }
+        }
+        if (!inviteLink) {
+          let token = u.inviteToken?.trim() || "";
+          if (rotate || !token) {
+            token = newUserInviteToken();
+            await userRepo().update(u.id, {
+              inviteToken: token,
+              inviteStatus: "pending",
+              password: null
+            });
+          } else if (u.inviteStatus !== "pending") {
+            await userRepo().update(u.id, {
+              inviteStatus: "pending"
+            });
           }
-          const { markVendorInvitePendingForUser } = await import('./vendor-invite-status-PWJ3DE76.js');
-          await markVendorInvitePendingForUser(dataSource, entityMap.vendors, user.id);
+          inviteLink = buildUserInviteLink(baseUrl, token);
+        } else if (rotate) {
+          await userRepo().update(u.id, {
+            inviteStatus: "pending",
+            password: null
+          });
         }
-        await trySendInviteEmail(user.email, inviteLink, user.name ?? "");
+        let emailSent = false;
+        if (sendEmail && inviteLink) {
+          await trySendInviteEmail(u.email, inviteLink, u.name ?? "");
+          emailSent = true;
+        }
+        const rotatedNote = rotate ? " Previous invite link is no longer valid." : "";
         return json({
-          message: "New invite link generated successfully",
-          inviteLink
+          message: emailSent ? `Invite email sent.${rotatedNote}` : sendEmail ? `Invite link ready (email may not have been sent \u2014 check email plugin).${rotatedNote}` : rotate ? "New invite link created. Previous invite link is no longer valid." : "Invite link ready.",
+          emailSent,
+          inviteLink,
+          inviteStatus: "pending"
         });
       } catch {
         return json({
@@ -12732,6 +13153,39 @@ function slugify(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 __name(slugify, "slugify");
+async function userHasActiveVendor(em, entityMap, userId) {
+  const vendorRepo = em.getRepository(entityMap.vendors);
+  const owned = await vendorRepo.findOne({
+    where: {
+      userId,
+      deleted: false
+    }
+  });
+  if (owned) return true;
+  if (!entityMap.vendor_users) return false;
+  const link = await em.getRepository(entityMap.vendor_users).createQueryBuilder("vu").innerJoin("vendors", "v", 'v.id = vu."vendorId" AND v.deleted = false').where('vu."userId" = :userId', {
+    userId
+  }).getOne();
+  return !!link;
+}
+__name(userHasActiveVendor, "userHasActiveVendor");
+async function userHadAnyVendor(em, entityMap, userId) {
+  const vendorRepo = em.getRepository(entityMap.vendors);
+  const owned = await vendorRepo.findOne({
+    where: {
+      userId
+    }
+  });
+  if (owned) return true;
+  if (!entityMap.vendor_users) return false;
+  const link = await em.getRepository(entityMap.vendor_users).findOne({
+    where: {
+      userId
+    }
+  });
+  return !!link;
+}
+__name(userHadAnyVendor, "userHadAnyVendor");
 function vendorOnboardErrorResponse(json, err) {
   const msg = err instanceof Error ? err.message : String(err);
   console.error("[vendor-onboard]", err);
@@ -12830,14 +13284,80 @@ function createVendorOnboardHandlers(config) {
   __name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
     const scope = resolveVendorScopeFromSessionUser(u);
-    if (scope.type === "vendor") return scope.vendorId;
-    if (scope.type === "all") {
-      const id = u.activeVendorId ?? u.vendorIds?.[0];
-      return id != null && Number.isFinite(id) ? id : null;
+    const candidates = [];
+    if (scope.type === "vendor") candidates.push(scope.vendorId);
+    if (scope.type === "all" || scope.type === "vendor") {
+      const preferred = u.activeVendorId ?? u.vendorIds?.[0];
+      if (preferred != null && Number.isFinite(preferred)) candidates.push(Number(preferred));
+      for (const id of u.vendorIds ?? []) {
+        if (Number.isFinite(id)) candidates.push(Number(id));
+      }
+    }
+    if (entityMap.vendors && candidates.length > 0) {
+      const unique = [
+        ...new Set(candidates.filter((id) => id > 0))
+      ];
+      for (const id of unique) {
+        try {
+          const row = await dataSource.getRepository(entityMap.vendors).findOne({
+            where: {
+              id,
+              deleted: false
+            }
+          });
+          if (row) return id;
+        } catch {
+        }
+      }
+    }
+    const uid = u.id != null ? Number(u.id) : NaN;
+    if (Number.isFinite(uid) && entityMap.vendors) {
+      try {
+        const owned = await dataSource.getRepository(entityMap.vendors).findOne({
+          where: {
+            userId: uid,
+            deleted: false
+          },
+          order: {
+            id: "ASC"
+          }
+        });
+        const vid = owned ? Number(owned.id) : NaN;
+        if (Number.isFinite(vid) && vid > 0) return vid;
+      } catch {
+      }
     }
     return null;
   }
   __name(resolveActiveVendorId, "resolveActiveVendorId");
+  async function gateVendorPortal() {
+    const u = await getSessionUser();
+    if (!u?.email) return json({
+      error: "Unauthorized"
+    }, {
+      status: 401
+    });
+    if (!isVendorPortalUser(u) && !isPlatformAdministrator(u)) {
+      return json({
+        error: "Forbidden"
+      }, {
+        status: 403
+      });
+    }
+    const vendorId = await resolveActiveVendorId(u);
+    if (vendorId == null) {
+      return json({
+        error: "No vendor is linked to your account."
+      }, {
+        status: 400
+      });
+    }
+    return {
+      user: u,
+      vendorId
+    };
+  }
+  __name(gateVendorPortal, "gateVendorPortal");
   async function gateVendorTeam() {
     const u = await getSessionUser();
     if (!u?.email) return json({
@@ -12891,6 +13411,40 @@ function createVendorOnboardHandlers(config) {
   }
   __name(trySendVendorOnboardEmails, "trySendVendorOnboardEmails");
   return {
+    /** GET /api/admin/vendor/profile — current user's store (server-resolved vendor id). */
+    async getProfile() {
+      const gated = await gateVendorPortal();
+      if (gated instanceof Response) return gated;
+      const { vendorId } = gated;
+      if (!entityMap.vendors) {
+        return json({
+          error: "Vendors not configured"
+        }, {
+          status: 500
+        });
+      }
+      try {
+        const row = await dataSource.getRepository(entityMap.vendors).findOne({
+          where: {
+            id: vendorId,
+            deleted: false
+          }
+        });
+        if (!row) return json({
+          error: "Vendor not found"
+        }, {
+          status: 404
+        });
+        return json(row);
+      } catch (e) {
+        console.error("[vendor.profile]", e);
+        return json({
+          error: "Failed to load vendor profile"
+        }, {
+          status: 500
+        });
+      }
+    },
     /** POST /api/admin/vendors/onboard — create vendor + owner user + vendor_users + invite */
     async onboard(req) {
       const err = await gateAdmin();
@@ -12959,6 +13513,7 @@ function createVendorOnboardHandlers(config) {
             }
           });
           if (dupVendor) throw new Error("VENDOR_SLUG_EXISTS");
+          await retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
               name: VENDOR_OWNER_GROUP_NAME,
@@ -12987,8 +13542,15 @@ function createVendorOnboardHandlers(config) {
               email: userEmail
             }
           });
-          if (existingUser && !existingUser.deleted) throw new Error("USER_EMAIL_EXISTS");
-          const newUser = existingUser?.deleted ? await (async () => {
+          if (existingUser && !existingUser.deleted) {
+            if (await userHasActiveVendor(em, entityMap, existingUser.id)) {
+              throw new Error("USER_EMAIL_EXISTS");
+            }
+            if (!await userHadAnyVendor(em, entityMap, existingUser.id)) {
+              throw new Error("USER_EMAIL_EXISTS");
+            }
+          }
+          const newUser = existingUser ? await (async () => {
             await userRepo.update(existingUser.id, {
               deleted: false,
               deletedAt: null,
@@ -14355,6 +14917,13 @@ var User = class {
   phoneVerifiedAt;
   emailVerifiedAt;
   password;
+  /**
+  * `pending` = invite outstanding (cannot sign in until password is set).
+  * `active` = invite accepted / account usable (subject to `blocked`).
+  */
+  inviteStatus;
+  /** Rotating invite token; null when active or no invite outstanding. */
+  inviteToken;
   blocked;
   adminAccess;
   groupId;
@@ -14407,6 +14976,24 @@ _ts_decorate4([
   }),
   _ts_metadata4("design:type", Object)
 ], User.prototype, "password", void 0);
+_ts_decorate4([
+  Column({
+    type: "enum",
+    enum: [
+      "pending",
+      "active"
+    ],
+    enumName: "users_invitestatus_enum",
+    default: "active"
+  }),
+  _ts_metadata4("design:type", typeof UserInviteStatus === "undefined" ? Object : UserInviteStatus)
+], User.prototype, "inviteStatus", void 0);
+_ts_decorate4([
+  Column("varchar", {
+    nullable: true
+  }),
+  _ts_metadata4("design:type", Object)
+], User.prototype, "inviteToken", void 0);
 _ts_decorate4([
   Column("boolean", {
     default: false
@@ -16071,10 +16658,12 @@ var Customer = class {
     __name(this, "Customer");
   }
   id;
+  /** Set only when the customer can log in (linked `users` row). Admin/guest customers stay null. */
   userId;
   user;
   name;
   email;
+  /** Optional; multiple customers may have null (PostgreSQL UNIQUE allows multiple NULLs). */
   phone;
   createdAt;
   updatedAt;
@@ -16089,8 +16678,10 @@ _ts_decorate18([
   _ts_metadata18("design:type", Number)
 ], Customer.prototype, "id", void 0);
 _ts_decorate18([
-  Column("int"),
-  _ts_metadata18("design:type", Number)
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata18("design:type", Object)
 ], Customer.prototype, "userId", void 0);
 _ts_decorate18([
   ManyToOne(() => User, {
@@ -16113,9 +16704,10 @@ _ts_decorate18([
 ], Customer.prototype, "email", void 0);
 _ts_decorate18([
   Column("varchar", {
-    unique: true
+    unique: true,
+    nullable: true
   }),
-  _ts_metadata18("design:type", String)
+  _ts_metadata18("design:type", Object)
 ], Customer.prototype, "phone", void 0);
 _ts_decorate18([
   Column({
@@ -19135,6 +19727,8 @@ var OrderItem = class {
   id;
   orderId;
   productId;
+  /** Selected product variant at order time (optional). */
+  variantId;
   discountIds;
   vendorId;
   vendor;
@@ -19170,6 +19764,12 @@ _ts_decorate39([
   Column("int"),
   _ts_metadata39("design:type", Number)
 ], OrderItem.prototype, "productId", void 0);
+_ts_decorate39([
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata39("design:type", Object)
+], OrderItem.prototype, "variantId", void 0);
 _ts_decorate39([
   Column({
     type: "int",
@@ -19979,6 +20579,7 @@ var Type = /* @__PURE__ */ (function(Type2) {
   Type2["CATEGORY"] = "category";
   Type2["CART"] = "cart";
   Type2["PAYMENT_METHOD"] = "paymentMethod";
+  Type2["DEVICE_TYPE"] = "deviceType";
   Type2["ORDER"] = "order";
   Type2["QUANTITY"] = "quantity";
   Type2["TIME"] = "time";
@@ -22001,6 +22602,7 @@ var Combo = class {
   vendorId;
   vendor;
   name;
+  slug;
   desc;
   eventId;
   event;
@@ -22044,6 +22646,12 @@ _ts_decorate63([
   }),
   _ts_metadata63("design:type", String)
 ], Combo.prototype, "name", void 0);
+_ts_decorate63([
+  Column({
+    type: "varchar"
+  }),
+  _ts_metadata63("design:type", String)
+], Combo.prototype, "slug", void 0);
 _ts_decorate63([
   Column({
     type: "text",
@@ -22181,7 +22789,11 @@ _ts_decorate63([
   _ts_metadata63("design:type", Number)
 ], Combo.prototype, "deletedBy", void 0);
 Combo = _ts_decorate63([
-  Entity("combos")
+  Entity("combos"),
+  Unique("UQ_combos_vendor_slug", [
+    "vendorId",
+    "slug"
+  ])
 ], Combo);
 function _ts_decorate64(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -26107,8 +26719,11 @@ function createMessageTemplateRowLoader(dataSource, entityMap) {
   };
 }
 __name(createMessageTemplateRowLoader, "createMessageTemplateRowLoader");
-function registerMessagingQueueProcessors(cms) {
-  registerEmailQueueProcessor(cms);
+function registerMessagingQueueProcessors(cms, entityMap) {
+  registerEmailQueueProcessor(cms, {
+    getDataSource: /* @__PURE__ */ __name(async () => cms.dataSource, "getDataSource"),
+    entityMap
+  });
   registerWhatsAppQueueProcessor(cms);
 }
 __name(registerMessagingQueueProcessors, "registerMessagingQueueProcessors");
@@ -26160,7 +26775,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
     }
   }
   const merged = Object.keys(overlay).length > 0 ? overlayCmsPlugins(cms, overlay) : cms;
-  registerMessagingQueueProcessors(merged);
+  registerMessagingQueueProcessors(merged, entityMap);
   return merged;
 }
 __name(ensureMessagingPluginsOnCms, "ensureMessagingPluginsOnCms");
@@ -26209,7 +26824,7 @@ async function createCmsAppWithMessaging(options) {
     logger,
     plugins: mergedPlugins
   });
-  registerMessagingQueueProcessors(cms);
+  registerMessagingQueueProcessors(cms, entityMap);
   return cms;
 }
 __name(createCmsAppWithMessaging, "createCmsAppWithMessaging");
@@ -26406,7 +27021,7 @@ function createCmsApiHandler(config) {
         companyDetails
       };
       if (queue) {
-        const { queueEmail: queueEmail2 } = await import('./email-queue-CGZBVVAS.js');
+        const { queueEmail: queueEmail2 } = await import('./email-queue-OI2HSCGE.js');
         await queueEmail2(cms, {
           to: opts.to,
           templateName: "passwordReset",
@@ -26699,6 +27314,14 @@ function createCmsApiHandler(config) {
         });
         return vendorHandlers.switchVendor(req);
       }
+      if (path2[0] === "admin" && path2[1] === "vendor" && path2[2] === "profile" && path2.length === 3 && m === "GET") {
+        if (!vendorHandlers) return config.json({
+          error: "Not found"
+        }, {
+          status: 404
+        });
+        return vendorHandlers.getProfile();
+      }
       if (path2[0] === "admin" && path2[1] === "vendor" && path2[2] === "roles" && vendorRolesHandlers) {
         if (path2.length === 3 && m === "GET") return vendorRolesHandlers.list();
         if (path2.length === 3 && m === "POST") return vendorRolesHandlers.create(req);
@@ -27652,14 +28275,27 @@ function createCmsApiHandler(config) {
         const pe = await requireEntityPermissionEffective(req, "orders", "read");
         if (pe) return pe;
         const cms = await getCms();
-        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-3YISSOWW.js');
+        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-3GXDE443.js');
         const oid = Number(path2[1]);
         if (!Number.isFinite(oid)) return config.json({
           error: "Invalid id"
         }, {
           status: 400
         });
-        return streamOrderInvoicePdf2(cms, dataSource, entityMap, oid, {});
+        try {
+          return await streamOrderInvoicePdf2(cms, dataSource, entityMap, oid, {});
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.error("[invoice] route failed", {
+            orderId: oid,
+            error: msg
+          });
+          return config.json({
+            error: `Invoice failed: ${msg}`
+          }, {
+            status: 500
+          });
+        }
       }
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "repost-erp" && getCms) {
         const a = await config.requireAuth(req);
@@ -28006,7 +28642,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-XWIJYDGA.js');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-ZJZB2HUN.js');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -28078,6 +28714,30 @@ function createCmsApiHandler(config) {
             paymentId = Number(payment.id);
           }
         }
+        const orderWithItems = await orderRepo.findOne({
+          where: {
+            id: orderId,
+            deleted: false
+          },
+          relations: [
+            "items"
+          ]
+        });
+        if (orderWithItems) {
+          const { reconcileOrderInventoryBetweenSnapshots: reconcileOrderInventoryBetweenSnapshots2, orderInventorySnapshotFromRow: orderInventorySnapshotFromRow2 } = await import('./order-inventory-76V4XIGW.js');
+          const prevSnap = orderInventorySnapshotFromRow2(orderWithItems);
+          const invErr = await reconcileOrderInventoryBetweenSnapshots2(dataSource, entityMap, prevSnap, {
+            status: "cancelled",
+            lines: prevSnap.lines
+          });
+          if (invErr) {
+            return config.json({
+              error: invErr
+            }, {
+              status: 400
+            });
+          }
+        }
         await orderRepo.update(orderId, {
           status: "cancelled"
         });
@@ -29121,6 +29781,14 @@ function createStorefrontApiHandler(config) {
         entityMap
       });
     }).catch((err) => console.error("[notification-triggers] import failed", err));
+    if (!getCms) return;
+    void import('./send-order-placed-emails-WPI37KRZ.js').then(({ sendOrderPlacedEmailsAfterConfirmation }) => {
+      return sendOrderPlacedEmailsAfterConfirmation(orderId, {
+        getDataSource: /* @__PURE__ */ __name(async () => dataSource, "getDataSource"),
+        entityMap,
+        getCms
+      });
+    }).catch((err) => console.error("[order-emails] sendOrderPlacedEmailsAfterConfirmation failed", err));
   }
   __name(fireOrderPlacedNotification, "fireOrderPlacedNotification");
   const otpAllowPhoneLogin = config.otpAllowPhoneLogin !== false;
@@ -29168,13 +29836,36 @@ function createStorefrontApiHandler(config) {
         status: 400
       };
     }
+    const list = [
+      ...vendorIds
+    ];
     return {
-      vendorId: [
-        ...vendorIds
-      ][0]
+      vendorId: list[0],
+      vendorIds: list
     };
   }
   __name(resolveSingleVendorIdFromCart, "resolveSingleVendorIdFromCart");
+  async function linkOrderContactToVendors(contactId, vendorIds) {
+    try {
+      const contact = await contactRepo().findOne({
+        where: {
+          id: contactId,
+          deleted: false
+        }
+      });
+      if (!contact) return;
+      const email = String(contact.email ?? "").trim().toLowerCase();
+      if (!email) return;
+      await ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, contactId, {
+        name: String(contact.name ?? "").trim() || email.split("@")[0] || "Customer",
+        email,
+        phone: contact.phone ?? null
+      });
+    } catch (err) {
+      console.error("[storefront] vendor_customers link failed", err);
+    }
+  }
+  __name(linkOrderContactToVendors, "linkOrderContactToVendors");
   function roundMoney3(n) {
     return Math.round(n * 100) / 100;
   }
@@ -30866,9 +31557,12 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 400
           });
+          const { retireSoftDeletedUniqueValue: retireSoftDeletedUniqueValue2 } = await import('./retire-soft-deleted-unique-NXQIH4BC.js');
+          await retireSoftDeletedUniqueValue2(userRepo(), "email", email);
           const existing = await userRepo().findOne({
             where: {
-              email
+              email,
+              deleted: false
             }
           });
           if (existing) return json({
@@ -31496,6 +32190,7 @@ function createStorefrontApiHandler(config) {
               taxCode: line.taxCode
             }));
           }
+          await linkOrderContactToVendors(contactId, vendorRes.vendorIds);
           fireOrderPlacedNotification(oid);
           return json({
             orderId: oid,
@@ -31568,6 +32263,7 @@ function createStorefrontApiHandler(config) {
               taxCode: line.taxCode
             }));
           }
+          await linkOrderContactToVendors(contactId, vendorResChk.vendorIds);
           await cartItemRepo().delete({
             cartId: cart.id
           });
@@ -31747,6 +32443,7 @@ function createStorefrontApiHandler(config) {
               unitPrice: line.unitPrice,
               tax: line.tax,
               total: line.total,
+              metadata: line.metadata ?? null,
               product: p ? {
                 name: p.name,
                 slug: p.slug,
@@ -31814,4 +32511,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForEmail, customerPhoneForUser, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureCustomerForUser, ensureCustomerRecord, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isSyntheticCustomerPhone, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizeCustomerPhone, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };