@infuro/cms-core 1.0.45 → 1.0.46

package/dist/{chunk-MVXLRANV.js → chunk-UKC3HYXI.js}

@@ -1,11 +1,14 @@
-import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, mergeEmailLayoutCompanyDetails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-NNQBWDCI.js';
+import { validateInventoryForConfirmedOrderLines, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, orderInventorySnapshotFromRow, validateInventoryForOrderBecomingConfirmed } from './chunk-3K5AIEIZ.js';
+import { retireSoftDeletedUniqueValue, activeUniqueValueExists } from './chunk-DBPSJYLZ.js';
+import { isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, initWhatsappTriggerDispatcher } from './chunk-GUSHM5HN.js';
+import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, parseEmailRecipientsFromConfig, emailPlugin } from './chunk-CRYKVJTO.js';
 import { inviteStatusForActivation } from './chunk-JXF23MPG.js';
-import { unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-WEMDMVHQ.js';
-import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-5ELSW2UP.js';
+import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-L3525VXI.js';
+import { mergeEmailLayoutCompanyDetails, unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-2KUCQVAQ.js';
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MQBT33IV.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-KFFB6EMZ.js';
 import { JOB_RUNNER_QUEUE } from './chunk-GO7PPYNU.js';
-import { canManageRoles, sessionHasEntityAccess } from './chunk-BLR6H5GL.js';
+import { canManageRoles, sessionHasEntityAccess } from './chunk-SF2XKMCI.js';
 import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_OWNER_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-DN65KDIA.js';
 import { queueErp } from './chunk-SYBOCAWB.js';
 import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
@@ -646,6 +649,144 @@ function applyEventApprovalStatusSideEffects(updatePayload, opts) {
 }
 __name(applyEventApprovalStatusSideEffects, "applyEventApprovalStatusSideEffects");
 
+// src/lib/discount-usage.ts
+async function countDiscountOrdersForContact(dataSource, discountId, contactId) {
+  try {
+    const rows = await dataSource.query(`SELECT COUNT(DISTINCT od."orderId")::int AS count
+       FROM order_discounts od
+       WHERE od."discountId" = $1 AND od."userId" = $2`, [
+      discountId,
+      contactId
+    ]);
+    return Number(rows?.[0]?.count ?? 0);
+  } catch {
+    return 0;
+  }
+}
+__name(countDiscountOrdersForContact, "countDiscountOrdersForContact");
+function isMaxTotalUsageReached(discount) {
+  if (discount.maxTotalUsage == null) return false;
+  return Number(discount.usedCount ?? 0) >= Number(discount.maxTotalUsage);
+}
+__name(isMaxTotalUsageReached, "isMaxTotalUsageReached");
+async function isMaxPerUserUsageReached(dataSource, discount, contactId) {
+  if (discount.maxUsagePerUser == null || contactId == null) return false;
+  const count = await countDiscountOrdersForContact(dataSource, discount.id, contactId);
+  return count >= Number(discount.maxUsagePerUser);
+}
+__name(isMaxPerUserUsageReached, "isMaxPerUserUsageReached");
+async function checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId) {
+  if (!entityMap.discounts) return null;
+  const discountRepo = dataSource.getRepository(entityMap.discounts);
+  const discount = await discountRepo.findOne({
+    where: {
+      id: discountId
+    }
+  });
+  if (!discount) return `Discount #${discountId} not found`;
+  const d = discount;
+  if (d.maxUsagePerUser != null) {
+    const usageCount = await countDiscountOrdersForContact(dataSource, discountId, contactId);
+    if (usageCount >= Number(d.maxUsagePerUser)) {
+      return "You have reached the maximum usage limit for this discount";
+    }
+  }
+  const updated = await dataSource.query(`UPDATE discounts
+     SET "usedCount" = "usedCount" + 1
+     WHERE id = $1
+       AND ("maxTotalUsage" IS NULL OR "usedCount" < "maxTotalUsage")
+     RETURNING id`, [
+    discountId
+  ]);
+  if (!Array.isArray(updated) || updated.length === 0) {
+    return "Discount usage limit has been reached";
+  }
+  return null;
+}
+__name(checkAndIncrementDiscountUsage, "checkAndIncrementDiscountUsage");
+async function decrementDiscountUsage(dataSource, entityMap, discountId, orderId) {
+  if (!entityMap.discounts) return;
+  try {
+    await dataSource.query(`UPDATE discounts SET "usedCount" = GREATEST("usedCount" - 1, 0) WHERE id = $1`, [
+      discountId
+    ]);
+    if (entityMap.order_discounts) {
+      await dataSource.getRepository(entityMap.order_discounts).delete({
+        orderId,
+        discountId
+      });
+    }
+  } catch (err) {
+    console.error("[discountEngine] decrementDiscountUsage failed:", err);
+  }
+}
+__name(decrementDiscountUsage, "decrementDiscountUsage");
+async function recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
+  if (!entityMap.order_discounts) return;
+  try {
+    let discountCode = "";
+    if (entityMap.discounts) {
+      const discountRow = await dataSource.getRepository(entityMap.discounts).findOne({
+        where: {
+          id: discountId
+        }
+      });
+      discountCode = discountRow?.couponCode ?? "";
+    }
+    const odRepo = dataSource.getRepository(entityMap.order_discounts);
+    const orderItemRepo = dataSource.getRepository(entityMap.order_items);
+    const items = await orderItemRepo.find({
+      where: {
+        orderId
+      }
+    });
+    const discountedItems = items.filter((item) => Number(item.discount ?? 0) > 0);
+    if (discountedItems.length === 0) {
+      const firstItem = items[0];
+      if (!firstItem) return;
+      await odRepo.save(odRepo.create({
+        orderId,
+        orderItemId: firstItem.id,
+        discountId,
+        discountCode,
+        discountAmount,
+        userId: contactId
+      }));
+      return;
+    }
+    for (const item of discountedItems) {
+      const i = item;
+      await odRepo.save(odRepo.create({
+        orderId,
+        orderItemId: i.id,
+        discountId,
+        discountCode,
+        discountAmount: Number(i.discount ?? 0),
+        userId: contactId
+      }));
+    }
+  } catch (err) {
+    console.error("[discountEngine] recordDiscountUsage failed:", err);
+  }
+}
+__name(recordDiscountUsage, "recordDiscountUsage");
+async function consumeAppliedDiscountUsages(dataSource, entityMap, orderId, contactId, applied) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const row of applied) {
+    const id = Number(row.id);
+    if (!Number.isFinite(id) || id < 1) continue;
+    const amount = Math.max(0, Number(row.calculatedDiscount) || 0);
+    unique.set(id, (unique.get(id) ?? 0) + amount);
+  }
+  for (const [discountId, discountAmount] of unique) {
+    const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId);
+    if (usageErr) return usageErr;
+    await recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount);
+  }
+  return null;
+}
+__name(consumeAppliedDiscountUsages, "consumeAppliedDiscountUsages");
+
 // src/lib/default-vendor-id.ts
 function getDefaultVendorId() {
   const raw = process.env.DEFAULT_VENDOR_ID;
@@ -1989,6 +2130,7 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   let slug = baseSlug;
   let suffix = 0;
   while (true) {
+    await retireSoftDeletedUniqueValue(repo, "slug", slug);
     const where = excludeId != null ? {
       slug,
       vendorId,
@@ -2008,6 +2150,21 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   }
 }
 __name(ensureUniqueProductSlug, "ensureUniqueProductSlug");
+async function normalizeComboNameAndSlug(repo, body, vendorId, existing, excludeId) {
+  const incomingName = typeof body.name === "string" ? body.name.trim() : "";
+  const incomingSlugRaw = typeof body.slug === "string" ? body.slug.trim() : "";
+  const existingName = typeof existing?.name === "string" ? existing.name.trim() : "";
+  const existingSlug = typeof existing?.slug === "string" ? existing.slug.trim() : "";
+  const name = incomingName || existingName;
+  if (!name) return "Name is required";
+  if (incomingName) body.name = name;
+  const nameBasedSlug = slugifyProductLabel(name);
+  const typedSlug = incomingSlugRaw ? slugifyProductLabel(incomingSlugRaw) : "";
+  const slug = typedSlug || (excludeId != null ? existingSlug : "") || nameBasedSlug;
+  body.slug = await ensureUniqueProductSlug(repo, slug, vendorId, excludeId);
+  return null;
+}
+__name(normalizeComboNameAndSlug, "normalizeComboNameAndSlug");
 async function hydrateProductEventNames(dataSource, entityMap, products) {
   if (!products.length) return products;
   if (!entityMap.event_products || !entityMap.events) {
@@ -2254,6 +2411,20 @@ async function normalizeProductNameAndSlug(repo, body, vendorId, existing, exclu
   return null;
 }
 __name(normalizeProductNameAndSlug, "normalizeProductNameAndSlug");
+async function retireSoftDeletedUniquesFromBody(repo, body) {
+  const cols = new Set(repo.metadata.columns.map((c) => c.propertyName));
+  if (!cols.has("deleted")) return;
+  for (const col of [
+    "slug",
+    "email"
+  ]) {
+    if (!cols.has(col)) continue;
+    const raw = body[col];
+    if (typeof raw !== "string" || !raw.trim()) continue;
+    await retireSoftDeletedUniqueValue(repo, col, raw.trim());
+  }
+}
+__name(retireSoftDeletedUniquesFromBody, "retireSoftDeletedUniquesFromBody");
 function buildSoftDeletePayload(meta, deletedBy) {
   const payload = {
     deleted: true
@@ -2490,6 +2661,7 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
     case "category":
     case "cart":
     case "paymentMethod":
+    case "deviceType":
     case "order": {
       if (rule.subType === "nthOrder") {
         return true;
@@ -2673,87 +2845,22 @@ function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
   return totalDiscountApplied;
 }
 __name(applyDiscountToOrderLines, "applyDiscountToOrderLines");
-async function checkAndIncrementDiscountUsage(dataSource, entityMap, discountId, contactId) {
-  if (!entityMap["discounts"]) return null;
-  const discountRepo = dataSource.getRepository(entityMap["discounts"]);
-  const discount = await discountRepo.findOne({
-    where: {
-      id: discountId
-    }
-  });
-  if (!discount) return `Discount #${discountId} not found`;
-  await dataSource.query(`UPDATE discounts SET "usedCount" = "usedCount" + 1 WHERE id = $1`, [
-    discountId
-  ]);
-  return null;
+function asDiscountUsageEntityMap(entityMap) {
+  return entityMap;
 }
-__name(checkAndIncrementDiscountUsage, "checkAndIncrementDiscountUsage");
-async function decrementDiscountUsage(dataSource, entityMap, discountId, orderId) {
-  if (!entityMap["discounts"]) return;
-  try {
-    await dataSource.query(`UPDATE discounts SET "usedCount" = GREATEST("usedCount" - 1, 0) WHERE id = $1`, [
-      discountId
-    ]);
-    if (entityMap["order_discounts"]) {
-      await dataSource.getRepository(entityMap["order_discounts"]).delete({
-        orderId,
-        discountId
-      });
-    }
-  } catch (err) {
-    console.error("[discountEngine] decrementDiscountUsage failed:", err);
-  }
+__name(asDiscountUsageEntityMap, "asDiscountUsageEntityMap");
+async function checkAndIncrementDiscountUsage2(dataSource, entityMap, discountId, contactId) {
+  return checkAndIncrementDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), discountId, contactId);
 }
-__name(decrementDiscountUsage, "decrementDiscountUsage");
-async function recordDiscountUsage(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
-  if (!entityMap["order_discounts"]) return;
-  try {
-    let discountCode = "";
-    if (entityMap["discounts"]) {
-      const discountRow = await dataSource.getRepository(entityMap["discounts"]).findOne({
-        where: {
-          id: discountId
-        }
-      });
-      discountCode = discountRow?.couponCode ?? "";
-    }
-    const odRepo = dataSource.getRepository(entityMap["order_discounts"]);
-    const orderItemRepo = dataSource.getRepository(entityMap.order_items);
-    const items = await orderItemRepo.find({
-      where: {
-        orderId
-      }
-    });
-    const discountedItems = items.filter((item) => Number(item.discount ?? 0) > 0);
-    if (discountedItems.length === 0) {
-      const firstItem = items[0];
-      if (!firstItem) return;
-      await odRepo.save(odRepo.create({
-        orderId,
-        orderItemId: firstItem.id,
-        discountId,
-        discountCode,
-        discountAmount,
-        userId: contactId
-      }));
-      return;
-    }
-    for (const item of discountedItems) {
-      const i = item;
-      await odRepo.save(odRepo.create({
-        orderId,
-        orderItemId: i.id,
-        discountId,
-        discountCode,
-        discountAmount: Number(i.discount ?? 0),
-        userId: contactId
-      }));
-    }
-  } catch (err) {
-    console.error("[discountEngine] recordDiscountUsage failed:", err);
-  }
+__name(checkAndIncrementDiscountUsage2, "checkAndIncrementDiscountUsage");
+async function decrementDiscountUsage2(dataSource, entityMap, discountId, orderId) {
+  return decrementDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), discountId, orderId);
 }
-__name(recordDiscountUsage, "recordDiscountUsage");
+__name(decrementDiscountUsage2, "decrementDiscountUsage");
+async function recordDiscountUsage2(dataSource, entityMap, orderId, discountId, contactId, discountAmount) {
+  return recordDiscountUsage(dataSource, asDiscountUsageEntityMap(entityMap), orderId, discountId, contactId, discountAmount);
+}
+__name(recordDiscountUsage2, "recordDiscountUsage");
 async function validateCoupon(dataSource, entityMap, couponCode, orderLines, currency = "INR", contactId, isAutomatic, discountId, vendorId) {
   if (!entityMap["discounts"]) return {
     valid: false,
@@ -2798,21 +2905,12 @@ async function validateCoupon(dataSource, entityMap, couponCode, orderLines, cur
     };
   }
   if (contactId != null && d.maxUsagePerUser != null) {
-    try {
-      const userUsage = await dataSource.query(`SELECT COUNT(DISTINCT od."orderId") as count FROM order_discounts od
-         WHERE od."discountId" = $1 
-         AND od."userId" = $2`, [
-        d.id,
-        contactId
-      ]);
-      const usageCount = Number(userUsage?.[0]?.count ?? 0);
-      if (usageCount >= d.maxUsagePerUser) {
-        return {
-          valid: false,
-          error: "You have reached the maximum usage limit for this discount"
-        };
-      }
-    } catch {
+    const usageCount = await countDiscountOrdersForContact(dataSource, d.id, contactId);
+    if (usageCount >= d.maxUsagePerUser) {
+      return {
+        valid: false,
+        error: "You have reached the maximum usage limit for this discount"
+      };
     }
   }
   const flatRules = entityMap["discount_rules"] ? await dataSource.getRepository(entityMap["discount_rules"]).find({
@@ -2890,128 +2988,32 @@ function normalizeOrderLinesInput(raw) {
     if (!Number.isFinite(productId) || productId <= 0) continue;
     const qRaw = Number(r.quantity ?? 1);
     const q = Number.isFinite(qRaw) ? Math.min(99999, Math.max(1, Math.floor(qRaw))) : 1;
-    merged.set(productId, (merged.get(productId) ?? 0) + q);
+    const vidRaw = r.variantId ?? r.variant_id;
+    const vid = vidRaw != null && String(vidRaw).trim() !== "" ? Number(vidRaw) : NaN;
+    const variantId = Number.isFinite(vid) && vid > 0 ? vid : null;
+    const key = `${productId}:${variantId ?? 0}`;
+    const prev = merged.get(key);
+    if (prev) prev.quantity += q;
+    else merged.set(key, {
+      productId,
+      quantity: q,
+      variantId
+    });
   }
   return [
-    ...merged.entries()
-  ].map(([productId, quantity]) => ({
-    productId,
-    quantity
-  }));
+    ...merged.values()
+  ];
 }
 __name(normalizeOrderLinesInput, "normalizeOrderLinesInput");
 var ORDER_STATUS_CONFIRMED = "confirmed";
-function orderInventorySnapshotFromRow(order) {
-  return {
-    status: order.status ?? "pending",
-    lines: (order.items ?? []).map((i) => ({
-      productId: Number(i.productId),
-      quantity: Math.max(0, Math.floor(Number(i.quantity) || 0))
-    })).filter((l) => l.productId > 0 && l.quantity > 0)
-  };
-}
-__name(orderInventorySnapshotFromRow, "orderInventorySnapshotFromRow");
-function mergeInventoryLinesByProduct(lines) {
-  const m = /* @__PURE__ */ new Map();
-  for (const { productId, quantity } of lines) {
-    if (!Number.isFinite(productId) || productId <= 0 || quantity <= 0) continue;
-    m.set(productId, (m.get(productId) ?? 0) + quantity);
-  }
-  return m;
-}
-__name(mergeInventoryLinesByProduct, "mergeInventoryLinesByProduct");
-async function validateInventoryForConfirmedOrderLines(dataSource, entityMap, calcLines) {
-  const productRepo = dataSource.getRepository(entityMap.products);
-  const merged = mergeInventoryLinesByProduct(calcLines.filter((l) => l.found && l.productId != null).map((l) => ({
+async function validateInventoryForConfirmedOrderLines2(dataSource, entityMap, calcLines) {
+  const lines = calcLines.filter((l) => l.found && l.productId != null).map((l) => ({
     productId: l.productId,
     quantity: l.quantity
-  })));
-  for (const [productId, qty] of merged) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    const cur = Number(row.quantity ?? 0);
-    if (cur < qty) {
-      const name = row.name ?? String(productId);
-      return `Insufficient stock for ${name}: available ${cur}, required ${qty}`;
-    }
-  }
-  return null;
-}
-__name(validateInventoryForConfirmedOrderLines, "validateInventoryForConfirmedOrderLines");
-async function applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, sign, validateDeduct) {
-  const productRepo = dataSource.getRepository(entityMap.products);
-  for (const [productId, qty] of merged) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    const cur = Number(row.quantity ?? 0);
-    if (sign === -1) {
-      if (validateDeduct && cur < qty) {
-        const name = row.name ?? String(productId);
-        return `Insufficient stock for ${name}: available ${cur}, required ${qty}`;
-      }
-      await productRepo.update(productId, {
-        quantity: Math.max(0, cur - qty)
-      });
-    } else {
-      await productRepo.update(productId, {
-        quantity: cur + qty
-      });
-    }
-  }
-  return null;
-}
-__name(applyInventoryDeltaForMergedLines, "applyInventoryDeltaForMergedLines");
-async function validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, prevSnap, nextLines) {
-  const mergedNext = mergeInventoryLinesByProduct(nextLines);
-  const productRepo = dataSource.getRepository(entityMap.products);
-  const prevByProduct = prevSnap?.status === ORDER_STATUS_CONFIRMED ? mergeInventoryLinesByProduct(prevSnap.lines) : /* @__PURE__ */ new Map();
-  for (const [productId, need] of mergedNext) {
-    const row = await productRepo.findOne({
-      where: {
-        id: productId,
-        deleted: false
-      }
-    });
-    if (!row) return `Product #${productId} not found`;
-    if (row.type === "service") continue;
-    let available = Number(row.quantity ?? 0);
-    available += prevByProduct.get(productId) ?? 0;
-    if (available < need) {
-      const name = row.name ?? String(productId);
-      return `Insufficient stock for ${name}: available ${available}, required ${need}`;
-    }
-  }
-  return null;
-}
-__name(validateInventoryForOrderBecomingConfirmed, "validateInventoryForOrderBecomingConfirmed");
-async function reconcileOrderInventoryBetweenSnapshots(dataSource, entityMap, prev, next) {
-  const wasConfirmed = prev.status === ORDER_STATUS_CONFIRMED;
-  const isConfirmed = next.status === ORDER_STATUS_CONFIRMED;
-  if (wasConfirmed) {
-    const merged = mergeInventoryLinesByProduct(prev.lines);
-    const err = await applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, 1, false);
-    if (err) return err;
-  }
-  if (isConfirmed) {
-    const merged = mergeInventoryLinesByProduct(next.lines);
-    const err = await applyInventoryDeltaForMergedLines(dataSource, entityMap, merged, -1, true);
-    if (err) return err;
-  }
-  return null;
+  }));
+  return validateInventoryForConfirmedOrderLines(dataSource, entityMap, lines);
 }
-__name(reconcileOrderInventoryBetweenSnapshots, "reconcileOrderInventoryBetweenSnapshots");
+__name(validateInventoryForConfirmedOrderLines2, "validateInventoryForConfirmedOrderLines");
 async function resolveProductTaxRate(dataSource, entityMap, productId, productVendorId) {
   if (!entityMap.product_config || !entityMap.taxes) {
     return {
@@ -4997,6 +4999,22 @@ function createCrudHandler(dataSource, entityMap, options) {
           status: 400
         });
       }
+      if (resource === "combos") {
+        const vendorIdForSlug = scopeCreate.type === "vendor" ? scopeCreate.vendorId : Number(persistBody.vendorId);
+        if (!Number.isFinite(vendorIdForSlug) || vendorIdForSlug <= 0) {
+          return json({
+            error: "vendorId is required"
+          }, {
+            status: 400
+          });
+        }
+        const comboSlugErr = await normalizeComboNameAndSlug(repo, persistBody, vendorIdForSlug);
+        if (comboSlugErr) return json({
+          error: comboSlugErr
+        }, {
+          status: 400
+        });
+      }
       sanitizeBodyForEntity(repo, persistBody);
       let created;
       try {
@@ -5095,6 +5113,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           persistBody.orderNumber = `ORD00${randomPart}`;
           persistBody.qrToken = crypto2.randomBytes(16).toString("hex");
         }
+        await retireSoftDeletedUniquesFromBody(repo, persistBody);
         created = await repo.save(repo.create(persistBody));
         if (resource === "orders") {
           const orderItemRepo = dataSource.getRepository(entityMap.order_items);
@@ -5136,8 +5155,8 @@ function createCrudHandler(dataSource, entityMap, options) {
             }
           }
           const createdStatus = String(persistBody.status ?? "pending");
-          if (createdStatus === ORDER_STATUS_CONFIRMED) {
-            const stockErr = await validateInventoryForConfirmedOrderLines(dataSource, entityMap, lines);
+          if (orderStatusHoldsStock(createdStatus)) {
+            const stockErr = await validateInventoryForConfirmedOrderLines2(dataSource, entityMap, lines);
             if (stockErr) {
               await repo.delete(created.id);
               return json({
@@ -5159,6 +5178,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             await orderItemRepo.save(orderItemRepo.create({
               orderId: created.id,
               productId: line.productId,
+              variantId: null,
               quantity: line.quantity,
               unitPrice: line.unitPrice,
               subTotal: line.subtotal,
@@ -5252,7 +5272,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           if (orderDiscountId) {
             if (createdStatus === ORDER_STATUS_CONFIRMED) {
-              const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, orderDiscountId, persistBody.contactId);
+              const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, orderDiscountId, persistBody.contactId);
               if (usageErr) {
                 await repo.delete(created.id);
                 return json({
@@ -5262,7 +5282,7 @@ function createCrudHandler(dataSource, entityMap, options) {
                 });
               }
             }
-            await recordDiscountUsage(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
+            await recordDiscountUsage2(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
           }
           const orderIdForNotify = created.id;
           void import('./emit-order-notification-trigger-IVLWKKJL.js').then(({ fireOrderNotificationTrigger }) => {
@@ -5271,6 +5291,16 @@ function createCrudHandler(dataSource, entityMap, options) {
               entityMap
             });
           });
+          if (getCms) {
+            void import('./send-order-placed-emails-WPI37KRZ.js').then(({ sendOrderPlacedEmailsAfterConfirmation }) => {
+              return sendOrderPlacedEmailsAfterConfirmation(orderIdForNotify, {
+                getDataSource: /* @__PURE__ */ __name(async () => dataSource, "getDataSource"),
+                entityMap,
+                getCms: /* @__PURE__ */ __name(async () => await getCms(), "getCms")
+              });
+            }).catch(() => {
+            });
+          }
         }
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -5916,6 +5946,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         sanitizeBodyForEntity(repo, updatePayload2);
+        await retireSoftDeletedUniquesFromBody(repo, updatePayload2);
         await repo.update(numericId, updatePayload2);
         if (Array.isArray(rawBody.tags)) {
           const tagNames = rawBody.tags.map((t) => String(t).trim()).filter(Boolean);
@@ -6004,7 +6035,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           } : await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, effectiveCurrency, putDiscountId, Number.isFinite(putOrderVendorId) ? putOrderVendorId : null);
           const scalarUpdate = pickColumnUpdates(repo, rawBody);
           const nextStatus = typeof scalarUpdate.status === "string" && scalarUpdate.status ? String(scalarUpdate.status) : orderInvPrev?.status ?? "pending";
-          if (nextStatus === ORDER_STATUS_CONFIRMED && lines.length > 0) {
+          if (orderStatusHoldsStock(nextStatus) && lines.length > 0) {
             const verr = await validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, lines.filter((l) => l.found && l.productId != null).map((l) => ({
               productId: l.productId,
               quantity: l.quantity
@@ -6133,17 +6164,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
               }) : null;
               const existingDiscountId = existingOd ? existingOd.discountId : null;
               if (!putDiscountId && existingDiscountId && wasConfirmed) {
-                await decrementDiscountUsage(dataSource, entityMap, existingDiscountId, numericId);
+                await decrementDiscountUsage2(dataSource, entityMap, existingDiscountId, numericId);
                 if (entityMap["order_discounts"] && existingOd) {
                   await dataSource.getRepository(entityMap["order_discounts"]).delete(existingOd.id);
                 }
               }
               if (putDiscountId && existingDiscountId && putDiscountId !== existingDiscountId) {
                 if (wasConfirmed) {
-                  await decrementDiscountUsage(dataSource, entityMap, existingDiscountId, numericId);
+                  await decrementDiscountUsage2(dataSource, entityMap, existingDiscountId, numericId);
                 }
                 if (isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
@@ -6156,12 +6187,12 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                     discountAmount: discount
                   });
                 } else {
-                  await recordDiscountUsage(dataSource, entityMap, numericId, putDiscountId, cid, discount);
+                  await recordDiscountUsage2(dataSource, entityMap, numericId, putDiscountId, cid, discount);
                 }
               }
               if (putDiscountId && existingDiscountId && putDiscountId === existingDiscountId) {
                 if (!wasConfirmed && isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
@@ -6169,7 +6200,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                   });
                 }
                 if (wasConfirmed && !isNowConfirmed) {
-                  await decrementDiscountUsage(dataSource, entityMap, putDiscountId, numericId);
+                  await decrementDiscountUsage2(dataSource, entityMap, putDiscountId, numericId);
                 }
                 if (existingOd && entityMap["order_discounts"]) {
                   await dataSource.getRepository(entityMap["order_discounts"]).update(existingOd.id, {
@@ -6179,14 +6210,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
               }
               if (putDiscountId && !existingDiscountId) {
                 if (isNowConfirmed) {
-                  const usageErr = await checkAndIncrementDiscountUsage(dataSource, entityMap, putDiscountId);
+                  const usageErr = await checkAndIncrementDiscountUsage2(dataSource, entityMap, putDiscountId, cid);
                   if (usageErr) return json({
                     error: usageErr
                   }, {
                     status: 400
                   });
                 }
-                await recordDiscountUsage(dataSource, entityMap, numericId, putDiscountId, cid, discount);
+                await recordDiscountUsage2(dataSource, entityMap, numericId, putDiscountId, cid, discount);
               }
             }
           }
@@ -6657,7 +6688,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       if (resource === "orders" && orderInvPrev) {
         const nextSt = typeof updatePayload.status === "string" && updatePayload.status ? String(updatePayload.status) : orderInvPrev.status;
-        if (nextSt === ORDER_STATUS_CONFIRMED && orderInvPrev.lines.length > 0) {
+        if (orderStatusHoldsStock(nextSt) && orderInvPrev.lines.length > 0) {
           const verr = await validateInventoryForOrderBecomingConfirmed(dataSource, entityMap, orderInvPrev, orderInvPrev.lines);
           if (verr) return json({
             error: verr
@@ -6666,6 +6697,33 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           });
         }
       }
+      if (resource === "combos") {
+        const currentCombo = await repo.findOne({
+          where: {
+            id: numericId,
+            deleted: false
+          }
+        });
+        if (!currentCombo) return json({
+          message: "Not found"
+        }, {
+          status: 404
+        });
+        const vendorIdForSlug = scopePut.type === "vendor" ? scopePut.vendorId : Number(currentCombo.vendorId);
+        if (!Number.isFinite(vendorIdForSlug) || vendorIdForSlug <= 0) {
+          return json({
+            error: "vendorId is required"
+          }, {
+            status: 400
+          });
+        }
+        const comboSlugErr = await normalizeComboNameAndSlug(repo, updatePayload, vendorIdForSlug, currentCombo, numericId);
+        if (comboSlugErr) return json({
+          error: comboSlugErr
+        }, {
+          status: 400
+        });
+      }
       if (Object.keys(updatePayload).length > 0) {
         if (resource === "payments" && updatePayload.status === "paid" && updatePayload.paidAt == null) {
           const existingPayment = await repo.findOne({
@@ -6679,6 +6737,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         sanitizeBodyForEntity(repo, updatePayload);
+        await retireSoftDeletedUniquesFromBody(repo, updatePayload);
         await repo.update(numericId, updatePayload);
       }
       if (resource === "orders" && rawBody && entityMap["order_addresses"]) {
@@ -6854,7 +6913,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             });
             if (od) {
               const odRow = od;
-              await decrementDiscountUsage(dataSource, entityMap, odRow.discountId, numericId);
+              await decrementDiscountUsage2(dataSource, entityMap, odRow.discountId, numericId);
             }
           }
         }
@@ -6867,11 +6926,19 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         await repo.update(numericId, buildSoftDeletePayload(repo.metadata, deletedBy));
-        if ((resource === "forms" || resource === "vendors") && existing && typeof existing.slug === "string") {
-          const slug = String(existing.slug).trim();
-          if (slug && !slug.includes("__deleted_")) {
+        const softDeletedCols = repo.metadata.columns.map((c) => c.propertyName);
+        const uniqueColsToRetire = [
+          "slug",
+          "email"
+        ].filter((col) => softDeletedCols.includes(col));
+        if (existing && uniqueColsToRetire.length > 0) {
+          for (const col of uniqueColsToRetire) {
+            const raw = existing[col];
+            if (typeof raw !== "string") continue;
+            const value = raw.trim();
+            if (!value || value.includes("__deleted_")) continue;
             await repo.update(numericId, {
-              slug: `${slug}__deleted_${numericId}`
+              [col]: `${value}__deleted_${numericId}`
             });
           }
         }
@@ -6919,6 +6986,49 @@ async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, em
   });
 }
 __name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
+function buildUserInviteLink(baseUrl, token) {
+  const base = baseUrl.replace(/\/+$/, "");
+  return `${base}/admin/invite?token=${encodeURIComponent(token)}`;
+}
+__name(buildUserInviteLink, "buildUserInviteLink");
+function newUserInviteToken() {
+  return randomBytes(32).toString("hex");
+}
+__name(newUserInviteToken, "newUserInviteToken");
+async function findUserByInviteToken(dataSource, userEntity, token) {
+  const trimmed = token.trim();
+  if (!trimmed) return null;
+  const repo = dataSource.getRepository(userEntity);
+  const row = await repo.findOne({
+    where: {
+      inviteToken: trimmed,
+      deleted: false
+    },
+    select: [
+      "id",
+      "email",
+      "blocked",
+      "password",
+      "inviteStatus",
+      "inviteToken"
+    ]
+  });
+  if (!row) return null;
+  const u = row;
+  return u;
+}
+__name(findUserByInviteToken, "findUserByInviteToken");
+async function completeUserInviteAccept(dataSource, userEntity, userId, passwordHash) {
+  await dataSource.getRepository(userEntity).update(userId, {
+    password: passwordHash,
+    blocked: false,
+    inviteStatus: "active",
+    inviteToken: null
+  });
+}
+__name(completeUserInviteAccept, "completeUserInviteAccept");
+
+// src/lib/vendor-invite-token.ts
 var VENDOR_INVITE_METADATA_TOKEN = "inviteToken";
 var VENDOR_INVITE_METADATA_EXPIRES = "inviteExpiresAt";
 var VENDOR_INVITE_METADATA_SENT = "inviteSentAt";
@@ -6943,6 +7053,13 @@ function invalidatedInviteMessage() {
   return "This invitation is no longer valid. Ask an admin to resend the invite.";
 }
 __name(invalidatedInviteMessage, "invalidatedInviteMessage");
+function userAlreadyActive(user) {
+  const hasPassword = !!(user.password && String(user.password).trim());
+  if (user.inviteStatus === "active" && hasPassword) return true;
+  if (user.inviteStatus === "pending") return false;
+  return !user.blocked && hasPassword;
+}
+__name(userAlreadyActive, "userAlreadyActive");
 async function validateInviteTokenForActivation(dataSource, entityMap, token) {
   const trimmedToken = String(token ?? "").trim();
   if (!trimmedToken) {
@@ -6989,15 +7106,15 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
           "id",
           "email",
           "blocked",
-          "password"
+          "password",
+          "inviteStatus"
         ]
       });
       if (!user2) return {
         ok: false,
         error: "User not found"
       };
-      const hasPassword2 = !!user2.password;
-      if (!user2.blocked && hasPassword2) {
+      if (userAlreadyActive(user2)) {
         return {
           ok: false,
           error: "User is already active"
@@ -7013,6 +7130,24 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
       };
     }
   }
+  if (userRepo && entityMap.users) {
+    const userMatch = await findUserByInviteToken(dataSource, entityMap.users, trimmedToken);
+    if (userMatch) {
+      if (userMatch.inviteStatus === "active" || userAlreadyActive(userMatch)) {
+        return {
+          ok: false,
+          error: "This invitation has already been accepted"
+        };
+      }
+      return {
+        ok: true,
+        target: {
+          userId: userMatch.id,
+          email: userMatch.email
+        }
+      };
+    }
+  }
   let email;
   try {
     email = Buffer.from(trimmedToken, "base64").toString("utf8").trim();
@@ -7042,22 +7177,30 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
       "id",
       "email",
       "blocked",
-      "password"
+      "password",
+      "inviteStatus",
+      "inviteToken"
     ]
   });
   if (!user) return {
     ok: false,
     error: "User not found"
   };
-  const hasPassword = !!user.password;
-  if (!user.blocked && hasPassword) {
+  const u = user;
+  if (userAlreadyActive(u)) {
     return {
       ok: false,
       error: "User is already active"
     };
   }
+  if (u.inviteToken && String(u.inviteToken).trim()) {
+    return {
+      ok: false,
+      error: invalidatedInviteMessage()
+    };
+  }
   if (entityMap.vendors) {
-    const ownerVendor = await loadOwnerVendorForUser(dataSource, entityMap.vendors, user.id);
+    const ownerVendor = await loadOwnerVendorForUser(dataSource, entityMap.vendors, u.id);
     if (ownerVendor && readVendorInviteToken(ownerVendor.metadata)) {
       return {
         ok: false,
@@ -7068,8 +7211,8 @@ async function validateInviteTokenForActivation(dataSource, entityMap, token) {
   return {
     ok: true,
     target: {
-      userId: user.id,
-      email: String(user.email)
+      userId: u.id,
+      email: String(u.email)
     }
   };
 }
@@ -7287,10 +7430,7 @@ function createInviteAcceptHandler(config) {
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
-      await dataSource.getRepository(entityMap.users).update(userId, {
-        password: hashedPassword,
-        blocked: false
-      });
+      await completeUserInviteAccept(dataSource, entityMap.users, userId, hashedPassword);
       if (vendorId != null && entityMap.vendors) {
         await completeVendorInviteAccept(dataSource, entityMap.vendors, vendorId);
       }
@@ -7651,50 +7791,6 @@ async function findLlmAgentByScope(dataSource, entityMap, scope, options = {}) {
 }
 __name(findLlmAgentByScope, "findLlmAgentByScope");
 
-// src/lib/retire-soft-deleted-unique.ts
-async function retireSoftDeletedUniqueValue(repo, column, value) {
-  const trimmed = typeof value === "string" ? value.trim() : "";
-  if (!trimmed) return;
-  const cols = new Set(repo.metadata.columns.map((c) => c.propertyName));
-  if (!cols.has(column) || !cols.has("deleted")) return;
-  const rows = await repo.find({
-    where: {
-      [column]: trimmed,
-      deleted: true
-    }
-  });
-  for (const row of rows) {
-    const id = row.id;
-    if (!Number.isFinite(id)) continue;
-    const current = String(row[column] ?? "");
-    if (current.includes("__deleted_")) continue;
-    await repo.update(id, {
-      [column]: `${trimmed}__deleted_${id}`
-    });
-  }
-}
-__name(retireSoftDeletedUniqueValue, "retireSoftDeletedUniqueValue");
-async function activeUniqueValueExists(repo, column, value, excludeId) {
-  const trimmed = typeof value === "string" ? value.trim() : "";
-  if (!trimmed) return false;
-  const cols = new Set(repo.metadata.columns.map((c) => c.propertyName));
-  if (!cols.has(column)) return false;
-  const qb = repo.createQueryBuilder("row").where(`row.${column} = :value`, {
-    value: trimmed
-  });
-  if (cols.has("deleted")) {
-    qb.andWhere("row.deleted = false");
-  }
-  if (excludeId != null && Number.isFinite(excludeId) && excludeId > 0) {
-    qb.andWhere("row.id != :excludeId", {
-      excludeId
-    });
-  }
-  const hit = await qb.getOne();
-  return !!hit;
-}
-__name(activeUniqueValueExists, "activeUniqueValueExists");
-
 // src/lib/media-folder-path.ts
 function sanitizeMediaFolderPath(input) {
   if (input == null) return "";
@@ -8761,6 +8857,9 @@ function createUploadHandler(config) {
     "image/png",
     "image/gif",
     "image/webp",
+    "video/mp4",
+    "video/webm",
+    "video/quicktime",
     "application/pdf",
     "text/plain",
     "application/zip",
@@ -8788,8 +8887,11 @@ function createUploadHandler(config) {
       });
       const defaultMax = 10 * 1024 * 1024;
       const maxZipBytes = 80 * 1024 * 1024;
+      const maxVideoBytes = 100 * 1024 * 1024;
       const baseMax = maxSizeBytes ?? defaultMax;
-      const effectiveMax = file.type === "application/zip" || file.type === "application/x-zip-compressed" ? Math.max(baseMax, maxZipBytes) : baseMax;
+      const isZip = file.type === "application/zip" || file.type === "application/x-zip-compressed";
+      const isVideo = file.type === "video/mp4" || file.type === "video/webm" || file.type === "video/quicktime";
+      const effectiveMax = isZip ? Math.max(baseMax, maxZipBytes) : isVideo ? Math.max(baseMax, maxVideoBytes) : baseMax;
       if (file.size > effectiveMax) return json({
         error: "File size exceeds limit"
       }, {
@@ -8862,12 +8964,20 @@ function createUploadHandler(config) {
         parentId
       });
     } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
       console.error("[upload] File upload failed", {
-        error: err instanceof Error ? err.message : String(err),
+        error: message,
         stack: err instanceof Error ? err.stack : void 0,
         name: err instanceof Error ? err.name : void 0,
         metadata: err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0
       });
+      if (/Failed to parse body as FormData/i.test(message)) {
+        return json({
+          error: "File upload failed: request body could not be read as FormData. Exclude /api/upload from middleware matcher and raise proxyClientMaxBodySize."
+        }, {
+          status: 500
+        });
+      }
       return json({
         error: "File upload failed"
       }, {
@@ -9621,7 +9731,8 @@ function createUsersApiHandlers(config) {
           "name",
           "email",
           "id",
-          "blocked"
+          "blocked",
+          "inviteStatus"
         ]);
         const sortField = allowedSort.has(sortFieldRaw) ? sortFieldRaw : "createdAt";
         const sortOrder = url.searchParams.get("sortOrder") === "desc" ? "DESC" : "ASC";
@@ -9634,6 +9745,7 @@ function createUsersApiHandlers(config) {
           "u.name",
           "u.email",
           "u.blocked",
+          "u.inviteStatus",
           "u.createdAt",
           "u.updatedAt",
           "u.groupId",
@@ -9729,6 +9841,7 @@ function createUsersApiHandlers(config) {
         const isCustomer = !!(customerG && gid === customerG.id);
         const adminAccess = isCustomer ? false : body.adminAccess === false ? false : true;
         const blocked = body.blocked === true || body.blocked === "true" || body.blocked === 1 || body.blocked === "1";
+        const inviteToken = newUserInviteToken();
         const newUser = existing?.deleted ? await (async () => {
           await userRepo().update(existing.id, {
             deleted: false,
@@ -9738,6 +9851,8 @@ function createUsersApiHandlers(config) {
             email,
             password: null,
             blocked,
+            inviteStatus: "pending",
+            inviteToken,
             groupId: gid,
             adminAccess,
             updatedAt: /* @__PURE__ */ new Date()
@@ -9754,6 +9869,8 @@ function createUsersApiHandlers(config) {
           email,
           password: null,
           blocked,
+          inviteStatus: "pending",
+          inviteToken,
           groupId: gid,
           adminAccess
         }));
@@ -9771,13 +9888,12 @@ function createUsersApiHandlers(config) {
             phone
           });
         }
-        const emailToken = Buffer.from(newUser.email).toString("base64");
-        const inviteLink = `${baseUrl}/admin/invite?token=${emailToken}`;
-        await trySendInviteEmail(newUser.email, inviteLink, newUser.name ?? "");
+        const inviteLink = buildUserInviteLink(baseUrl, inviteToken);
         return json({
-          message: blocked ? "User created successfully (blocked until password is set)" : "User created successfully",
+          message: "User created successfully. Invite is pending until they set a password.",
           user: newUser,
-          inviteLink
+          inviteLink,
+          emailSent: false
         }, {
           status: 201
         });
@@ -9811,6 +9927,7 @@ function createUsersApiHandlers(config) {
             "email",
             "phone",
             "blocked",
+            "inviteStatus",
             "createdAt",
             "updatedAt",
             "groupId"
@@ -9923,6 +10040,7 @@ function createUsersApiHandlers(config) {
             "email",
             "phone",
             "blocked",
+            "inviteStatus",
             "createdAt",
             "updatedAt",
             "groupId"
@@ -9990,13 +10108,21 @@ function createUsersApiHandlers(config) {
         });
       }
     },
-    async regenerateInvite(_req, id) {
-      const authErr = await requireAuth(new Request(_req.url));
+    async regenerateInvite(req, id) {
+      const authErr = await requireAuth(new Request(req.url));
       if (authErr) return authErr;
       if (requireEntityPermission) {
-        const pe = await requireEntityPermission(_req, "users", "update");
+        const pe = await requireEntityPermission(req, "users", "update");
         if (pe) return pe;
       }
+      let sendEmail = true;
+      let rotate = true;
+      try {
+        const body = await req.json().catch(() => ({}));
+        if (body.sendEmail === false) sendEmail = false;
+        if (body.rotate === false) rotate = false;
+      } catch {
+      }
       try {
         const user = await userRepo().findOne({
           where: {
@@ -10006,7 +10132,11 @@ function createUsersApiHandlers(config) {
           select: [
             "id",
             "email",
-            "name"
+            "name",
+            "password",
+            "inviteStatus",
+            "inviteToken",
+            "blocked"
           ]
         });
         if (!user) return json({
@@ -10014,34 +10144,75 @@ function createUsersApiHandlers(config) {
         }, {
           status: 404
         });
-        let inviteLink = `${baseUrl}/admin/invite?token=${Buffer.from(user.email).toString("base64")}`;
+        const u = user;
+        const hasPassword = !!(u.password && String(u.password).trim());
+        if (u.inviteStatus === "active" && hasPassword) {
+          return json({
+            error: "User has already accepted the invite"
+          }, {
+            status: 400
+          });
+        }
+        let inviteLink = "";
         if (entityMap.vendors) {
           const vendorRepo = dataSource.getRepository(entityMap.vendors);
           const vendor = await vendorRepo.findOne({
             where: {
-              userId: user.id,
+              userId: u.id,
               deleted: false
             }
           });
           const v = vendor;
           if (v && (v.inviteStatus === "pending" || v.inviteStatus === "expired")) {
-            const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
-            await vendorRepo.update(v.id, {
-              metadata: rotatedMetadata,
-              inviteStatus: "pending"
-            });
-            const token = readVendorInviteToken(rotatedMetadata);
+            const nextMetadata = rotate ? applyRotatingVendorInvite(v.metadata) : {
+              ...v.metadata ?? {}
+            };
+            if (rotate || v.inviteStatus !== "pending") {
+              await vendorRepo.update(v.id, {
+                metadata: nextMetadata,
+                inviteStatus: "pending"
+              });
+            }
+            const token = readVendorInviteToken(nextMetadata);
             if (token) {
               inviteLink = buildVendorInviteLink(baseUrl, token);
             }
+            const { markVendorInvitePendingForUser } = await import('./vendor-invite-status-PWJ3DE76.js');
+            await markVendorInvitePendingForUser(dataSource, entityMap.vendors, u.id);
+          }
+        }
+        if (!inviteLink) {
+          let token = u.inviteToken?.trim() || "";
+          if (rotate || !token) {
+            token = newUserInviteToken();
+            await userRepo().update(u.id, {
+              inviteToken: token,
+              inviteStatus: "pending",
+              password: null
+            });
+          } else if (u.inviteStatus !== "pending") {
+            await userRepo().update(u.id, {
+              inviteStatus: "pending"
+            });
           }
-          const { markVendorInvitePendingForUser } = await import('./vendor-invite-status-PWJ3DE76.js');
-          await markVendorInvitePendingForUser(dataSource, entityMap.vendors, user.id);
+          inviteLink = buildUserInviteLink(baseUrl, token);
+        } else if (rotate) {
+          await userRepo().update(u.id, {
+            inviteStatus: "pending",
+            password: null
+          });
         }
-        await trySendInviteEmail(user.email, inviteLink, user.name ?? "");
+        let emailSent = false;
+        if (sendEmail && inviteLink) {
+          await trySendInviteEmail(u.email, inviteLink, u.name ?? "");
+          emailSent = true;
+        }
+        const rotatedNote = rotate ? " Previous invite link is no longer valid." : "";
         return json({
-          message: "New invite link generated successfully",
-          inviteLink
+          message: emailSent ? `Invite email sent.${rotatedNote}` : sendEmail ? `Invite link ready (email may not have been sent \u2014 check email plugin).${rotatedNote}` : rotate ? "New invite link created. Previous invite link is no longer valid." : "Invite link ready.",
+          emailSent,
+          inviteLink,
+          inviteStatus: "pending"
         });
       } catch {
         return json({
@@ -14746,6 +14917,13 @@ var User = class {
   phoneVerifiedAt;
   emailVerifiedAt;
   password;
+  /**
+  * `pending` = invite outstanding (cannot sign in until password is set).
+  * `active` = invite accepted / account usable (subject to `blocked`).
+  */
+  inviteStatus;
+  /** Rotating invite token; null when active or no invite outstanding. */
+  inviteToken;
   blocked;
   adminAccess;
   groupId;
@@ -14798,6 +14976,24 @@ _ts_decorate4([
   }),
   _ts_metadata4("design:type", Object)
 ], User.prototype, "password", void 0);
+_ts_decorate4([
+  Column({
+    type: "enum",
+    enum: [
+      "pending",
+      "active"
+    ],
+    enumName: "users_invitestatus_enum",
+    default: "active"
+  }),
+  _ts_metadata4("design:type", typeof UserInviteStatus === "undefined" ? Object : UserInviteStatus)
+], User.prototype, "inviteStatus", void 0);
+_ts_decorate4([
+  Column("varchar", {
+    nullable: true
+  }),
+  _ts_metadata4("design:type", Object)
+], User.prototype, "inviteToken", void 0);
 _ts_decorate4([
   Column("boolean", {
     default: false
@@ -19531,6 +19727,8 @@ var OrderItem = class {
   id;
   orderId;
   productId;
+  /** Selected product variant at order time (optional). */
+  variantId;
   discountIds;
   vendorId;
   vendor;
@@ -19566,6 +19764,12 @@ _ts_decorate39([
   Column("int"),
   _ts_metadata39("design:type", Number)
 ], OrderItem.prototype, "productId", void 0);
+_ts_decorate39([
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata39("design:type", Object)
+], OrderItem.prototype, "variantId", void 0);
 _ts_decorate39([
   Column({
     type: "int",
@@ -20375,6 +20579,7 @@ var Type = /* @__PURE__ */ (function(Type2) {
   Type2["CATEGORY"] = "category";
   Type2["CART"] = "cart";
   Type2["PAYMENT_METHOD"] = "paymentMethod";
+  Type2["DEVICE_TYPE"] = "deviceType";
   Type2["ORDER"] = "order";
   Type2["QUANTITY"] = "quantity";
   Type2["TIME"] = "time";
@@ -22397,6 +22602,7 @@ var Combo = class {
   vendorId;
   vendor;
   name;
+  slug;
   desc;
   eventId;
   event;
@@ -22440,6 +22646,12 @@ _ts_decorate63([
   }),
   _ts_metadata63("design:type", String)
 ], Combo.prototype, "name", void 0);
+_ts_decorate63([
+  Column({
+    type: "varchar"
+  }),
+  _ts_metadata63("design:type", String)
+], Combo.prototype, "slug", void 0);
 _ts_decorate63([
   Column({
     type: "text",
@@ -22577,7 +22789,11 @@ _ts_decorate63([
   _ts_metadata63("design:type", Number)
 ], Combo.prototype, "deletedBy", void 0);
 Combo = _ts_decorate63([
-  Entity("combos")
+  Entity("combos"),
+  Unique("UQ_combos_vendor_slug", [
+    "vendorId",
+    "slug"
+  ])
 ], Combo);
 function _ts_decorate64(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -26503,8 +26719,11 @@ function createMessageTemplateRowLoader(dataSource, entityMap) {
   };
 }
 __name(createMessageTemplateRowLoader, "createMessageTemplateRowLoader");
-function registerMessagingQueueProcessors(cms) {
-  registerEmailQueueProcessor(cms);
+function registerMessagingQueueProcessors(cms, entityMap) {
+  registerEmailQueueProcessor(cms, {
+    getDataSource: /* @__PURE__ */ __name(async () => cms.dataSource, "getDataSource"),
+    entityMap
+  });
   registerWhatsAppQueueProcessor(cms);
 }
 __name(registerMessagingQueueProcessors, "registerMessagingQueueProcessors");
@@ -26556,7 +26775,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
     }
   }
   const merged = Object.keys(overlay).length > 0 ? overlayCmsPlugins(cms, overlay) : cms;
-  registerMessagingQueueProcessors(merged);
+  registerMessagingQueueProcessors(merged, entityMap);
   return merged;
 }
 __name(ensureMessagingPluginsOnCms, "ensureMessagingPluginsOnCms");
@@ -26605,7 +26824,7 @@ async function createCmsAppWithMessaging(options) {
     logger,
     plugins: mergedPlugins
   });
-  registerMessagingQueueProcessors(cms);
+  registerMessagingQueueProcessors(cms, entityMap);
   return cms;
 }
 __name(createCmsAppWithMessaging, "createCmsAppWithMessaging");
@@ -26802,7 +27021,7 @@ function createCmsApiHandler(config) {
         companyDetails
       };
       if (queue) {
-        const { queueEmail: queueEmail2 } = await import('./email-queue-CGZBVVAS.js');
+        const { queueEmail: queueEmail2 } = await import('./email-queue-OI2HSCGE.js');
         await queueEmail2(cms, {
           to: opts.to,
           templateName: "passwordReset",
@@ -28056,14 +28275,27 @@ function createCmsApiHandler(config) {
         const pe = await requireEntityPermissionEffective(req, "orders", "read");
         if (pe) return pe;
         const cms = await getCms();
-        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-3YISSOWW.js');
+        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-3GXDE443.js');
         const oid = Number(path2[1]);
         if (!Number.isFinite(oid)) return config.json({
           error: "Invalid id"
         }, {
           status: 400
         });
-        return streamOrderInvoicePdf2(cms, dataSource, entityMap, oid, {});
+        try {
+          return await streamOrderInvoicePdf2(cms, dataSource, entityMap, oid, {});
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.error("[invoice] route failed", {
+            orderId: oid,
+            error: msg
+          });
+          return config.json({
+            error: `Invoice failed: ${msg}`
+          }, {
+            status: 500
+          });
+        }
       }
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "repost-erp" && getCms) {
         const a = await config.requireAuth(req);
@@ -28410,7 +28642,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-XWIJYDGA.js');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-ZJZB2HUN.js');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -28482,6 +28714,30 @@ function createCmsApiHandler(config) {
             paymentId = Number(payment.id);
           }
         }
+        const orderWithItems = await orderRepo.findOne({
+          where: {
+            id: orderId,
+            deleted: false
+          },
+          relations: [
+            "items"
+          ]
+        });
+        if (orderWithItems) {
+          const { reconcileOrderInventoryBetweenSnapshots: reconcileOrderInventoryBetweenSnapshots2, orderInventorySnapshotFromRow: orderInventorySnapshotFromRow2 } = await import('./order-inventory-76V4XIGW.js');
+          const prevSnap = orderInventorySnapshotFromRow2(orderWithItems);
+          const invErr = await reconcileOrderInventoryBetweenSnapshots2(dataSource, entityMap, prevSnap, {
+            status: "cancelled",
+            lines: prevSnap.lines
+          });
+          if (invErr) {
+            return config.json({
+              error: invErr
+            }, {
+              status: 400
+            });
+          }
+        }
         await orderRepo.update(orderId, {
           status: "cancelled"
         });
@@ -29525,6 +29781,14 @@ function createStorefrontApiHandler(config) {
         entityMap
       });
     }).catch((err) => console.error("[notification-triggers] import failed", err));
+    if (!getCms) return;
+    void import('./send-order-placed-emails-WPI37KRZ.js').then(({ sendOrderPlacedEmailsAfterConfirmation }) => {
+      return sendOrderPlacedEmailsAfterConfirmation(orderId, {
+        getDataSource: /* @__PURE__ */ __name(async () => dataSource, "getDataSource"),
+        entityMap,
+        getCms
+      });
+    }).catch((err) => console.error("[order-emails] sendOrderPlacedEmailsAfterConfirmation failed", err));
   }
   __name(fireOrderPlacedNotification, "fireOrderPlacedNotification");
   const otpAllowPhoneLogin = config.otpAllowPhoneLogin !== false;
@@ -31293,9 +31557,12 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 400
           });
+          const { retireSoftDeletedUniqueValue: retireSoftDeletedUniqueValue2 } = await import('./retire-soft-deleted-unique-NXQIH4BC.js');
+          await retireSoftDeletedUniqueValue2(userRepo(), "email", email);
           const existing = await userRepo().findOne({
             where: {
-              email
+              email,
+              deleted: false
             }
           });
           if (existing) return json({
@@ -32176,6 +32443,7 @@ function createStorefrontApiHandler(config) {
               unitPrice: line.unitPrice,
               tax: line.tax,
               total: line.total,
+              metadata: line.metadata ?? null,
               product: p ? {
                 name: p.name,
                 slug: p.slug,
@@ -32243,4 +32511,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForEmail, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureCustomerRecord, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isSyntheticCustomerPhone, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizeCustomerPhone, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForEmail, customerPhoneForUser, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureCustomerForUser, ensureCustomerRecord, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isSyntheticCustomerPhone, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizeCustomerPhone, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };