@infuro/cms-core 1.0.50 → 1.0.51

package/dist/admin.js

@@ -26,10 +26,10 @@ import 'jodit/es2021/jodit.min.css';
 import { Chart, ArcElement, Tooltip, Legend, CategoryScale, LinearScale, PointElement, LineElement, Title, Filler, BarElement } from 'chart.js';
 import { Line, Doughnut, Bar } from 'react-chartjs-2';
 import * as CheckboxPrimitive from '@radix-ui/react-checkbox';
+import { Country, State, City } from 'country-state-city';
 import { QRCode } from 'react-qr-code';
 import 'typeorm';
 import { Editor, Frame, Element as Element$1, useEditor, useNode } from '@craftjs/core';
-import { Country, State, City } from 'country-state-city';
 import { ThemeProvider } from 'next-themes';
 
 var __defProp = Object.defineProperty;
@@ -230,11 +230,20 @@ var init_infuro_favicon = __esm({
 function isSuperAdminGroupName(name) {
   return name === ADMIN_GROUP_NAME;
 }
+function hasEntityPermission(record, entity, action) {
+  const p = record?.[entity];
+  if (!p) return false;
+  if (action === "create") return p.c;
+  if (action === "read") return p.r;
+  if (action === "update") return p.u;
+  return p.d;
+}
 var ADMIN_GROUP_NAME;
 var init_permission_entities = __esm({
   "src/auth/permission-entities.ts"() {
     ADMIN_GROUP_NAME = "Administrator";
     __name(isSuperAdminGroupName, "isSuperAdminGroupName");
+    __name(hasEntityPermission, "hasEntityPermission");
   }
 });
 
@@ -436,6 +445,395 @@ var init_Header = __esm({
     __name(AdminHeader, "AdminHeader");
   }
 });
+
+// src/lib/vendor-role-defaults.ts
+function full() {
+  return {
+    canCreate: true,
+    canRead: true,
+    canUpdate: true,
+    canDelete: true
+  };
+}
+function read() {
+  return {
+    canCreate: false,
+    canRead: true,
+    canUpdate: false,
+    canDelete: false
+  };
+}
+function none() {
+  return {
+    canCreate: false,
+    canRead: false,
+    canUpdate: false,
+    canDelete: false
+  };
+}
+function readUpdate() {
+  return {
+    canCreate: false,
+    canRead: true,
+    canUpdate: true,
+    canDelete: false
+  };
+}
+function storePerms(spec) {
+  const resolve = /* @__PURE__ */ __name((v) => {
+    if (v === "full") return full();
+    if (v === "read") return read();
+    if (v === "none") return none();
+    return v;
+  }, "resolve");
+  const out = {};
+  for (const entity of STORE_ENTITIES) {
+    out[entity] = resolve(spec[entity] ?? "none");
+  }
+  return out;
+}
+var VENDOR_RBAC_ENTITIES, STORE_ENTITIES;
+var init_vendor_role_defaults = __esm({
+  "src/lib/vendor-role-defaults.ts"() {
+    init_vendor_scope();
+    VENDOR_RBAC_ENTITIES = [
+      ...VENDOR_STORE_RBAC_ENTITIES,
+      "dashboard",
+      "settings",
+      "team",
+      "roles"
+    ];
+    STORE_ENTITIES = [
+      ...VENDOR_STORE_RBAC_ENTITIES
+    ];
+    __name(full, "full");
+    __name(read, "read");
+    __name(none, "none");
+    __name(readUpdate, "readUpdate");
+    __name(storePerms, "storePerms");
+    [
+      {
+        name: "Owner",
+        description: "Full store access and team/role management",
+        isSystem: true,
+        isOwnerRole: true,
+        permissions: {
+          ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
+            e,
+            "full"
+          ]))),
+          dashboard: read(),
+          settings: readUpdate(),
+          team: full(),
+          roles: full()
+        }
+      },
+      {
+        name: "Manager",
+        description: "Day-to-day store operations",
+        isSystem: true,
+        isOwnerRole: false,
+        permissions: {
+          ...storePerms({
+            products: "full",
+            collections: "full",
+            brands: "full",
+            product_categories: "full",
+            orders: "full",
+            vendor_customers: "full",
+            discounts: "full",
+            order_discounts: "full",
+            order_addresses: "full",
+            payments: "read",
+            taxes: "read",
+            attributes: "read"
+          }),
+          dashboard: read(),
+          settings: read(),
+          team: none(),
+          roles: none()
+        }
+      },
+      {
+        name: "Catalog Staff",
+        description: "Manage products and catalog content",
+        isSystem: true,
+        isOwnerRole: false,
+        permissions: {
+          ...storePerms({
+            products: "full",
+            collections: "full",
+            brands: "full",
+            product_categories: "full",
+            attributes: "full",
+            orders: "read",
+            vendor_customers: "read"
+          }),
+          dashboard: read(),
+          settings: none(),
+          team: none(),
+          roles: none()
+        }
+      },
+      {
+        name: "Fulfillment",
+        description: "Orders and fulfillment",
+        isSystem: true,
+        isOwnerRole: false,
+        permissions: {
+          ...storePerms({
+            products: "read",
+            orders: "full",
+            order_addresses: "full",
+            order_discounts: "read",
+            vendor_customers: "read"
+          }),
+          dashboard: read(),
+          settings: none(),
+          team: none(),
+          roles: none()
+        }
+      },
+      {
+        name: "Viewer",
+        description: "Read-only access to store data",
+        isSystem: true,
+        isOwnerRole: false,
+        permissions: {
+          ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
+            e,
+            "read"
+          ]))),
+          dashboard: read(),
+          settings: none(),
+          team: none(),
+          roles: none()
+        }
+      }
+    ];
+  }
+});
+
+// src/auth/rbac-debug.ts
+function summarizeEntityPerms(entityPerms) {
+  const out = {};
+  if (!entityPerms) return out;
+  for (const [entity, p] of Object.entries(entityPerms)) {
+    out[entity] = {
+      c: p.c,
+      r: p.r,
+      u: p.u,
+      d: p.d
+    };
+  }
+  return out;
+}
+function vendorPortalFallbackReason(user, entity, action) {
+  if (!isVendorPortalUser(user)) return null;
+  if (entity === "dashboard" && action === "read") return "vendor_portal_dashboard_fallback";
+  if (entity === "analytics" && action === "read") return "vendor_portal_analytics_fallback";
+  if (entity === "settings" && action === "read") return "vendor_portal_settings_read_fallback";
+  if (entity === "upload" && (action === "create" || action === "read")) {
+    return "vendor_portal_upload_fallback";
+  }
+  if (VENDOR_STORE_RBAC_ENTITIES.has(entity) && action === "read") return "vendor_portal_store_read_fallback";
+  return null;
+}
+function explainSessionEntityAccess(user, entity, action) {
+  const userSnapshot = {
+    email: user?.email ?? null,
+    id: user?.id ?? null,
+    groupId: user?.groupId ?? null,
+    groupName: user?.groupName ?? null,
+    isRBACAdmin: user?.isRBACAdmin ?? false,
+    adminAccess: user?.adminAccess ?? null,
+    vendorIds: user?.vendorIds ?? [],
+    activeVendorId: user?.activeVendorId ?? null,
+    vendorRole: user?.vendorRole ?? null,
+    vendorRoleId: user?.vendorRoleId ?? null,
+    vendorRoleName: user?.vendorRoleName ?? null,
+    isVendorRoleOwner: user?.isVendorRoleOwner ?? false,
+    vendorEntityPerms: summarizeEntityPerms(user?.vendorEntityPerms),
+    isVendorPortal: user?.isVendorPortal ?? false,
+    isVendorOwner: user?.isVendorOwner ?? false,
+    isVendorPortalComputed: isVendorPortalUser(user),
+    isVendorOwnerComputed: isVendorOwner(user),
+    jwtEntityPerms: summarizeEntityPerms(user?.entityPerms),
+    jwtEntityPermForTarget: user?.entityPerms?.[entity] ?? null
+  };
+  if (!user?.email) {
+    return {
+      allowed: false,
+      reason: "no_session_email",
+      userSnapshot
+    };
+  }
+  if (user.isRBACAdmin) {
+    return {
+      allowed: true,
+      reason: "platform_administrator",
+      userSnapshot
+    };
+  }
+  if ((isVendorPortalUser(user) || (user.vendorIds?.length ?? 0) > 0) && entity === "upload" && (action === "create" || action === "read")) {
+    return {
+      allowed: true,
+      reason: "vendor_portal_upload",
+      userSnapshot
+    };
+  }
+  const vendorIds = user.vendorIds ?? [];
+  const isStaff = user.vendorRole === "staff";
+  const vendorPerms = user.vendorEntityPerms;
+  const hasVendorRolePerms = vendorPerms != null && Object.keys(vendorPerms).length > 0;
+  const enforceVendorRoleMatrix = vendorIds.length > 0 && (hasVendorRolePerms || user.vendorRoleId != null);
+  if (enforceVendorRoleMatrix) {
+    const vendorRbacSet = new Set(VENDOR_RBAC_ENTITIES);
+    if (vendorRbacSet.has(entity) || entity === "analytics") {
+      if (entity === "analytics" && action === "read") {
+        const allowed3 = hasEntityPermission(vendorPerms, "dashboard", "read");
+        return {
+          allowed: allowed3,
+          reason: allowed3 ? "vendor_role_analytics_via_dashboard" : "vendor_role_analytics_denied",
+          userSnapshot
+        };
+      }
+      if (user.isVendorRoleOwner === true) {
+        return {
+          allowed: true,
+          reason: "vendor_owner_role_full",
+          userSnapshot
+        };
+      }
+      const allowed2 = hasEntityPermission(vendorPerms, entity, action);
+      return {
+        allowed: allowed2,
+        reason: allowed2 ? "vendor_role_permissions_allow" : "vendor_role_permissions_deny",
+        userSnapshot
+      };
+    }
+  }
+  if (vendorIds.length > 0) {
+    if (entity === "dashboard" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_link_dashboard_read",
+        userSnapshot
+      };
+    }
+    if (entity === "analytics" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_link_analytics_read",
+        userSnapshot
+      };
+    }
+    if (entity === "settings") {
+      if (action === "read") {
+        return {
+          allowed: true,
+          reason: "vendor_link_settings_read",
+          userSnapshot
+        };
+      }
+      if (action === "update" && !isStaff) {
+        return {
+          allowed: true,
+          reason: "vendor_link_settings_update",
+          userSnapshot
+        };
+      }
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      if (isStaff && action === "read") {
+        return {
+          allowed: true,
+          reason: "vendor_staff_store_read",
+          userSnapshot
+        };
+      }
+      if (!isStaff) {
+        return {
+          allowed: true,
+          reason: "vendor_link_store_full",
+          userSnapshot
+        };
+      }
+      return {
+        allowed: false,
+        reason: "vendor_staff_store_write_denied",
+        userSnapshot
+      };
+    }
+  }
+  if (isVendorPortalUser(user) && isVendorOwner(user)) {
+    if (entity === "dashboard" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_dashboard",
+        userSnapshot
+      };
+    }
+    if (entity === "analytics" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_analytics",
+        userSnapshot
+      };
+    }
+    if (entity === "settings" && (action === "read" || action === "update")) {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_settings",
+        userSnapshot
+      };
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_store",
+        userSnapshot
+      };
+    }
+  }
+  const vendorPortalReason = vendorPortalFallbackReason(user, entity, action);
+  if (vendorPortalReason) {
+    return {
+      allowed: true,
+      reason: vendorPortalReason,
+      userSnapshot
+    };
+  }
+  const explicit = user.entityPerms?.[entity];
+  if (explicit !== void 0) {
+    const allowed2 = hasEntityPermission(user.entityPerms, entity, action);
+    return {
+      allowed: allowed2,
+      reason: allowed2 ? "jwt_entity_perms_allow" : "jwt_entity_perms_deny",
+      userSnapshot
+    };
+  }
+  const allowed = hasEntityPermission(user.entityPerms, entity, action);
+  return {
+    allowed,
+    reason: allowed ? "entity_perms_fallback_allow" : "no_matching_rule",
+    userSnapshot
+  };
+}
+function sessionHasEntityAccessFromExplanation(user, entity, action) {
+  return explainSessionEntityAccess(user, entity, action).allowed;
+}
+var init_rbac_debug = __esm({
+  "src/auth/rbac-debug.ts"() {
+    init_permission_entities();
+    init_vendor_role_defaults();
+    init_vendor_scope();
+    __name(summarizeEntityPerms, "summarizeEntityPerms");
+    __name(vendorPortalFallbackReason, "vendorPortalFallbackReason");
+    __name(explainSessionEntityAccess, "explainSessionEntityAccess");
+    __name(sessionHasEntityAccessFromExplanation, "sessionHasEntityAccessFromExplanation");
+  }
+});
 var defaultValue, AdminConfigContext;
 var init_admin_config_context = __esm({
   "src/admin/admin-config-context.tsx"() {
@@ -455,7 +853,7 @@ var init_admin_config_context = __esm({
 var CMS_VERSION;
 var init_cms_version = __esm({
   "src/lib/cms-version.ts"() {
-    CMS_VERSION = "1.0.50" ;
+    CMS_VERSION = "1.0.51" ;
   }
 });
 function useCatalogCategories(enabled = true) {
@@ -590,6 +988,10 @@ function AdminSidebar({ variant = "sidebar" }) {
   const sectionCls7 = "mb-5";
   const headingCls = "text-[11px] font-semibold text-gray-400 uppercase tracking-wider px-2.5 mb-1.5";
   const asideCls = isDrawer ? "w-full h-full min-h-0 bg-white flex flex-col overflow-hidden" : "w-52 h-full min-h-0 bg-white border-r border-gray-200 flex-shrink-0 flex flex-col overflow-hidden";
+  const canReadEntity = /* @__PURE__ */ __name((entity) => {
+    if (!sessionUser) return true;
+    return sessionHasEntityAccessFromExplanation(sessionUser, entity, "read");
+  }, "canReadEntity");
   return /* @__PURE__ */ React.createElement("aside", {
     className: asideCls
   }, /* @__PURE__ */ React.createElement("div", {
@@ -607,30 +1009,40 @@ function AdminSidebar({ variant = "sidebar" }) {
     className: `${linkCls} ${isActive("/admin/dashboard") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(LayoutDashboard, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/dashboard") ? iconActive : iconInactive}`
-  }), "Dashboard")))), showPlatformNav && customNavSections.length > 0 && customNavSections.map((section) => /* @__PURE__ */ React.createElement("div", {
-    key: section.title,
-    className: sectionCls7
-  }, /* @__PURE__ */ React.createElement("h3", {
-    className: headingCls
-  }, section.title), /* @__PURE__ */ React.createElement("ul", {
-    className: "space-y-0.5"
-  }, section.items.map((item) => {
-    const Icon2 = getIconForItem(item.icon);
-    return /* @__PURE__ */ React.createElement("li", {
-      key: item.href
-    }, /* @__PURE__ */ React.createElement(Link2, {
-      href: item.href,
-      className: `${linkCls} ${isActive(item.href) ? linkActive : linkInactive}`
-    }, /* @__PURE__ */ React.createElement(Icon2, {
-      className: `h-4 w-4 mr-2 ${isActive(item.href) ? iconActive : iconInactive}`
-    }), item.label));
-  })))), showPlatformNav && customNavSections.length === 0 && customNavItems.length > 0 && /* @__PURE__ */ React.createElement("div", {
+  }), "Dashboard")))), showPlatformNav && customNavSections.length > 0 && customNavSections.map((section) => {
+    const filteredItems = section.items.filter((item) => {
+      const entity = item.href.replace("/admin/", "").split("/")[0];
+      return canReadEntity(entity);
+    });
+    if (filteredItems.length === 0) return null;
+    return /* @__PURE__ */ React.createElement("div", {
+      key: section.title,
+      className: sectionCls7
+    }, /* @__PURE__ */ React.createElement("h3", {
+      className: headingCls
+    }, section.title), /* @__PURE__ */ React.createElement("ul", {
+      className: "space-y-0.5"
+    }, filteredItems.map((item) => {
+      const Icon2 = getIconForItem(item.icon);
+      return /* @__PURE__ */ React.createElement("li", {
+        key: item.href
+      }, /* @__PURE__ */ React.createElement(Link2, {
+        href: item.href,
+        className: `${linkCls} ${isActive(item.href) ? linkActive : linkInactive}`
+      }, /* @__PURE__ */ React.createElement(Icon2, {
+        className: `h-4 w-4 mr-2 ${isActive(item.href) ? iconActive : iconInactive}`
+      }), item.label));
+    })));
+  }), showPlatformNav && customNavSections.length === 0 && customNavItems.length > 0 && /* @__PURE__ */ React.createElement("div", {
     className: sectionCls7
   }, /* @__PURE__ */ React.createElement("h3", {
     className: headingCls
   }, "Custom"), /* @__PURE__ */ React.createElement("ul", {
     className: "space-y-0.5"
-  }, customNavItems.map((item) => {
+  }, customNavItems.filter((item) => {
+    const entity = item.href.replace("/admin/", "").split("/")[0];
+    return canReadEntity(entity);
+  }).map((item) => {
     const Icon2 = getIconForItem(item.icon);
     return /* @__PURE__ */ React.createElement("li", {
       key: item.href
@@ -651,85 +1063,92 @@ function AdminSidebar({ variant = "sidebar" }) {
     className: `${linkCls} ${isActive("/admin/dashboard") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(LayoutDashboard, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/dashboard") ? iconActive : iconInactive}`
-  }), "Dashboard")))), vendorPortal && customNavSections.length > 0 && customNavSections.map((section) => /* @__PURE__ */ React.createElement("div", {
-    key: section.title,
-    className: sectionCls7
-  }, /* @__PURE__ */ React.createElement("h3", {
-    className: headingCls
-  }, section.title), /* @__PURE__ */ React.createElement("ul", {
-    className: "space-y-0.5"
-  }, section.items.map((item) => {
-    const Icon2 = getIconForItem(item.icon);
-    return /* @__PURE__ */ React.createElement("li", {
-      key: item.href
-    }, /* @__PURE__ */ React.createElement(Link2, {
-      href: item.href,
-      className: `${linkCls} ${isActive(item.href) ? linkActive : linkInactive}`
-    }, /* @__PURE__ */ React.createElement(Icon2, {
-      className: `h-4 w-4 mr-2 ${isActive(item.href) ? iconActive : iconInactive}`
-    }), item.label));
-  })))), showStoreNav && /* @__PURE__ */ React.createElement("div", {
+  }), "Dashboard")))), vendorPortal && customNavSections.length > 0 && customNavSections.map((section) => {
+    const filteredItems = section.items.filter((item) => {
+      const entity = item.href.replace("/admin/", "").split("/")[0];
+      return canReadEntity(entity);
+    });
+    if (filteredItems.length === 0) return null;
+    return /* @__PURE__ */ React.createElement("div", {
+      key: section.title,
+      className: sectionCls7
+    }, /* @__PURE__ */ React.createElement("h3", {
+      className: headingCls
+    }, section.title), /* @__PURE__ */ React.createElement("ul", {
+      className: "space-y-0.5"
+    }, filteredItems.map((item) => {
+      const Icon2 = getIconForItem(item.icon);
+      return /* @__PURE__ */ React.createElement("li", {
+        key: item.href
+      }, /* @__PURE__ */ React.createElement(Link2, {
+        href: item.href,
+        className: `${linkCls} ${isActive(item.href) ? linkActive : linkInactive}`
+      }, /* @__PURE__ */ React.createElement(Icon2, {
+        className: `h-4 w-4 mr-2 ${isActive(item.href) ? iconActive : iconInactive}`
+      }), item.label));
+    })));
+  }), showStoreNav && /* @__PURE__ */ React.createElement("div", {
     className: sectionCls7
   }, /* @__PURE__ */ React.createElement("h3", {
     className: headingCls
   }, "Store"), /* @__PURE__ */ React.createElement("ul", {
     className: "space-y-0.5"
-  }, showVendorOnboard && multiVendorEnabled !== false && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }, showVendorOnboard && multiVendorEnabled !== false && canReadEntity("vendors") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/vendors",
     className: `${linkCls} ${isActive("/admin/vendors") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Store, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/vendors") ? iconActive : iconInactive}`
-  }), "Vendors")), showVendorCategories && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Vendors")), showVendorCategories && canReadEntity("product_categories") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/product_categories",
     className: `${linkCls} ${isActive("/admin/product_categories") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(FolderTree, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/product_categories") ? iconActive : iconInactive}`
-  }), "Categories")), showVendorCollections && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Categories")), showVendorCollections && canReadEntity("collections") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/collections",
     className: `${linkCls} ${isActive("/admin/collections") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Layers, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/collections") ? iconActive : iconInactive}`
-  }), "Collections")), showVendorBrands && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Collections")), showVendorBrands && canReadEntity("brands") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/brands",
     className: `${linkCls} ${isActive("/admin/brands") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Building2, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/brands") ? iconActive : iconInactive}`
-  }), "Brands")), !hasCustomEventsNav && eventsEnabled !== false ? /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Brands")), !hasCustomEventsNav && eventsEnabled !== false && canReadEntity("events") ? /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/events",
     className: `${linkCls} ${isActive("/admin/events") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(CalendarDays, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/events") ? iconActive : iconInactive}`
-  }), "Events")) : null, /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Events")) : null, canReadEntity("products") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/products",
     className: `${linkCls} ${isActive("/admin/products") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(ShoppingBag, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/products") ? iconActive : iconInactive}`
-  }), "Products")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Products")), canReadEntity("combos") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/combos",
     className: `${linkCls} ${isActive("/admin/combos") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Package, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/combos") ? iconActive : iconInactive}`
-  }), "Combos")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Combos")), canReadEntity("taxes") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/taxes",
     className: `${linkCls} ${isActive("/admin/taxes") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Receipt, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/taxes") ? iconActive : iconInactive}`
-  }), "Taxes")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Taxes")), canReadEntity("discounts") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/discounts",
     className: `${linkCls} ${isActive("/admin/discounts") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(BadgePercent, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/discounts") ? iconActive : iconInactive}`
-  }), "Discounts")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Discounts")), canReadEntity("orders") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/orders",
     className: `${linkCls} ${isActive("/admin/orders") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(ShoppingCart, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/orders") ? iconActive : iconInactive}`
-  }), "Orders")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Orders")), canReadEntity("payments") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/payments",
     className: `${linkCls} ${isActive("/admin/payments") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(CreditCard, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/payments") ? iconActive : iconInactive}`
-  }), "Payments")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Payments")), canReadEntity("vendor_customers") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/vendor_customers",
     className: `${linkCls} ${isActive("/admin/vendor_customers") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Users, {
@@ -740,32 +1159,32 @@ function AdminSidebar({ variant = "sidebar" }) {
     className: headingCls
   }, "Management"), /* @__PURE__ */ React.createElement("ul", {
     className: "space-y-0.5"
-  }, /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }, canReadEntity("contacts") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/contacts",
     className: `${linkCls} ${isActive("/admin/contacts") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Inbox, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/contacts") ? iconActive : iconInactive}`
-  }), "Contacts")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Contacts")), canReadEntity("blogs") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/blogs",
     className: `${linkCls} ${isActive("/admin/blogs") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(File, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/blogs") ? iconActive : iconInactive}`
-  }), "Blogs")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Blogs")), canReadEntity("pages") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/pages",
     className: `${linkCls} ${isActive("/admin/pages") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(LinkIcon, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/pages") ? iconActive : iconInactive}`
-  }), "Pages")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Pages")), canReadEntity("forms") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/forms",
     className: `${linkCls} ${isActive("/admin/forms") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(ClipboardList, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/forms") ? iconActive : iconInactive}`
-  }), "Forms")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Forms")), canReadEntity("form_submissions") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/submissions",
     className: `${linkCls} ${isActive("/admin/submissions") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(MessageSquare, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/submissions") ? iconActive : iconInactive}`
-  }), "Submissions")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Submissions")), canReadEntity("upload") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/media",
     className: `${linkCls} ${isActive("/admin/media") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Image$1, {
@@ -802,12 +1221,12 @@ function AdminSidebar({ variant = "sidebar" }) {
     className: headingCls
   }, "System"), /* @__PURE__ */ React.createElement("ul", {
     className: "space-y-0.5"
-  }, /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }, canReadEntity("users") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/users",
     className: `${linkCls} ${isActive("/admin/users") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Users, {
     className: `h-4 w-4 mr-2 ${isActive("/admin/users") ? iconActive : iconInactive}`
-  }), "Users")), /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
+  }), "Users")), canReadEntity("roles") && /* @__PURE__ */ React.createElement("li", null, /* @__PURE__ */ React.createElement(Link2, {
     href: "/admin/roles",
     className: `${linkCls} ${isActive("/admin/roles") ? linkActive : linkInactive}`
   }, /* @__PURE__ */ React.createElement(Shield, {
@@ -854,6 +1273,7 @@ var init_Sidebar = __esm({
   "src/components/Admin/Sidebar.tsx"() {
     "use client";
     init_vendor_scope();
+    init_rbac_debug();
     init_admin_config_context();
     init_infuro_favicon();
     init_cms_version();
@@ -1480,7 +1900,15 @@ function useEventsSettings() {
     requireEventApproval
   };
 }
-function AdminLayout({ children, customNavItems = [], customNavSections = [], customCrudConfigs = {}, categoryRelatedProductLabels = {}, renderOrderDetailFooter, theme, themeRegistry, pluginDescriptors = [] }) {
+function AdminLayout({ children, customNavItems = [], customNavSections = [], customCrudConfigs = {}, categoryRelatedProductLabels = {}, renderOrderDetailFooter, extraNotificationVariables, theme, themeRegistry, pluginDescriptors = [] }) {
+  useEffect(() => {
+    document.documentElement.style.overflow = "hidden";
+    document.body.style.overflow = "hidden";
+    return () => {
+      document.documentElement.style.overflow = "";
+      document.body.style.overflow = "";
+    };
+  }, []);
   const resolvedTheme = useResolvedTheme(theme, themeRegistry);
   const { storeEnabled, currency } = useStoreEnabled();
   const { multiVendorEnabled, vendorCanCreateCategories, vendorCanCreateCollections, vendorCanCreateBrands, requireProductApproval } = useMultiVendorSettings();
@@ -1501,6 +1929,7 @@ function AdminLayout({ children, customNavItems = [], customNavSections = [], cu
     customCrudConfigs,
     categoryRelatedProductLabels,
     renderOrderDetailFooter,
+    extraNotificationVariables,
     theme: resolvedTheme,
     themeRegistry,
     pluginDescriptors: mergedPluginDescriptors,
@@ -1519,6 +1948,7 @@ function AdminLayout({ children, customNavItems = [], customNavSections = [], cu
     customCrudConfigs,
     categoryRelatedProductLabels,
     renderOrderDetailFooter,
+    extraNotificationVariables,
     resolvedTheme,
     themeRegistry,
     mergedPluginDescriptors,
@@ -4375,6 +4805,8 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
   const hasLoadedRef = useRef(false);
   const isMobile = useIsMobile();
   const showGroupColumn = !!manageUserGroups && roleOptions.length > 0;
+  const { data: session } = useSession();
+  const sessionUser = session?.user;
   const listColumns = useMemo(() => Array.isArray(columns) ? columns.filter((c) => !c.hideInTable) : [], [
     columns
   ]);
@@ -4915,6 +5347,9 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
     withListFrom
   ]);
   const resourceName = apiEndpoint.replace("/api/", "");
+  const canCreate = !sessionUser || sessionHasEntityAccessFromExplanation(sessionUser, resourceName, "create");
+  const canUpdate = !sessionUser || sessionHasEntityAccessFromExplanation(sessionUser, resourceName, "update");
+  const canDelete = !sessionUser || sessionHasEntityAccessFromExplanation(sessionUser, resourceName, "delete");
   const dedicatedRecordEditHref = /* @__PURE__ */ __name((recordId) => addEditPage && (resourceName === "orders" || resourceName === "events") ? withListFrom(`${addEditPageUrl}/${recordId}/edit`) : addEditPage ? withListFrom(`${addEditPageUrl}/${recordId}`) : "", "dedicatedRecordEditHref");
   const showDedicatedDuplicate = addEditPage && !CRUD_NO_DUPLICATE_RESOURCES.has(resourceName);
   const hasCustomView = customViewPageUrl && customViewPageUrl.length > 0;
@@ -5074,15 +5509,15 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
     onClick: /* @__PURE__ */ __name(() => setBulkDialogOpen(true), "onClick"),
     variant: "outline",
     className: "bg-transparent text-white border-gray-600 hover:bg-gray-700 text-xs h-8"
-  }, /* @__PURE__ */ React.createElement(Upload, {
+  }, /* @__PURE__ */ React.createElement(Download, {
     className: "h-3.5 w-3.5 mr-1"
   }), "Import"), /* @__PURE__ */ React.createElement(Button, {
     onClick: handleExport,
     variant: "outline",
     className: "bg-transparent text-white border-gray-600 hover:bg-gray-700 text-xs h-8"
-  }, /* @__PURE__ */ React.createElement(Download, {
+  }, /* @__PURE__ */ React.createElement(Upload, {
     className: "h-3.5 w-3.5 mr-1"
-  }), "Export"), !addEditPage && /* @__PURE__ */ React.createElement(Button, {
+  }), "Export"), canCreate && !addEditPage && /* @__PURE__ */ React.createElement(Button, {
     onClick: /* @__PURE__ */ __name(() => {
       setEditingItem(null);
       setDuplicateSeed(null);
@@ -5091,7 +5526,7 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
     className: "bg-white text-gray-800 hover:bg-gray-100 border-0 text-xs h-8"
   }, /* @__PURE__ */ React.createElement(Plus, {
     className: "h-3.5 w-3.5"
-  }), "Add"), addEditPage && dedicatedCreateHref && /* @__PURE__ */ React.createElement(Link2, {
+  }), "Add"), canCreate && addEditPage && dedicatedCreateHref && /* @__PURE__ */ React.createElement(Link2, {
     href: dedicatedCreateHref,
     className: "inline-flex items-center gap-1 bg-white text-gray-800 hover:bg-gray-100 border-0 text-xs h-8 px-3 rounded-md font-medium"
   }, /* @__PURE__ */ React.createElement(Plus, {
@@ -5250,7 +5685,7 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
     onClick: /* @__PURE__ */ __name((e) => e.stopPropagation(), "onClick")
   }, /* @__PURE__ */ React.createElement("div", {
     className: "flex items-center justify-center gap-1"
-  }, customRowActions ? customRowActions(item) : /* @__PURE__ */ React.createElement(React.Fragment, null, !addEditPage && /* @__PURE__ */ React.createElement(Button, {
+  }, customRowActions ? customRowActions(item) : /* @__PURE__ */ React.createElement(React.Fragment, null, canUpdate && !addEditPage && /* @__PURE__ */ React.createElement(Button, {
     variant: "outline",
     size: "icon",
     className: "h-7 w-7",
@@ -5260,7 +5695,7 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
     className: "h-3.5 w-3.5"
   }), /* @__PURE__ */ React.createElement("span", {
     className: "sr-only"
-  }, "Edit")), addEditPage && /* @__PURE__ */ React.createElement(Button, {
+  }, "Edit")), canUpdate && addEditPage && /* @__PURE__ */ React.createElement(Button, {
     variant: "outline",
     size: "icon",
     className: "h-7 w-7",
@@ -5270,7 +5705,7 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
     className: "h-3.5 w-3.5"
   }), /* @__PURE__ */ React.createElement("span", {
     className: "sr-only"
-  }, "Edit")), showDuplicateEntry && /* @__PURE__ */ React.createElement(Button, {
+  }, "Edit")), canCreate && showDuplicateEntry && /* @__PURE__ */ React.createElement(Button, {
     variant: "outline",
     size: "icon",
     className: "h-7 w-7",
@@ -5296,7 +5731,7 @@ function AdminCRUD({ title, apiEndpoint, columns, addEditPageUrl, customViewPage
     className: "h-3.5 w-3.5"
   }), /* @__PURE__ */ React.createElement("span", {
     className: "sr-only"
-  }, "Resend invite")), /* @__PURE__ */ React.createElement(Button, {
+  }, "Resend invite")), canDelete && /* @__PURE__ */ React.createElement(Button, {
     variant: "outline",
     size: "icon",
     className: "h-7 w-7 border-red-300 text-red-600 hover:text-red-700",
@@ -5434,6 +5869,7 @@ var init_CRUD = __esm({
     init_dropdown_menu();
     init_utils();
     init_use_mobile();
+    init_rbac_debug();
     init_BulkUploadDialog();
     init_admin_list_return_url();
     init_build_crud_list_filters_from_columns();
@@ -15502,6 +15938,18 @@ var init_email_recipients = __esm({
     __name(serializeEmailRecipients, "serializeEmailRecipients");
   }
 });
+function useNotificationVariables() {
+  const config = useContext(AdminConfigContext);
+  const extra = config?.extraNotificationVariables ?? [];
+  const vars = [
+    ...KNOWN_VARS,
+    ...extra.map((e) => e.name)
+  ];
+  return {
+    vars,
+    extra
+  };
+}
 function getEmailTriggerDefaults(triggerKey, audience = "customer") {
   if (audience === "vendor") {
     return VENDOR_EMAIL_TRIGGER_DEFAULTS[triggerKey] ?? {
@@ -15645,6 +16093,7 @@ var KNOWN_VARS, EMAIL_TRIGGER_DEFAULTS, VENDOR_EMAIL_TRIGGER_DEFAULTS, ADMIN_EMA
 var init_order_notification_bindings_shared = __esm({
   "src/admin/components/order-notification-bindings-shared.ts"() {
     "use client";
+    init_admin_config_context();
     KNOWN_VARS = [
       "orderId",
       "orderNumber",
@@ -15659,6 +16108,7 @@ var init_order_notification_bindings_shared = __esm({
       "invoiceNumber",
       "invoiceUrl"
     ];
+    __name(useNotificationVariables, "useNotificationVariables");
     EMAIL_TRIGGER_DEFAULTS = {
       order_placed: {
         subject: "Your order {{orderNumber}} is confirmed",
@@ -16362,16 +16812,23 @@ function TriggerEmailEditor({ triggerKey, label, description, audience = "custom
       cancelled = true;
     };
   }, []);
+  const { vars: availableVars, extra: extraVars } = useNotificationVariables();
   const visibleVars = useMemo(() => {
-    return KNOWN_VARS.filter((v) => {
+    return availableVars.filter((v) => {
       if (v === "vendorName" || v === "vendorId") return multiVendorOn;
       if (v === "eventName") return eventsOn;
       return true;
     });
   }, [
+    availableVars,
     multiVendorOn,
     eventsOn
   ]);
+  const getVarHint = /* @__PURE__ */ __name((v) => {
+    if (v in VAR_HINTS) return VAR_HINTS[v];
+    const match = extraVars.find((e) => e.name === v);
+    return match?.hint || match?.label || v;
+  }, "getVarHint");
   return /* @__PURE__ */ React.createElement("div", {
     className: "space-y-3 border-t border-gray-100 pt-4 first:border-t-0 first:pt-0 dark:border-gray-700"
   }, /* @__PURE__ */ React.createElement("div", {
@@ -16434,7 +16891,7 @@ function TriggerEmailEditor({ triggerKey, label, description, audience = "custom
   }, visibleVars.map((v) => /* @__PURE__ */ React.createElement("button", {
     key: v,
     type: "button",
-    title: VAR_HINTS[v],
+    title: getVarHint(v),
     onClick: /* @__PURE__ */ __name(() => insertVariable(v), "onClick"),
     className: "rounded border border-gray-200 bg-white px-2 py-1 font-mono text-[11px] text-gray-700 hover:border-blue-300 hover:bg-blue-50 dark:border-gray-600 dark:bg-gray-900 dark:text-gray-300 dark:hover:border-blue-700 dark:hover:bg-blue-950/40"
   }, `{{${v}}}`))), /* @__PURE__ */ React.createElement("p", {
@@ -16480,6 +16937,12 @@ function PushTriggerBindings({ audience = "customer" }) {
   const bodyRef = useRef(null);
   const subjectRef = useRef(null);
   const lastFocused = useRef("body");
+  const { vars: availableVars, extra: extraVars } = useNotificationVariables();
+  const getVarHint = /* @__PURE__ */ __name((v) => {
+    if (v in VAR_HINTS2) return VAR_HINTS2[v];
+    const match = extraVars.find((e) => e.name === v);
+    return match?.hint || match?.label || v;
+  }, "getVarHint");
   useEffect(() => {
     let cancelled = false;
     (async () => {
@@ -16701,11 +17164,11 @@ function PushTriggerBindings({ audience = "customer" }) {
     className: "text-xs font-medium text-gray-700 dark:text-gray-300"
   }, "Insert Variables"), /* @__PURE__ */ React.createElement("div", {
     className: "flex flex-wrap gap-1.5"
-  }, KNOWN_VARS.map((v) => /* @__PURE__ */ React.createElement("button", {
+  }, availableVars.map((v) => /* @__PURE__ */ React.createElement("button", {
     key: v,
     type: "button",
     onClick: /* @__PURE__ */ __name(() => insertVariable(v), "onClick"),
-    title: VAR_HINTS2[v],
+    title: getVarHint(v),
     className: "px-2 py-1 bg-gray-100 hover:bg-gray-200 dark:bg-gray-800 dark:hover:bg-gray-700 text-gray-700 dark:text-gray-300 rounded text-xs font-mono border border-gray-200 dark:border-gray-700 transition-colors"
   }, `{{${v}}}`)))), /* @__PURE__ */ React.createElement("div", {
     className: "space-y-1.5"
@@ -20811,183 +21274,6 @@ var init_PluginsPage = __esm({
   }
 });
 
-// src/lib/vendor-role-defaults.ts
-function full() {
-  return {
-    canCreate: true,
-    canRead: true,
-    canUpdate: true,
-    canDelete: true
-  };
-}
-function read() {
-  return {
-    canCreate: false,
-    canRead: true,
-    canUpdate: false,
-    canDelete: false
-  };
-}
-function none() {
-  return {
-    canCreate: false,
-    canRead: false,
-    canUpdate: false,
-    canDelete: false
-  };
-}
-function readUpdate() {
-  return {
-    canCreate: false,
-    canRead: true,
-    canUpdate: true,
-    canDelete: false
-  };
-}
-function storePerms(spec) {
-  const resolve = /* @__PURE__ */ __name((v) => {
-    if (v === "full") return full();
-    if (v === "read") return read();
-    if (v === "none") return none();
-    return v;
-  }, "resolve");
-  const out = {};
-  for (const entity of STORE_ENTITIES) {
-    out[entity] = resolve(spec[entity] ?? "none");
-  }
-  return out;
-}
-var STORE_ENTITIES;
-var init_vendor_role_defaults = __esm({
-  "src/lib/vendor-role-defaults.ts"() {
-    init_vendor_scope();
-    [
-      ...VENDOR_STORE_RBAC_ENTITIES,
-      "dashboard",
-      "settings",
-      "team",
-      "roles"
-    ];
-    STORE_ENTITIES = [
-      ...VENDOR_STORE_RBAC_ENTITIES
-    ];
-    __name(full, "full");
-    __name(read, "read");
-    __name(none, "none");
-    __name(readUpdate, "readUpdate");
-    __name(storePerms, "storePerms");
-    [
-      {
-        name: "Owner",
-        description: "Full store access and team/role management",
-        isSystem: true,
-        isOwnerRole: true,
-        permissions: {
-          ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
-            e,
-            "full"
-          ]))),
-          dashboard: read(),
-          settings: readUpdate(),
-          team: full(),
-          roles: full()
-        }
-      },
-      {
-        name: "Manager",
-        description: "Day-to-day store operations",
-        isSystem: true,
-        isOwnerRole: false,
-        permissions: {
-          ...storePerms({
-            products: "full",
-            collections: "full",
-            brands: "full",
-            product_categories: "full",
-            orders: "full",
-            vendor_customers: "full",
-            discounts: "full",
-            order_discounts: "full",
-            order_addresses: "full",
-            payments: "read",
-            taxes: "read",
-            attributes: "read"
-          }),
-          dashboard: read(),
-          settings: read(),
-          team: none(),
-          roles: none()
-        }
-      },
-      {
-        name: "Catalog Staff",
-        description: "Manage products and catalog content",
-        isSystem: true,
-        isOwnerRole: false,
-        permissions: {
-          ...storePerms({
-            products: "full",
-            collections: "full",
-            brands: "full",
-            product_categories: "full",
-            attributes: "full",
-            orders: "read",
-            vendor_customers: "read"
-          }),
-          dashboard: read(),
-          settings: none(),
-          team: none(),
-          roles: none()
-        }
-      },
-      {
-        name: "Fulfillment",
-        description: "Orders and fulfillment",
-        isSystem: true,
-        isOwnerRole: false,
-        permissions: {
-          ...storePerms({
-            products: "read",
-            orders: "full",
-            order_addresses: "full",
-            order_discounts: "read",
-            vendor_customers: "read"
-          }),
-          dashboard: read(),
-          settings: none(),
-          team: none(),
-          roles: none()
-        }
-      },
-      {
-        name: "Viewer",
-        description: "Read-only access to store data",
-        isSystem: true,
-        isOwnerRole: false,
-        permissions: {
-          ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
-            e,
-            "read"
-          ]))),
-          dashboard: read(),
-          settings: none(),
-          team: none(),
-          roles: none()
-        }
-      }
-    ];
-  }
-});
-
-// src/auth/rbac-debug.ts
-var init_rbac_debug = __esm({
-  "src/auth/rbac-debug.ts"() {
-    init_permission_entities();
-    init_vendor_role_defaults();
-    init_vendor_scope();
-  }
-});
-
 // src/auth/helpers.ts
 function canManageRoles(user) {
   return !!(user?.email && user.isRBACAdmin);
@@ -21145,23 +21431,6 @@ function VendorRolesPage() {
       return next;
     });
   }, "setAllRows");
-  const toggleEntityRow = /* @__PURE__ */ __name((entity) => {
-    const isOwnerOnlyEntity = entity === "team" || entity === "roles";
-    setMatrix((prev) => {
-      const current = prev[entity];
-      const isAllChecked = current?.canRead && (isOwnerOnlyEntity || current.canCreate && current.canUpdate && current.canDelete);
-      return {
-        ...prev,
-        [entity]: {
-          entity,
-          canRead: !isAllChecked,
-          canCreate: isOwnerOnlyEntity ? false : !isAllChecked,
-          canUpdate: isOwnerOnlyEntity ? false : !isAllChecked,
-          canDelete: isOwnerOnlyEntity ? false : !isAllChecked
-        }
-      };
-    });
-  }, "toggleEntityRow");
   const saveMatrix = /* @__PURE__ */ __name(async () => {
     if (!selectedId) return;
     setSaving(true);
@@ -21355,31 +21624,35 @@ function VendorRolesPage() {
   }), " Clear All"))), /* @__PURE__ */ React25__default.createElement("div", {
     className: "overflow-x-auto rounded-lg border border-gray-200 dark:border-gray-700"
   }, /* @__PURE__ */ React25__default.createElement("table", {
-    className: "min-w-full text-xs"
+    className: "min-w-full text-sm"
   }, /* @__PURE__ */ React25__default.createElement("thead", {
-    className: "bg-gray-100 text-left text-gray-700 dark:bg-gray-900 dark:text-gray-300"
-  }, /* @__PURE__ */ React25__default.createElement("tr", null, /* @__PURE__ */ React25__default.createElement("th", {
-    className: "px-3 py-2 font-medium"
-  }, "Entity"), /* @__PURE__ */ React25__default.createElement("th", {
-    className: "px-3 py-2 font-medium"
+    className: "bg-white dark:bg-gray-800"
+  }, /* @__PURE__ */ React25__default.createElement("tr", {
+    className: "border-b border-gray-200 dark:border-gray-700"
+  }, /* @__PURE__ */ React25__default.createElement("th", {
+    className: "px-3 py-2.5 text-left font-semibold text-gray-700 dark:text-gray-300"
+  }, /* @__PURE__ */ React25__default.createElement("div", {
+    className: "flex items-center gap-2"
+  }, /* @__PURE__ */ React25__default.createElement("span", null, "Entity"))), /* @__PURE__ */ React25__default.createElement("th", {
+    className: "px-3 py-2.5 text-center font-semibold text-gray-700 dark:text-gray-300"
   }, "Create"), /* @__PURE__ */ React25__default.createElement("th", {
-    className: "px-3 py-2 font-medium"
+    className: "px-3 py-2.5 text-center font-semibold text-gray-700 dark:text-gray-300"
   }, "Read"), /* @__PURE__ */ React25__default.createElement("th", {
-    className: "px-3 py-2 font-medium"
+    className: "px-3 py-2.5 text-center font-semibold text-gray-700 dark:text-gray-300"
   }, "Update"), /* @__PURE__ */ React25__default.createElement("th", {
-    className: "px-3 py-2 font-medium"
-  }, "Delete"), /* @__PURE__ */ React25__default.createElement("th", {
-    className: "px-3 py-2 font-medium text-right"
-  }, "Row Actions"))), /* @__PURE__ */ React25__default.createElement("tbody", null, entities.map((entity) => {
+    className: "px-3 py-2.5 text-center font-semibold text-gray-700 dark:text-gray-300"
+  }, "Delete"))), /* @__PURE__ */ React25__default.createElement("tbody", null, entities.map((entity) => {
     const isOwnerOnlyEntity = entity === "team" || entity === "roles";
     return /* @__PURE__ */ React25__default.createElement("tr", {
       key: entity,
-      className: "border-t border-gray-100 dark:border-gray-700 hover:bg-gray-50/50 dark:hover:bg-gray-800/50"
+      className: "border-b border-gray-100 last:border-b-0 hover:bg-gray-50 dark:border-gray-700 dark:hover:bg-gray-800/50"
     }, /* @__PURE__ */ React25__default.createElement("td", {
-      className: "px-3 py-2 font-mono text-gray-800 dark:text-gray-200 font-medium"
-    }, entity, isOwnerOnlyEntity && /* @__PURE__ */ React25__default.createElement("span", {
-      className: "ml-2 text-[10px] text-amber-600 dark:text-amber-400 font-normal"
-    }, "(Owner managed)")), [
+      className: "px-3 py-2.5 font-mono text-sm text-gray-800 dark:text-gray-200"
+    }, /* @__PURE__ */ React25__default.createElement("div", {
+      className: "flex items-center gap-2"
+    }, /* @__PURE__ */ React25__default.createElement("span", null, entity), isOwnerOnlyEntity && /* @__PURE__ */ React25__default.createElement("span", {
+      className: "text-[10px] text-amber-600 dark:text-amber-400"
+    }, "(Owner managed)"))), [
       "canCreate",
       "canRead",
       "canUpdate",
@@ -21388,21 +21661,15 @@ function VendorRolesPage() {
       const disabled = isOwnerOnlyEntity && key !== "canRead";
       return /* @__PURE__ */ React25__default.createElement("td", {
         key,
-        className: "px-3 py-2"
+        className: "px-3 py-2.5 text-center"
       }, /* @__PURE__ */ React25__default.createElement("input", {
         type: "checkbox",
         checked: disabled ? false : !!matrix[entity]?.[key],
         disabled,
         onChange: /* @__PURE__ */ __name(() => toggle(entity, key), "onChange"),
-        className: disabled ? "cursor-not-allowed opacity-40" : "cursor-pointer"
+        className: disabled ? "h-4 w-4 cursor-not-allowed opacity-40" : "h-4 w-4 cursor-pointer"
       }));
-    }), /* @__PURE__ */ React25__default.createElement("td", {
-      className: "px-3 py-2 text-right"
-    }, /* @__PURE__ */ React25__default.createElement("button", {
-      type: "button",
-      onClick: /* @__PURE__ */ __name(() => toggleEntityRow(entity), "onClick"),
-      className: "text-[11px] text-blue-600 hover:underline dark:text-blue-400"
-    }, "Toggle")));
+    }));
   })))))))), /* @__PURE__ */ React25__default.createElement(Dialog, {
     open: deleteOpen,
     onOpenChange: setDeleteOpen
@@ -22280,39 +22547,90 @@ var init_VendorTeamPage = __esm({
     __name(VendorTeamPage, "VendorTeamPage");
   }
 });
-
-// src/lib/vendor-profile.ts
-function validateIndiaTaxIds(gstin, pan) {
-  if (gstin && !/^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/i.test(gstin)) {
-    return "Invalid GSTIN format (15 characters, e.g. 22AAAAA0000A1Z5)";
+function splitPhoneAndCountryCode(rawPhone, defaultCode = "+91") {
+  if (!rawPhone || !rawPhone.trim()) {
+    return {
+      countryCode: defaultCode,
+      phoneNumber: ""
+    };
   }
-  if (pan && !/^[A-Z]{5}[0-9]{4}[A-Z]$/i.test(pan)) {
+  const trimmed = rawPhone.trim();
+  const match = COUNTRY_PHONE_CODES.find((c) => trimmed.startsWith(c.code));
+  if (match) {
+    return {
+      countryCode: match.code,
+      phoneNumber: trimmed.slice(match.code.length).replace(/\s+/g, "")
+    };
+  }
+  if (trimmed.startsWith("+")) {
+    const spaceIdx = trimmed.indexOf(" ");
+    if (spaceIdx > 0) {
+      return {
+        countryCode: trimmed.slice(0, spaceIdx),
+        phoneNumber: trimmed.slice(spaceIdx + 1).replace(/\s+/g, "")
+      };
+    }
+  }
+  return {
+    countryCode: defaultCode,
+    phoneNumber: trimmed.replace(/\D/g, "")
+  };
+}
+function formatPhoneWithCountryCode(countryCode, phoneNumber) {
+  const cleanNum = phoneNumber.replace(/\D/g, "");
+  if (!cleanNum) return null;
+  const cleanCode = countryCode.trim() || "+91";
+  return `${cleanCode}${cleanNum}`;
+}
+function validateGstin(gstin, options) {
+  const required = options?.required === true;
+  if (!gstin || !gstin.trim()) {
+    if (required) return "GSTIN number is required";
+    return null;
+  }
+  if (!/^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/i.test(gstin.trim())) {
+    return "Invalid GSTIN number (15 characters, e.g. 22AAAAA0000A1Z5)";
+  }
+  return null;
+}
+function validateIndiaTaxIds(gstin, pan, options) {
+  const gstinErr = validateGstin(gstin, {
+    required: options?.requiredGstin
+  });
+  if (gstinErr) return gstinErr;
+  if (options?.requiredPan && (!pan || !pan.trim())) {
+    return "PAN is required";
+  }
+  if (pan && !/^[A-Z]{5}[0-9]{4}[A-Z]$/i.test(pan.trim())) {
     return "Invalid PAN format (e.g. ABCDE1234F)";
   }
   return null;
 }
 function validateAadhaar(aadhaar) {
   if (!aadhaar) return null;
-  if (!/^[0-9]{12}$/.test(aadhaar)) {
+  if (!/^[0-9]{12}$/.test(aadhaar.replace(/\s+/g, ""))) {
     return "Invalid Aadhaar number (12 digits)";
   }
   return null;
 }
 function validatePersonKyc(person, options) {
   const required = options?.required === true;
-  if (required && !person.aadhaarNo) return "Aadhaar number is required";
-  if (required && !person.panNo) return "PAN is required";
+  if (required && (!person.aadhaarNo || !person.aadhaarNo.trim())) return "Aadhaar number is required";
+  if (required && (!person.panNo || !person.panNo.trim())) return "PAN is required";
   const aadhaarErr = validateAadhaar(person.aadhaarNo ?? null);
   if (aadhaarErr) return aadhaarErr;
-  const panErr = validateIndiaTaxIds(null, person.panNo ?? null);
+  const panErr = validateIndiaTaxIds(null, person.panNo ?? null, {
+    requiredPan: required
+  });
   if (panErr) return panErr;
   return null;
 }
 function readOwnerDesignation(metadata) {
-  const v = metadata?.ownerDesignation;
-  return typeof v === "string" ? v : "";
+  if (!metadata || typeof metadata !== "object") return "";
+  const d = metadata.ownerDesignation;
+  return typeof d === "string" ? d.trim() : "";
 }
-var VENDOR_REGISTRATION_STATUSES, VENDOR_BUSINESS_TYPES;
+var VENDOR_REGISTRATION_STATUSES, VENDOR_BUSINESS_TYPES, COUNTRY_PHONE_CODES;
 var init_vendor_profile = __esm({
   "src/lib/vendor-profile.ts"() {
     VENDOR_REGISTRATION_STATUSES = [
@@ -22359,7 +22677,34 @@ var init_vendor_profile = __esm({
         label: "Other"
       }
     ];
+    COUNTRY_PHONE_CODES = (() => {
+      const list = [];
+      const seenCodes = /* @__PURE__ */ new Set();
+      for (const c of Country.getAllCountries()) {
+        if (!c.phonecode) continue;
+        const rawCode = c.phonecode.replace(/^\+/, "").trim();
+        if (!rawCode) continue;
+        const code = `+${rawCode}`;
+        const key = `${code}-${c.name}`;
+        if (seenCodes.has(key)) continue;
+        seenCodes.add(key);
+        list.push({
+          code,
+          country: c.name,
+          isoCode: c.isoCode,
+          label: `${code} (${c.name})`
+        });
+      }
+      return list.sort((a, b) => {
+        if (a.code === "+91" && b.code !== "+91") return -1;
+        if (b.code === "+91" && a.code !== "+91") return 1;
+        return a.country.localeCompare(b.country);
+      });
+    })();
+    __name(splitPhoneAndCountryCode, "splitPhoneAndCountryCode");
+    __name(formatPhoneWithCountryCode, "formatPhoneWithCountryCode");
     new Set(VENDOR_REGISTRATION_STATUSES.map((s) => s.value));
+    __name(validateGstin, "validateGstin");
     __name(validateIndiaTaxIds, "validateIndiaTaxIds");
     __name(validateAadhaar, "validateAadhaar");
     __name(validatePersonKyc, "validatePersonKyc");
@@ -22962,10 +23307,26 @@ function SubmissionDetailPage({ submissionId }) {
   }
   const formName = submission.form?.name ?? `Form #${submission.formId}`;
   const contact = submission.contact;
-  const fieldLabel = /* @__PURE__ */ __name((key) => {
-    const field = submission.form?.fields?.find((f) => String(f.id) === key);
-    return field?.label ?? key;
-  }, "fieldLabel");
+  const resolveFieldLabel = /* @__PURE__ */ __name((key) => {
+    if (!key) return "\u2014";
+    const rawKey = key.trim();
+    const numericIdMatch = rawKey.match(/^(?:field_)?(\d+)$/i);
+    const fieldIdStr = numericIdMatch ? numericIdMatch[1] : null;
+    const fields = submission?.form?.fields ?? [];
+    const field = fields.find((f) => fieldIdStr !== null && String(f.id) === fieldIdStr || String(f.id) === rawKey || f.name && f.name.trim().toLowerCase() === rawKey.toLowerCase() || f.label && f.label.trim().toLowerCase() === rawKey.toLowerCase());
+    if (field) {
+      if (field.label && field.label.trim() && !/^\d+$/.test(field.label.trim())) {
+        return field.label.trim();
+      }
+      if (field.name && field.name.trim() && !/^\d+$/.test(field.name.trim())) {
+        return field.name.trim().replace(/_/g, " ").replace(/([a-z])([A-Z])/g, "$1 $2").replace(/\b\w/g, (c) => c.toUpperCase());
+      }
+    }
+    if (fieldIdStr !== null) {
+      return `Field #${fieldIdStr}`;
+    }
+    return rawKey.replace(/_/g, " ").replace(/([a-z])([A-Z])/g, "$1 $2").replace(/\b\w/g, (c) => c.toUpperCase());
+  }, "resolveFieldLabel");
   return /* @__PURE__ */ React.createElement("div", {
     className: "rounded-lg bg-white shadow-md"
   }, /* @__PURE__ */ React.createElement(DetailPageHeader, {
@@ -23024,7 +23385,7 @@ function SubmissionDetailPage({ submissionId }) {
     key
   }, /* @__PURE__ */ React.createElement("td", {
     className: "py-2 px-3 text-gray-600 font-medium"
-  }, fieldLabel(key)), /* @__PURE__ */ React.createElement("td", {
+  }, resolveFieldLabel(key)), /* @__PURE__ */ React.createElement("td", {
     className: "py-2 px-3 text-gray-900 break-words min-w-0"
   }, value === null || value === void 0 ? "\u2014" : typeof value === "object" ? JSON.stringify(value) : String(value)))))))), /* @__PURE__ */ React.createElement("section", null, /* @__PURE__ */ React.createElement("h2", {
     className: "text-xs font-semibold text-gray-400 uppercase tracking-wider mb-2"
@@ -24679,7 +25040,7 @@ function OrderPlacementPage({ editOrderId }) {
     productQuery
   ]);
   const recalcPreview = useCallback(async () => {
-    const orderLines = lines.filter((l) => !rewardProductIds.current.has(l.productId)).map((l) => ({
+    const orderLines = lines.filter((l) => !l.key.startsWith("reward-")).map((l) => ({
       productId: l.productId,
       quantity: l.quantity
     }));
@@ -24703,19 +25064,22 @@ function OrderPlacementPage({ editOrderId }) {
         body: JSON.stringify({
           orderLines,
           currency,
-          discountId: coupons[0]?.discountId ?? null
+          discountId: coupons[0]?.discountId ?? null,
+          discountIds: coupons.map((c) => c.discountId)
         })
       });
       if (!res.ok) throw new Error("Calculate failed");
       const data = await res.json();
       const correctedLines = data.lines.map((cl) => {
         if (cl.productId == null) return cl;
-        const cached = productCache.current.get(cl.productId);
+        const pid = Number(cl.productId);
+        const cached = productCache.current.get(pid);
         if (!cl.found && cached) {
-          const unitPrice2 = cached.price;
+          const unitPrice2 = Number(cached.price ?? 0);
           const subtotal3 = unitPrice2 * cl.quantity;
           return {
             ...cl,
+            productId: pid,
             found: true,
             unitPrice: unitPrice2,
             subtotal: subtotal3,
@@ -24723,15 +25087,16 @@ function OrderPlacementPage({ editOrderId }) {
             total: subtotal3
           };
         }
-        const unitPrice = cached?.price ?? cl.unitPrice;
+        const unitPrice = Number(cached?.price ?? cl.unitPrice ?? 0);
         const subtotal2 = unitPrice * cl.quantity;
-        const taxRate = cl.taxRate ?? (cl.subtotal > 0 && cl.tax > 0 ? cl.tax / cl.subtotal : 0);
-        const lineDiscount = cl.subtotal > 0 && subtotal2 > 0 ? cl.discount ?? 0 : 0;
+        const taxRate = Number(cl.taxRate ?? (cl.subtotal > 0 && cl.tax > 0 ? cl.tax / cl.subtotal * 100 : 0));
+        const lineDiscount = Number(cl.discount ?? 0);
         const discountedBase = Math.max(0, subtotal2 - lineDiscount);
         const tax2 = discountedBase * taxRate / 100;
         const total2 = discountedBase + tax2;
         return {
           ...cl,
+          productId: pid,
           unitPrice,
           subtotal: subtotal2,
           taxRate,
@@ -24739,13 +25104,14 @@ function OrderPlacementPage({ editOrderId }) {
           total: total2
         };
       });
-      const rewardDisplayLines = lines.filter((l) => rewardProductIds.current.has(l.productId)).map((l) => {
-        const cached = productCache.current.get(l.productId);
+      const rewardDisplayLines = lines.filter((l) => l.key.startsWith("reward-")).map((l) => {
+        const pid = Number(l.productId);
+        const cached = productCache.current.get(pid);
         return {
-          productId: l.productId,
+          productId: pid,
           productName: l.label,
           found: true,
-          unitPrice: cached?.price ?? 0,
+          unitPrice: Number(cached?.price ?? 0),
           quantity: l.quantity,
           subtotal: 0,
           tax: 0,
@@ -24787,7 +25153,7 @@ function OrderPlacementPage({ editOrderId }) {
   useEffect(() => {
     const automaticCoupons = coupons.filter((c) => c.isAutomatic);
     if (automaticCoupons.length === 0) return;
-    const nonRewardLines = lines.filter((l) => !rewardProductIds.current.has(l.productId));
+    const nonRewardLines = lines.filter((l) => !l.key.startsWith("reward-"));
     if (nonRewardLines.length === 0) {
       const autoIds = new Set(automaticCoupons.map((c) => c.discountId));
       const rewardPids = new Set(automaticCoupons.flatMap((c) => c.rewardLines.map((r) => r.productId)));
@@ -24867,7 +25233,7 @@ function OrderPlacementPage({ editOrderId }) {
       cancelled = true;
     };
   }, [
-    lines.filter((l) => !rewardProductIds.current.has(l.productId)).map((l) => `${l.productId}:${l.quantity}`).join(","),
+    lines.filter((l) => !l.key.startsWith("reward-")).map((l) => `${l.productId}:${l.quantity}`).join(","),
     coupons.filter((c) => c.isAutomatic).map((c) => c.discountId).join(",")
   ]);
   function handleRemoveCoupon(couponCode) {
@@ -24989,7 +25355,10 @@ function OrderPlacementPage({ editOrderId }) {
   const calcByProductId = useMemo(() => {
     const m = /* @__PURE__ */ new Map();
     for (const l of preview?.lines ?? []) {
-      if (l.productId != null && l.found) m.set(l.productId, l);
+      if (l.productId != null && l.found) {
+        const pid = Number(l.productId);
+        if (Number.isFinite(pid)) m.set(pid, l);
+      }
     }
     return m;
   }, [
@@ -25011,13 +25380,13 @@ function OrderPlacementPage({ editOrderId }) {
     }
     const unknown = preview?.lines.filter((l) => !l.found) ?? [];
     if (unknown.length > 0) {
-      toast.error("Some products are missing or unavailable. Remove invalid lines and try again.");
+      toast.error(`One or more items could not be validated: ${unknown.map((u) => u.productName).join(", ")}`);
       return;
     }
     setSubmitting(true);
+    let resolvedContactId = effectiveContactId;
     try {
-      let resolvedContactId = placeForSomeoneElse ? subContactId : null;
-      if (!resolvedContactId && effectiveEmail) {
+      if (resolvedContactId == null && effectiveEmail) {
         try {
           const res2 = await fetch(`/api/contacts?search=${encodeURIComponent(effectiveEmail)}&limit=1`);
           if (res2.ok) {
@@ -25039,12 +25408,12 @@ function OrderPlacementPage({ editOrderId }) {
         billingAddress,
         shippingAddress: sameAsBilling ? billingAddress : shippingAddress,
         orderLines: lines.map((l) => {
-          const isReward = rewardProductIds.current.has(l.productId);
-          const calc = preview?.lines.find((pl) => pl.productId === l.productId);
+          const isReward = l.key.startsWith("reward-");
+          const calc = preview?.lines.find((pl) => Number(pl.productId) === Number(l.productId));
           return {
             productId: l.productId,
             quantity: l.quantity,
-            unitPrice: isReward ? 0 : calc?.unitPrice ?? productCache.current.get(l.productId)?.price ?? 0
+            unitPrice: isReward ? 0 : calc?.unitPrice ?? Number(productCache.current.get(l.productId)?.price ?? 0)
           };
         })
       };
@@ -30020,8 +30389,8 @@ function ProductEditPage({ productId }) {
   const [price, setPrice] = useState(0);
   const [defaultPriceStr, setDefaultPriceStr] = useState("");
   const [pricingConfig, setPricingConfig] = useState(DEFAULT_PRICING_CONFIG);
-  const [compareAtPrice, setCompareAtPrice] = useState(0);
-  const [quantity, setQuantity] = useState(1);
+  const [compareAtPrice, setCompareAtPrice] = useState("");
+  const [quantity, setQuantity] = useState("1");
   const [status, setStatus] = useState("draft");
   const [approvalStatus, setApprovalStatus] = useState("pending");
   const [rejectionReason, setRejectionReason] = useState("");
@@ -30242,8 +30611,8 @@ function ProductEditPage({ productId }) {
         setDefaultPriceStr(product.price != null && Number.isFinite(Number(product.price)) ? String(product.price) : "");
         setPrice(product.price != null ? Number(product.price) : 0);
         const rawCompare = product.compareAtPrice != null ? Number(product.compareAtPrice) : 0;
-        setCompareAtPrice(Number.isFinite(rawCompare) ? rawCompare : 0);
-        setQuantity(product.quantity ?? 1);
+        setCompareAtPrice(rawCompare != null && Number.isFinite(rawCompare) ? String(rawCompare) : "");
+        setQuantity(product.quantity != null ? String(product.quantity) : "1");
         setStatus(product.status ?? "draft");
         setApprovalStatus(typeof product.approvalStatus === "string" && product.approvalStatus ? product.approvalStatus : "pending");
         setRejectionReason(typeof product.rejectionReason === "string" ? product.rejectionReason : "");
@@ -30410,22 +30779,6 @@ function ProductEditPage({ productId }) {
       return pricingConfig.defaultCurrency || "INR";
     }
   })();
-  const handleNumberChange = /* @__PURE__ */ __name((setter, options) => (e) => {
-    const value = e.target.value;
-    if (value === "") {
-      setter(0);
-      return;
-    }
-    let num = options?.integer ? Number.parseInt(value, 10) : Number(value);
-    if (Number.isNaN(num)) {
-      setter(0);
-      return;
-    }
-    if (options?.min !== void 0) {
-      num = Math.max(options.min, num);
-    }
-    setter(num);
-  }, "handleNumberChange");
   const openRejectModal = /* @__PURE__ */ __name((fromStatus) => {
     approvalBeforeRejectRef.current = fromStatus === "rejected" ? "pending" : fromStatus;
     setRejectDraft(rejectionReason);
@@ -30498,12 +30851,13 @@ function ProductEditPage({ productId }) {
         return;
       }
     }
-    const quantityErrors = validateProductQuantity(quantity, hasVariants, parsedVariants);
+    const quantityValue = quantity === "" ? 0 : Number(quantity);
+    const quantityErrors = validateProductQuantity(quantityValue, hasVariants, parsedVariants);
     if (quantityErrors.length) {
       setErrors(quantityErrors);
       return;
     }
-    const resolvedQuantity = hasVariants ? productQuantityFromVariants(parsedVariants) : quantity;
+    const resolvedQuantity = hasVariants ? productQuantityFromVariants(parsedVariants) : quantityValue;
     setSaving(true);
     try {
       const compareAtPriceValue = compareAtPrice ? Math.round(Number(compareAtPrice) * 100) / 100 : null;
@@ -31117,9 +31471,8 @@ function ProductEditPage({ productId }) {
       type: "number",
       value: compareAtPrice,
       className: inputCls3,
-      onChange: handleNumberChange(setCompareAtPrice, {
-        min: 0
-      })
+      min: 0,
+      onChange: /* @__PURE__ */ __name((e) => setCompareAtPrice(e.target.value), "onChange")
     })), /* @__PURE__ */ React.createElement("div", null, /* @__PURE__ */ React.createElement("label", {
       className: labelCls3
     }, "Contact form"), /* @__PURE__ */ React.createElement("select", {
@@ -31142,10 +31495,7 @@ function ProductEditPage({ productId }) {
       min: 0,
       step: 1,
       value: hasVariants ? productQuantityFromVariants(variantsFromForm(variantRows, pricingConfig.defaultCurrency)) : quantity,
-      onChange: handleNumberChange(setQuantity, {
-        min: 0,
-        integer: true
-      }),
+      onChange: /* @__PURE__ */ __name((e) => setQuantity(e.target.value), "onChange"),
       className: `${inputCls3}${hasVariants ? " bg-gray-100" : ""}`,
       required: !hasVariants,
       readOnly: hasVariants,
@@ -31222,8 +31572,18 @@ function ProductEditPage({ productId }) {
         value: row.taxId === "" ? "" : String(row.taxId),
         onChange: /* @__PURE__ */ __name((e) => {
           const v = e.target.value;
+          if (v === "") {
+            setTaxRow(i, {
+              taxId: "",
+              rate: ""
+            });
+            return;
+          }
+          const taxId = Number(v);
+          const selectedTax = taxMasterList.find((t) => t.id === taxId);
           setTaxRow(i, {
-            taxId: v === "" ? "" : Number(v)
+            taxId,
+            rate: selectedTax?.rate != null ? String(selectedTax.rate) : ""
           });
         }, "onChange"),
         className: inputCls3
@@ -33048,6 +33408,35 @@ function EventEditPage({ eventId }) {
   const [saving, setSaving] = useState(false);
   const [errors, setErrors] = useState([]);
   const [activeTab, setActiveTab] = useState("basic");
+  const eventTabs = [
+    {
+      key: "basic",
+      label: "Basic info"
+    },
+    {
+      key: "venue",
+      label: "Venue"
+    },
+    {
+      key: "datetime",
+      label: "Date & time"
+    },
+    {
+      key: "settings",
+      label: "Settings"
+    }
+  ];
+  const activeTabIndex = eventTabs.findIndex((tab) => tab.key === activeTab);
+  const goToPreviousTab = /* @__PURE__ */ __name(() => {
+    if (activeTabIndex > 0) {
+      setActiveTab(eventTabs[activeTabIndex - 1].key);
+    }
+  }, "goToPreviousTab");
+  const goToNextTab = /* @__PURE__ */ __name(() => {
+    if (activeTabIndex < eventTabs.length - 1) {
+      setActiveTab(eventTabs[activeTabIndex + 1].key);
+    }
+  }, "goToNextTab");
   const [name, setName] = useState("");
   const [slug, setSlug] = useState("");
   const [description, setDescription] = useState("");
@@ -33867,7 +34256,19 @@ function EventEditPage({ eventId }) {
         [key]: value
       })), "onChange")
     }))))
-  }), showEventProducts ? /* @__PURE__ */ React.createElement("div", {
+  }), /* @__PURE__ */ React.createElement("div", {
+    className: "flex items-center justify-between border-t border-gray-200 px-4 py-4 sm:px-6"
+  }, /* @__PURE__ */ React.createElement("button", {
+    type: "button",
+    onClick: goToPreviousTab,
+    disabled: activeTabIndex === 0,
+    className: "rounded-md border border-gray-300 bg-white px-4 py-2 text-sm font-medium text-gray-700 hover:bg-gray-50 disabled:cursor-not-allowed disabled:opacity-40"
+  }, "Previous"), /* @__PURE__ */ React.createElement("button", {
+    type: "button",
+    onClick: goToNextTab,
+    disabled: activeTabIndex === eventTabs.length - 1,
+    className: "rounded-md bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-800 disabled:cursor-not-allowed disabled:opacity-40"
+  }, "Next")), showEventProducts ? /* @__PURE__ */ React.createElement("div", {
     className: "border-t border-gray-200 px-4 py-4 sm:px-6"
   }, /* @__PURE__ */ React.createElement(EventProductsSection, {
     eventId: eventRecordId,
@@ -34212,6 +34613,18 @@ function ComboEditPage({ comboId }) {
       ]);
       return;
     }
+    if (!startsAt) {
+      setErrors([
+        "Starts at is required"
+      ]);
+      return;
+    }
+    if (!endsAt) {
+      setErrors([
+        "Ends at is required"
+      ]);
+      return;
+    }
     if (!priceStr.trim()) {
       setErrors([
         `Price (${defaultCurrency}) is required`
@@ -34501,18 +34914,20 @@ function ComboEditPage({ comboId }) {
       className: "grid grid-cols-2 gap-4"
     }, /* @__PURE__ */ React.createElement("div", null, /* @__PURE__ */ React.createElement("label", {
       className: "block text-xs font-medium text-gray-600 mb-1"
-    }, "Starts at"), /* @__PURE__ */ React.createElement("input", {
+    }, "Starts at *"), /* @__PURE__ */ React.createElement("input", {
       type: "datetime-local",
       value: startsAt,
       onChange: /* @__PURE__ */ __name((e) => setStartsAt(e.target.value), "onChange"),
-      className: "w-full rounded-md border border-gray-300 px-3 py-2 text-sm"
+      className: "w-full rounded-md border border-gray-300 px-3 py-2 text-sm",
+      required: true
     })), /* @__PURE__ */ React.createElement("div", null, /* @__PURE__ */ React.createElement("label", {
       className: "block text-xs font-medium text-gray-600 mb-1"
-    }, "Ends at"), /* @__PURE__ */ React.createElement("input", {
+    }, "Ends at *"), /* @__PURE__ */ React.createElement("input", {
       type: "datetime-local",
       value: endsAt,
       onChange: /* @__PURE__ */ __name((e) => setEndsAt(e.target.value), "onChange"),
-      className: "w-full rounded-md border border-gray-300 px-3 py-2 text-sm"
+      className: "w-full rounded-md border border-gray-300 px-3 py-2 text-sm",
+      required: true
     })))))),
     sidebar: /* @__PURE__ */ React.createElement(React.Fragment, null)
   }));
@@ -34598,7 +35013,8 @@ function VendorEditPage({ vendorId }) {
   const [website, setWebsite] = useState("");
   const [logo, setLogo] = useState("");
   const [email, setEmail] = useState("");
-  const [phone, setPhone] = useState("");
+  const [storePhoneCode, setStorePhoneCode] = useState("+91");
+  const [storePhoneNum, setStorePhoneNum] = useState("");
   const [addressLine1, setAddressLine1] = useState("");
   const [addressLine2, setAddressLine2] = useState("");
   const [city, setCity] = useState("");
@@ -34612,7 +35028,8 @@ function VendorEditPage({ vendorId }) {
   const [metadata, setMetadata] = useState(null);
   const [ownerName, setOwnerName] = useState("");
   const [ownerEmail, setOwnerEmail] = useState("");
-  const [ownerPhone, setOwnerPhone] = useState("");
+  const [ownerPhoneCode, setOwnerPhoneCode] = useState("+91");
+  const [ownerPhoneNum, setOwnerPhoneNum] = useState("");
   const [ownerDesignation, setOwnerDesignation] = useState("");
   const [ownerAadhaarNo, setOwnerAadhaarNo] = useState("");
   const [ownerPanNo, setOwnerPanNo] = useState("");
@@ -34636,7 +35053,7 @@ function VendorEditPage({ vendorId }) {
     website: website.trim() || null,
     logo: logo.trim() || null,
     email: email.trim() || null,
-    phone: phone.trim() || null,
+    phone: formatPhoneWithCountryCode(storePhoneCode, storePhoneNum),
     addressLine1: addressLine1.trim() || null,
     addressLine2: addressLine2.trim() || null,
     city: city.trim() || null,
@@ -34664,7 +35081,9 @@ function VendorEditPage({ vendorId }) {
         setWebsite(data.website ?? "");
         setLogo(data.logo ?? "");
         setEmail(data.email ?? "");
-        setPhone(data.phone ?? "");
+        const sPhone = splitPhoneAndCountryCode(data.phone);
+        setStorePhoneCode(sPhone.countryCode);
+        setStorePhoneNum(sPhone.phoneNumber);
         setAddressLine1(data.addressLine1 ?? "");
         setAddressLine2(data.addressLine2 ?? "");
         setCity(data.city ?? "");
@@ -34686,7 +35105,9 @@ function VendorEditPage({ vendorId }) {
             if (!cancelled) {
               setOwnerName(user.name ?? "");
               setOwnerEmail(user.email ?? "");
-              setOwnerPhone(user.phone ?? "");
+              const oPhone = splitPhoneAndCountryCode(user.phone);
+              setOwnerPhoneCode(oPhone.countryCode);
+              setOwnerPhoneNum(oPhone.phoneNumber);
             }
           }
         } else if (!cancelled) {
@@ -34833,7 +35254,10 @@ function VendorEditPage({ vendorId }) {
       setSaving(false);
       return;
     }
-    const taxError = validateIndiaTaxIds(gstin.trim().toUpperCase() || null, null);
+    const formattedOwnerPhone = formatPhoneWithCountryCode(ownerPhoneCode, ownerPhoneNum);
+    const taxError = validateGstin(gstin.trim().toUpperCase() || null, {
+      required: true
+    });
     if (taxError) {
       setErrors([
         taxError
@@ -34875,7 +35299,7 @@ function VendorEditPage({ vendorId }) {
           user: {
             name: ownerName.trim(),
             email: ownerEmail.trim(),
-            phone: ownerPhone.trim() || void 0,
+            phone: formattedOwnerPhone || void 0,
             designation: ownerDesignation.trim() || void 0,
             aadhaarNo: ownerAadhaarNo.trim(),
             panNo: ownerPanNo.trim().toUpperCase(),
@@ -34939,7 +35363,9 @@ function VendorEditPage({ vendorId }) {
       setSaving(false);
       return;
     }
-    const taxError = validateIndiaTaxIds(gstin.trim().toUpperCase() || null, null);
+    const taxError = validateGstin(gstin.trim().toUpperCase() || null, {
+      required: false
+    });
     if (taxError) {
       setErrors([
         taxError
@@ -34975,6 +35401,7 @@ function VendorEditPage({ vendorId }) {
         return;
       }
       if (ownerUserId != null) {
+        const formattedOwnerPhone = formatPhoneWithCountryCode(ownerPhoneCode, ownerPhoneNum);
         const userRes = await fetch(`/api/users/${ownerUserId}`, {
           method: "PUT",
           headers: {
@@ -34983,7 +35410,7 @@ function VendorEditPage({ vendorId }) {
           body: JSON.stringify({
             name: ownerName.trim(),
             email: ownerEmail.trim(),
-            phone: ownerPhone.trim() || null
+            phone: formattedOwnerPhone || null
           })
         });
         if (!userRes.ok) {
@@ -35117,12 +35544,23 @@ function VendorEditPage({ vendorId }) {
       className: `mt-1 ${fieldClass}`
     })), /* @__PURE__ */ React25__default.createElement("div", null, /* @__PURE__ */ React25__default.createElement(FieldLabel, {
       htmlFor: "vendorPhone"
-    }, "Store phone"), /* @__PURE__ */ React25__default.createElement(Input, {
+    }, "Store phone"), /* @__PURE__ */ React25__default.createElement("div", {
+      className: "flex gap-2 mt-1"
+    }, /* @__PURE__ */ React25__default.createElement("select", {
+      value: storePhoneCode,
+      onChange: /* @__PURE__ */ __name((e) => setStorePhoneCode(e.target.value), "onChange"),
+      className: "w-36 rounded-md border border-gray-300 px-3 py-2 text-sm bg-white focus:outline-none focus:ring-1 focus:ring-black"
+    }, COUNTRY_PHONE_CODES.map((c) => /* @__PURE__ */ React25__default.createElement("option", {
+      key: c.code,
+      value: c.code
+    }, c.label))), /* @__PURE__ */ React25__default.createElement(Input, {
       id: "vendorPhone",
-      value: phone,
-      onChange: /* @__PURE__ */ __name((e) => setPhone(e.target.value), "onChange"),
-      className: `mt-1 ${fieldClass}`
-    })))), /* @__PURE__ */ React25__default.createElement("section", null, /* @__PURE__ */ React25__default.createElement("h2", {
+      type: "tel",
+      placeholder: "9876543210",
+      value: storePhoneNum,
+      onChange: /* @__PURE__ */ __name((e) => setStorePhoneNum(e.target.value.replace(/\D/g, "")), "onChange"),
+      className: `flex-1 ${fieldClass}`
+    }))))), /* @__PURE__ */ React25__default.createElement("section", null, /* @__PURE__ */ React25__default.createElement("h2", {
       className: "text-xs font-semibold text-gray-400 uppercase tracking-wider mb-2"
     }, "Store address"), /* @__PURE__ */ React25__default.createElement("div", {
       className: sectionCls5
@@ -35175,12 +35613,15 @@ function VendorEditPage({ vendorId }) {
       className: `mt-1 ${fieldClass}`
     }))))), /* @__PURE__ */ React25__default.createElement("section", null, /* @__PURE__ */ React25__default.createElement("h2", {
       className: "text-xs font-semibold text-gray-400 uppercase tracking-wider mb-2"
-    }, "Tax (India)"), /* @__PURE__ */ React25__default.createElement("div", {
+    }, "Tax"), /* @__PURE__ */ React25__default.createElement("div", {
       className: sectionCls5
     }, /* @__PURE__ */ React25__default.createElement("div", null, /* @__PURE__ */ React25__default.createElement(FieldLabel, {
-      htmlFor: "gstin"
+      htmlFor: "gstin",
+      required: create
     }, "GSTIN"), /* @__PURE__ */ React25__default.createElement(Input, {
       id: "gstin",
+      required: create,
+      maxLength: 15,
       value: gstin,
       onChange: /* @__PURE__ */ __name((e) => setGstin(e.target.value.toUpperCase()), "onChange"),
       placeholder: "22AAAAA0000A1Z5",
@@ -35210,12 +35651,23 @@ function VendorEditPage({ vendorId }) {
       className: `mt-1 ${fieldClass}`
     })), /* @__PURE__ */ React25__default.createElement("div", null, /* @__PURE__ */ React25__default.createElement(FieldLabel, {
       htmlFor: "ownerPhone"
-    }, "Phone"), /* @__PURE__ */ React25__default.createElement(Input, {
+    }, "Phone"), /* @__PURE__ */ React25__default.createElement("div", {
+      className: "flex gap-2 mt-1"
+    }, /* @__PURE__ */ React25__default.createElement("select", {
+      value: ownerPhoneCode,
+      onChange: /* @__PURE__ */ __name((e) => setOwnerPhoneCode(e.target.value), "onChange"),
+      className: "w-36 rounded-md border border-gray-300 px-3 py-2 text-sm bg-white focus:outline-none focus:ring-1 focus:ring-black"
+    }, COUNTRY_PHONE_CODES.map((c) => /* @__PURE__ */ React25__default.createElement("option", {
+      key: c.code,
+      value: c.code
+    }, c.label))), /* @__PURE__ */ React25__default.createElement(Input, {
       id: "ownerPhone",
-      value: ownerPhone,
-      onChange: /* @__PURE__ */ __name((e) => setOwnerPhone(e.target.value), "onChange"),
-      className: `mt-1 ${fieldClass}`
-    })), /* @__PURE__ */ React25__default.createElement("div", null, /* @__PURE__ */ React25__default.createElement(FieldLabel, {
+      type: "tel",
+      placeholder: "9876543210",
+      value: ownerPhoneNum,
+      onChange: /* @__PURE__ */ __name((e) => setOwnerPhoneNum(e.target.value.replace(/\D/g, "")), "onChange"),
+      className: `flex-1 ${fieldClass}`
+    }))), /* @__PURE__ */ React25__default.createElement("div", null, /* @__PURE__ */ React25__default.createElement(FieldLabel, {
       htmlFor: "ownerDesignation"
     }, "Designation"), /* @__PURE__ */ React25__default.createElement(Input, {
       id: "ownerDesignation",
@@ -35300,7 +35752,7 @@ function VendorEditPage({ vendorId }) {
       htmlFor: "termsAccepted",
       className: "font-normal cursor-pointer text-sm leading-snug"
     }, "I confirm I have read and accepted the terms and conditions for selling on this platform."))))),
-    sidebar: /* @__PURE__ */ React25__default.createElement(React25__default.Fragment, null, !create && /* @__PURE__ */ React25__default.createElement("section", null, /* @__PURE__ */ React25__default.createElement("h2", {
+    sidebar: create ? void 0 : /* @__PURE__ */ React25__default.createElement("section", null, /* @__PURE__ */ React25__default.createElement("h2", {
       className: "text-xs font-semibold text-gray-400 uppercase tracking-wider mb-2"
     }, "Status"), /* @__PURE__ */ React25__default.createElement("div", {
       className: sectionCls5
@@ -35335,18 +35787,7 @@ function VendorEditPage({ vendorId }) {
       readOnly: true,
       value: active ? "Yes" : "No",
       className: `mt-1 ${fieldClass} bg-gray-100`
-    })))), create ? /* @__PURE__ */ React25__default.createElement("section", null, /* @__PURE__ */ React25__default.createElement("h2", {
-      className: "text-xs font-semibold text-gray-400 uppercase tracking-wider mb-2"
-    }, "Owner access"), /* @__PURE__ */ React25__default.createElement("div", {
-      className: sectionCls5
-    }, /* @__PURE__ */ React25__default.createElement("p", {
-      className: "text-sm text-gray-600"
-    }, "Creates the vendor and an invite for the owner. After create, you can send the invite email or copy the invite link."), /* @__PURE__ */ React25__default.createElement(Button, {
-      type: "button",
-      disabled: saving,
-      onClick: handleCreate,
-      className: "w-full"
-    }, saving ? "Creating\u2026" : "Create vendor"))) : void 0)
+    }))))
   }), /* @__PURE__ */ React25__default.createElement(Dialog, {
     open: inviteDialog != null,
     onOpenChange: /* @__PURE__ */ __name((open) => {
@@ -36941,7 +37382,7 @@ function ConditionCard({ condition, onChange, onRemove, eventsOn }) {
     value: "minAmount"
   }, "Minimum order amount"), /* @__PURE__ */ React.createElement(SelectItem, {
     value: "minQuantity"
-  }, "Minimum quantity"), /* @__PURE__ */ React.createElement(SelectItem, {
+  }, "Minimum Cart Quantity"), /* @__PURE__ */ React.createElement(SelectItem, {
     value: "productMinQuantity"
   }, "Product"), (eventsOn || condition.kind === "events") && /* @__PURE__ */ React.createElement(SelectItem, {
     value: "events"
@@ -38396,8 +38837,8 @@ function ContactDetailPage({ contactId }) {
       setAddAddressError("Select country, state, and city from the lists.");
       return;
     }
-    const { Country: Country2, State: State2 } = await import('country-state-city');
-    const countryName = Country2.getCountryByCode(addressGeo.countryIso)?.name ?? "";
+    const { Country: Country3, State: State2 } = await import('country-state-city');
+    const countryName = Country3.getCountryByCode(addressGeo.countryIso)?.name ?? "";
     const stateName = State2.getStatesOfCountry(addressGeo.countryIso).find((s) => s.isoCode === addressGeo.stateIso)?.name ?? "";
     const payload = {
       contactId: Number(contactId),