@infuro/cms-core 1.0.50 → 1.0.51

package/dist/{chunk-UUWAUHUW.cjs → chunk-JN4AFHZ4.cjs}

@@ -83,6 +83,9 @@ function buildEventOrderTemplateVariables(input) {
     currency: String(order.currency ?? "INR"),
     lines: orderLines
   };
+  const qrToken = order.qrToken?.trim() || order.orderNumber?.trim() || "";
+  const fallbackQrUrl = qrToken ? `https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=${encodeURIComponent(qrToken)}` : "";
+  const fallbackTicketQr = fallbackQrUrl ? `<img src="${fallbackQrUrl}" alt="Ticket QR Code" width="200" height="200" style="display:block;margin:12px 0;border:1px solid #e5e7eb;border-radius:8px;" />` : "";
   return {
     eventName: event.name ?? productNames ?? "",
     vendorName: vendorName.trim(),
@@ -99,6 +102,8 @@ function buildEventOrderTemplateVariables(input) {
     trackUrl,
     invoiceNumber,
     invoiceUrl,
+    ticketQr: fallbackTicketQr,
+    qrImageUrl: fallbackQrUrl,
     orderDetails: formatOrderDetailsText(orderDetailsPayload),
     orderDetailsHtml: formatOrderDetailsHtml(orderDetailsPayload)
   };
@@ -1326,7 +1331,7 @@ function renderEmail(templateName, ctx, options) {
 chunkUSNT2KNT_cjs.__name(renderEmail, "renderEmail");
 
 // src/plugins/email/email-service.ts
-var require2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-UUWAUHUW.cjs', document.baseURI).href)));
+var require2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-JN4AFHZ4.cjs', document.baseURI).href)));
 var MailComposer = require2("nodemailer/lib/mail-composer");
 var SES_REGIONS_WITHOUT_SMTP = /* @__PURE__ */ new Set([
   "af-south-1",
@@ -2125,72 +2130,27 @@ async function getGoogleAccessToken(clientEmail, privateKey) {
   return tokenData.access_token;
 }
 chunkUSNT2KNT_cjs.__name(getGoogleAccessToken, "getGoogleAccessToken");
-async function resolveFcmServiceAccount(dataSource, entityMap) {
-  const pushSettings = await getSettingsGroup(dataSource, entityMap, "push");
-  let projectId = pushSettings.firebase_project_id?.trim();
-  let clientEmail = pushSettings.firebase_client_email?.trim();
-  let privateKey = pushSettings.firebase_private_key?.trim();
-  if (pushSettings.firebase_service_account_json?.trim()) {
-    try {
-      const parsed = JSON.parse(pushSettings.firebase_service_account_json.trim());
-      if (parsed.project_id) projectId = parsed.project_id;
-      if (parsed.client_email) clientEmail = parsed.client_email;
-      if (parsed.private_key) privateKey = parsed.private_key;
-    } catch {
-    }
-  }
-  if (!projectId || !clientEmail || !privateKey) {
-    return {
-      ok: false,
-      error: "Firebase Service Account JSON / credentials are not configured"
-    };
-  }
-  return {
-    ok: true,
-    account: {
-      projectId,
-      clientEmail,
-      privateKey
-    }
-  };
-}
-chunkUSNT2KNT_cjs.__name(resolveFcmServiceAccount, "resolveFcmServiceAccount");
-async function validateFcmCredentials(dataSource, entityMap) {
-  try {
-    const resolved = await resolveFcmServiceAccount(dataSource, entityMap);
-    if (!resolved.ok) {
-      return {
-        success: false,
-        error: resolved.error
-      };
-    }
-    const { projectId, clientEmail, privateKey } = resolved.account;
-    await getGoogleAccessToken(clientEmail, privateKey);
-    return {
-      success: true,
-      projectId,
-      clientEmail
-    };
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : "Unknown credential validation error";
-    console.error("[fcm-push] Exception in validateFcmCredentials", errorMsg);
-    return {
-      success: false,
-      error: errorMsg
-    };
-  }
-}
-chunkUSNT2KNT_cjs.__name(validateFcmCredentials, "validateFcmCredentials");
 async function sendFcmPushNotification(dataSource, entityMap, msg) {
   try {
-    const resolved = await resolveFcmServiceAccount(dataSource, entityMap);
-    if (!resolved.ok) {
+    const pushSettings = await getSettingsGroup(dataSource, entityMap, "push");
+    let projectId = pushSettings.firebase_project_id?.trim();
+    let clientEmail = pushSettings.firebase_client_email?.trim();
+    let privateKey = pushSettings.firebase_private_key?.trim();
+    if (pushSettings.firebase_service_account_json?.trim()) {
+      try {
+        const parsed = JSON.parse(pushSettings.firebase_service_account_json.trim());
+        if (parsed.project_id) projectId = parsed.project_id;
+        if (parsed.client_email) clientEmail = parsed.client_email;
+        if (parsed.private_key) privateKey = parsed.private_key;
+      } catch {
+      }
+    }
+    if (!projectId || !clientEmail || !privateKey) {
       return {
         success: false,
-        error: resolved.error
+        error: "Firebase Service Account JSON / credentials are not configured"
       };
     }
-    const { projectId, clientEmail, privateKey } = resolved.account;
     const accessToken = await getGoogleAccessToken(clientEmail, privateKey);
     const fcmEndpoint = `https://fcm.googleapis.com/v1/projects/${projectId}/messages:send`;
     const fcmPayload = {
@@ -2301,59 +2261,69 @@ async function loadBoundTemplate(triggerKey, channel, audienceType = "customers"
     console.warn("[order-notifications] order_notification_bindings or message_templates missing from entityMap");
     return null;
   }
-  const bindingRepo = dataSource.getRepository(entityMap.order_notification_bindings);
-  let binding = await bindingRepo.findOne({
-    where: {
-      triggerKey,
-      channel,
-      type: audienceType,
-      enabled: true
-    }
-  });
-  if (!binding && audienceType === "customers") {
-    binding = await bindingRepo.findOne({
+  try {
+    const bindingRepo = dataSource.getRepository(entityMap.order_notification_bindings);
+    let binding = await bindingRepo.findOne({
       where: {
         triggerKey,
         channel,
+        type: audienceType,
         enabled: true
       }
-    });
-  }
-  if (!binding) {
-    console.warn("[order-notifications] no order_notification_bindings row", {
-      triggerKey,
-      channel,
-      audienceType
-    });
-    return null;
-  }
-  const templateId = binding.messageTemplateId;
-  if (templateId == null) {
-    console.warn("[order-notifications] binding exists but no template selected", {
-      triggerKey,
-      channel,
-      audienceType
-    });
-    return null;
-  }
-  const template = await dataSource.getRepository(entityMap.message_templates).findOne({
-    where: {
-      id: templateId,
-      channel,
-      deleted: false,
-      enabled: true
+    }).catch(() => null);
+    if (!binding && audienceType === "customers") {
+      binding = await bindingRepo.findOne({
+        where: {
+          triggerKey,
+          channel,
+          enabled: true
+        }
+      }).catch(() => null);
     }
-  });
-  if (!template) {
-    console.warn("[order-notifications] bound template not found or disabled", {
+    if (!binding) {
+      console.warn("[order-notifications] no order_notification_bindings row", {
+        triggerKey,
+        channel,
+        audienceType
+      });
+      return null;
+    }
+    const templateId = binding.messageTemplateId;
+    if (templateId == null) {
+      console.warn("[order-notifications] binding exists but no template selected", {
+        triggerKey,
+        channel,
+        audienceType
+      });
+      return null;
+    }
+    const template = await dataSource.getRepository(entityMap.message_templates).findOne({
+      where: {
+        id: templateId,
+        channel,
+        deleted: false,
+        enabled: true
+      }
+    }).catch(() => null);
+    if (!template) {
+      console.warn("[order-notifications] bound template not found or disabled", {
+        triggerKey,
+        channel,
+        audienceType,
+        templateId
+      });
+      return null;
+    }
+    return template;
+  } catch (err) {
+    console.warn("[order-notifications] loadBoundTemplate query failed", {
       triggerKey,
       channel,
       audienceType,
-      templateId
+      error: err instanceof Error ? err.message : String(err)
     });
     return null;
   }
-  return template;
 }
 chunkUSNT2KNT_cjs.__name(loadBoundTemplate, "loadBoundTemplate");
 function mergeTriggerVariables(payload, rich) {
@@ -2370,9 +2340,11 @@ function mergeTriggerVariables(payload, rich) {
       refundAmount: String(payload.refundAmount)
     } : {}
   };
+  const extraVars = payload.extraVariables ?? {};
   return {
     ...basic,
-    ...rich ?? {}
+    ...rich ?? {},
+    ...extraVars
   };
 }
 chunkUSNT2KNT_cjs.__name(mergeTriggerVariables, "mergeTriggerVariables");
@@ -2568,7 +2540,23 @@ async function getAdminRecipientEmails(dataSource, entityMap) {
     }
   } catch {
   }
-  return Array.from(emails);
+  const vendorEmails = /* @__PURE__ */ new Set();
+  try {
+    const vRows = await dataSource.query(`SELECT DISTINCT LOWER(TRIM(email)) AS email FROM vendors WHERE COALESCE(deleted, false) = false AND email IS NOT NULL AND TRIM(email) != ''`).catch(() => []);
+    for (const r of vRows) {
+      if (r.email) vendorEmails.add(r.email.toLowerCase());
+    }
+    const vuRows = await dataSource.query(`SELECT DISTINCT LOWER(TRIM(u.email)) AS email
+           FROM users u
+      LEFT JOIN user_groups g ON g.id = u."groupId"
+          WHERE COALESCE(u.deleted, false) = false
+            AND (LOWER(g.name) LIKE '%vendor%' OR u."groupId" = 5)`).catch(() => []);
+    for (const r of vuRows) {
+      if (r.email) vendorEmails.add(r.email.toLowerCase());
+    }
+  } catch {
+  }
+  return Array.from(emails).filter((e) => !vendorEmails.has(e.toLowerCase()));
 }
 chunkUSNT2KNT_cjs.__name(getAdminRecipientEmails, "getAdminRecipientEmails");
 function formatBodyForEmailHtml(body) {
@@ -2802,6 +2790,8 @@ function initWhatsappTriggerDispatcher(deps) {
   if (initialized) return;
   initialized = true;
   const { dataSource, entityMap, getCms } = deps;
+  void dataSource.query(`ALTER TYPE "order_notification_bindings_channel_enum" ADD VALUE IF NOT EXISTS 'mobile'`).catch(() => {
+  });
   chunkUCKN4BBY_cjs.notificationTriggerEmitter.onAnyTrigger((triggerKey, payload) => {
     void handleTrigger(triggerKey, payload, dataSource, entityMap, getCms).catch((err) => {
       console.error("[order-notifications]", triggerKey, err);
@@ -2886,5 +2876,4 @@ exports.resolveChatEmailToolSettings = resolveChatEmailToolSettings;
 exports.sendChatLeadEmail = sendChatLeadEmail;
 exports.sendFcmPushNotification = sendFcmPushNotification;
 exports.serializeEmailRecipients = serializeEmailRecipients;
-exports.validateFcmCredentials = validateFcmCredentials;
 exports.whatsAppConfigured = whatsAppConfigured;

package/dist/{chunk-JE22VP6S.js → chunk-MXIWUFBP.js}

@@ -59,7 +59,7 @@ async function emitOrderNotificationTrigger(triggerKey, orderId, deps, extra) {
     total: fo.total ?? 0,
     currency: String(fo.currency ?? "INR"),
     vendorId: fo.vendorId ?? null,
-    ...extra?.extraVariables ?? {},
+    extraVariables: extra?.extraVariables,
     ...extra?.refundAmount != null ? {
       refundAmount: extra.refundAmount
     } : {}

package/dist/{chunk-LT2WOPKA.js → chunk-NUXR7BUG.js}

@@ -1,5 +1,5 @@
 import { validateInventoryForConfirmedOrderLines, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, orderInventorySnapshotFromRow, validateInventoryForOrderBecomingConfirmed } from './chunk-3K5AIEIZ.js';
-import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, validateFcmCredentials, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-IPDHT2UV.js';
+import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-CTXBYO2J.js';
 import { inviteStatusForActivation } from './chunk-JXF23MPG.js';
 import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-L3525VXI.js';
 import { mergeEmailLayoutCompanyDetails, unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-2KUCQVAQ.js';
@@ -2966,46 +2966,51 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
       total
     });
   }
-  if (discountId && entityMap["discounts"]) {
+  const dIds = Array.isArray(discountId) ? discountId.filter((id) => id != null && Number.isFinite(id) && id > 0) : discountId != null && Number.isFinite(discountId) && discountId > 0 ? [
+    discountId
+  ] : [];
+  if (dIds.length > 0 && entityMap["discounts"]) {
     try {
       const discountRepo = dataSource.getRepository(entityMap["discounts"]);
       const rulesRepo = entityMap["discount_rules"] ? dataSource.getRepository(entityMap["discount_rules"]) : null;
-      const discountRow = await discountRepo.findOne({
-        where: withDiscountVendorWhere({
-          id: discountId
-        }, vendorId)
-      });
-      if (discountRow) {
-        const flatRules = rulesRepo ? await rulesRepo.find({
-          where: {
-            discountId
-          }
-        }) : [];
-        const discountForEval = {
-          ...discountRow,
-          rules: flatRules
-        };
-        const cartLines = lines.filter((l) => l.found && l.productId != null).map((l) => ({
-          productId: l.productId,
-          quantity: l.quantity,
-          unitPrice: l.unitPrice,
-          subtotal: l.subtotal
-        }));
-        const evalResult = evaluateDiscount(discountForEval, cartLines);
-        if (evalResult.conditionsMet) {
-          const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
-          for (const line of lines) {
-            if (!line.found || line.taxRate === 0) continue;
-            const discountedAmount = line.subtotal - (line.discount ?? 0);
-            line.tax = discountedAmount * line.taxRate / 100;
-            line.total = discountedAmount + line.tax;
+      for (const dId of dIds) {
+        const discountRow = await discountRepo.findOne({
+          where: withDiscountVendorWhere({
+            id: dId
+          }, vendorId)
+        });
+        if (discountRow) {
+          const flatRules = rulesRepo ? await rulesRepo.find({
+            where: {
+              discountId: dId
+            }
+          }) : [];
+          const discountForEval = {
+            ...discountRow,
+            rules: flatRules
+          };
+          const cartLines = lines.filter((l) => l.found && l.productId != null).map((l) => ({
+            productId: l.productId,
+            quantity: l.quantity,
+            unitPrice: l.unitPrice,
+            subtotal: l.subtotal
+          }));
+          const evalResult = evaluateDiscount(discountForEval, cartLines);
+          if (evalResult.conditionsMet) {
+            const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
+            orderDiscount += totalDiscountApplied;
           }
-          orderDiscount = totalDiscountApplied;
-          orderTotal = lines.reduce((s, l) => s + l.total, 0);
-          orderSubTotal = lines.reduce((s, l) => s + l.subtotal, 0);
-          orderTax = lines.reduce((s, l) => s + l.tax, 0);
         }
       }
+      for (const line of lines) {
+        if (!line.found || line.taxRate === 0) continue;
+        const discountedAmount = Math.max(0, line.subtotal - (line.discount ?? 0));
+        line.tax = discountedAmount * line.taxRate / 100;
+        line.total = discountedAmount + line.tax;
+      }
+      orderTotal = lines.reduce((s, l) => s + l.total, 0);
+      orderSubTotal = lines.reduce((s, l) => s + l.subtotal, 0);
+      orderTax = lines.reduce((s, l) => s + l.tax, 0);
     } catch (err) {
       logCrudServerError("discount evaluation failed", {
         discountId,
@@ -5039,7 +5044,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             await recordDiscountUsage2(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
           }
           const orderIdForNotify = created.id;
-          void import('./emit-order-notification-trigger-6XX7LSC4.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_placed", orderIdForNotify, {
               dataSource,
               entityMap
@@ -5216,9 +5221,14 @@ function createCrudHandler(dataSource, entityMap, options) {
       const where = hasDeleted ? {
         deleted: false
       } : {};
-      const data = await repo.find({
+      let data = await repo.find({
         where
       });
+      const scope = await resolveScope();
+      const flags = await getVendorCatalogCreateFlags(dataSource);
+      if (scope.type !== "all") {
+        data = data.filter((row) => vendorScopeRowAccess(row, scope, resource, flags) === "ok");
+      }
       const excludeCols = /* @__PURE__ */ new Set([
         "deletedAt",
         "deletedBy",
@@ -12995,17 +13005,80 @@ async function getSettingsGroup(deps, group) {
   ]));
 }
 __name(getSettingsGroup, "getSettingsGroup");
+async function getSuperAdminEmails(deps) {
+  try {
+    const ds = await deps.getDataSource();
+    if (!deps.entityMap.users) return [];
+    const userRepo = ds.getRepository(deps.entityMap.users);
+    const superAdmins = await userRepo.createQueryBuilder("u").leftJoin("u.group", "g").where("u.deleted = false").andWhere("u.blocked = false").andWhere("(u.groupId = 1 OR LOWER(g.name) IN (:...adminGroupNames) OR u.adminAccess = true)", {
+      adminGroupNames: [
+        "administrator",
+        "admin",
+        "super admin",
+        "superadmin"
+      ]
+    }).select([
+      "u.email"
+    ]).getMany();
+    return superAdmins.map((u) => String(u.email ?? "").trim().toLowerCase()).filter((e) => Boolean(e));
+  } catch {
+    return [];
+  }
+}
+__name(getSuperAdminEmails, "getSuperAdminEmails");
+async function getVendorEmails(deps) {
+  const emails = /* @__PURE__ */ new Set();
+  try {
+    const ds = await deps.getDataSource();
+    if (deps.entityMap.vendors) {
+      const vendors = await ds.getRepository(deps.entityMap.vendors).find({
+        where: {
+          deleted: false
+        },
+        select: [
+          "email"
+        ]
+      });
+      for (const v of vendors) {
+        const e = String(v.email ?? "").trim().toLowerCase();
+        if (e) emails.add(e);
+      }
+    }
+    if (deps.entityMap.users) {
+      const vendorUsers = await ds.getRepository(deps.entityMap.users).createQueryBuilder("u").leftJoin("u.group", "g").where("u.deleted = false").andWhere("(LOWER(g.name) LIKE :vGroup OR u.groupId = 5)", {
+        vGroup: "%vendor%"
+      }).select([
+        "u.email"
+      ]).getMany();
+      for (const u of vendorUsers) {
+        const e = String(u.email ?? "").trim().toLowerCase();
+        if (e) emails.add(e);
+      }
+    }
+  } catch {
+  }
+  return emails;
+}
+__name(getVendorEmails, "getVendorEmails");
 async function sendVendorOnboardEmails(input, deps) {
   let ownerEmailSent = false;
   try {
-    const [branding, emailSettings] = await Promise.all([
+    const [branding, emailSettings, superAdminEmails, vendorEmailSet] = await Promise.all([
       getSettingsGroup(deps, "branding"),
-      getSettingsGroup(deps, "email")
+      getSettingsGroup(deps, "email"),
+      getSuperAdminEmails(deps),
+      getVendorEmails(deps)
     ]);
     const companyDetails = mergeEmailLayoutCompanyDetails(branding, emailSettings);
-    const notifyEmails = parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
-    const sendToOwner = input.sendToOwner !== false;
+    const configuredNotify = parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const ownerEmail = input.ownerEmail?.trim() || "";
+    const ownerEmailLower = ownerEmail.toLowerCase();
+    const sendToOwner = input.sendToOwner !== false;
+    const combined = [
+      ...configuredNotify,
+      ...superAdminEmails
+    ];
+    const notifyEmails = Array.from(new Set(combined.map((e) => e.trim().toLowerCase()).filter((e) => e && e !== ownerEmailLower && !vendorEmailSet.has(e))));
     const cms = await deps.getCms();
     await queueVendorOnboardEmails(cms, {
       vendorName: input.vendorName,
@@ -13152,8 +13225,6 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
   return id != null ? Number(id) : null;
 }
 __name(getDefaultStaffRoleIdForVendor, "getDefaultStaffRoleIdForVendor");
-
-// src/lib/vendor-profile.ts
 var VENDOR_REGISTRATION_STATUSES = [
   {
     value: "pending",
@@ -13172,6 +13243,30 @@ var VENDOR_REGISTRATION_STATUSES = [
     label: "Suspended"
   }
 ];
+(() => {
+  const list = [];
+  const seenCodes = /* @__PURE__ */ new Set();
+  for (const c of Country.getAllCountries()) {
+    if (!c.phonecode) continue;
+    const rawCode = c.phonecode.replace(/^\+/, "").trim();
+    if (!rawCode) continue;
+    const code = `+${rawCode}`;
+    const key = `${code}-${c.name}`;
+    if (seenCodes.has(key)) continue;
+    seenCodes.add(key);
+    list.push({
+      code,
+      country: c.name,
+      isoCode: c.isoCode,
+      label: `${code} (${c.name})`
+    });
+  }
+  return list.sort((a, b) => {
+    if (a.code === "+91" && b.code !== "+91") return -1;
+    if (b.code === "+91" && a.code !== "+91") return 1;
+    return a.country.localeCompare(b.country);
+  });
+})();
 function trimOrNull(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
@@ -13224,11 +13319,27 @@ function parseVendorPersonProfileFromBody(raw, fallbacks) {
   };
 }
 __name(parseVendorPersonProfileFromBody, "parseVendorPersonProfileFromBody");
-function validateIndiaTaxIds(gstin, pan) {
-  if (gstin && !/^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/i.test(gstin)) {
-    return "Invalid GSTIN format (15 characters, e.g. 22AAAAA0000A1Z5)";
+function validateGstin(gstin, options) {
+  const required = options?.required === true;
+  if (!gstin || !gstin.trim()) {
+    if (required) return "GSTIN number is required";
+    return null;
+  }
+  if (!/^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/i.test(gstin.trim())) {
+    return "Invalid GSTIN number (15 characters, e.g. 22AAAAA0000A1Z5)";
+  }
+  return null;
+}
+__name(validateGstin, "validateGstin");
+function validateIndiaTaxIds(gstin, pan, options) {
+  const gstinErr = validateGstin(gstin, {
+    required: options?.requiredGstin
+  });
+  if (gstinErr) return gstinErr;
+  if (options?.requiredPan && (!pan || !pan.trim())) {
+    return "PAN is required";
   }
-  if (pan && !/^[A-Z]{5}[0-9]{4}[A-Z]$/i.test(pan)) {
+  if (pan && !/^[A-Z]{5}[0-9]{4}[A-Z]$/i.test(pan.trim())) {
     return "Invalid PAN format (e.g. ABCDE1234F)";
   }
   return null;
@@ -13236,7 +13347,7 @@ function validateIndiaTaxIds(gstin, pan) {
 __name(validateIndiaTaxIds, "validateIndiaTaxIds");
 function validateAadhaar(aadhaar) {
   if (!aadhaar) return null;
-  if (!/^[0-9]{12}$/.test(aadhaar)) {
+  if (!/^[0-9]{12}$/.test(aadhaar.replace(/\s+/g, ""))) {
     return "Invalid Aadhaar number (12 digits)";
   }
   return null;
@@ -13244,11 +13355,13 @@ function validateAadhaar(aadhaar) {
 __name(validateAadhaar, "validateAadhaar");
 function validatePersonKyc(person, options) {
   const required = options?.required === true;
-  if (required && !person.aadhaarNo) return "Aadhaar number is required";
-  if (required && !person.panNo) return "PAN is required";
+  if (required && (!person.aadhaarNo || !person.aadhaarNo.trim())) return "Aadhaar number is required";
+  if (required && (!person.panNo || !person.panNo.trim())) return "PAN is required";
   const aadhaarErr = validateAadhaar(person.aadhaarNo ?? null);
   if (aadhaarErr) return aadhaarErr;
-  const panErr = validateIndiaTaxIds(null, person.panNo ?? null);
+  const panErr = validateIndiaTaxIds(null, person.panNo ?? null, {
+    requiredPan: required
+  });
   if (panErr) return panErr;
   return null;
 }
@@ -13594,7 +13707,9 @@ function createVendorOnboardHandlers(config) {
       }, {
         getDataSource: /* @__PURE__ */ __name(async () => dataSource, "getDataSource"),
         entityMap: {
-          configs: entityMap.configs
+          configs: entityMap.configs,
+          users: entityMap.users,
+          vendors: entityMap.vendors
         },
         getCms
       });
@@ -13720,7 +13835,9 @@ function createVendorOnboardHandlers(config) {
         const profile = parseVendorProfileFromBody(body.vendor, {
           defaultRegistrationStatus: "approved"
         });
-        const gstError = validateIndiaTaxIds(profile.gstin, null);
+        const gstError = validateGstin(profile.gstin, {
+          required: true
+        });
         if (gstError) return json({
           error: gstError
         }, {
@@ -29361,7 +29478,10 @@ function createCmsApiHandler(config) {
         if (pe) return pe;
         try {
           const body = await req.json();
-          const discountId = body?.discountId ? Number(body.discountId) : null;
+          const discountIdsRaw = Array.isArray(body?.discountIds) ? body.discountIds : body?.discountId ? [
+            body.discountId
+          ] : [];
+          const discountIds = discountIdsRaw.map((id) => Number(id)).filter((id) => Number.isFinite(id) && id > 0);
           const currency = typeof body?.currency === "string" ? body.currency.trim().toUpperCase() : "INR";
           let vendorId = null;
           if (resolveSessionUser) {
@@ -29371,7 +29491,7 @@ function createCmsApiHandler(config) {
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
           if (orderLinesNorm && orderLinesNorm.length > 0) {
-            const result2 = await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, currency, discountId, vendorId);
+            const result2 = await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, currency, discountIds.length > 0 ? discountIds : null, vendorId);
             return config.json(result2);
           }
           const itemsSummary = String(body?.itemsSummary ?? "").trim();
@@ -29384,7 +29504,7 @@ function createCmsApiHandler(config) {
               lines: []
             });
           }
-          const result = await calculateOrderTotals(dataSource, entityMap, itemsSummary, discountId, vendorId);
+          const result = await calculateOrderTotals(dataSource, entityMap, itemsSummary, discountIds[0] ?? null, vendorId);
           return config.json(result);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -29572,7 +29692,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-3TA4ETYJ.js');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-AT4IFAGL.js');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -29672,7 +29792,7 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ __name((refundAmount) => {
-          void import('./emit-order-notification-trigger-6XX7LSC4.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
@@ -30705,7 +30825,7 @@ function createStorefrontApiHandler(config) {
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
   function fireOrderPlacedNotification(orderId) {
-    void import('./emit-order-notification-trigger-6XX7LSC4.js').then(({ fireOrderNotificationTrigger }) => {
+    void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
       fireOrderNotificationTrigger("order_placed", orderId, {
         dataSource,
         entityMap

package/dist/{chunk-KOTXDSQB.cjs → chunk-UQWZUZ5X.cjs}

@@ -61,7 +61,7 @@ async function emitOrderNotificationTrigger(triggerKey, orderId, deps, extra) {
     total: fo.total ?? 0,
     currency: String(fo.currency ?? "INR"),
     vendorId: fo.vendorId ?? null,
-    ...extra?.extraVariables ?? {},
+    extraVariables: extra?.extraVariables,
     ...extra?.refundAmount != null ? {
       refundAmount: extra.refundAmount
     } : {}