@infuro/cms-core 1.0.50 → 1.0.52

package/dist/{chunk-LT2WOPKA.js → chunk-UO5Q5RXB.js}

@@ -1,16 +1,16 @@
+import { JOB_RUNNER_QUEUE } from './chunk-GO7PPYNU.js';
 import { validateInventoryForConfirmedOrderLines, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, orderInventorySnapshotFromRow, validateInventoryForOrderBecomingConfirmed } from './chunk-3K5AIEIZ.js';
-import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, validateFcmCredentials, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-IPDHT2UV.js';
+import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-CTXBYO2J.js';
 import { inviteStatusForActivation } from './chunk-JXF23MPG.js';
 import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-L3525VXI.js';
 import { mergeEmailLayoutCompanyDetails, unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-2KUCQVAQ.js';
+import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MQBT33IV.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-AYERBA7I.js';
-import { JOB_RUNNER_QUEUE } from './chunk-GO7PPYNU.js';
 import { ensureCustomerRecord, linkUnclaimedContactToUser, ensureCustomerForUser, canManageRoles, sessionHasEntityAccess } from './chunk-RK5ETF2I.js';
 import { retireSoftDeletedUniqueValue, activeUniqueValueExists } from './chunk-DBPSJYLZ.js';
 import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-JIWUVQ6B.js';
 import { queueErp } from './chunk-SYBOCAWB.js';
-import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { __name } from './chunk-SHUYVCID.js';
 import { PrimaryGeneratedColumn, Column, Entity, CreateDateColumn, UpdateDateColumn, Unique, ManyToOne, JoinColumn, OneToMany, Index, ManyToMany, JoinTable, In, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan, IsNull } from 'typeorm';
 import { Country, State, City } from 'country-state-city';
@@ -2966,46 +2966,51 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
       total
     });
   }
-  if (discountId && entityMap["discounts"]) {
+  const dIds = Array.isArray(discountId) ? discountId.filter((id) => id != null && Number.isFinite(id) && id > 0) : discountId != null && Number.isFinite(discountId) && discountId > 0 ? [
+    discountId
+  ] : [];
+  if (dIds.length > 0 && entityMap["discounts"]) {
     try {
       const discountRepo = dataSource.getRepository(entityMap["discounts"]);
       const rulesRepo = entityMap["discount_rules"] ? dataSource.getRepository(entityMap["discount_rules"]) : null;
-      const discountRow = await discountRepo.findOne({
-        where: withDiscountVendorWhere({
-          id: discountId
-        }, vendorId)
-      });
-      if (discountRow) {
-        const flatRules = rulesRepo ? await rulesRepo.find({
-          where: {
-            discountId
-          }
-        }) : [];
-        const discountForEval = {
-          ...discountRow,
-          rules: flatRules
-        };
-        const cartLines = lines.filter((l) => l.found && l.productId != null).map((l) => ({
-          productId: l.productId,
-          quantity: l.quantity,
-          unitPrice: l.unitPrice,
-          subtotal: l.subtotal
-        }));
-        const evalResult = evaluateDiscount(discountForEval, cartLines);
-        if (evalResult.conditionsMet) {
-          const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
-          for (const line of lines) {
-            if (!line.found || line.taxRate === 0) continue;
-            const discountedAmount = line.subtotal - (line.discount ?? 0);
-            line.tax = discountedAmount * line.taxRate / 100;
-            line.total = discountedAmount + line.tax;
+      for (const dId of dIds) {
+        const discountRow = await discountRepo.findOne({
+          where: withDiscountVendorWhere({
+            id: dId
+          }, vendorId)
+        });
+        if (discountRow) {
+          const flatRules = rulesRepo ? await rulesRepo.find({
+            where: {
+              discountId: dId
+            }
+          }) : [];
+          const discountForEval = {
+            ...discountRow,
+            rules: flatRules
+          };
+          const cartLines = lines.filter((l) => l.found && l.productId != null).map((l) => ({
+            productId: l.productId,
+            quantity: l.quantity,
+            unitPrice: l.unitPrice,
+            subtotal: l.subtotal
+          }));
+          const evalResult = evaluateDiscount(discountForEval, cartLines);
+          if (evalResult.conditionsMet) {
+            const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
+            orderDiscount += totalDiscountApplied;
           }
-          orderDiscount = totalDiscountApplied;
-          orderTotal = lines.reduce((s, l) => s + l.total, 0);
-          orderSubTotal = lines.reduce((s, l) => s + l.subtotal, 0);
-          orderTax = lines.reduce((s, l) => s + l.tax, 0);
         }
       }
+      for (const line of lines) {
+        if (!line.found || line.taxRate === 0) continue;
+        const discountedAmount = Math.max(0, line.subtotal - (line.discount ?? 0));
+        line.tax = discountedAmount * line.taxRate / 100;
+        line.total = discountedAmount + line.tax;
+      }
+      orderTotal = lines.reduce((s, l) => s + l.total, 0);
+      orderSubTotal = lines.reduce((s, l) => s + l.subtotal, 0);
+      orderTax = lines.reduce((s, l) => s + l.tax, 0);
     } catch (err) {
       logCrudServerError("discount evaluation failed", {
         discountId,
@@ -5039,7 +5044,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             await recordDiscountUsage2(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
           }
           const orderIdForNotify = created.id;
-          void import('./emit-order-notification-trigger-6XX7LSC4.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_placed", orderIdForNotify, {
               dataSource,
               entityMap
@@ -5216,9 +5221,14 @@ function createCrudHandler(dataSource, entityMap, options) {
       const where = hasDeleted ? {
         deleted: false
       } : {};
-      const data = await repo.find({
+      let data = await repo.find({
         where
       });
+      const scope = await resolveScope();
+      const flags = await getVendorCatalogCreateFlags(dataSource);
+      if (scope.type !== "all") {
+        data = data.filter((row) => vendorScopeRowAccess(row, scope, resource, flags) === "ok");
+      }
       const excludeCols = /* @__PURE__ */ new Set([
         "deletedAt",
         "deletedBy",
@@ -12995,17 +13005,80 @@ async function getSettingsGroup(deps, group) {
   ]));
 }
 __name(getSettingsGroup, "getSettingsGroup");
+async function getSuperAdminEmails(deps) {
+  try {
+    const ds = await deps.getDataSource();
+    if (!deps.entityMap.users) return [];
+    const userRepo = ds.getRepository(deps.entityMap.users);
+    const superAdmins = await userRepo.createQueryBuilder("u").leftJoin("u.group", "g").where("u.deleted = false").andWhere("u.blocked = false").andWhere("(u.groupId = 1 OR LOWER(g.name) IN (:...adminGroupNames) OR u.adminAccess = true)", {
+      adminGroupNames: [
+        "administrator",
+        "admin",
+        "super admin",
+        "superadmin"
+      ]
+    }).select([
+      "u.email"
+    ]).getMany();
+    return superAdmins.map((u) => String(u.email ?? "").trim().toLowerCase()).filter((e) => Boolean(e));
+  } catch {
+    return [];
+  }
+}
+__name(getSuperAdminEmails, "getSuperAdminEmails");
+async function getVendorEmails(deps) {
+  const emails = /* @__PURE__ */ new Set();
+  try {
+    const ds = await deps.getDataSource();
+    if (deps.entityMap.vendors) {
+      const vendors = await ds.getRepository(deps.entityMap.vendors).find({
+        where: {
+          deleted: false
+        },
+        select: [
+          "email"
+        ]
+      });
+      for (const v of vendors) {
+        const e = String(v.email ?? "").trim().toLowerCase();
+        if (e) emails.add(e);
+      }
+    }
+    if (deps.entityMap.users) {
+      const vendorUsers = await ds.getRepository(deps.entityMap.users).createQueryBuilder("u").leftJoin("u.group", "g").where("u.deleted = false").andWhere("(LOWER(g.name) LIKE :vGroup OR u.groupId = 5)", {
+        vGroup: "%vendor%"
+      }).select([
+        "u.email"
+      ]).getMany();
+      for (const u of vendorUsers) {
+        const e = String(u.email ?? "").trim().toLowerCase();
+        if (e) emails.add(e);
+      }
+    }
+  } catch {
+  }
+  return emails;
+}
+__name(getVendorEmails, "getVendorEmails");
 async function sendVendorOnboardEmails(input, deps) {
   let ownerEmailSent = false;
   try {
-    const [branding, emailSettings] = await Promise.all([
+    const [branding, emailSettings, superAdminEmails, vendorEmailSet] = await Promise.all([
       getSettingsGroup(deps, "branding"),
-      getSettingsGroup(deps, "email")
+      getSettingsGroup(deps, "email"),
+      getSuperAdminEmails(deps),
+      getVendorEmails(deps)
     ]);
     const companyDetails = mergeEmailLayoutCompanyDetails(branding, emailSettings);
-    const notifyEmails = parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
-    const sendToOwner = input.sendToOwner !== false;
+    const configuredNotify = parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const ownerEmail = input.ownerEmail?.trim() || "";
+    const ownerEmailLower = ownerEmail.toLowerCase();
+    const sendToOwner = input.sendToOwner !== false;
+    const combined = [
+      ...configuredNotify,
+      ...superAdminEmails
+    ];
+    const notifyEmails = Array.from(new Set(combined.map((e) => e.trim().toLowerCase()).filter((e) => e && e !== ownerEmailLower && !vendorEmailSet.has(e))));
     const cms = await deps.getCms();
     await queueVendorOnboardEmails(cms, {
       vendorName: input.vendorName,
@@ -13152,8 +13225,6 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
   return id != null ? Number(id) : null;
 }
 __name(getDefaultStaffRoleIdForVendor, "getDefaultStaffRoleIdForVendor");
-
-// src/lib/vendor-profile.ts
 var VENDOR_REGISTRATION_STATUSES = [
   {
     value: "pending",
@@ -13172,6 +13243,30 @@ var VENDOR_REGISTRATION_STATUSES = [
     label: "Suspended"
   }
 ];
+(() => {
+  const list = [];
+  const seenCodes = /* @__PURE__ */ new Set();
+  for (const c of Country.getAllCountries()) {
+    if (!c.phonecode) continue;
+    const rawCode = c.phonecode.replace(/^\+/, "").trim();
+    if (!rawCode) continue;
+    const code = `+${rawCode}`;
+    const key = `${code}-${c.name}`;
+    if (seenCodes.has(key)) continue;
+    seenCodes.add(key);
+    list.push({
+      code,
+      country: c.name,
+      isoCode: c.isoCode,
+      label: `${code} (${c.name})`
+    });
+  }
+  return list.sort((a, b) => {
+    if (a.code === "+91" && b.code !== "+91") return -1;
+    if (b.code === "+91" && a.code !== "+91") return 1;
+    return a.country.localeCompare(b.country);
+  });
+})();
 function trimOrNull(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
@@ -13224,11 +13319,27 @@ function parseVendorPersonProfileFromBody(raw, fallbacks) {
   };
 }
 __name(parseVendorPersonProfileFromBody, "parseVendorPersonProfileFromBody");
-function validateIndiaTaxIds(gstin, pan) {
-  if (gstin && !/^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/i.test(gstin)) {
-    return "Invalid GSTIN format (15 characters, e.g. 22AAAAA0000A1Z5)";
+function validateGstin(gstin, options) {
+  const required = options?.required === true;
+  if (!gstin || !gstin.trim()) {
+    if (required) return "GSTIN number is required";
+    return null;
+  }
+  if (!/^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/i.test(gstin.trim())) {
+    return "Invalid GSTIN number (15 characters, e.g. 22AAAAA0000A1Z5)";
+  }
+  return null;
+}
+__name(validateGstin, "validateGstin");
+function validateIndiaTaxIds(gstin, pan, options) {
+  const gstinErr = validateGstin(gstin, {
+    required: options?.requiredGstin
+  });
+  if (gstinErr) return gstinErr;
+  if (options?.requiredPan && (!pan || !pan.trim())) {
+    return "PAN is required";
   }
-  if (pan && !/^[A-Z]{5}[0-9]{4}[A-Z]$/i.test(pan)) {
+  if (pan && !/^[A-Z]{5}[0-9]{4}[A-Z]$/i.test(pan.trim())) {
     return "Invalid PAN format (e.g. ABCDE1234F)";
   }
   return null;
@@ -13236,7 +13347,7 @@ function validateIndiaTaxIds(gstin, pan) {
 __name(validateIndiaTaxIds, "validateIndiaTaxIds");
 function validateAadhaar(aadhaar) {
   if (!aadhaar) return null;
-  if (!/^[0-9]{12}$/.test(aadhaar)) {
+  if (!/^[0-9]{12}$/.test(aadhaar.replace(/\s+/g, ""))) {
     return "Invalid Aadhaar number (12 digits)";
   }
   return null;
@@ -13244,11 +13355,13 @@ function validateAadhaar(aadhaar) {
 __name(validateAadhaar, "validateAadhaar");
 function validatePersonKyc(person, options) {
   const required = options?.required === true;
-  if (required && !person.aadhaarNo) return "Aadhaar number is required";
-  if (required && !person.panNo) return "PAN is required";
+  if (required && (!person.aadhaarNo || !person.aadhaarNo.trim())) return "Aadhaar number is required";
+  if (required && (!person.panNo || !person.panNo.trim())) return "PAN is required";
   const aadhaarErr = validateAadhaar(person.aadhaarNo ?? null);
   if (aadhaarErr) return aadhaarErr;
-  const panErr = validateIndiaTaxIds(null, person.panNo ?? null);
+  const panErr = validateIndiaTaxIds(null, person.panNo ?? null, {
+    requiredPan: required
+  });
   if (panErr) return panErr;
   return null;
 }
@@ -13594,7 +13707,9 @@ function createVendorOnboardHandlers(config) {
       }, {
         getDataSource: /* @__PURE__ */ __name(async () => dataSource, "getDataSource"),
         entityMap: {
-          configs: entityMap.configs
+          configs: entityMap.configs,
+          users: entityMap.users,
+          vendors: entityMap.vendors
         },
         getCms
       });
@@ -13720,7 +13835,9 @@ function createVendorOnboardHandlers(config) {
         const profile = parseVendorProfileFromBody(body.vendor, {
           defaultRegistrationStatus: "approved"
         });
-        const gstError = validateIndiaTaxIds(profile.gstin, null);
+        const gstError = validateGstin(profile.gstin, {
+          required: true
+        });
         if (gstError) return json({
           error: gstError
         }, {
@@ -29361,7 +29478,10 @@ function createCmsApiHandler(config) {
         if (pe) return pe;
         try {
           const body = await req.json();
-          const discountId = body?.discountId ? Number(body.discountId) : null;
+          const discountIdsRaw = Array.isArray(body?.discountIds) ? body.discountIds : body?.discountId ? [
+            body.discountId
+          ] : [];
+          const discountIds = discountIdsRaw.map((id) => Number(id)).filter((id) => Number.isFinite(id) && id > 0);
           const currency = typeof body?.currency === "string" ? body.currency.trim().toUpperCase() : "INR";
           let vendorId = null;
           if (resolveSessionUser) {
@@ -29371,7 +29491,7 @@ function createCmsApiHandler(config) {
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
           if (orderLinesNorm && orderLinesNorm.length > 0) {
-            const result2 = await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, currency, discountId, vendorId);
+            const result2 = await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, currency, discountIds.length > 0 ? discountIds : null, vendorId);
             return config.json(result2);
           }
           const itemsSummary = String(body?.itemsSummary ?? "").trim();
@@ -29384,7 +29504,7 @@ function createCmsApiHandler(config) {
               lines: []
             });
           }
-          const result = await calculateOrderTotals(dataSource, entityMap, itemsSummary, discountId, vendorId);
+          const result = await calculateOrderTotals(dataSource, entityMap, itemsSummary, discountIds[0] ?? null, vendorId);
           return config.json(result);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -29572,7 +29692,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-3TA4ETYJ.js');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-AT4IFAGL.js');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -29672,7 +29792,7 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ __name((refundAmount) => {
-          void import('./emit-order-notification-trigger-6XX7LSC4.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
@@ -30705,7 +30825,7 @@ function createStorefrontApiHandler(config) {
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
   function fireOrderPlacedNotification(orderId) {
-    void import('./emit-order-notification-trigger-6XX7LSC4.js').then(({ fireOrderNotificationTrigger }) => {
+    void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
       fireOrderNotificationTrigger("order_placed", orderId, {
         dataSource,
         entityMap

package/dist/{chunk-KOTXDSQB.cjs → chunk-UQWZUZ5X.cjs}

@@ -61,7 +61,7 @@ async function emitOrderNotificationTrigger(triggerKey, orderId, deps, extra) {
     total: fo.total ?? 0,
     currency: String(fo.currency ?? "INR"),
     vendorId: fo.vendorId ?? null,
-    ...extra?.extraVariables ?? {},
+    extraVariables: extra?.extraVariables,
     ...extra?.refundAmount != null ? {
       refundAmount: extra.refundAmount
     } : {}

package/dist/chunk-WUQAOTHA.js

@@ -0,0 +1,203 @@
+import { __name } from './chunk-SHUYVCID.js';
+
+// src/auth/auth-debug.ts
+var LOG_PREFIX = "[cms-auth]";
+function isAuthDebugEnabled() {
+  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+__name(isAuthDebugEnabled, "isAuthDebugEnabled");
+function isAuthDebugClientEnabled() {
+  if (typeof window === "undefined") return false;
+  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+__name(isAuthDebugClientEnabled, "isAuthDebugClientEnabled");
+function logAuth(message, data) {
+  if (!isAuthDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX, message, data);
+  else console.info(LOG_PREFIX, message);
+}
+__name(logAuth, "logAuth");
+function logAuthClient(message, data) {
+  if (!isAuthDebugClientEnabled()) return;
+  if (data) console.info(LOG_PREFIX, message, data);
+  else console.info(LOG_PREFIX, message);
+}
+__name(logAuthClient, "logAuthClient");
+function summarizeSessionUserForLog(user) {
+  if (!user || typeof user !== "object") return {
+    present: false
+  };
+  const u = user;
+  return {
+    present: true,
+    email: u.email ?? null,
+    id: u.id ?? null,
+    adminAccess: u.adminAccess ?? null,
+    isRBACAdmin: u.isRBACAdmin ?? null,
+    isVendorPortal: u.isVendorPortal ?? null,
+    groupName: u.groupName ?? null
+  };
+}
+__name(summarizeSessionUserForLog, "summarizeSessionUserForLog");
+function nextAuthCookieDebugInfo() {
+  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
+  const isHttps = nextAuthUrl.startsWith("https");
+  return {
+    nextAuthUrl,
+    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
+    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
+    cookieSecure: isHttps,
+    nodeEnv: process.env.NODE_ENV ?? "(unset)"
+  };
+}
+__name(nextAuthCookieDebugInfo, "nextAuthCookieDebugInfo");
+
+// src/auth/middleware.ts
+var defaultPublicApiMethods = {
+  "/api/contacts": [
+    "POST"
+  ],
+  "/api/form-submissions": [
+    "POST"
+  ],
+  "/api/blogs": [
+    "GET"
+  ],
+  "/api/forms": [
+    "GET"
+  ],
+  "/api/auth": [
+    "GET",
+    "POST"
+  ],
+  "/api/health": [
+    "GET"
+  ],
+  "/api/users/forgot-password": [
+    "POST"
+  ],
+  "/api/users/set-password": [
+    "POST"
+  ],
+  "/api/users/invite": [
+    "GET",
+    "POST"
+  ],
+  /** Public keys only (e.g. googleEnabled); secrets stay private in the settings handler. */
+  "/api/settings/auth_providers": [
+    "GET"
+  ]
+};
+function legacyGetSessionToken(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  return secure ?? regular;
+}
+__name(legacyGetSessionToken, "legacyGetSessionToken");
+function sessionCookiePresence(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
+  return {
+    hasSecureToken: Boolean(secure),
+    hasRegularToken: Boolean(regular),
+    hasChunkedToken: hasChunked,
+    resolved: Boolean(secure ?? regular ?? hasChunked)
+  };
+}
+__name(sessionCookiePresence, "sessionCookiePresence");
+function isPublicMethod(pathname, method, publicApiMethods) {
+  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
+    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;
+  }
+  return false;
+}
+__name(isPublicMethod, "isPublicMethod");
+async function hasValidSession(request, secret, legacyGetToken) {
+  const presence = sessionCookiePresence(request);
+  if (presence.resolved || presence.hasChunkedToken) return true;
+  if (request.req) {
+    try {
+      const { getToken } = await import('next-auth/jwt');
+      const token = await getToken({
+        req: request.req,
+        secret
+      });
+      if (token != null) return true;
+    } catch {
+    }
+  }
+  return Boolean(legacyGetToken(request));
+}
+__name(hasValidSession, "hasValidSession");
+function createCmsMiddleware(config = {}) {
+  const { publicAdminPaths = [
+    "/admin/signin",
+    "/admin/forgot-password",
+    "/admin/reset-password",
+    "/admin/invite"
+  ], publicApiMethods = defaultPublicApiMethods, signInPath = "/admin/signin", getSessionToken = legacyGetSessionToken, secret = process.env.NEXTAUTH_SECRET } = config;
+  return /* @__PURE__ */ __name(async function cmsMiddleware(request) {
+    const pathname = request.nextUrl.pathname;
+    const method = request.method;
+    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
+      return {
+        type: "next"
+      };
+    }
+    if (pathname.startsWith("/admin")) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      const cookies = sessionCookiePresence(request);
+      if (!authenticated) {
+        logAuth("middleware: admin redirect to signin (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...cookies,
+          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
+        });
+        return {
+          type: "redirect",
+          url: new URL(signInPath, request.url).toString()
+        };
+      }
+      logAuth("middleware: admin allowed", {
+        pathname,
+        method,
+        usesGetToken: Boolean(request.req),
+        ...cookies
+      });
+    }
+    if (pathname.startsWith("/api")) {
+      if (isPublicMethod(pathname, method, publicApiMethods)) {
+        return {
+          type: "next"
+        };
+      }
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      if (!authenticated) {
+        logAuth("middleware: api 401 (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...sessionCookiePresence(request)
+        });
+        return {
+          type: "json",
+          status: 401,
+          body: {
+            error: "Unauthorized"
+          }
+        };
+      }
+    }
+    return {
+      type: "next"
+    };
+  }, "cmsMiddleware");
+}
+__name(createCmsMiddleware, "createCmsMiddleware");
+
+export { createCmsMiddleware, defaultPublicApiMethods, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, summarizeSessionUserForLog };

package/dist/{emit-order-notification-trigger-6XX7LSC4.js → emit-order-notification-trigger-HZQPPSFB.js}

@@ -1,3 +1,3 @@
-export { emitOrderNotificationTrigger, fireOrderNotificationTrigger } from './chunk-JE22VP6S.js';
+export { emitOrderNotificationTrigger, fireOrderNotificationTrigger } from './chunk-MXIWUFBP.js';
 import './chunk-HCIRL37O.js';
 import './chunk-SHUYVCID.js';

package/dist/{emit-order-notification-trigger-NASG7ZEO.cjs → emit-order-notification-trigger-NR3VN6C6.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkKOTXDSQB_cjs = require('./chunk-KOTXDSQB.cjs');
+var chunkUQWZUZ5X_cjs = require('./chunk-UQWZUZ5X.cjs');
 require('./chunk-UCKN4BBY.cjs');
 require('./chunk-USNT2KNT.cjs');
 
@@ -8,9 +8,9 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "emitOrderNotificationTrigger", {
   enumerable: true,
-  get: function () { return chunkKOTXDSQB_cjs.emitOrderNotificationTrigger; }
+  get: function () { return chunkUQWZUZ5X_cjs.emitOrderNotificationTrigger; }
 });
 Object.defineProperty(exports, "fireOrderNotificationTrigger", {
   enumerable: true,
-  get: function () { return chunkKOTXDSQB_cjs.fireOrderNotificationTrigger; }
+  get: function () { return chunkUQWZUZ5X_cjs.fireOrderNotificationTrigger; }
 });