@infuro/cms-core 1.0.57 → 1.0.59

package/dist/{chunk-CMXNHMHP.cjs → chunk-MCCA7WLQ.cjs}

@@ -2,7 +2,7 @@
 
 var chunkXQ3QUHWR_cjs = require('./chunk-XQ3QUHWR.cjs');
 var chunkHY3AXLOI_cjs = require('./chunk-HY3AXLOI.cjs');
-var chunkJN4AFHZ4_cjs = require('./chunk-JN4AFHZ4.cjs');
+var chunkHXLC56ZK_cjs = require('./chunk-HXLC56ZK.cjs');
 var chunk7NMT3GBR_cjs = require('./chunk-7NMT3GBR.cjs');
 var chunkV25RDUOU_cjs = require('./chunk-V25RDUOU.cjs');
 var chunkBXYZDMTZ_cjs = require('./chunk-BXYZDMTZ.cjs');
@@ -1520,6 +1520,36 @@ async function validateLlmAgentScopeForWrite(dataSource, entityMap, scope, exclu
 chunkUSNT2KNT_cjs.__name(validateLlmAgentScopeForWrite, "validateLlmAgentScopeForWrite");
 
 // src/api/crud.ts
+async function autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order) {
+  if (!order || typeof order !== "object") return order;
+  const status = String(order.status ?? "").toLowerCase();
+  if (status !== "pending") return order;
+  const meta = typeof order.metadata === "object" && order.metadata ? order.metadata : {};
+  const expiresAtStr = meta.paymentExpiresAt ? String(meta.paymentExpiresAt) : null;
+  if (!expiresAtStr) return order;
+  const expiresMs = new Date(expiresAtStr).getTime();
+  if (Number.isNaN(expiresMs) || Date.now() <= expiresMs) return order;
+  try {
+    const orderId = Number(order.id);
+    if (orderId && entityMap.orders) {
+      const orderRepo = dataSource.getRepository(entityMap.orders);
+      const updatedMeta = {
+        ...meta,
+        cancelReason: "Payment window expired (10 minutes)"
+      };
+      await orderRepo.update(orderId, {
+        status: "cancelled",
+        metadata: updatedMeta
+      });
+      order.status = "cancelled";
+      order.metadata = updatedMeta;
+    }
+  } catch (err) {
+    console.error("[payment-expiry] Auto-cancelling expired order failed", err);
+  }
+  return order;
+}
+chunkUSNT2KNT_cjs.__name(autoExpireOrderIfPaymentTimeExceeded, "autoExpireOrderIfPaymentTimeExceeded");
 var CRUD_LOG = "[cms-crud]";
 function logCrudClientError(op, detail) {
   console.warn(CRUD_LOG, op, detail);
@@ -3564,6 +3594,12 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           const itemsSummary = parts.join(", ") || "\u2014";
           const { payments: _payments, ...orderWithoutPayments } = order;
+          const rawPayStatus = String(orderPayments[0]?.status ?? "unpaid").toLowerCase();
+          const orderStatus = String(order.status ?? "").toLowerCase();
+          let paymentStatus2 = rawPayStatus;
+          if (orderStatus === "cancelled" && rawPayStatus !== "paid" && rawPayStatus !== "captured" && rawPayStatus !== "refunded") {
+            paymentStatus2 = "unpaid";
+          }
           return {
             ...orderWithoutPayments,
             contact: contact ? {
@@ -3573,7 +3609,7 @@ function createCrudHandler(dataSource, entityMap, options) {
               phone: contact.phone
             } : null,
             itemsSummary,
-            paymentStatus: orderPayments[0]?.status ?? "unpaid"
+            paymentStatus: paymentStatus2
           };
         }));
         return json({
@@ -5458,6 +5494,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "payments"
           ]
         });
+        if (order) {
+          await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
+        }
         const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
         if (orderDenied) return orderDenied;
         const relatedOrders = await repo.find({
@@ -10798,7 +10837,7 @@ function createChatHandlers(config) {
         const notifyEmailAgent = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT, {
           enabledOnly: false
         });
-        const emailTool = chunkJN4AFHZ4_cjs.resolveChatEmailToolSettings(llmSettings, {
+        const emailTool = chunkHXLC56ZK_cjs.resolveChatEmailToolSettings(llmSettings, {
           chatbotValidationRules: agentRow?.validationRules ?? null,
           notifyAgent: notifyEmailAgent ? {
             systemInstruction: notifyEmailAgent.systemInstruction,
@@ -10808,7 +10847,7 @@ function createChatHandlers(config) {
         const emailPlugin2 = cms.getPlugin("email");
         const convLeadSent = conv.leadEmailSentAt;
         const chatAgentFn = llm.chatAgent?.bind(llm);
-        console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline check", {
+        console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline check", {
           conversationId,
           enabled: emailTool.enabled,
           intentCount: emailTool.intents.length,
@@ -10822,27 +10861,27 @@ function createChatHandlers(config) {
           mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
         });
         if (!emailTool.enabled) {
-          console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_tool_disabled"
           });
         } else if (emailTool.intents.length === 0) {
-          console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "no_intents_configured"
           });
         } else if (!emailPlugin2) {
-          console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_plugin_missing"
           });
         } else if (!chatAgentFn) {
-          console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "llm_chat_agent_unavailable"
           });
         } else if (convLeadSent) {
-          console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "lead_email_already_sent",
             leadEmailSentAt: convLeadSent
@@ -10855,7 +10894,7 @@ function createChatHandlers(config) {
             }
           });
           if (!contactRow) {
-            console.warn(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+            console.warn(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
               conversationId,
               reason: "contact_not_found",
               contactId
@@ -10863,7 +10902,7 @@ function createChatHandlers(config) {
           } else {
             const c = contactRow;
             try {
-              const intent = await chunkJN4AFHZ4_cjs.detectChatLeadIntent({
+              const intent = await chunkHXLC56ZK_cjs.detectChatLeadIntent({
                 chatAgent: chatAgentFn
               }, {
                 settings: emailTool,
@@ -10877,15 +10916,15 @@ function createChatHandlers(config) {
                 model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
               });
               if (!intent.intent || !intent.emailTo) {
-                console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "no email sent", {
+                console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "no email sent", {
                   conversationId,
                   reason: intent.intent ? "missing_email_to" : "no_intent_match",
                   intentLabel: intent.intentLabel,
                   classifierReason: intent.reason
                 });
               } else {
-                const intentRecipients = chunkJN4AFHZ4_cjs.parseIntentRecipientEmails(intent.emailTo);
-                console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                const intentRecipients = chunkHXLC56ZK_cjs.parseIntentRecipientEmails(intent.emailTo);
+                console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
                   conversationId,
                   intent: intent.intent,
                   emailTo: intent.emailTo,
@@ -10895,7 +10934,7 @@ function createChatHandlers(config) {
                 const emailSettings = await loadSettingsGroupMap(dataSource, entityMap, "email");
                 const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
                 const companyDetails = chunkBXYZDMTZ_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
-                const leadResult = await chunkJN4AFHZ4_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                const leadResult = await chunkHXLC56ZK_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
                   contactName: String(c.name ?? "").trim() || "Visitor",
                   contactEmail: String(c.email ?? "").trim(),
                   contactPhone: c.phone ?? null,
@@ -10903,7 +10942,7 @@ function createChatHandlers(config) {
                   latestMessage: message,
                   intentCode: intent.intent,
                   intentReason: intent.intentLabel || intent.reason,
-                  transcript: chunkJN4AFHZ4_cjs.buildTranscriptForLeadEmail(history, message),
+                  transcript: chunkHXLC56ZK_cjs.buildTranscriptForLeadEmail(history, message),
                   companyDetails,
                   recipients: intentRecipients.length > 0 ? intentRecipients : void 0
                 });
@@ -10911,13 +10950,13 @@ function createChatHandlers(config) {
                   await convRepo().update(conversationId, {
                     leadEmailSentAt: /* @__PURE__ */ new Date()
                   });
-                  console.info(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
+                  console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
                     conversationId,
                     sent: true,
                     recipients: leadResult.recipients
                   });
                 } else {
-                  console.warn(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
+                  console.warn(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
                     conversationId,
                     sent: false,
                     error: leadResult.error ?? "unknown",
@@ -10926,7 +10965,7 @@ function createChatHandlers(config) {
                 }
               }
             } catch (intentErr) {
-              console.warn(chunkJN4AFHZ4_cjs.CHAT_EMAIL_LOG, "pipeline error", {
+              console.warn(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline error", {
                 conversationId,
                 error: intentErr instanceof Error ? intentErr.message : String(intentErr)
               });
@@ -10943,7 +10982,7 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = chunkJN4AFHZ4_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
+          const systemPrompt = chunkHXLC56ZK_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
           const res = await llm.chatAgent({
             ...fromAgent,
             systemPrompt: systemPrompt || void 0,
@@ -10964,7 +11003,7 @@ ${contextParts.join("\n\n")}` : "";
               agentRow.systemInstruction?.trim(),
               ragSystem
             ].filter(Boolean).join("\n\n");
-            systemContent = chunkJN4AFHZ4_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
+            systemContent = chunkHXLC56ZK_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -12066,6 +12105,7 @@ exports.UserDeviceToken = class UserDeviceToken {
     chunkUSNT2KNT_cjs.__name(this, "UserDeviceToken");
   }
   id;
+  /** Staff/vendor app store. Null for customer/marketplace tokens (membership is `vendor_customers`). */
   vendorId;
   vendor;
   userId;
@@ -12086,13 +12126,15 @@ _ts_decorate2([
 _ts_decorate2([
   typeorm.Column({
     type: "integer",
-    name: "vendor_id"
+    name: "vendor_id",
+    nullable: true
   }),
-  _ts_metadata2("design:type", Number)
+  _ts_metadata2("design:type", Object)
 ], exports.UserDeviceToken.prototype, "vendorId", void 0);
 _ts_decorate2([
   typeorm.ManyToOne("Vendor", {
-    onDelete: "CASCADE"
+    onDelete: "CASCADE",
+    nullable: true
   }),
   typeorm.JoinColumn({
     name: "vendor_id"
@@ -12189,6 +12231,22 @@ exports.UserDeviceToken = _ts_decorate2([
 ], exports.UserDeviceToken);
 
 // src/api/device-tokens-handlers.ts
+function parseRequiredPositiveInt(value, field) {
+  const n = parseInt(String(value ?? "").trim(), 10);
+  if (!Number.isFinite(n) || n <= 0) {
+    return {
+      error: `${field} must be a positive integer`
+    };
+  }
+  return n;
+}
+chunkUSNT2KNT_cjs.__name(parseRequiredPositiveInt, "parseRequiredPositiveInt");
+function parseOptionalVendorId(value) {
+  if (value == null) return null;
+  if (typeof value === "string" && value.trim() === "") return null;
+  return parseRequiredPositiveInt(value, "vendor_id");
+}
+chunkUSNT2KNT_cjs.__name(parseOptionalVendorId, "parseOptionalVendorId");
 function createDeviceTokensHandlers(config) {
   const { dataSource, entityMap, json } = config;
   return /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async function handleDeviceTokensApi(req, pathSegments) {
@@ -12200,7 +12258,7 @@ function createDeviceTokensHandlers(config) {
         const title = body.title?.trim() || "Test Push Notification";
         const msgBody = body.body?.trim() || "Firebase Push Notification setup is working!";
         if (!token || token === "validate" || token === "validate_only") {
-          const valRes = await validateFcmCredentials(dataSource, entityMap);
+          const valRes = await chunkHXLC56ZK_cjs.validateFcmCredentials(dataSource, entityMap);
           if (!valRes.success) {
             return json({
               success: false,
@@ -12217,7 +12275,7 @@ function createDeviceTokensHandlers(config) {
             clientEmail: valRes.clientEmail
           });
         }
-        const res = await chunkJN4AFHZ4_cjs.sendFcmPushNotification(dataSource, entityMap, {
+        const res = await chunkHXLC56ZK_cjs.sendFcmPushNotification(dataSource, entityMap, {
           token,
           title,
           body: msgBody,
@@ -12260,18 +12318,28 @@ function createDeviceTokensHandlers(config) {
       if (method === "POST") {
         try {
           const body = await req.json().catch(() => ({}));
-          const vendorId = body.vendor_id?.trim();
-          const userId = body.user_id?.trim();
+          const vendorParsed = parseOptionalVendorId(body.vendor_id);
+          const userParsed = parseRequiredPositiveInt(body.user_id, "user_id");
           const token = body.token?.trim();
           const platformRaw = body.platform?.trim().toLowerCase();
-          if (!vendorId || !userId || !token || !platformRaw) {
+          if (vendorParsed !== null && typeof vendorParsed === "object") {
+            return json({
+              success: false,
+              error: vendorParsed.error
+            }, {
+              status: 400
+            });
+          }
+          if (typeof userParsed === "object" || !token || !platformRaw) {
             return json({
               success: false,
-              error: "vendor_id, user_id, token, and platform (android|ios) are required"
+              error: (typeof userParsed === "object" ? userParsed.error : null) || "user_id, token, and platform (android|ios) are required"
             }, {
               status: 400
             });
           }
+          const vendorId = vendorParsed;
+          const userId = userParsed;
           if (platformRaw !== "android" && platformRaw !== "ios") {
             return json({
               success: false,
@@ -12337,13 +12405,35 @@ function createDeviceTokensHandlers(config) {
       if (method === "GET") {
         try {
           const url = new URL(req.url);
-          const userId = url.searchParams.get("userId")?.trim();
-          const vendorId = url.searchParams.get("vendorId")?.trim();
+          const userIdRaw = url.searchParams.get("userId")?.trim();
+          const vendorIdRaw = url.searchParams.get("vendorId")?.trim();
           const whereCondition = {
             isActive: true
           };
-          if (userId) whereCondition.userId = userId;
-          if (vendorId) whereCondition.vendorId = vendorId;
+          if (userIdRaw) {
+            const userId = parseRequiredPositiveInt(userIdRaw, "userId");
+            if (typeof userId === "object") {
+              return json({
+                success: false,
+                error: userId.error
+              }, {
+                status: 400
+              });
+            }
+            whereCondition.userId = userId;
+          }
+          if (vendorIdRaw) {
+            const vendorId = parseRequiredPositiveInt(vendorIdRaw, "vendorId");
+            if (typeof vendorId === "object") {
+              return json({
+                success: false,
+                error: vendorId.error
+              }, {
+                status: 400
+              });
+            }
+            whereCondition.vendorId = vendorId;
+          }
           const tokens = await tokenRepo.find({
             where: whereCondition,
             order: {
@@ -12370,16 +12460,17 @@ function createDeviceTokensHandlers(config) {
       if (method === "DELETE") {
         try {
           const body = await req.json().catch(() => ({}));
-          const userId = body.user_id?.trim();
+          const userParsed = parseRequiredPositiveInt(body.user_id, "user_id");
           const token = body.token?.trim();
-          if (!userId || !token) {
+          if (typeof userParsed === "object" || !token) {
             return json({
               success: false,
-              error: "user_id and token are required to deactivate"
+              error: (typeof userParsed === "object" ? userParsed.error : null) || "user_id and token are required to deactivate"
             }, {
               status: 400
             });
           }
+          const userId = userParsed;
           await tokenRepo.update({
             userId,
             token
@@ -13179,7 +13270,7 @@ async function sendVendorOnboardEmails(input, deps) {
       getVendorEmails(deps)
     ]);
     const companyDetails = chunkBXYZDMTZ_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings);
-    const configuredNotify = chunkJN4AFHZ4_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
+    const configuredNotify = chunkHXLC56ZK_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const ownerEmail = input.ownerEmail?.trim() || "";
     const ownerEmailLower = ownerEmail.toLowerCase();
     const sendToOwner = input.sendToOwner !== false;
@@ -27748,16 +27839,16 @@ function whatsappPlugin(config = {}) {
         db = await getWhatsAppSettings?.() ?? {};
       } catch {
       }
-      if (!chunkJN4AFHZ4_cjs.isWhatsAppPluginEnabled(db)) {
+      if (!chunkHXLC56ZK_cjs.isWhatsAppPluginEnabled(db)) {
         context.logger.warn("WhatsApp plugin skipped: disabled in Plugins \u2192 WhatsApp");
         return null;
       }
-      const merged = chunkJN4AFHZ4_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
-      if (!getWhatsAppSettings && !chunkJN4AFHZ4_cjs.whatsAppConfigured(merged)) {
+      const merged = chunkHXLC56ZK_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
+      if (!getWhatsAppSettings && !chunkHXLC56ZK_cjs.whatsAppConfigured(merged)) {
         context.logger.warn("WhatsApp plugin skipped: set WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID, or pass getWhatsAppSettings");
         return null;
       }
-      const svc = new chunkJN4AFHZ4_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
+      const svc = new chunkHXLC56ZK_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
       return {
         send: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((opts) => svc.send(opts), "send")
       };
@@ -27834,7 +27925,7 @@ function registerMessagingQueueProcessors(cms, entityMap) {
     getDataSource: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => cms.dataSource, "getDataSource"),
     entityMap
   });
-  chunkJN4AFHZ4_cjs.registerWhatsAppQueueProcessor(cms);
+  chunkHXLC56ZK_cjs.registerWhatsAppQueueProcessor(cms);
 }
 chunkUSNT2KNT_cjs.__name(registerMessagingQueueProcessors, "registerMessagingQueueProcessors");
 async function ensureMessagingPluginsOnCms(base, options) {
@@ -27863,7 +27954,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
   }
   if (!cms.getPlugin("email")) {
     try {
-      const instance = await chunkJN4AFHZ4_cjs.emailPlugin({
+      const instance = await chunkHXLC56ZK_cjs.emailPlugin({
         type: "SMTP",
         from: config.SMTP_FROM ?? "no-reply@localhost",
         to: config.SMTP_TO ?? ""
@@ -27904,7 +27995,7 @@ function messagingPlugins(options) {
   const config = options.config ?? (typeof process !== "undefined" ? process.env : {});
   return [
     queuePlugin(),
-    chunkJN4AFHZ4_cjs.emailPlugin({
+    chunkHXLC56ZK_cjs.emailPlugin({
       type: "SMTP",
       from: config.SMTP_FROM ?? "no-reply@localhost",
       to: config.SMTP_TO ?? ""
@@ -28038,7 +28129,7 @@ function createCmsApiHandler(config) {
   } : void 0;
   const entityMap = withLlmKnowledgeEntityFallbacks(rawEntityMap);
   if (getCms) {
-    chunkJN4AFHZ4_cjs.initWhatsappTriggerDispatcher({
+    chunkHXLC56ZK_cjs.initWhatsappTriggerDispatcher({
       dataSource,
       entityMap,
       getCms
@@ -29801,7 +29892,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-YBAWDOIO.cjs');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-2FCZFZUD.cjs');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -32842,6 +32933,23 @@ function createStorefrontApiHandler(config) {
           });
           return json(body);
         }
+        if (path2[0] === "cart" && path2.length === 1 && method === "DELETE") {
+          const { cart, err } = await getOrCreateCart(req);
+          if (err) return err;
+          const cartId = cart?.id;
+          if (cartId && Number.isFinite(cartId) && cartId > 0) {
+            await cartItemRepo().delete({
+              cartId
+            });
+            await cartRepo().update(cartId, {
+              updatedAt: /* @__PURE__ */ new Date()
+            });
+          }
+          return json({
+            ok: true,
+            message: "Cart cleared"
+          });
+        }
         if (path2[0] === "cart" && path2[1] === "items" && path2.length === 2 && method === "POST") {
           const body = await req.json().catch(() => ({}));
           const capCart = await assertCaptchaOk(getCms, body, req, json);
@@ -33361,7 +33469,8 @@ function createStorefrontApiHandler(config) {
             total: prepOrd.orderTotal,
             currency: cart.currency || "INR",
             metadata: {
-              cartId
+              cartId,
+              paymentExpiresAt: new Date(Date.now() + 10 * 60 * 1e3).toISOString()
             }
           }));
           const oid = ord.id;
@@ -33434,7 +33543,11 @@ function createStorefrontApiHandler(config) {
             tax: prepChk.orderTax,
             discount: 0,
             total: prepChk.orderTotal,
-            currency: cart.currency || "INR"
+            currency: cart.currency || "INR",
+            metadata: {
+              cartId: cart.id,
+              paymentExpiresAt: new Date(Date.now() + 10 * 60 * 1e3).toISOString()
+            }
           }));
           const oid = ord.id;
           await orderRepo().update(oid, {
@@ -33680,6 +33793,7 @@ function createStorefrontApiHandler(config) {
             status: 404
           });
           const o = order;
+          await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, o);
           const lines = (o.items || []).map((line) => {
             const p = line.product;
             return {
@@ -33740,6 +33854,73 @@ function createStorefrontApiHandler(config) {
             fulfillmentPreview: fulfillmentPreview || void 0
           });
         }
+        if (path2[0] === "orders" && path2.length === 3 && path2[2] === "cancel" && method === "POST") {
+          const orderId = parseInt(path2[1], 10);
+          if (!Number.isFinite(orderId)) return json({
+            error: "Invalid order id"
+          }, {
+            status: 400
+          });
+          const order = await orderRepo().findOne({
+            where: {
+              id: orderId,
+              deleted: false
+            }
+          });
+          if (!order) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
+          const o = order;
+          const status = String(o.status || "").toLowerCase();
+          if (status === "pending") {
+            const meta = typeof o.metadata === "object" && o.metadata ? o.metadata : {};
+            const updatedMeta = {
+              ...meta,
+              cancelReason: "Cancelled by user during payment window"
+            };
+            await orderRepo().update(orderId, {
+              status: "cancelled",
+              metadata: updatedMeta
+            });
+            try {
+              if (entityMap.payments) {
+                const payRepo = dataSource.getRepository(entityMap.payments);
+                const pendingPayment = await payRepo.findOne({
+                  where: {
+                    orderId,
+                    status: "pending"
+                  }
+                });
+                if (pendingPayment) {
+                  await payRepo.update(pendingPayment.id, {
+                    status: "unpaid"
+                  });
+                }
+              }
+            } catch {
+            }
+            try {
+              const { cart } = await getOrCreateCart(req);
+              const cartId = cart?.id;
+              if (cartId && Number.isFinite(cartId) && cartId > 0) {
+                await cartItemRepo().delete({
+                  cartId
+                });
+                await cartRepo().update(cartId, {
+                  updatedAt: /* @__PURE__ */ new Date()
+                });
+              }
+            } catch {
+            }
+          }
+          return json({
+            ok: true,
+            orderId,
+            status: "cancelled"
+          });
+        }
         return json({
           error: "Not found"
         }, {
@@ -33779,6 +33960,7 @@ exports.assertCaptchaOk = assertCaptchaOk;
 exports.assertContactAllowedForVendorOrder = assertContactAllowedForVendorOrder;
 exports.assertEventApprovalUpdate = assertEventApprovalUpdate;
 exports.assertProductApprovalUpdate = assertProductApprovalUpdate;
+exports.autoExpireOrderIfPaymentTimeExceeded = autoExpireOrderIfPaymentTimeExceeded;
 exports.buildBlogMetadataUserPrompt = buildBlogMetadataUserPrompt;
 exports.buildCronFromSchedule = buildCronFromSchedule;
 exports.buildRssUserPromptFromFeeds = buildRssUserPromptFromFeeds;