@infuro/cms-core 1.0.58 → 1.0.60

package/dist/{chunk-BHUEXLD2.cjs → chunk-BSLNXKV2.cjs}

@@ -2,16 +2,16 @@
 
 var chunkXQ3QUHWR_cjs = require('./chunk-XQ3QUHWR.cjs');
 var chunkHY3AXLOI_cjs = require('./chunk-HY3AXLOI.cjs');
-var chunkHXLC56ZK_cjs = require('./chunk-HXLC56ZK.cjs');
+var chunkYSYX4GUD_cjs = require('./chunk-YSYX4GUD.cjs');
 var chunk7NMT3GBR_cjs = require('./chunk-7NMT3GBR.cjs');
 var chunkV25RDUOU_cjs = require('./chunk-V25RDUOU.cjs');
 var chunkBXYZDMTZ_cjs = require('./chunk-BXYZDMTZ.cjs');
 var chunkUPLVMVRX_cjs = require('./chunk-UPLVMVRX.cjs');
 var chunk3DZRIZOD_cjs = require('./chunk-3DZRIZOD.cjs');
 var chunkTJ2MIQUT_cjs = require('./chunk-TJ2MIQUT.cjs');
-var chunk3EOM4V2M_cjs = require('./chunk-3EOM4V2M.cjs');
+var chunk4U6DATGZ_cjs = require('./chunk-4U6DATGZ.cjs');
 var chunkOY2YTBMP_cjs = require('./chunk-OY2YTBMP.cjs');
-var chunk77NUXO6A_cjs = require('./chunk-77NUXO6A.cjs');
+var chunkJ7FMZK66_cjs = require('./chunk-J7FMZK66.cjs');
 var chunkD5FBNKQM_cjs = require('./chunk-D5FBNKQM.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 var typeorm = require('typeorm');
@@ -120,7 +120,7 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
         `, [
         primary.vendorRoleId
       ]);
-      vendorEntityPerms = chunk77NUXO6A_cjs.permissionRowsToRecord(permRows);
+      vendorEntityPerms = chunkJ7FMZK66_cjs.permissionRowsToRecord(permRows);
     } catch (err) {
       if (!isMissingVendorRoleSchemaError(err)) throw err;
     }
@@ -227,7 +227,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     ]);
     const resolvedId = Number(byEmailRows[0]?.id);
     if (!Number.isFinite(resolvedId)) {
-      chunk77NUXO6A_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
+      chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
         email: user.email,
         rawSessionId: user.id ?? null
       });
@@ -247,7 +247,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   const groupName = rows[0]?.groupName ?? user.groupName ?? null;
   const groupId = rows[0]?.groupId ?? user.groupId ?? void 0;
   const adminAccess = rows[0]?.adminAccess ?? user.adminAccess;
-  const isRBACAdmin = user.isRBACAdmin ?? chunk77NUXO6A_cjs.isSuperAdmin({
+  const isRBACAdmin = user.isRBACAdmin ?? chunkJ7FMZK66_cjs.isSuperAdmin({
     groupId,
     groupName,
     isRBACAdmin: user.isRBACAdmin
@@ -260,7 +260,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   };
   if (multiVendorEnabled) {
     ctx = await loadUserVendorContext(dataSource, id, user.activeVendorId);
-    flags = chunk77NUXO6A_cjs.vendorPortalFlagsFromUser({
+    flags = chunkJ7FMZK66_cjs.vendorPortalFlagsFromUser({
       email: user.email,
       isRBACAdmin,
       groupName,
@@ -295,7 +295,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     isVendorPortal: flags.isVendorPortal,
     isVendorOwner: flags.isVendorOwner
   };
-  chunk77NUXO6A_cjs.logRbac("hydrateVendorSessionUser", {
+  chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser", {
     email: user.email,
     userId: id,
     groupName,
@@ -908,7 +908,7 @@ function repoHasVendorIdColumn(repo) {
 }
 chunkUSNT2KNT_cjs.__name(repoHasVendorIdColumn, "repoHasVendorIdColumn");
 function resourceUsesVendorScope(resource) {
-  return resource === "vendors" || chunk77NUXO6A_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
+  return resource === "vendors" || chunkJ7FMZK66_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 chunkUSNT2KNT_cjs.__name(resourceUsesVendorScope, "resourceUsesVendorScope");
 function mergeWhereClause(where, extra) {
@@ -1398,7 +1398,7 @@ async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, c
   }
   let customerId = null;
   if (entityMap.customer) {
-    const ensured = await chunk3EOM4V2M_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
+    const ensured = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
       name,
       email,
       phone,
@@ -1520,6 +1520,36 @@ async function validateLlmAgentScopeForWrite(dataSource, entityMap, scope, exclu
 chunkUSNT2KNT_cjs.__name(validateLlmAgentScopeForWrite, "validateLlmAgentScopeForWrite");
 
 // src/api/crud.ts
+async function autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order) {
+  if (!order || typeof order !== "object") return order;
+  const status = String(order.status ?? "").toLowerCase();
+  if (status !== "pending") return order;
+  const meta = typeof order.metadata === "object" && order.metadata ? order.metadata : {};
+  const expiresAtStr = meta.paymentExpiresAt ? String(meta.paymentExpiresAt) : null;
+  if (!expiresAtStr) return order;
+  const expiresMs = new Date(expiresAtStr).getTime();
+  if (Number.isNaN(expiresMs) || Date.now() <= expiresMs) return order;
+  try {
+    const orderId = Number(order.id);
+    if (orderId && entityMap.orders) {
+      const orderRepo = dataSource.getRepository(entityMap.orders);
+      const updatedMeta = {
+        ...meta,
+        cancelReason: "Payment window expired (10 minutes)"
+      };
+      await orderRepo.update(orderId, {
+        status: "cancelled",
+        metadata: updatedMeta
+      });
+      order.status = "cancelled";
+      order.metadata = updatedMeta;
+    }
+  } catch (err) {
+    console.error("[payment-expiry] Auto-cancelling expired order failed", err);
+  }
+  return order;
+}
+chunkUSNT2KNT_cjs.__name(autoExpireOrderIfPaymentTimeExceeded, "autoExpireOrderIfPaymentTimeExceeded");
 var CRUD_LOG = "[cms-crud]";
 function logCrudClientError(op, detail) {
   console.warn(CRUD_LOG, op, detail);
@@ -2424,13 +2454,46 @@ function discountCompare(cartValue, op, ruleValue) {
   }
 }
 chunkUSNT2KNT_cjs.__name(discountCompare, "discountCompare");
-function discountEvaluateRule(rule, cartLines, cartTotal) {
-  if (rule.conditionType === "group") return discountEvaluateGroup(rule, cartLines, cartTotal);
+async function getExchangeRate(dataSource, entityMap, fromCurrency, toCurrency) {
+  const from = (fromCurrency || "INR").trim().toUpperCase();
+  const to = (toCurrency || "INR").trim().toUpperCase();
+  if (from === to) return 1;
+  if (entityMap["currency_exchange"]) {
+    try {
+      const exchangeRepo = dataSource.getRepository(entityMap["currency_exchange"]);
+      const direct = await exchangeRepo.findOne({
+        where: {
+          fromCurrency: from,
+          toCurrency: to
+        }
+      });
+      if (direct && Number(direct.rate) > 0) {
+        return Number(direct.rate);
+      }
+      const inverse = await exchangeRepo.findOne({
+        where: {
+          fromCurrency: to,
+          toCurrency: from
+        }
+      });
+      if (inverse && Number(inverse.rate) > 0) {
+        return 1 / Number(inverse.rate);
+      }
+    } catch {
+    }
+  }
+  return 1;
+}
+chunkUSNT2KNT_cjs.__name(getExchangeRate, "getExchangeRate");
+function discountEvaluateRule(rule, cartLines, cartTotal, exchangeRate = 1) {
+  if (rule.conditionType === "group") return discountEvaluateGroup(rule, cartLines, cartTotal, exchangeRate);
   if (rule.type === "reward") return true;
-  const ruleValue = discountExtractValue(rule.value);
+  const rawRuleValue = discountExtractValue(rule.value);
   switch (rule.type) {
-    case "minAmount":
-      return discountCompare(cartTotal, rule.comparisonOperator, ruleValue);
+    case "minAmount": {
+      const convertedValue = typeof rawRuleValue === "number" ? rawRuleValue * exchangeRate : !isNaN(Number(rawRuleValue)) ? Number(rawRuleValue) * exchangeRate : rawRuleValue;
+      return discountCompare(cartTotal, rule.comparisonOperator, convertedValue);
+    }
     case "quantity": {
       if (rule.subType === "productId" && rule.value?.productId) {
         const targetProductId = Number(rule.value.productId);
@@ -2439,11 +2502,11 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
         return discountCompare(productQty, rule.comparisonOperator, requiredQty);
       }
       const totalQty = cartLines.reduce((s, l) => s + l.quantity, 0);
-      return discountCompare(totalQty, rule.comparisonOperator, ruleValue);
+      return discountCompare(totalQty, rule.comparisonOperator, rawRuleValue);
     }
     case "product":
       if (rule.subType === "productId") {
-        return cartLines.some((l) => discountCompare(l.productId, rule.comparisonOperator, ruleValue));
+        return cartLines.some((l) => discountCompare(l.productId, rule.comparisonOperator, rawRuleValue));
       }
       return false;
     // These require external context (user session, payment method, time) —
@@ -2467,11 +2530,11 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
   }
 }
 chunkUSNT2KNT_cjs.__name(discountEvaluateRule, "discountEvaluateRule");
-function discountEvaluateGroup(group, cartLines, cartTotal) {
+function discountEvaluateGroup(group, cartLines, cartTotal, exchangeRate = 1) {
   if (!group.children?.length) return true;
   const op = (group.conditionOperator ?? "and").toLowerCase();
-  if (op === "and") return group.children.every((child) => discountEvaluateRule(child, cartLines, cartTotal));
-  if (op === "or") return group.children.some((child) => discountEvaluateRule(child, cartLines, cartTotal));
+  if (op === "and") return group.children.every((child) => discountEvaluateRule(child, cartLines, cartTotal, exchangeRate));
+  if (op === "or") return group.children.some((child) => discountEvaluateRule(child, cartLines, cartTotal, exchangeRate));
   return true;
 }
 chunkUSNT2KNT_cjs.__name(discountEvaluateGroup, "discountEvaluateGroup");
@@ -2518,19 +2581,19 @@ function discountExtractBuyProductId(nodes) {
   return null;
 }
 chunkUSNT2KNT_cjs.__name(discountExtractBuyProductId, "discountExtractBuyProductId");
-function discountBuildUniversalResult(discount, cartLines) {
+function discountBuildUniversalResult(discount, cartLines, effectiveValue) {
   return {
     rewardLines: cartLines.map((l) => ({
       productId: l.productId,
       quantity: l.quantity,
-      discountRate: Number(discount.value),
+      discountRate: effectiveValue,
       discountType: discount.discountType
     })),
     conditionsMet: true
   };
 }
 chunkUSNT2KNT_cjs.__name(discountBuildUniversalResult, "discountBuildUniversalResult");
-function evaluateDiscount(discount, cartLines) {
+function evaluateDiscount(discount, cartLines, exchangeRate = 1) {
   const empty = {
     rewardLines: [],
     conditionsMet: false
@@ -2554,16 +2617,17 @@ function evaluateDiscount(discount, cartLines) {
       reason: "discount usage limit reached"
     };
   }
+  const effectiveValue = discount.discountType === "FLAT" ? Number(discount.value) * exchangeRate : Number(discount.value);
   const cartTotal = cartLines.reduce((s, l) => s + l.subtotal, 0);
   const tree = discountBuildTree(discount.rules ?? []);
-  if (tree.length === 0) return discountBuildUniversalResult(discount, cartLines);
-  const conditionsMet = tree.every((node) => discountEvaluateRule(node, cartLines, cartTotal));
+  if (tree.length === 0) return discountBuildUniversalResult(discount, cartLines, effectiveValue);
+  const conditionsMet = tree.every((node) => discountEvaluateRule(node, cartLines, cartTotal, exchangeRate));
   if (!conditionsMet) return {
     ...empty,
     reason: "conditions not met"
   };
   const rewardRules = discountCollectRewardRules(tree);
-  if (rewardRules.length === 0) return discountBuildUniversalResult(discount, cartLines);
+  if (rewardRules.length === 0) return discountBuildUniversalResult(discount, cartLines, effectiveValue);
   const requiredBuyQty = discountExtractRequiredBuyQty(tree);
   const buyProductId = discountExtractBuyProductId(tree);
   let dealMultiplier = 1;
@@ -2581,7 +2645,7 @@ function evaluateDiscount(discount, cartLines) {
       rewardLines.push({
         productId: rewardProductId,
         quantity: dealMultiplier,
-        discountRate: Number(discount.value),
+        discountRate: effectiveValue,
         discountType: discount.discountType
       });
     } else {
@@ -2590,7 +2654,7 @@ function evaluateDiscount(discount, cartLines) {
       rewardLines.push({
         productId: rewardProductId,
         quantity: rewardQty,
-        discountRate: Number(discount.value),
+        discountRate: effectiveValue,
         discountType: discount.discountType
       });
     }
@@ -2601,8 +2665,9 @@ function evaluateDiscount(discount, cartLines) {
   };
 }
 chunkUSNT2KNT_cjs.__name(evaluateDiscount, "evaluateDiscount");
-function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
+function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount, exchangeRate = 1) {
   if (!evalResult.conditionsMet || evalResult.rewardLines.length === 0) return 0;
+  const effectiveMaxDiscountAmount = maxDiscountAmount != null ? Number(maxDiscountAmount) * exchangeRate : null;
   let totalDiscountApplied = 0;
   for (const reward of evalResult.rewardLines) {
     const line = lines.find((l) => l.productId === reward.productId);
@@ -2619,8 +2684,8 @@ function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
     line.subtotal = line.unitPrice * line.quantity;
     line.total = Math.max(0, line.subtotal - (line.discount ?? 0));
   }
-  if (maxDiscountAmount != null && totalDiscountApplied > maxDiscountAmount) {
-    const excess = totalDiscountApplied - maxDiscountAmount;
+  if (effectiveMaxDiscountAmount != null && totalDiscountApplied > effectiveMaxDiscountAmount) {
+    const excess = totalDiscountApplied - effectiveMaxDiscountAmount;
     for (let i = evalResult.rewardLines.length - 1; i >= 0; i--) {
       const reward = evalResult.rewardLines[i];
       const line = lines.find((l) => l.productId === reward.productId);
@@ -2630,7 +2695,7 @@ function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
       line.total = Math.max(0, line.total + rollback);
       if (rollback > 0) break;
     }
-    totalDiscountApplied = maxDiscountAmount;
+    totalDiscountApplied = effectiveMaxDiscountAmount;
   }
   return totalDiscountApplied;
 }
@@ -2736,7 +2801,9 @@ async function validateCoupon(dataSource, entityMap, couponCode, orderLines, cur
     unitPrice: l.unitPrice,
     subtotal: l.subtotal
   }));
-  const evalResult = evaluateDiscount(discountForEval, cartLines);
+  const dCurrency = d.currency || "INR";
+  const exchangeRate = await getExchangeRate(dataSource, entityMap, dCurrency, currency);
+  const evalResult = evaluateDiscount(discountForEval, cartLines, exchangeRate);
   if (!evalResult.conditionsMet) {
     return {
       valid: false,
@@ -2746,7 +2813,7 @@ async function validateCoupon(dataSource, entityMap, couponCode, orderLines, cur
   const clonedLines = lines.map((l) => ({
     ...l
   }));
-  const calculatedDiscount = applyDiscountToOrderLines(clonedLines, evalResult, d.maxDiscountAmount);
+  const calculatedDiscount = applyDiscountToOrderLines(clonedLines, evalResult, d.maxDiscountAmount, exchangeRate);
   const rewardProductIds = evalResult.rewardLines.map((r) => r.productId);
   return {
     valid: true,
@@ -3031,9 +3098,11 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
             unitPrice: l.unitPrice,
             subtotal: l.subtotal
           }));
-          const evalResult = evaluateDiscount(discountForEval, cartLines);
+          const dCurrency = discountRow.currency || "INR";
+          const exchangeRate2 = await getExchangeRate(dataSource, entityMap, dCurrency, currency);
+          const evalResult = evaluateDiscount(discountForEval, cartLines, exchangeRate2);
           if (evalResult.conditionsMet) {
-            const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
+            const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount, exchangeRate2);
             orderDiscount += totalDiscountApplied;
           }
         }
@@ -3146,9 +3215,25 @@ async function calculateOrderTotals(dataSource, entityMap, itemsSummary, discoun
           unitPrice: l.unitPrice,
           subtotal: l.subtotal
         }));
-        const evalResult = evaluateDiscount(discountForEval, cartLines);
+        const dCurrency = discountRow.currency || "INR";
+        let storeCurrency = "INR";
+        if (entityMap["configs"]) {
+          try {
+            const configRepo = dataSource.getRepository(entityMap["configs"]);
+            const curr = await configRepo.findOne({
+              where: {
+                settings: "store",
+                key: "currency"
+              }
+            });
+            storeCurrency = curr?.value?.toUpperCase() ?? "INR";
+          } catch {
+          }
+        }
+        const exchangeRate = await getExchangeRate(dataSource, entityMap, dCurrency, storeCurrency);
+        const evalResult = evaluateDiscount(discountForEval, cartLines, exchangeRate);
         if (evalResult.conditionsMet) {
-          const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
+          const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount, exchangeRate);
           for (const line of lines) {
             if (!line.found || line.taxRate === 0) continue;
             const discountedAmount = line.subtotal - (line.discount ?? 0);
@@ -3564,6 +3649,12 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           const itemsSummary = parts.join(", ") || "\u2014";
           const { payments: _payments, ...orderWithoutPayments } = order;
+          const rawPayStatus = String(orderPayments[0]?.status ?? "unpaid").toLowerCase();
+          const orderStatus = String(order.status ?? "").toLowerCase();
+          let paymentStatus2 = rawPayStatus;
+          if (orderStatus === "cancelled" && rawPayStatus !== "paid" && rawPayStatus !== "captured" && rawPayStatus !== "refunded") {
+            paymentStatus2 = "unpaid";
+          }
           return {
             ...orderWithoutPayments,
             contact: contact ? {
@@ -3573,7 +3664,7 @@ function createCrudHandler(dataSource, entityMap, options) {
               phone: contact.phone
             } : null,
             itemsSummary,
-            paymentStatus: orderPayments[0]?.status ?? "unpaid"
+            paymentStatus: paymentStatus2
           };
         }));
         return json({
@@ -4312,7 +4403,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const savedCustomer = await chunk3EOM4V2M_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
+        const savedCustomer = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
           phone,
@@ -5091,11 +5182,18 @@ function createCrudHandler(dataSource, entityMap, options) {
             await recordDiscountUsage2(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
           }
           const orderIdForNotify = created.id;
-          void import('./emit-order-notification-trigger-NR3VN6C6.cjs').then(({ fireOrderNotificationTrigger }) => {
+          const initialPayStatus = String(persistBody.paymentStatus ?? "unpaid").toLowerCase();
+          void import('./emit-order-notification-trigger-TNEZOYEE.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_placed", orderIdForNotify, {
               dataSource,
               entityMap
             });
+            if (initialPayStatus === "paid" || initialPayStatus === "captured") {
+              fireOrderNotificationTrigger("payment_success", orderIdForNotify, {
+                dataSource,
+                entityMap
+              });
+            }
           });
         }
       } catch (err) {
@@ -5458,6 +5556,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "payments"
           ]
         });
+        if (order) {
+          await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
+        }
         const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
         if (orderDenied) return orderDenied;
         const relatedOrders = await repo.find({
@@ -6559,6 +6660,43 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         await retireSoftDeletedUniquesFromBody(repo, updatePayload);
         try {
           await repo.update(numericId, updatePayload);
+          if (resource === "payments" && updatePayload.status) {
+            const updatedPay = await repo.findOne({
+              where: {
+                id: numericId
+              }
+            });
+            const pOrder = updatedPay?.orderId;
+            const newPayStatus = String(updatePayload.status).toLowerCase();
+            if (pOrder && Number.isFinite(pOrder)) {
+              if (newPayStatus === "paid" || newPayStatus === "captured") {
+                if (entityMap.orders) {
+                  await dataSource.getRepository(entityMap.orders).update(pOrder, {
+                    status: "confirmed"
+                  });
+                }
+                void import('./emit-order-notification-trigger-TNEZOYEE.cjs').then(({ fireOrderNotificationTrigger }) => {
+                  fireOrderNotificationTrigger("order_placed", pOrder, {
+                    dataSource,
+                    entityMap
+                  });
+                  fireOrderNotificationTrigger("payment_success", pOrder, {
+                    dataSource,
+                    entityMap
+                  });
+                }).catch(() => {
+                });
+              } else if (newPayStatus === "failed") {
+                void import('./emit-order-notification-trigger-TNEZOYEE.cjs').then(({ fireOrderNotificationTrigger }) => {
+                  fireOrderNotificationTrigger("payment_failed", pOrder, {
+                    dataSource,
+                    entityMap
+                  });
+                }).catch(() => {
+                });
+              }
+            }
+          }
         } catch (err) {
           if (resource === "events" && isSlugUniqueViolation(err)) {
             return json({
@@ -7242,7 +7380,7 @@ function createInviteAcceptHandler(config) {
       }
       const { userId, email, vendorId } = validation.target;
       if (entityMap.contacts) {
-        await chunk3EOM4V2M_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+        await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
@@ -8335,7 +8473,7 @@ function createVendorDashboardHandler(config) {
       if (pe) return pe;
     }
     const user = await getSessionUser();
-    if (!user || !chunk77NUXO6A_cjs.isVendorPortalUser(user)) {
+    if (!user || !chunkJ7FMZK66_cjs.isVendorPortalUser(user)) {
       return json({
         error: "Forbidden"
       }, {
@@ -9113,7 +9251,9 @@ function createFormSaveHandlers(config) {
           "description",
           "campaign",
           "slug",
-          "published"
+          "published",
+          "enableTurnstile",
+          "enable_turnstile"
         ]) {
           if (body[key] !== void 0) formRow[key] = body[key];
         }
@@ -9704,11 +9844,11 @@ function createUsersApiHandlers(config) {
           adminAccess
         }));
         if (entityMap.contacts) {
-          await chunk3EOM4V2M_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
+          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
         }
         if (entityMap.customer) {
           const phone = typeof body.phone === "string" && body.phone.trim() ? body.phone.trim() : null;
-          await chunk3EOM4V2M_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+          await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
             id: newUser.id,
             name: String(newUser.name ?? body.name),
             email: String(newUser.email),
@@ -10798,7 +10938,7 @@ function createChatHandlers(config) {
         const notifyEmailAgent = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT, {
           enabledOnly: false
         });
-        const emailTool = chunkHXLC56ZK_cjs.resolveChatEmailToolSettings(llmSettings, {
+        const emailTool = chunkYSYX4GUD_cjs.resolveChatEmailToolSettings(llmSettings, {
           chatbotValidationRules: agentRow?.validationRules ?? null,
           notifyAgent: notifyEmailAgent ? {
             systemInstruction: notifyEmailAgent.systemInstruction,
@@ -10808,7 +10948,7 @@ function createChatHandlers(config) {
         const emailPlugin2 = cms.getPlugin("email");
         const convLeadSent = conv.leadEmailSentAt;
         const chatAgentFn = llm.chatAgent?.bind(llm);
-        console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline check", {
+        console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline check", {
           conversationId,
           enabled: emailTool.enabled,
           intentCount: emailTool.intents.length,
@@ -10822,27 +10962,27 @@ function createChatHandlers(config) {
           mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
         });
         if (!emailTool.enabled) {
-          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_tool_disabled"
           });
         } else if (emailTool.intents.length === 0) {
-          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "no_intents_configured"
           });
         } else if (!emailPlugin2) {
-          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_plugin_missing"
           });
         } else if (!chatAgentFn) {
-          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "llm_chat_agent_unavailable"
           });
         } else if (convLeadSent) {
-          console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "lead_email_already_sent",
             leadEmailSentAt: convLeadSent
@@ -10855,7 +10995,7 @@ function createChatHandlers(config) {
             }
           });
           if (!contactRow) {
-            console.warn(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+            console.warn(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
               conversationId,
               reason: "contact_not_found",
               contactId
@@ -10863,7 +11003,7 @@ function createChatHandlers(config) {
           } else {
             const c = contactRow;
             try {
-              const intent = await chunkHXLC56ZK_cjs.detectChatLeadIntent({
+              const intent = await chunkYSYX4GUD_cjs.detectChatLeadIntent({
                 chatAgent: chatAgentFn
               }, {
                 settings: emailTool,
@@ -10877,15 +11017,15 @@ function createChatHandlers(config) {
                 model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
               });
               if (!intent.intent || !intent.emailTo) {
-                console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "no email sent", {
+                console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "no email sent", {
                   conversationId,
                   reason: intent.intent ? "missing_email_to" : "no_intent_match",
                   intentLabel: intent.intentLabel,
                   classifierReason: intent.reason
                 });
               } else {
-                const intentRecipients = chunkHXLC56ZK_cjs.parseIntentRecipientEmails(intent.emailTo);
-                console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                const intentRecipients = chunkYSYX4GUD_cjs.parseIntentRecipientEmails(intent.emailTo);
+                console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
                   conversationId,
                   intent: intent.intent,
                   emailTo: intent.emailTo,
@@ -10895,7 +11035,7 @@ function createChatHandlers(config) {
                 const emailSettings = await loadSettingsGroupMap(dataSource, entityMap, "email");
                 const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
                 const companyDetails = chunkBXYZDMTZ_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings);
-                const leadResult = await chunkHXLC56ZK_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                const leadResult = await chunkYSYX4GUD_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
                   contactName: String(c.name ?? "").trim() || "Visitor",
                   contactEmail: String(c.email ?? "").trim(),
                   contactPhone: c.phone ?? null,
@@ -10903,7 +11043,7 @@ function createChatHandlers(config) {
                   latestMessage: message,
                   intentCode: intent.intent,
                   intentReason: intent.intentLabel || intent.reason,
-                  transcript: chunkHXLC56ZK_cjs.buildTranscriptForLeadEmail(history, message),
+                  transcript: chunkYSYX4GUD_cjs.buildTranscriptForLeadEmail(history, message),
                   companyDetails,
                   recipients: intentRecipients.length > 0 ? intentRecipients : void 0
                 });
@@ -10911,13 +11051,13 @@ function createChatHandlers(config) {
                   await convRepo().update(conversationId, {
                     leadEmailSentAt: /* @__PURE__ */ new Date()
                   });
-                  console.info(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
+                  console.info(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
                     conversationId,
                     sent: true,
                     recipients: leadResult.recipients
                   });
                 } else {
-                  console.warn(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
+                  console.warn(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
                     conversationId,
                     sent: false,
                     error: leadResult.error ?? "unknown",
@@ -10926,7 +11066,7 @@ function createChatHandlers(config) {
                 }
               }
             } catch (intentErr) {
-              console.warn(chunkHXLC56ZK_cjs.CHAT_EMAIL_LOG, "pipeline error", {
+              console.warn(chunkYSYX4GUD_cjs.CHAT_EMAIL_LOG, "pipeline error", {
                 conversationId,
                 error: intentErr instanceof Error ? intentErr.message : String(intentErr)
               });
@@ -10943,7 +11083,7 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = chunkHXLC56ZK_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
+          const systemPrompt = chunkYSYX4GUD_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
           const res = await llm.chatAgent({
             ...fromAgent,
             systemPrompt: systemPrompt || void 0,
@@ -10964,7 +11104,7 @@ ${contextParts.join("\n\n")}` : "";
               agentRow.systemInstruction?.trim(),
               ragSystem
             ].filter(Boolean).join("\n\n");
-            systemContent = chunkHXLC56ZK_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
+            systemContent = chunkYSYX4GUD_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -12219,7 +12359,7 @@ function createDeviceTokensHandlers(config) {
         const title = body.title?.trim() || "Test Push Notification";
         const msgBody = body.body?.trim() || "Firebase Push Notification setup is working!";
         if (!token || token === "validate" || token === "validate_only") {
-          const valRes = await chunkHXLC56ZK_cjs.validateFcmCredentials(dataSource, entityMap);
+          const valRes = await chunkYSYX4GUD_cjs.validateFcmCredentials(dataSource, entityMap);
           if (!valRes.success) {
             return json({
               success: false,
@@ -12236,7 +12376,7 @@ function createDeviceTokensHandlers(config) {
             clientEmail: valRes.clientEmail
           });
         }
-        const res = await chunkHXLC56ZK_cjs.sendFcmPushNotification(dataSource, entityMap, {
+        const res = await chunkYSYX4GUD_cjs.sendFcmPushNotification(dataSource, entityMap, {
           token,
           title,
           body: msgBody,
@@ -12790,7 +12930,7 @@ chunkUSNT2KNT_cjs.__name(findActiveRefundPolicyForVendor, "findActiveRefundPolic
 // src/api/admin-roles-handlers.ts
 function createAdminRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
-  const baseEntities = chunk77NUXO6A_cjs.getPermissionableEntityKeys(entityMap);
+  const baseEntities = chunkJ7FMZK66_cjs.getPermissionableEntityKeys(entityMap);
   const allowEntities = /* @__PURE__ */ new Set([
     ...baseEntities,
     "users"
@@ -12805,7 +12945,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk3EOM4V2M_cjs.canManageRoles(u) && !chunk77NUXO6A_cjs.canManageVendorRoles(u)) {
+    if (!chunk4U6DATGZ_cjs.canManageRoles(u) && !chunkJ7FMZK66_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -12816,11 +12956,11 @@ function createAdminRolesHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunk77NUXO6A_cjs.canManageVendorRoles(u) && !chunk3EOM4V2M_cjs.canManageRoles(u);
+    return chunkJ7FMZK66_cjs.canManageVendorRoles(u) && !chunk4U6DATGZ_cjs.canManageRoles(u);
   }
   chunkUSNT2KNT_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
-    ...chunk77NUXO6A_cjs.VENDOR_STORE_RBAC_ENTITIES,
+    ...chunkJ7FMZK66_cjs.VENDOR_STORE_RBAC_ENTITIES,
     "dashboard",
     "settings"
   ].sort();
@@ -12977,7 +13117,7 @@ function createAdminRolesHandlers(config) {
         }, {
           status: 404
         });
-        if (chunk77NUXO6A_cjs.isSuperAdminGroupName(g.name) && !chunk77NUXO6A_cjs.isSuperAdminGroupName(name)) {
+        if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name) && !chunkJ7FMZK66_cjs.isSuperAdminGroupName(name)) {
           return json({
             error: "Cannot rename the administrator group"
           }, {
@@ -13034,7 +13174,7 @@ function createAdminRolesHandlers(config) {
       }, {
         status: 404
       });
-      if (chunk77NUXO6A_cjs.isSuperAdminGroupName(g.name)) return json({
+      if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name)) return json({
         error: "Cannot delete the administrator group"
       }, {
         status: 400
@@ -13231,7 +13371,7 @@ async function sendVendorOnboardEmails(input, deps) {
       getVendorEmails(deps)
     ]);
     const companyDetails = chunkBXYZDMTZ_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings);
-    const configuredNotify = chunkHXLC56ZK_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
+    const configuredNotify = chunkYSYX4GUD_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const ownerEmail = input.ownerEmail?.trim() || "";
     const ownerEmailLower = ownerEmail.toLowerCase();
     const sendToOwner = input.sendToOwner !== false;
@@ -13265,7 +13405,7 @@ chunkUSNT2KNT_cjs.__name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
 async function insertRolePermissions(exec, vendorRoleId, permissions) {
-  for (const entity of chunk77NUXO6A_cjs.VENDOR_RBAC_ENTITIES) {
+  for (const entity of chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
     await exec.query(`
@@ -13296,7 +13436,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     for (const r of existing) {
       roleIdsByName2[r.name] = Number(r.id);
       if (r.isOwnerRole) ownerRoleId2 = Number(r.id);
-      if (r.name === chunk77NUXO6A_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
+      if (r.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
     }
     return {
       roleIdsByName: roleIdsByName2,
@@ -13307,7 +13447,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
   const roleIdsByName = {};
   let ownerRoleId = 0;
   let viewerRoleId = 0;
-  for (const def of chunk77NUXO6A_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
+  for (const def of chunkJ7FMZK66_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
     const inserted = await exec.query(`
       INSERT INTO "vendor_roles"
         ("vendorId", "name", "description", "isSystem", "isOwnerRole")
@@ -13324,7 +13464,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     if (!roleId) continue;
     roleIdsByName[def.name] = roleId;
     if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === chunk77NUXO6A_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
+    if (def.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
     await insertRolePermissions(exec, roleId, def.permissions);
   }
   return {
@@ -13354,7 +13494,7 @@ async function backfillVendorUserRoleIds(em, vendorId, seeded) {
       vendorId
     ]);
   }
-  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunk77NUXO6A_cjs.VENDOR_VIEWER_ROLE_NAME];
+  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME];
   if (viewerId) {
     await em.query(`
       UPDATE "vendor_users"
@@ -13380,7 +13520,7 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
     LIMIT 1
     `, [
     vendorId,
-    chunk77NUXO6A_cjs.VENDOR_VIEWER_ROLE_NAME
+    chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME
   ]);
   const id = rows[0]?.id;
   return id != null ? Number(id) : null;
@@ -13741,7 +13881,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk77NUXO6A_cjs.isPlatformAdministrator(u)) return json({
+    if (!chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) return json({
       error: "Forbidden",
       reason: "admin_only"
     }, {
@@ -13751,7 +13891,7 @@ function createVendorOnboardHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
-    const scope = chunk77NUXO6A_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
     const candidates = [];
     if (scope.type === "vendor") candidates.push(scope.vendorId);
     if (scope.type === "all" || scope.type === "vendor") {
@@ -13805,7 +13945,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk77NUXO6A_cjs.isVendorPortalUser(u) && !chunk77NUXO6A_cjs.isPlatformAdministrator(u)) {
+    if (!chunkJ7FMZK66_cjs.isVendorPortalUser(u) && !chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -13833,7 +13973,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk77NUXO6A_cjs.canManageVendorTeam(u)) return json({
+    if (!chunkJ7FMZK66_cjs.canManageVendorTeam(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -14051,7 +14191,7 @@ function createVendorOnboardHandlers(config) {
           await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
-              name: chunk77NUXO6A_cjs.VENDOR_GROUP_NAME,
+              name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
               deleted: false
             }
           });
@@ -14066,12 +14206,12 @@ function createVendorOnboardHandlers(config) {
           if (!ownerGroup) {
             try {
               await groupRepo.save(groupRepo.create({
-                name: chunk77NUXO6A_cjs.VENDOR_GROUP_NAME,
+                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }));
               ownerGroup = await groupRepo.findOne({
                 where: {
-                  name: chunk77NUXO6A_cjs.VENDOR_GROUP_NAME,
+                  name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
                   deleted: false
                 }
               });
@@ -14188,7 +14328,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk3EOM4V2M_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -14688,7 +14828,7 @@ function createVendorOnboardHandlers(config) {
           if (!groupId) {
             const g = await groupRepo.findOne({
               where: {
-                name: chunk77NUXO6A_cjs.VENDOR_GROUP_NAME,
+                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }
             }) ?? await groupRepo.findOne({
@@ -14788,7 +14928,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk3EOM4V2M_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -15325,10 +15465,10 @@ chunkUSNT2KNT_cjs.__name(createVendorOnboardHandlers, "createVendorOnboardHandle
 function createVendorRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
   const vendorRoleEntities = [
-    ...chunk77NUXO6A_cjs.VENDOR_RBAC_ENTITIES
+    ...chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES
   ].sort();
   async function resolveActiveVendorId(u) {
-    const scope = chunk77NUXO6A_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -15344,7 +15484,7 @@ function createVendorRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk77NUXO6A_cjs.canManageVendorRoles(u)) return json({
+    if (!chunkJ7FMZK66_cjs.canManageVendorRoles(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -17009,6 +17149,7 @@ exports.Form = class Form {
   campaign;
   slug;
   published;
+  enableTurnstile;
   createdAt;
   updatedAt;
   deletedAt;
@@ -17051,6 +17192,14 @@ _ts_decorate14([
   }),
   _ts_metadata14("design:type", Boolean)
 ], exports.Form.prototype, "published", void 0);
+_ts_decorate14([
+  typeorm.Column("boolean", {
+    default: false,
+    name: "enable_turnstile",
+    nullable: true
+  }),
+  _ts_metadata14("design:type", Boolean)
+], exports.Form.prototype, "enableTurnstile", void 0);
 _ts_decorate14([
   typeorm.Column({
     type: "timestamp",
@@ -27800,16 +27949,16 @@ function whatsappPlugin(config = {}) {
         db = await getWhatsAppSettings?.() ?? {};
       } catch {
       }
-      if (!chunkHXLC56ZK_cjs.isWhatsAppPluginEnabled(db)) {
+      if (!chunkYSYX4GUD_cjs.isWhatsAppPluginEnabled(db)) {
         context.logger.warn("WhatsApp plugin skipped: disabled in Plugins \u2192 WhatsApp");
         return null;
       }
-      const merged = chunkHXLC56ZK_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
-      if (!getWhatsAppSettings && !chunkHXLC56ZK_cjs.whatsAppConfigured(merged)) {
+      const merged = chunkYSYX4GUD_cjs.mergeWhatsAppConfigLayers(env, db, staticRest);
+      if (!getWhatsAppSettings && !chunkYSYX4GUD_cjs.whatsAppConfigured(merged)) {
         context.logger.warn("WhatsApp plugin skipped: set WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID, or pass getWhatsAppSettings");
         return null;
       }
-      const svc = new chunkHXLC56ZK_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
+      const svc = new chunkYSYX4GUD_cjs.WhatsAppService(env, staticRest, getWhatsAppSettings, getMessageTemplateRow);
       return {
         send: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((opts) => svc.send(opts), "send")
       };
@@ -27886,7 +28035,7 @@ function registerMessagingQueueProcessors(cms, entityMap) {
     getDataSource: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => cms.dataSource, "getDataSource"),
     entityMap
   });
-  chunkHXLC56ZK_cjs.registerWhatsAppQueueProcessor(cms);
+  chunkYSYX4GUD_cjs.registerWhatsAppQueueProcessor(cms);
 }
 chunkUSNT2KNT_cjs.__name(registerMessagingQueueProcessors, "registerMessagingQueueProcessors");
 async function ensureMessagingPluginsOnCms(base, options) {
@@ -27915,7 +28064,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
   }
   if (!cms.getPlugin("email")) {
     try {
-      const instance = await chunkHXLC56ZK_cjs.emailPlugin({
+      const instance = await chunkYSYX4GUD_cjs.emailPlugin({
         type: "SMTP",
         from: config.SMTP_FROM ?? "no-reply@localhost",
         to: config.SMTP_TO ?? ""
@@ -27956,7 +28105,7 @@ function messagingPlugins(options) {
   const config = options.config ?? (typeof process !== "undefined" ? process.env : {});
   return [
     queuePlugin(),
-    chunkHXLC56ZK_cjs.emailPlugin({
+    chunkYSYX4GUD_cjs.emailPlugin({
       type: "SMTP",
       from: config.SMTP_FROM ?? "no-reply@localhost",
       to: config.SMTP_TO ?? ""
@@ -28090,7 +28239,7 @@ function createCmsApiHandler(config) {
   } : void 0;
   const entityMap = withLlmKnowledgeEntityFallbacks(rawEntityMap);
   if (getCms) {
-    chunkHXLC56ZK_cjs.initWhatsappTriggerDispatcher({
+    chunkYSYX4GUD_cjs.initWhatsappTriggerDispatcher({
       dataSource,
       entityMap,
       getCms
@@ -28103,7 +28252,7 @@ function createCmsApiHandler(config) {
   ] : baseCrudResources;
   const requireEntityPermissionEffective = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async (_req, entity, action) => {
     if (!resolveSessionUser) {
-      chunk77NUXO6A_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
+      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
         entity,
         action,
         hint: "Pass getSessionUser: auth.getAuthenticatedUser from createCmsAuthBundle()"
@@ -28113,7 +28262,7 @@ function createCmsApiHandler(config) {
       const raw = await resolveSessionUser();
       const u = await hydrateVendorSessionUser(dataSource, raw);
       if (!u?.email) {
-        chunk77NUXO6A_cjs.logRbac("requireEntityPermission: no session user", {
+        chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: no session user", {
           entity,
           action
         });
@@ -28123,13 +28272,13 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunk3EOM4V2M_cjs.sessionHasEntityAccess(u, entity, action);
-      await chunk77NUXO6A_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
+      const allowed = chunk4U6DATGZ_cjs.sessionHasEntityAccess(u, entity, action);
+      await chunkJ7FMZK66_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
       });
       if (allowed) return null;
-      const { reason } = chunk77NUXO6A_cjs.explainSessionEntityAccess(u, entity, action);
+      const { reason } = chunkJ7FMZK66_cjs.explainSessionEntityAccess(u, entity, action);
       return config.json({
         error: "Forbidden",
         entity,
@@ -28140,7 +28289,7 @@ function createCmsApiHandler(config) {
       });
     }
     if (userRequireEntityPermission) {
-      chunk77NUXO6A_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
+      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
         entity,
         action
       });
@@ -28227,10 +28376,10 @@ function createCmsApiHandler(config) {
       getVendorScope: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
         if (!multiVendorEnabled) {
-          return chunk77NUXO6A_cjs.resolveDisabledMultiVendorScope(dataSource);
+          return chunkJ7FMZK66_cjs.resolveDisabledMultiVendorScope(dataSource);
         }
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-        return chunk77NUXO6A_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+        return chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
       }, "getVendorScope"),
       getHydratedSessionUser: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
@@ -29188,7 +29337,7 @@ function createCmsApiHandler(config) {
       }
       if (path2[0] === "settings" && path2.length === 2 && settingsHandlers) {
         const group = path2[1];
-        const isPublic = group === "multi_vendor" || settingsConfig?.publicGetGroups?.includes(group);
+        const isPublic = group === "multi_vendor" || group === "turnstile" || group === "auth_providers" || settingsConfig?.publicGetGroups?.includes(group);
         if (m === "GET") {
           if (!isPublic) {
             const a = await config.requireAuth(req);
@@ -29564,7 +29713,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunk77NUXO6A_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const result = await validateCoupon(dataSource, entityMap, couponCode, orderLinesNorm, currency, contactId, isAutomatic, discountId ?? void 0, vendorId);
@@ -29647,7 +29796,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunk77NUXO6A_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
@@ -29846,14 +29995,21 @@ function createCmsApiHandler(config) {
           body = {};
         }
         const triggerKey = String(body.triggerKey ?? "order_placed").trim() || "order_placed";
-        if (triggerKey !== "order_placed" && triggerKey !== "order_cancelled") {
+        const validTriggers = [
+          "order_placed",
+          "order_cancelled",
+          "payment_success",
+          "payment_failed",
+          "payment_refund_initiated"
+        ];
+        if (!validTriggers.includes(triggerKey)) {
           return config.json({
-            error: "Invalid triggerKey; use order_placed or order_cancelled"
+            error: `Invalid triggerKey; use one of: ${validTriggers.join(", ")}`
           }, {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-2FCZFZUD.cjs');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-KJVGLK5E.cjs');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -29875,11 +30031,9 @@ function createCmsApiHandler(config) {
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "cancel" && m === "POST") {
         const a = await config.requireAuth(req);
         if (a) return a;
-        const pe = await requireEntityPermissionEffective(req, "orders", "update");
-        if (pe) return pe;
-        const orderId = Number(path2[1]);
-        if (!Number.isFinite(orderId)) return config.json({
-          error: "Invalid id"
+        const orderId = parseInt(path2[1], 10);
+        if (Number.isNaN(orderId)) return config.json({
+          error: "Invalid order ID"
         }, {
           status: 400
         });
@@ -29896,9 +30050,10 @@ function createCmsApiHandler(config) {
           status: 404
         });
         const o = order;
-        if (o.status !== "confirmed" && o.status !== "completed") {
+        const currentStatus = (o.status || "").toLowerCase();
+        if (currentStatus === "cancelled") {
           return config.json({
-            error: "Only confirmed or completed orders can be cancelled"
+            error: "Order is already cancelled"
           }, {
             status: 400
           });
@@ -29921,7 +30076,7 @@ function createCmsApiHandler(config) {
             }
           });
           if (payment) {
-            paymentStatus = String(payment.status ?? "unpaid");
+            paymentStatus = String(payment.status ?? "unpaid").toLowerCase();
             paymentId = Number(payment.id);
           }
         }
@@ -29953,13 +30108,26 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((refundAmount) => {
-          void import('./emit-order-notification-trigger-NR3VN6C6.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-TNEZOYEE.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
             }, refundAmount != null && refundAmount > 0 ? {
               refundAmount
             } : void 0);
+            if (paymentStatus === "paid" || paymentStatus === "captured") {
+              fireOrderNotificationTrigger("payment_refund_initiated", orderId, {
+                dataSource,
+                entityMap
+              }, refundAmount != null && refundAmount > 0 ? {
+                refundAmount
+              } : void 0);
+            } else {
+              fireOrderNotificationTrigger("payment_failed", orderId, {
+                dataSource,
+                entityMap
+              });
+            }
           });
         }, "fireOrderCancelledNotification");
         if (paymentStatus === "paid" && entityMap.payments && paymentId) {
@@ -30285,7 +30453,7 @@ function createCmsApiHandler(config) {
           if (resolveSessionUser) {
             const raw = await resolveSessionUser();
             const u = await hydrateVendorSessionUser(dataSource, raw);
-            const scope = chunk77NUXO6A_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") {
               scopedVendorIds = scope.vendorIds;
             }
@@ -30985,12 +31153,23 @@ function createStorefrontApiHandler(config) {
   const otpFlags = config.otpFlags;
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
-  function fireOrderPlacedNotification(orderId) {
-    void import('./emit-order-notification-trigger-NR3VN6C6.cjs').then(({ fireOrderNotificationTrigger }) => {
+  function fireOrderPlacedNotification(orderId, isPaid) {
+    void import('./emit-order-notification-trigger-TNEZOYEE.cjs').then(({ fireOrderNotificationTrigger }) => {
       fireOrderNotificationTrigger("order_placed", orderId, {
         dataSource,
         entityMap
       });
+      if (isPaid) {
+        fireOrderNotificationTrigger("payment_success", orderId, {
+          dataSource,
+          entityMap
+        });
+      } else {
+        fireOrderNotificationTrigger("payment_failed", orderId, {
+          dataSource,
+          entityMap
+        });
+      }
     }).catch((err) => console.error("[notification-triggers] import failed", err));
   }
   chunkUSNT2KNT_cjs.__name(fireOrderPlacedNotification, "fireOrderPlacedNotification");
@@ -32833,10 +33012,10 @@ function createStorefrontApiHandler(config) {
             adminAccess: false
           }));
           const userId = newUser.id;
-          await chunk3EOM4V2M_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
           if (entityMap.customer) {
             const phone = typeof b.phone === "string" && b.phone.trim() ? String(b.phone).trim() : null;
-            await chunk3EOM4V2M_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+            await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
               id: userId,
               name,
               email,
@@ -32894,6 +33073,23 @@ function createStorefrontApiHandler(config) {
           });
           return json(body);
         }
+        if (path2[0] === "cart" && path2.length === 1 && method === "DELETE") {
+          const { cart, err } = await getOrCreateCart(req);
+          if (err) return err;
+          const cartId = cart?.id;
+          if (cartId && Number.isFinite(cartId) && cartId > 0) {
+            await cartItemRepo().delete({
+              cartId
+            });
+            await cartRepo().update(cartId, {
+              updatedAt: /* @__PURE__ */ new Date()
+            });
+          }
+          return json({
+            ok: true,
+            message: "Cart cleared"
+          });
+        }
         if (path2[0] === "cart" && path2[1] === "items" && path2.length === 2 && method === "POST") {
           const body = await req.json().catch(() => ({}));
           const capCart = await assertCaptchaOk(getCms, body, req, json);
@@ -33413,7 +33609,8 @@ function createStorefrontApiHandler(config) {
             total: prepOrd.orderTotal,
             currency: cart.currency || "INR",
             metadata: {
-              cartId
+              cartId,
+              paymentExpiresAt: new Date(Date.now() + 10 * 60 * 1e3).toISOString()
             }
           }));
           const oid = ord.id;
@@ -33486,7 +33683,11 @@ function createStorefrontApiHandler(config) {
             tax: prepChk.orderTax,
             discount: 0,
             total: prepChk.orderTotal,
-            currency: cart.currency || "INR"
+            currency: cart.currency || "INR",
+            metadata: {
+              cartId: cart.id,
+              paymentExpiresAt: new Date(Date.now() + 10 * 60 * 1e3).toISOString()
+            }
           }));
           const oid = ord.id;
           await orderRepo().update(oid, {
@@ -33732,6 +33933,7 @@ function createStorefrontApiHandler(config) {
             status: 404
           });
           const o = order;
+          await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, o);
           const lines = (o.items || []).map((line) => {
             const p = line.product;
             return {
@@ -33792,6 +33994,87 @@ function createStorefrontApiHandler(config) {
             fulfillmentPreview: fulfillmentPreview || void 0
           });
         }
+        if (path2[0] === "orders" && path2.length === 3 && path2[2] === "cancel" && method === "POST") {
+          const orderId = parseInt(path2[1], 10);
+          if (!Number.isFinite(orderId)) return json({
+            error: "Invalid order id"
+          }, {
+            status: 400
+          });
+          const order = await orderRepo().findOne({
+            where: {
+              id: orderId,
+              deleted: false
+            }
+          });
+          if (!order) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
+          const o = order;
+          const status = String(o.status || "").toLowerCase();
+          if (status === "pending") {
+            const meta = typeof o.metadata === "object" && o.metadata ? o.metadata : {};
+            const updatedMeta = {
+              ...meta,
+              cancelReason: "Cancelled by user during payment window"
+            };
+            await orderRepo().update(orderId, {
+              status: "cancelled",
+              metadata: updatedMeta
+            });
+            try {
+              if (entityMap.payments) {
+                const payRepo = dataSource.getRepository(entityMap.payments);
+                const pendingPayment = await payRepo.findOne({
+                  where: {
+                    orderId,
+                    status: "pending"
+                  }
+                });
+                if (pendingPayment) {
+                  await payRepo.update(pendingPayment.id, {
+                    status: "unpaid"
+                  });
+                }
+              }
+            } catch {
+            }
+            try {
+              const { cart } = await getOrCreateCart(req);
+              const cartId = cart?.id;
+              if (cartId && Number.isFinite(cartId) && cartId > 0) {
+                await cartItemRepo().delete({
+                  cartId
+                });
+                await cartRepo().update(cartId, {
+                  updatedAt: /* @__PURE__ */ new Date()
+                });
+              }
+            } catch {
+            }
+            try {
+              void import('./emit-order-notification-trigger-TNEZOYEE.cjs').then(({ fireOrderNotificationTrigger }) => {
+                fireOrderNotificationTrigger("order_cancelled", orderId, {
+                  dataSource,
+                  entityMap
+                });
+                fireOrderNotificationTrigger("payment_failed", orderId, {
+                  dataSource,
+                  entityMap
+                });
+              }).catch(() => {
+              });
+            } catch {
+            }
+          }
+          return json({
+            ok: true,
+            orderId,
+            status: "cancelled"
+          });
+        }
         return json({
           error: "Not found"
         }, {
@@ -33831,6 +34114,7 @@ exports.assertCaptchaOk = assertCaptchaOk;
 exports.assertContactAllowedForVendorOrder = assertContactAllowedForVendorOrder;
 exports.assertEventApprovalUpdate = assertEventApprovalUpdate;
 exports.assertProductApprovalUpdate = assertProductApprovalUpdate;
+exports.autoExpireOrderIfPaymentTimeExceeded = autoExpireOrderIfPaymentTimeExceeded;
 exports.buildBlogMetadataUserPrompt = buildBlogMetadataUserPrompt;
 exports.buildCronFromSchedule = buildCronFromSchedule;
 exports.buildRssUserPromptFromFeeds = buildRssUserPromptFromFeeds;