@infuro/cms-core 1.0.58 → 1.0.60

package/dist/{chunk-AGU3B5JW.js → chunk-JAEUYYGA.js}

@@ -1,15 +1,15 @@
 import { JOB_RUNNER_QUEUE } from './chunk-GO7PPYNU.js';
 import { validateInventoryForConfirmedOrderLines, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, orderInventorySnapshotFromRow, validateInventoryForOrderBecomingConfirmed } from './chunk-3K5AIEIZ.js';
-import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, validateFcmCredentials, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-HYW3MUXT.js';
+import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, validateFcmCredentials, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, mergeWhatsAppConfigLayers, whatsAppConfigured, WhatsAppService, registerWhatsAppQueueProcessor, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-URN7GS23.js';
 import { inviteStatusForActivation } from './chunk-JXF23MPG.js';
 import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-L3525VXI.js';
 import { mergeEmailLayoutCompanyDetails, unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-2KUCQVAQ.js';
 import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MQBT33IV.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-AYERBA7I.js';
-import { ensureCustomerRecord, linkUnclaimedContactToUser, ensureCustomerForUser, canManageRoles, sessionHasEntityAccess } from './chunk-RK5ETF2I.js';
+import { ensureCustomerRecord, linkUnclaimedContactToUser, ensureCustomerForUser, canManageRoles, sessionHasEntityAccess } from './chunk-NR44CK5E.js';
 import { retireSoftDeletedUniqueValue, activeUniqueValueExists } from './chunk-DBPSJYLZ.js';
-import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-JIWUVQ6B.js';
+import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-MVHDC3XF.js';
 import { queueErp } from './chunk-SYBOCAWB.js';
 import { __name } from './chunk-SHUYVCID.js';
 import { PrimaryGeneratedColumn, Column, Entity, ManyToOne, JoinColumn, CreateDateColumn, UpdateDateColumn, Unique, OneToMany, Index, ManyToMany, JoinTable, In, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan, IsNull } from 'typeorm';
@@ -1510,6 +1510,36 @@ async function validateLlmAgentScopeForWrite(dataSource, entityMap, scope, exclu
 __name(validateLlmAgentScopeForWrite, "validateLlmAgentScopeForWrite");
 
 // src/api/crud.ts
+async function autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order) {
+  if (!order || typeof order !== "object") return order;
+  const status = String(order.status ?? "").toLowerCase();
+  if (status !== "pending") return order;
+  const meta = typeof order.metadata === "object" && order.metadata ? order.metadata : {};
+  const expiresAtStr = meta.paymentExpiresAt ? String(meta.paymentExpiresAt) : null;
+  if (!expiresAtStr) return order;
+  const expiresMs = new Date(expiresAtStr).getTime();
+  if (Number.isNaN(expiresMs) || Date.now() <= expiresMs) return order;
+  try {
+    const orderId = Number(order.id);
+    if (orderId && entityMap.orders) {
+      const orderRepo = dataSource.getRepository(entityMap.orders);
+      const updatedMeta = {
+        ...meta,
+        cancelReason: "Payment window expired (10 minutes)"
+      };
+      await orderRepo.update(orderId, {
+        status: "cancelled",
+        metadata: updatedMeta
+      });
+      order.status = "cancelled";
+      order.metadata = updatedMeta;
+    }
+  } catch (err) {
+    console.error("[payment-expiry] Auto-cancelling expired order failed", err);
+  }
+  return order;
+}
+__name(autoExpireOrderIfPaymentTimeExceeded, "autoExpireOrderIfPaymentTimeExceeded");
 var CRUD_LOG = "[cms-crud]";
 function logCrudClientError(op, detail) {
   console.warn(CRUD_LOG, op, detail);
@@ -2414,13 +2444,46 @@ function discountCompare(cartValue, op, ruleValue) {
   }
 }
 __name(discountCompare, "discountCompare");
-function discountEvaluateRule(rule, cartLines, cartTotal) {
-  if (rule.conditionType === "group") return discountEvaluateGroup(rule, cartLines, cartTotal);
+async function getExchangeRate(dataSource, entityMap, fromCurrency, toCurrency) {
+  const from = (fromCurrency || "INR").trim().toUpperCase();
+  const to = (toCurrency || "INR").trim().toUpperCase();
+  if (from === to) return 1;
+  if (entityMap["currency_exchange"]) {
+    try {
+      const exchangeRepo = dataSource.getRepository(entityMap["currency_exchange"]);
+      const direct = await exchangeRepo.findOne({
+        where: {
+          fromCurrency: from,
+          toCurrency: to
+        }
+      });
+      if (direct && Number(direct.rate) > 0) {
+        return Number(direct.rate);
+      }
+      const inverse = await exchangeRepo.findOne({
+        where: {
+          fromCurrency: to,
+          toCurrency: from
+        }
+      });
+      if (inverse && Number(inverse.rate) > 0) {
+        return 1 / Number(inverse.rate);
+      }
+    } catch {
+    }
+  }
+  return 1;
+}
+__name(getExchangeRate, "getExchangeRate");
+function discountEvaluateRule(rule, cartLines, cartTotal, exchangeRate = 1) {
+  if (rule.conditionType === "group") return discountEvaluateGroup(rule, cartLines, cartTotal, exchangeRate);
   if (rule.type === "reward") return true;
-  const ruleValue = discountExtractValue(rule.value);
+  const rawRuleValue = discountExtractValue(rule.value);
   switch (rule.type) {
-    case "minAmount":
-      return discountCompare(cartTotal, rule.comparisonOperator, ruleValue);
+    case "minAmount": {
+      const convertedValue = typeof rawRuleValue === "number" ? rawRuleValue * exchangeRate : !isNaN(Number(rawRuleValue)) ? Number(rawRuleValue) * exchangeRate : rawRuleValue;
+      return discountCompare(cartTotal, rule.comparisonOperator, convertedValue);
+    }
     case "quantity": {
       if (rule.subType === "productId" && rule.value?.productId) {
         const targetProductId = Number(rule.value.productId);
@@ -2429,11 +2492,11 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
         return discountCompare(productQty, rule.comparisonOperator, requiredQty);
       }
       const totalQty = cartLines.reduce((s, l) => s + l.quantity, 0);
-      return discountCompare(totalQty, rule.comparisonOperator, ruleValue);
+      return discountCompare(totalQty, rule.comparisonOperator, rawRuleValue);
     }
     case "product":
       if (rule.subType === "productId") {
-        return cartLines.some((l) => discountCompare(l.productId, rule.comparisonOperator, ruleValue));
+        return cartLines.some((l) => discountCompare(l.productId, rule.comparisonOperator, rawRuleValue));
       }
       return false;
     // These require external context (user session, payment method, time) —
@@ -2457,11 +2520,11 @@ function discountEvaluateRule(rule, cartLines, cartTotal) {
   }
 }
 __name(discountEvaluateRule, "discountEvaluateRule");
-function discountEvaluateGroup(group, cartLines, cartTotal) {
+function discountEvaluateGroup(group, cartLines, cartTotal, exchangeRate = 1) {
   if (!group.children?.length) return true;
   const op = (group.conditionOperator ?? "and").toLowerCase();
-  if (op === "and") return group.children.every((child) => discountEvaluateRule(child, cartLines, cartTotal));
-  if (op === "or") return group.children.some((child) => discountEvaluateRule(child, cartLines, cartTotal));
+  if (op === "and") return group.children.every((child) => discountEvaluateRule(child, cartLines, cartTotal, exchangeRate));
+  if (op === "or") return group.children.some((child) => discountEvaluateRule(child, cartLines, cartTotal, exchangeRate));
   return true;
 }
 __name(discountEvaluateGroup, "discountEvaluateGroup");
@@ -2508,19 +2571,19 @@ function discountExtractBuyProductId(nodes) {
   return null;
 }
 __name(discountExtractBuyProductId, "discountExtractBuyProductId");
-function discountBuildUniversalResult(discount, cartLines) {
+function discountBuildUniversalResult(discount, cartLines, effectiveValue) {
   return {
     rewardLines: cartLines.map((l) => ({
       productId: l.productId,
       quantity: l.quantity,
-      discountRate: Number(discount.value),
+      discountRate: effectiveValue,
       discountType: discount.discountType
     })),
     conditionsMet: true
   };
 }
 __name(discountBuildUniversalResult, "discountBuildUniversalResult");
-function evaluateDiscount(discount, cartLines) {
+function evaluateDiscount(discount, cartLines, exchangeRate = 1) {
   const empty = {
     rewardLines: [],
     conditionsMet: false
@@ -2544,16 +2607,17 @@ function evaluateDiscount(discount, cartLines) {
       reason: "discount usage limit reached"
     };
   }
+  const effectiveValue = discount.discountType === "FLAT" ? Number(discount.value) * exchangeRate : Number(discount.value);
   const cartTotal = cartLines.reduce((s, l) => s + l.subtotal, 0);
   const tree = discountBuildTree(discount.rules ?? []);
-  if (tree.length === 0) return discountBuildUniversalResult(discount, cartLines);
-  const conditionsMet = tree.every((node) => discountEvaluateRule(node, cartLines, cartTotal));
+  if (tree.length === 0) return discountBuildUniversalResult(discount, cartLines, effectiveValue);
+  const conditionsMet = tree.every((node) => discountEvaluateRule(node, cartLines, cartTotal, exchangeRate));
   if (!conditionsMet) return {
     ...empty,
     reason: "conditions not met"
   };
   const rewardRules = discountCollectRewardRules(tree);
-  if (rewardRules.length === 0) return discountBuildUniversalResult(discount, cartLines);
+  if (rewardRules.length === 0) return discountBuildUniversalResult(discount, cartLines, effectiveValue);
   const requiredBuyQty = discountExtractRequiredBuyQty(tree);
   const buyProductId = discountExtractBuyProductId(tree);
   let dealMultiplier = 1;
@@ -2571,7 +2635,7 @@ function evaluateDiscount(discount, cartLines) {
       rewardLines.push({
         productId: rewardProductId,
         quantity: dealMultiplier,
-        discountRate: Number(discount.value),
+        discountRate: effectiveValue,
         discountType: discount.discountType
       });
     } else {
@@ -2580,7 +2644,7 @@ function evaluateDiscount(discount, cartLines) {
       rewardLines.push({
         productId: rewardProductId,
         quantity: rewardQty,
-        discountRate: Number(discount.value),
+        discountRate: effectiveValue,
         discountType: discount.discountType
       });
     }
@@ -2591,8 +2655,9 @@ function evaluateDiscount(discount, cartLines) {
   };
 }
 __name(evaluateDiscount, "evaluateDiscount");
-function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
+function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount, exchangeRate = 1) {
   if (!evalResult.conditionsMet || evalResult.rewardLines.length === 0) return 0;
+  const effectiveMaxDiscountAmount = maxDiscountAmount != null ? Number(maxDiscountAmount) * exchangeRate : null;
   let totalDiscountApplied = 0;
   for (const reward of evalResult.rewardLines) {
     const line = lines.find((l) => l.productId === reward.productId);
@@ -2609,8 +2674,8 @@ function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
     line.subtotal = line.unitPrice * line.quantity;
     line.total = Math.max(0, line.subtotal - (line.discount ?? 0));
   }
-  if (maxDiscountAmount != null && totalDiscountApplied > maxDiscountAmount) {
-    const excess = totalDiscountApplied - maxDiscountAmount;
+  if (effectiveMaxDiscountAmount != null && totalDiscountApplied > effectiveMaxDiscountAmount) {
+    const excess = totalDiscountApplied - effectiveMaxDiscountAmount;
     for (let i = evalResult.rewardLines.length - 1; i >= 0; i--) {
       const reward = evalResult.rewardLines[i];
       const line = lines.find((l) => l.productId === reward.productId);
@@ -2620,7 +2685,7 @@ function applyDiscountToOrderLines(lines, evalResult, maxDiscountAmount) {
       line.total = Math.max(0, line.total + rollback);
       if (rollback > 0) break;
     }
-    totalDiscountApplied = maxDiscountAmount;
+    totalDiscountApplied = effectiveMaxDiscountAmount;
   }
   return totalDiscountApplied;
 }
@@ -2726,7 +2791,9 @@ async function validateCoupon(dataSource, entityMap, couponCode, orderLines, cur
     unitPrice: l.unitPrice,
     subtotal: l.subtotal
   }));
-  const evalResult = evaluateDiscount(discountForEval, cartLines);
+  const dCurrency = d.currency || "INR";
+  const exchangeRate = await getExchangeRate(dataSource, entityMap, dCurrency, currency);
+  const evalResult = evaluateDiscount(discountForEval, cartLines, exchangeRate);
   if (!evalResult.conditionsMet) {
     return {
       valid: false,
@@ -2736,7 +2803,7 @@ async function validateCoupon(dataSource, entityMap, couponCode, orderLines, cur
   const clonedLines = lines.map((l) => ({
     ...l
   }));
-  const calculatedDiscount = applyDiscountToOrderLines(clonedLines, evalResult, d.maxDiscountAmount);
+  const calculatedDiscount = applyDiscountToOrderLines(clonedLines, evalResult, d.maxDiscountAmount, exchangeRate);
   const rewardProductIds = evalResult.rewardLines.map((r) => r.productId);
   return {
     valid: true,
@@ -3021,9 +3088,11 @@ async function calculateOrderTotalsFromLines(dataSource, entityMap, lineInputs,
             unitPrice: l.unitPrice,
             subtotal: l.subtotal
           }));
-          const evalResult = evaluateDiscount(discountForEval, cartLines);
+          const dCurrency = discountRow.currency || "INR";
+          const exchangeRate2 = await getExchangeRate(dataSource, entityMap, dCurrency, currency);
+          const evalResult = evaluateDiscount(discountForEval, cartLines, exchangeRate2);
           if (evalResult.conditionsMet) {
-            const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
+            const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount, exchangeRate2);
             orderDiscount += totalDiscountApplied;
           }
         }
@@ -3136,9 +3205,25 @@ async function calculateOrderTotals(dataSource, entityMap, itemsSummary, discoun
           unitPrice: l.unitPrice,
           subtotal: l.subtotal
         }));
-        const evalResult = evaluateDiscount(discountForEval, cartLines);
+        const dCurrency = discountRow.currency || "INR";
+        let storeCurrency = "INR";
+        if (entityMap["configs"]) {
+          try {
+            const configRepo = dataSource.getRepository(entityMap["configs"]);
+            const curr = await configRepo.findOne({
+              where: {
+                settings: "store",
+                key: "currency"
+              }
+            });
+            storeCurrency = curr?.value?.toUpperCase() ?? "INR";
+          } catch {
+          }
+        }
+        const exchangeRate = await getExchangeRate(dataSource, entityMap, dCurrency, storeCurrency);
+        const evalResult = evaluateDiscount(discountForEval, cartLines, exchangeRate);
         if (evalResult.conditionsMet) {
-          const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount);
+          const totalDiscountApplied = applyDiscountToOrderLines(lines, evalResult, discountRow.maxDiscountAmount, exchangeRate);
           for (const line of lines) {
             if (!line.found || line.taxRate === 0) continue;
             const discountedAmount = line.subtotal - (line.discount ?? 0);
@@ -3554,6 +3639,12 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           const itemsSummary = parts.join(", ") || "\u2014";
           const { payments: _payments, ...orderWithoutPayments } = order;
+          const rawPayStatus = String(orderPayments[0]?.status ?? "unpaid").toLowerCase();
+          const orderStatus = String(order.status ?? "").toLowerCase();
+          let paymentStatus2 = rawPayStatus;
+          if (orderStatus === "cancelled" && rawPayStatus !== "paid" && rawPayStatus !== "captured" && rawPayStatus !== "refunded") {
+            paymentStatus2 = "unpaid";
+          }
           return {
             ...orderWithoutPayments,
             contact: contact ? {
@@ -3563,7 +3654,7 @@ function createCrudHandler(dataSource, entityMap, options) {
               phone: contact.phone
             } : null,
             itemsSummary,
-            paymentStatus: orderPayments[0]?.status ?? "unpaid"
+            paymentStatus: paymentStatus2
           };
         }));
         return json({
@@ -5081,11 +5172,18 @@ function createCrudHandler(dataSource, entityMap, options) {
             await recordDiscountUsage2(dataSource, entityMap, created.id, orderDiscountId, persistBody.contactId, discount);
           }
           const orderIdForNotify = created.id;
-          void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
+          const initialPayStatus = String(persistBody.paymentStatus ?? "unpaid").toLowerCase();
+          void import('./emit-order-notification-trigger-CZU3V2WE.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_placed", orderIdForNotify, {
               dataSource,
               entityMap
             });
+            if (initialPayStatus === "paid" || initialPayStatus === "captured") {
+              fireOrderNotificationTrigger("payment_success", orderIdForNotify, {
+                dataSource,
+                entityMap
+              });
+            }
           });
         }
       } catch (err) {
@@ -5448,6 +5546,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "payments"
           ]
         });
+        if (order) {
+          await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
+        }
         const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
         if (orderDenied) return orderDenied;
         const relatedOrders = await repo.find({
@@ -6549,6 +6650,43 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         await retireSoftDeletedUniquesFromBody(repo, updatePayload);
         try {
           await repo.update(numericId, updatePayload);
+          if (resource === "payments" && updatePayload.status) {
+            const updatedPay = await repo.findOne({
+              where: {
+                id: numericId
+              }
+            });
+            const pOrder = updatedPay?.orderId;
+            const newPayStatus = String(updatePayload.status).toLowerCase();
+            if (pOrder && Number.isFinite(pOrder)) {
+              if (newPayStatus === "paid" || newPayStatus === "captured") {
+                if (entityMap.orders) {
+                  await dataSource.getRepository(entityMap.orders).update(pOrder, {
+                    status: "confirmed"
+                  });
+                }
+                void import('./emit-order-notification-trigger-CZU3V2WE.js').then(({ fireOrderNotificationTrigger }) => {
+                  fireOrderNotificationTrigger("order_placed", pOrder, {
+                    dataSource,
+                    entityMap
+                  });
+                  fireOrderNotificationTrigger("payment_success", pOrder, {
+                    dataSource,
+                    entityMap
+                  });
+                }).catch(() => {
+                });
+              } else if (newPayStatus === "failed") {
+                void import('./emit-order-notification-trigger-CZU3V2WE.js').then(({ fireOrderNotificationTrigger }) => {
+                  fireOrderNotificationTrigger("payment_failed", pOrder, {
+                    dataSource,
+                    entityMap
+                  });
+                }).catch(() => {
+                });
+              }
+            }
+          }
         } catch (err) {
           if (resource === "events" && isSlugUniqueViolation(err)) {
             return json({
@@ -9103,7 +9241,9 @@ function createFormSaveHandlers(config) {
           "description",
           "campaign",
           "slug",
-          "published"
+          "published",
+          "enableTurnstile",
+          "enable_turnstile"
         ]) {
           if (body[key] !== void 0) formRow[key] = body[key];
         }
@@ -16999,6 +17139,7 @@ var Form = class {
   campaign;
   slug;
   published;
+  enableTurnstile;
   createdAt;
   updatedAt;
   deletedAt;
@@ -17041,6 +17182,14 @@ _ts_decorate14([
   }),
   _ts_metadata14("design:type", Boolean)
 ], Form.prototype, "published", void 0);
+_ts_decorate14([
+  Column("boolean", {
+    default: false,
+    name: "enable_turnstile",
+    nullable: true
+  }),
+  _ts_metadata14("design:type", Boolean)
+], Form.prototype, "enableTurnstile", void 0);
 _ts_decorate14([
   Column({
     type: "timestamp",
@@ -29178,7 +29327,7 @@ function createCmsApiHandler(config) {
       }
       if (path2[0] === "settings" && path2.length === 2 && settingsHandlers) {
         const group = path2[1];
-        const isPublic = group === "multi_vendor" || settingsConfig?.publicGetGroups?.includes(group);
+        const isPublic = group === "multi_vendor" || group === "turnstile" || group === "auth_providers" || settingsConfig?.publicGetGroups?.includes(group);
         if (m === "GET") {
           if (!isPublic) {
             const a = await config.requireAuth(req);
@@ -29836,14 +29985,21 @@ function createCmsApiHandler(config) {
           body = {};
         }
         const triggerKey = String(body.triggerKey ?? "order_placed").trim() || "order_placed";
-        if (triggerKey !== "order_placed" && triggerKey !== "order_cancelled") {
+        const validTriggers = [
+          "order_placed",
+          "order_cancelled",
+          "payment_success",
+          "payment_failed",
+          "payment_refund_initiated"
+        ];
+        if (!validTriggers.includes(triggerKey)) {
           return config.json({
-            error: "Invalid triggerKey; use order_placed or order_cancelled"
+            error: `Invalid triggerKey; use one of: ${validTriggers.join(", ")}`
           }, {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-64WDCHHG.js');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-ZSFKEYMP.js');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -29865,11 +30021,9 @@ function createCmsApiHandler(config) {
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "cancel" && m === "POST") {
         const a = await config.requireAuth(req);
         if (a) return a;
-        const pe = await requireEntityPermissionEffective(req, "orders", "update");
-        if (pe) return pe;
-        const orderId = Number(path2[1]);
-        if (!Number.isFinite(orderId)) return config.json({
-          error: "Invalid id"
+        const orderId = parseInt(path2[1], 10);
+        if (Number.isNaN(orderId)) return config.json({
+          error: "Invalid order ID"
         }, {
           status: 400
         });
@@ -29886,9 +30040,10 @@ function createCmsApiHandler(config) {
           status: 404
         });
         const o = order;
-        if (o.status !== "confirmed" && o.status !== "completed") {
+        const currentStatus = (o.status || "").toLowerCase();
+        if (currentStatus === "cancelled") {
           return config.json({
-            error: "Only confirmed or completed orders can be cancelled"
+            error: "Order is already cancelled"
           }, {
             status: 400
           });
@@ -29911,7 +30066,7 @@ function createCmsApiHandler(config) {
             }
           });
           if (payment) {
-            paymentStatus = String(payment.status ?? "unpaid");
+            paymentStatus = String(payment.status ?? "unpaid").toLowerCase();
             paymentId = Number(payment.id);
           }
         }
@@ -29943,13 +30098,26 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ __name((refundAmount) => {
-          void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-CZU3V2WE.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
             }, refundAmount != null && refundAmount > 0 ? {
               refundAmount
             } : void 0);
+            if (paymentStatus === "paid" || paymentStatus === "captured") {
+              fireOrderNotificationTrigger("payment_refund_initiated", orderId, {
+                dataSource,
+                entityMap
+              }, refundAmount != null && refundAmount > 0 ? {
+                refundAmount
+              } : void 0);
+            } else {
+              fireOrderNotificationTrigger("payment_failed", orderId, {
+                dataSource,
+                entityMap
+              });
+            }
           });
         }, "fireOrderCancelledNotification");
         if (paymentStatus === "paid" && entityMap.payments && paymentId) {
@@ -30975,12 +31143,23 @@ function createStorefrontApiHandler(config) {
   const otpFlags = config.otpFlags;
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
-  function fireOrderPlacedNotification(orderId) {
-    void import('./emit-order-notification-trigger-HZQPPSFB.js').then(({ fireOrderNotificationTrigger }) => {
+  function fireOrderPlacedNotification(orderId, isPaid) {
+    void import('./emit-order-notification-trigger-CZU3V2WE.js').then(({ fireOrderNotificationTrigger }) => {
       fireOrderNotificationTrigger("order_placed", orderId, {
         dataSource,
         entityMap
       });
+      if (isPaid) {
+        fireOrderNotificationTrigger("payment_success", orderId, {
+          dataSource,
+          entityMap
+        });
+      } else {
+        fireOrderNotificationTrigger("payment_failed", orderId, {
+          dataSource,
+          entityMap
+        });
+      }
     }).catch((err) => console.error("[notification-triggers] import failed", err));
   }
   __name(fireOrderPlacedNotification, "fireOrderPlacedNotification");
@@ -32884,6 +33063,23 @@ function createStorefrontApiHandler(config) {
           });
           return json(body);
         }
+        if (path2[0] === "cart" && path2.length === 1 && method === "DELETE") {
+          const { cart, err } = await getOrCreateCart(req);
+          if (err) return err;
+          const cartId = cart?.id;
+          if (cartId && Number.isFinite(cartId) && cartId > 0) {
+            await cartItemRepo().delete({
+              cartId
+            });
+            await cartRepo().update(cartId, {
+              updatedAt: /* @__PURE__ */ new Date()
+            });
+          }
+          return json({
+            ok: true,
+            message: "Cart cleared"
+          });
+        }
         if (path2[0] === "cart" && path2[1] === "items" && path2.length === 2 && method === "POST") {
           const body = await req.json().catch(() => ({}));
           const capCart = await assertCaptchaOk(getCms, body, req, json);
@@ -33403,7 +33599,8 @@ function createStorefrontApiHandler(config) {
             total: prepOrd.orderTotal,
             currency: cart.currency || "INR",
             metadata: {
-              cartId
+              cartId,
+              paymentExpiresAt: new Date(Date.now() + 10 * 60 * 1e3).toISOString()
             }
           }));
           const oid = ord.id;
@@ -33476,7 +33673,11 @@ function createStorefrontApiHandler(config) {
             tax: prepChk.orderTax,
             discount: 0,
             total: prepChk.orderTotal,
-            currency: cart.currency || "INR"
+            currency: cart.currency || "INR",
+            metadata: {
+              cartId: cart.id,
+              paymentExpiresAt: new Date(Date.now() + 10 * 60 * 1e3).toISOString()
+            }
           }));
           const oid = ord.id;
           await orderRepo().update(oid, {
@@ -33722,6 +33923,7 @@ function createStorefrontApiHandler(config) {
             status: 404
           });
           const o = order;
+          await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, o);
           const lines = (o.items || []).map((line) => {
             const p = line.product;
             return {
@@ -33782,6 +33984,87 @@ function createStorefrontApiHandler(config) {
             fulfillmentPreview: fulfillmentPreview || void 0
           });
         }
+        if (path2[0] === "orders" && path2.length === 3 && path2[2] === "cancel" && method === "POST") {
+          const orderId = parseInt(path2[1], 10);
+          if (!Number.isFinite(orderId)) return json({
+            error: "Invalid order id"
+          }, {
+            status: 400
+          });
+          const order = await orderRepo().findOne({
+            where: {
+              id: orderId,
+              deleted: false
+            }
+          });
+          if (!order) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
+          const o = order;
+          const status = String(o.status || "").toLowerCase();
+          if (status === "pending") {
+            const meta = typeof o.metadata === "object" && o.metadata ? o.metadata : {};
+            const updatedMeta = {
+              ...meta,
+              cancelReason: "Cancelled by user during payment window"
+            };
+            await orderRepo().update(orderId, {
+              status: "cancelled",
+              metadata: updatedMeta
+            });
+            try {
+              if (entityMap.payments) {
+                const payRepo = dataSource.getRepository(entityMap.payments);
+                const pendingPayment = await payRepo.findOne({
+                  where: {
+                    orderId,
+                    status: "pending"
+                  }
+                });
+                if (pendingPayment) {
+                  await payRepo.update(pendingPayment.id, {
+                    status: "unpaid"
+                  });
+                }
+              }
+            } catch {
+            }
+            try {
+              const { cart } = await getOrCreateCart(req);
+              const cartId = cart?.id;
+              if (cartId && Number.isFinite(cartId) && cartId > 0) {
+                await cartItemRepo().delete({
+                  cartId
+                });
+                await cartRepo().update(cartId, {
+                  updatedAt: /* @__PURE__ */ new Date()
+                });
+              }
+            } catch {
+            }
+            try {
+              void import('./emit-order-notification-trigger-CZU3V2WE.js').then(({ fireOrderNotificationTrigger }) => {
+                fireOrderNotificationTrigger("order_cancelled", orderId, {
+                  dataSource,
+                  entityMap
+                });
+                fireOrderNotificationTrigger("payment_failed", orderId, {
+                  dataSource,
+                  entityMap
+                });
+              }).catch(() => {
+              });
+            } catch {
+            }
+          }
+          return json({
+            ok: true,
+            orderId,
+            status: "cancelled"
+          });
+        }
         return json({
           error: "Not found"
         }, {
@@ -33799,4 +34082,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, autoExpireOrderIfPaymentTimeExceeded, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };