@infuro/cms-core 1.0.59 → 1.0.61

package/dist/index.js

@@ -1,12 +1,12 @@
-export { emitOrderNotificationTrigger, fireOrderNotificationTrigger } from './chunk-MXIWUFBP.js';
-import { checkMultiVendorEnabled, loadUserVendorContext, getPublicSettingsGroup, BlogGeneratorService } from './chunk-BTUEUA5H.js';
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, autoExpireOrderIfPaymentTimeExceeded, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging } from './chunk-BTUEUA5H.js';
+export { emitOrderNotificationTrigger, fireOrderNotificationTrigger } from './chunk-O2642WVS.js';
+import { checkMultiVendorEnabled, loadUserVendorContext, getPublicSettingsGroup, BlogGeneratorService } from './chunk-UHT4INVW.js';
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, autoExpireOrderIfPaymentTimeExceeded, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging } from './chunk-UHT4INVW.js';
 import { PgBossService } from './chunk-GO7PPYNU.js';
 export { JOB_RUNNER_QUEUE, PgBossService } from './chunk-GO7PPYNU.js';
 export { deductInventoryForConfirmedOrder, mergeInventoryLines, orderInventorySnapshotFromRow, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, restoreInventoryForCancelledOrder, validateInventoryForConfirmedOrderLines, validateInventoryForOrderBecomingConfirmed } from './chunk-3K5AIEIZ.js';
-import { parseEmailRecipientsFromConfig } from './chunk-HYW3MUXT.js';
-export { EmailService, buildEventOrderTemplateVariables, emailPlugin, emailTemplates, initWhatsappTriggerDispatcher, joinRecipientsForSend, parseEmailRecipientsFromConfig, queueWhatsApp, registerWhatsAppQueueProcessor, renderEmail, renderLayout, resendOrderNotification, serializeEmailRecipients } from './chunk-HYW3MUXT.js';
-export { KNOWN_NOTIFICATION_TRIGGERS, notificationTriggerEmitter } from './chunk-HCIRL37O.js';
+import { parseEmailRecipientsFromConfig } from './chunk-URN7GS23.js';
+export { EmailService, buildEventOrderTemplateVariables, emailPlugin, emailTemplates, initWhatsappTriggerDispatcher, joinRecipientsForSend, parseEmailRecipientsFromConfig, queueWhatsApp, registerWhatsAppQueueProcessor, renderEmail, renderLayout, resendOrderNotification, serializeEmailRecipients } from './chunk-URN7GS23.js';
+export { KNOWN_NOTIFICATION_TRIGGERS, notificationTriggerEmitter } from './chunk-T3HPSF7K.js';
 import './chunk-JXF23MPG.js';
 import { queueOrderPlacedEmails } from './chunk-L3525VXI.js';
 export { queueEmail, queueOrderPlacedEmails, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-L3525VXI.js';
@@ -16,11 +16,11 @@ import './chunk-JC6DLWTE.js';
 import './chunk-MQBT33IV.js';
 import './chunk-CRFV5WJK.js';
 export { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES, resolveEventOrderTemplate } from './chunk-AYERBA7I.js';
-export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCustomerUserFromGoogleOAuth, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isGoogleAuthPubliclyEnabled, resolveGoogleAuthConfig, seedAdministratorPermissions } from './chunk-BNKZNLEX.js';
-export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, customerPhoneForEmail, customerPhoneForUser, ensureCustomerForUser, ensureCustomerRecord, getRequiredPermission, isOpenEndpoint, isPublicMethod, isSyntheticCustomerPhone, linkUnclaimedContactToUser, normalizeCustomerPhone, sessionHasEntityAccess } from './chunk-RK5ETF2I.js';
+export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCustomerUserFromGoogleOAuth, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isGoogleAuthPubliclyEnabled, resolveGoogleAuthConfig, seedAdministratorPermissions } from './chunk-6DBDJ4VD.js';
+export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, customerPhoneForEmail, customerPhoneForUser, ensureCustomerForUser, ensureCustomerRecord, getRequiredPermission, isOpenEndpoint, isPublicMethod, isSyntheticCustomerPhone, linkUnclaimedContactToUser, normalizeCustomerPhone, sessionHasEntityAccess } from './chunk-NR44CK5E.js';
 export { activeUniqueValueExists, retireSoftDeletedUniqueValue } from './chunk-DBPSJYLZ.js';
-import { isSuperAdmin, isVendorGroupName } from './chunk-JIWUVQ6B.js';
-export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-JIWUVQ6B.js';
+import { isSuperAdmin, isVendorGroupName } from './chunk-MVHDC3XF.js';
+export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-MVHDC3XF.js';
 export { createCmsMiddleware, defaultPublicApiMethods, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, summarizeSessionUserForLog } from './chunk-WUQAOTHA.js';
 export { queueErpPaidOrderForOrderId } from './chunk-TDV6EJHV.js';
 import { erpSafeWebhookUrl, logErp, warnErp, errorErp } from './chunk-SYBOCAWB.js';
@@ -1050,37 +1050,91 @@ var LOG = "[s3]";
 function serializeS3Error(err) {
   if (!err || typeof err !== "object") {
     return {
-      error: String(err)
+      error: String(err),
+      errorType: typeof err
     };
   }
   const e = err;
-  return {
+  const out = {
     name: e.name,
     message: e.message,
     code: e.Code ?? e.code,
+    fault: e.$fault,
     httpStatus: e.$metadata?.httpStatusCode,
     requestId: e.$metadata?.requestId,
     extendedRequestId: e.$metadata?.extendedRequestId,
-    cfId: e.$metadata?.cfId
+    cfId: e.$metadata?.cfId,
+    attempts: e.$metadata?.attempts,
+    totalRetryDelay: e.$metadata?.totalRetryDelay,
+    stack: e.stack
   };
+  if (e.cause != null) {
+    out.cause = serializeS3Error(e.cause);
+  }
+  try {
+    const extras = {};
+    for (const k of Object.keys(e)) {
+      if (k === "name" || k === "message" || k === "Code" || k === "code" || k === "$fault" || k === "$metadata" || k === "stack" || k === "cause") {
+        continue;
+      }
+      const v = e[k];
+      if (typeof v === "string" || typeof v === "number" || typeof v === "boolean" || v == null) {
+        extras[k] = v;
+      } else {
+        extras[k] = String(v);
+      }
+    }
+    if (Object.keys(extras).length > 0) out.extras = extras;
+  } catch {
+  }
+  return out;
 }
 __name(serializeS3Error, "serializeS3Error");
 function publicObjectUrl(config, fullKey) {
+  console.info(LOG, "build public URL", {
+    fullKey,
+    hasBaseUrl: Boolean(config.baseUrl),
+    baseUrl: config.baseUrl ?? null,
+    bucket: config.bucket,
+    region: config.region
+  });
   if (config.baseUrl) {
-    return `${config.baseUrl.replace(/\/$/, "")}/${fullKey}`;
+    const url2 = `${config.baseUrl.replace(/\/$/, "")}/${fullKey}`;
+    console.info(LOG, "public URL from baseUrl", {
+      fullKey,
+      url: url2
+    });
+    return url2;
   }
-  return `https://s3.${config.region}.amazonaws.com/${config.bucket}/${fullKey}`;
+  const url = `https://s3.${config.region}.amazonaws.com/${config.bucket}/${fullKey}`;
+  console.info(LOG, "public URL from default S3 endpoint", {
+    fullKey,
+    url
+  });
+  return url;
 }
 __name(publicObjectUrl, "publicObjectUrl");
 function describeS3Config(config) {
-  const base = config.baseUrl ? new URL(config.baseUrl).host : null;
+  let baseUrlHost = null;
+  try {
+    baseUrlHost = config.baseUrl ? new URL(config.baseUrl).host : null;
+  } catch (err) {
+    console.error(LOG, "invalid baseUrl while describing config", {
+      baseUrl: config.baseUrl,
+      ...serializeS3Error(err)
+    });
+    baseUrlHost = config.baseUrl ?? null;
+  }
   return {
     bucket: config.bucket,
     region: config.region,
     prefix: config.prefix ?? "uploads",
     hasBaseUrl: Boolean(config.baseUrl),
-    baseUrlHost: base,
-    accessKeyIdLast4: config.accessKeyId.slice(-4),
+    baseUrl: config.baseUrl ?? null,
+    baseUrlHost,
+    accessKeyIdLast4: config.accessKeyId ? config.accessKeyId.slice(-4) : null,
+    accessKeyIdLength: config.accessKeyId?.length ?? 0,
+    secretAccessKeyLength: config.secretAccessKey?.length ?? 0,
     envSummary: {
       AWS_BUCKET_NAME: Boolean(config.bucket),
       AWS_REGION: Boolean(config.region),
@@ -1091,7 +1145,11 @@ function describeS3Config(config) {
   };
 }
 __name(describeS3Config, "describeS3Config");
-async function probePublicUrl(url) {
+async function probePublicUrl(url, fullKey) {
+  console.info(LOG, "probe public URL start", {
+    url,
+    fullKey
+  });
   try {
     const head = await fetch(url, {
       method: "HEAD",
@@ -1099,15 +1157,25 @@ async function probePublicUrl(url) {
     });
     const headInfo = {
       url,
+      fullKey,
       status: head.status,
       ok: head.ok,
       contentType: head.headers.get("content-type"),
-      location: head.headers.get("location")
+      contentLength: head.headers.get("content-length"),
+      location: head.headers.get("location"),
+      cacheControl: head.headers.get("cache-control"),
+      etag: head.headers.get("etag")
     };
+    console.info(LOG, "probe HEAD result", headInfo);
     if (head.ok) {
       console.info(LOG, "public URL reachable (HEAD)", headInfo);
       return;
     }
+    console.warn(LOG, "probe HEAD not ok \u2014 trying ranged GET", {
+      url,
+      fullKey,
+      status: head.status
+    });
     const getRes = await fetch(url, {
       method: "GET",
       headers: {
@@ -1118,19 +1186,26 @@ async function probePublicUrl(url) {
     let bodySnippet = "";
     try {
       bodySnippet = (await getRes.text()).slice(0, 400);
-    } catch {
+    } catch (bodyErr) {
+      console.error(LOG, "probe GET body read failed", {
+        url,
+        fullKey,
+        ...serializeS3Error(bodyErr)
+      });
     }
     console.error(LOG, "public URL not readable \u2014 admin images will not display", {
       ...headInfo,
       getStatus: getRes.status,
       getOk: getRes.ok,
       getContentType: getRes.headers.get("content-type"),
+      getContentLength: getRes.headers.get("content-length"),
       bodySnippet
     });
   } catch (err) {
     console.error(LOG, "public URL probe failed", {
       url,
-      error: err instanceof Error ? err.message : String(err)
+      fullKey,
+      ...serializeS3Error(err)
     });
   }
 }
@@ -1138,9 +1213,69 @@ __name(probePublicUrl, "probePublicUrl");
 function getS3Storage(config) {
   const prefix = (config.prefix ?? "uploads").replace(/\/$/, "");
   const keyPrefix = prefix ? `${prefix}/` : "";
+  console.info(LOG, "storage service created", {
+    ...describeS3Config(config),
+    keyPrefix,
+    resolvedPrefix: prefix
+  });
   return {
     async upload(buffer, key, contentType) {
-      const { S3Client, PutObjectCommand } = await import('@aws-sdk/client-s3');
+      const uploadId = `upl-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      const started = Date.now();
+      console.info(LOG, "upload() called", {
+        uploadId,
+        incomingKey: key,
+        contentType,
+        bytes: buffer?.length ?? null,
+        isBuffer: Buffer.isBuffer(buffer),
+        ...describeS3Config(config)
+      });
+      if (!buffer || !Buffer.isBuffer(buffer)) {
+        console.error(LOG, "upload aborted \u2014 invalid buffer", {
+          uploadId,
+          incomingKey: key,
+          bufferType: typeof buffer,
+          isBuffer: Buffer.isBuffer(buffer)
+        });
+        throw new Error("S3 upload: invalid buffer");
+      }
+      if (!key || typeof key !== "string") {
+        console.error(LOG, "upload aborted \u2014 invalid key", {
+          uploadId,
+          key,
+          keyType: typeof key
+        });
+        throw new Error("S3 upload: invalid key");
+      }
+      console.info(LOG, "importing @aws-sdk/client-s3", {
+        uploadId,
+        key
+      });
+      let S3Client;
+      let PutObjectCommand;
+      let HeadObjectCommand;
+      try {
+        const sdk = await import('@aws-sdk/client-s3');
+        S3Client = sdk.S3Client;
+        PutObjectCommand = sdk.PutObjectCommand;
+        HeadObjectCommand = sdk.HeadObjectCommand;
+        console.info(LOG, "AWS SDK import ok", {
+          uploadId,
+          key
+        });
+      } catch (err) {
+        console.error(LOG, "AWS SDK import failed", {
+          uploadId,
+          key,
+          ...serializeS3Error(err)
+        });
+        throw err;
+      }
+      console.info(LOG, "creating S3Client", {
+        uploadId,
+        region: config.region,
+        accessKeyIdLast4: config.accessKeyId.slice(-4)
+      });
       const client = new S3Client({
         region: config.region,
         credentials: {
@@ -1151,47 +1286,114 @@ function getS3Storage(config) {
       const rawKey = key.replace(/^\/+/, "");
       const fullKey = keyPrefix + rawKey;
       const publicUrl = publicObjectUrl(config, fullKey);
-      const started = Date.now();
-      console.info(LOG, "upload start", {
-        ...describeS3Config(config),
-        key: rawKey,
+      console.info(LOG, "resolved S3 object key", {
+        uploadId,
+        incomingKey: key,
+        rawKey,
+        keyPrefix,
         fullKey,
+        bucket: config.bucket,
+        region: config.region,
         publicUrl,
         contentType,
-        bytes: buffer.length
+        bytes: buffer.length,
+        note: "PutObject will use Bucket + Key (= fullKey)"
+      });
+      const putInput = {
+        Bucket: config.bucket,
+        Key: fullKey,
+        Body: buffer,
+        ContentType: contentType
+      };
+      console.info(LOG, "PutObjectCommand prepared", {
+        uploadId,
+        Bucket: putInput.Bucket,
+        Key: putInput.Key,
+        ContentType: putInput.ContentType,
+        BodyBytes: buffer.length,
+        BodyIsBuffer: Buffer.isBuffer(putInput.Body)
       });
+      let putResult;
       try {
-        await client.send(new PutObjectCommand({
-          Bucket: config.bucket,
-          Key: fullKey,
-          Body: buffer,
-          ContentType: contentType
-        }));
+        console.info(LOG, "PutObject send start", {
+          uploadId,
+          bucket: config.bucket,
+          fullKey,
+          msElapsed: Date.now() - started
+        });
+        putResult = await client.send(new PutObjectCommand(putInput));
+        console.info(LOG, "PutObject send returned", {
+          uploadId,
+          bucket: config.bucket,
+          fullKey,
+          ETag: putResult?.ETag,
+          VersionId: putResult?.VersionId,
+          httpStatus: putResult?.$metadata?.httpStatusCode,
+          requestId: putResult?.$metadata?.requestId,
+          ms: Date.now() - started
+        });
       } catch (err) {
-        const errorDump = serializeS3Error(err);
         console.error(LOG, "PutObject failed", {
+          uploadId,
           ...describeS3Config(config),
-          key: rawKey,
+          incomingKey: key,
+          rawKey,
+          keyPrefix,
           fullKey,
           publicUrl,
           contentType,
           bytes: buffer.length,
-          ...errorDump,
+          ms: Date.now() - started,
+          ...serializeS3Error(err),
           rawError: err instanceof Error ? err.message : String(err)
         });
         throw err;
       }
-      console.info(LOG, "PutObject ok", {
+      console.info(LOG, "PutObject ok \u2014 verifying with HeadObject", {
+        uploadId,
+        bucket: config.bucket,
+        fullKey,
+        publicUrl
+      });
+      try {
+        const head = await client.send(new HeadObjectCommand({
+          Bucket: config.bucket,
+          Key: fullKey
+        }));
+        console.info(LOG, "HeadObject ok \u2014 object exists in bucket", {
+          uploadId,
+          bucket: config.bucket,
+          fullKey,
+          contentType: head.ContentType,
+          contentLength: head.ContentLength,
+          etag: head.ETag,
+          lastModified: head.LastModified?.toISOString?.() ?? head.LastModified,
+          httpStatus: head.$metadata?.httpStatusCode,
+          requestId: head.$metadata?.requestId
+        });
+      } catch (headErr) {
+        console.error(LOG, "HeadObject failed after PutObject \u2014 key may be wrong or ACL/permission issue", {
+          uploadId,
+          bucket: config.bucket,
+          fullKey,
+          publicUrl,
+          ...serializeS3Error(headErr)
+        });
+      }
+      console.info(LOG, "upload complete", {
+        uploadId,
         ...describeS3Config(config),
-        key: rawKey,
+        incomingKey: key,
+        rawKey,
         fullKey,
         publicUrl,
         contentType,
         bytes: buffer.length,
         ms: Date.now() - started,
+        ETag: putResult?.ETag,
         hasCustomBaseUrl: Boolean(config.baseUrl)
       });
-      void probePublicUrl(publicUrl);
+      void probePublicUrl(publicUrl, fullKey);
       return publicUrl;
     }
   };
@@ -1202,26 +1404,66 @@ function s3StoragePlugin(config) {
     name: "storage",
     version: "1.0.0",
     async init(context) {
+      console.info(LOG, "plugin init start", {
+        configKeys: Object.keys(config ?? {}),
+        hasContextConfig: Boolean(context?.config),
+        contextConfigKeys: context?.config ? Object.keys(context.config) : []
+      });
       const region = config.region ?? context.config.AWS_REGION ?? "";
       const accessKeyId = config.accessKeyId ?? context.config.AWS_ACCESS_KEY_ID ?? "";
       const secretAccessKey = config.secretAccessKey ?? context.config.AWS_SECRET_ACCESS_KEY ?? "";
       const bucket = config.bucket ?? context.config.AWS_BUCKET_NAME ?? "";
       const baseUrl = config.baseUrl ?? context.config.S3_MEDIA_URL ?? context.config.S3_CUSTOM_DOMAIN;
+      console.info(LOG, "plugin init resolved raw values", {
+        region: region || "(empty)",
+        bucket: bucket || "(empty)",
+        prefix: config.prefix ?? "uploads",
+        hasAccessKeyId: Boolean(accessKeyId),
+        accessKeyIdLast4: accessKeyId ? accessKeyId.slice(-4) : null,
+        hasSecretAccessKey: Boolean(secretAccessKey),
+        secretAccessKeyLength: secretAccessKey?.length ?? 0,
+        baseUrlRaw: baseUrl ?? null,
+        fromPluginConfig: {
+          region: Boolean(config.region),
+          accessKeyId: Boolean(config.accessKeyId),
+          secretAccessKey: Boolean(config.secretAccessKey),
+          bucket: Boolean(config.bucket),
+          baseUrl: Boolean(config.baseUrl)
+        },
+        fromContext: {
+          AWS_REGION: Boolean(context.config.AWS_REGION),
+          AWS_ACCESS_KEY_ID: Boolean(context.config.AWS_ACCESS_KEY_ID),
+          AWS_SECRET_ACCESS_KEY: Boolean(context.config.AWS_SECRET_ACCESS_KEY),
+          AWS_BUCKET_NAME: Boolean(context.config.AWS_BUCKET_NAME),
+          S3_MEDIA_URL: Boolean(context.config.S3_MEDIA_URL),
+          S3_CUSTOM_DOMAIN: Boolean(context.config.S3_CUSTOM_DOMAIN)
+        }
+      });
       const resolvedBaseUrl = typeof baseUrl === "string" && baseUrl ? baseUrl.startsWith("http") ? baseUrl : `https://${baseUrl}` : void 0;
+      console.info(LOG, "plugin init baseUrl resolution", {
+        baseUrlRaw: baseUrl ?? null,
+        resolvedBaseUrl: resolvedBaseUrl ?? null
+      });
       if (!region || !accessKeyId || !secretAccessKey || !bucket) {
         console.error(LOG, "plugin init missing config", {
           hasRegion: Boolean(region),
           hasAccessKeyId: Boolean(accessKeyId),
           hasSecretAccessKey: Boolean(secretAccessKey),
           hasBucket: Boolean(bucket),
-          hasBaseUrl: Boolean(resolvedBaseUrl)
+          hasBaseUrl: Boolean(resolvedBaseUrl),
+          regionValue: region || null,
+          bucketValue: bucket || null
         });
         throw new Error("S3 storage plugin: missing region, accessKeyId, secretAccessKey or bucket");
       }
       let baseUrlHost = null;
       try {
         baseUrlHost = resolvedBaseUrl ? new URL(resolvedBaseUrl).host : null;
-      } catch {
+      } catch (err) {
+        console.error(LOG, "plugin init invalid resolvedBaseUrl", {
+          resolvedBaseUrl,
+          ...serializeS3Error(err)
+        });
         baseUrlHost = resolvedBaseUrl ?? null;
       }
       console.info(LOG, "plugin ready", {
@@ -1229,6 +1471,7 @@ function s3StoragePlugin(config) {
         bucket,
         prefix: config.prefix ?? "uploads",
         hasBaseUrl: Boolean(resolvedBaseUrl),
+        baseUrl: resolvedBaseUrl ?? null,
         baseUrlHost,
         accessKeyIdLast4: accessKeyId.slice(-4),
         envSummary: {
@@ -2491,6 +2734,27 @@ var DEFAULT_ORDER_NOTIFICATION_TRIGGER_SEEDS = [
     description: "Fires when an order is cancelled (includes refund amount when applicable).",
     category: "order",
     sortOrder: 2
+  },
+  {
+    triggerKey: "payment_success",
+    label: "Payment success",
+    description: "Fires when order is placed and payment status is paid.",
+    category: "order",
+    sortOrder: 3
+  },
+  {
+    triggerKey: "payment_failed",
+    label: "Payment failed",
+    description: "Fires when payment status is pending, unpaid, or failed, or when order is cancelled without payment.",
+    category: "order",
+    sortOrder: 4
+  },
+  {
+    triggerKey: "payment_refund_initiated",
+    label: "Payment refund initiated",
+    description: "Fires when order is cancelled and its payment status is paid (refund initiated).",
+    category: "order",
+    sortOrder: 5
   }
 ];
 
@@ -2503,6 +2767,18 @@ var ORDER_NOTIFICATION_TRIGGERS = [
   {
     key: "order_cancelled",
     label: "Order cancelled"
+  },
+  {
+    key: "payment_success",
+    label: "Payment success"
+  },
+  {
+    key: "payment_failed",
+    label: "Payment failed"
+  },
+  {
+    key: "payment_refund_initiated",
+    label: "Payment refund initiated"
   }
 ];
 function disablePgNative() {
@@ -2749,13 +3025,18 @@ __name(withAdminRlsContext, "withAdminRlsContext");
 
 // src/plugins/captcha/captcha-service.ts
 function resolveKeys(config) {
-  const turnstile = config.TURNSTILE_SITE_KEY?.trim() && config.TURNSTILE_SECRET_KEY?.trim() ? {
-    site: config.TURNSTILE_SITE_KEY.trim(),
-    secret: config.TURNSTILE_SECRET_KEY.trim()
+  const isTurnstileDisabled = config.enabled === "false" || config.turnstile_enabled === "false";
+  const turnstileSite = (config.TURNSTILE_SITE_KEY ?? config.siteKey ?? config.site_key ?? "").trim();
+  const turnstileSecret = (config.TURNSTILE_SECRET_KEY ?? config.secretKey ?? config.secret_key ?? "").trim();
+  const turnstile = !isTurnstileDisabled && turnstileSite && turnstileSecret ? {
+    site: turnstileSite,
+    secret: turnstileSecret
   } : null;
-  const recaptcha = config.RECAPTCHA_SITE_KEY?.trim() && config.RECAPTCHA_SECRET_KEY?.trim() ? {
-    site: config.RECAPTCHA_SITE_KEY.trim(),
-    secret: config.RECAPTCHA_SECRET_KEY.trim()
+  const recaptchaSite = (config.RECAPTCHA_SITE_KEY ?? config.recaptchaSiteKey ?? "").trim();
+  const recaptchaSecret = (config.RECAPTCHA_SECRET_KEY ?? config.recaptchaSecretKey ?? "").trim();
+  const recaptcha = recaptchaSite && recaptchaSecret ? {
+    site: recaptchaSite,
+    secret: recaptchaSecret
   } : null;
   const raw = config.CAPTCHA_PROVIDER?.trim().toLowerCase();
   let envDefaultProvider = null;

package/dist/migrations/1782800000000-AddPaymentSuccessFailedRefundTriggers.ts

@@ -0,0 +1,32 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+/** Add 3 new order notification triggers: payment_success, payment_failed, and payment_refund_initiated. */
+export class AddPaymentSuccessFailedRefundTriggers1782800000000 implements MigrationInterface {
+  name = 'AddPaymentSuccessFailedRefundTriggers1782800000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      INSERT INTO "order_notification_triggers" ("triggerKey", "label", "description", "category", "sortOrder")
+      VALUES
+        ('payment_success', 'Payment success', 'Fires when order is placed and payment status is paid.', 'order', 3),
+        ('payment_failed', 'Payment failed', 'Fires when payment status is pending, unpaid, or failed, or when order is cancelled without payment.', 'order', 4),
+        ('payment_refund_initiated', 'Payment refund initiated', 'Fires when order is cancelled and its payment status is paid (refund initiated).', 'order', 5)
+      ON CONFLICT ("triggerKey") DO UPDATE SET
+        "label" = EXCLUDED."label",
+        "description" = EXCLUDED."description",
+        "sortOrder" = EXCLUDED."sortOrder",
+        "updatedAt" = now();
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      DELETE FROM "order_notification_bindings"
+      WHERE "triggerKey" IN ('payment_success', 'payment_failed', 'payment_refund_initiated');
+    `);
+    await queryRunner.query(`
+      DELETE FROM "order_notification_triggers"
+      WHERE "triggerKey" IN ('payment_success', 'payment_failed', 'payment_refund_initiated');
+    `);
+  }
+}

package/dist/migrations/1782900000000-AddEnableTurnstileToForms.ts

@@ -0,0 +1,29 @@
+import { MigrationInterface, QueryRunner, TableColumn } from 'typeorm';
+
+export class AddEnableTurnstileToForms1782800000000 implements MigrationInterface {
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    const hasTable = await queryRunner.hasTable('forms');
+    if (!hasTable) return;
+    const hasCol = await queryRunner.hasColumn('forms', 'enable_turnstile');
+    if (!hasCol) {
+      await queryRunner.addColumn(
+        'forms',
+        new TableColumn({
+          name: 'enable_turnstile',
+          type: 'boolean',
+          default: false,
+          isNullable: true,
+        })
+      );
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    const hasTable = await queryRunner.hasTable('forms');
+    if (!hasTable) return;
+    const hasCol = await queryRunner.hasColumn('forms', 'enable_turnstile');
+    if (hasCol) {
+      await queryRunner.dropColumn('forms', 'enable_turnstile');
+    }
+  }
+}

package/dist/{order-notification-dispatcher-2FCZFZUD.cjs → order-notification-dispatcher-KJVGLK5E.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkHXLC56ZK_cjs = require('./chunk-HXLC56ZK.cjs');
-require('./chunk-UCKN4BBY.cjs');
+var chunkYSYX4GUD_cjs = require('./chunk-YSYX4GUD.cjs');
+require('./chunk-77I3KS7V.cjs');
 require('./chunk-V25RDUOU.cjs');
 require('./chunk-BXYZDMTZ.cjs');
 require('./chunk-UPLVMVRX.cjs');
@@ -12,13 +12,13 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "getSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkHXLC56ZK_cjs.getSettingsGroup; }
+  get: function () { return chunkYSYX4GUD_cjs.getSettingsGroup; }
 });
 Object.defineProperty(exports, "initWhatsappTriggerDispatcher", {
   enumerable: true,
-  get: function () { return chunkHXLC56ZK_cjs.initWhatsappTriggerDispatcher; }
+  get: function () { return chunkYSYX4GUD_cjs.initWhatsappTriggerDispatcher; }
 });
 Object.defineProperty(exports, "resendOrderNotification", {
   enumerable: true,
-  get: function () { return chunkHXLC56ZK_cjs.resendOrderNotification; }
+  get: function () { return chunkYSYX4GUD_cjs.resendOrderNotification; }
 });

package/dist/{order-notification-dispatcher-64WDCHHG.js → order-notification-dispatcher-ZSFKEYMP.js}

@@ -1,5 +1,5 @@
-export { getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-HYW3MUXT.js';
-import './chunk-HCIRL37O.js';
+export { getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-URN7GS23.js';
+import './chunk-T3HPSF7K.js';
 import './chunk-L3525VXI.js';
 import './chunk-2KUCQVAQ.js';
 import './chunk-JC6DLWTE.js';