@infuro/cms-core 1.0.60 → 1.0.61

package/dist/api.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkBSLNXKV2_cjs = require('./chunk-BSLNXKV2.cjs');
+var chunkCNAHVRRU_cjs = require('./chunk-CNAHVRRU.cjs');
 require('./chunk-XQ3QUHWR.cjs');
 require('./chunk-HY3AXLOI.cjs');
 require('./chunk-YSYX4GUD.cjs');
@@ -22,131 +22,131 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "autoExpireOrderIfPaymentTimeExceeded", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.autoExpireOrderIfPaymentTimeExceeded; }
+  get: function () { return chunkCNAHVRRU_cjs.autoExpireOrderIfPaymentTimeExceeded; }
 });
 Object.defineProperty(exports, "createAnalyticsHandlers", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createAnalyticsHandlers; }
+  get: function () { return chunkCNAHVRRU_cjs.createAnalyticsHandlers; }
 });
 Object.defineProperty(exports, "createBlogBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createBlogBySlugHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createBlogBySlugHandler; }
 });
 Object.defineProperty(exports, "createChangePasswordHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createChangePasswordHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createChangePasswordHandler; }
 });
 Object.defineProperty(exports, "createCmsApiHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createCmsApiHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createCmsApiHandler; }
 });
 Object.defineProperty(exports, "createCrudByIdHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createCrudByIdHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createCrudByIdHandler; }
 });
 Object.defineProperty(exports, "createCrudHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createCrudHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createCrudHandler; }
 });
 Object.defineProperty(exports, "createDashboardStatsHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createDashboardStatsHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createDashboardStatsHandler; }
 });
 Object.defineProperty(exports, "createEcommerceAnalyticsHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createEcommerceAnalyticsHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createEcommerceAnalyticsHandler; }
 });
 Object.defineProperty(exports, "createForgotPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createForgotPasswordHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createForgotPasswordHandler; }
 });
 Object.defineProperty(exports, "createFormBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createFormBySlugHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createFormBySlugHandler; }
 });
 Object.defineProperty(exports, "createInviteAcceptHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createInviteAcceptHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createInviteAcceptHandler; }
 });
 Object.defineProperty(exports, "createJobScheduleHandlers", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createJobScheduleHandlers; }
+  get: function () { return chunkCNAHVRRU_cjs.createJobScheduleHandlers; }
 });
 Object.defineProperty(exports, "createLlmAgentKnowledgeHandlers", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createLlmAgentKnowledgeHandlers; }
+  get: function () { return chunkCNAHVRRU_cjs.createLlmAgentKnowledgeHandlers; }
 });
 Object.defineProperty(exports, "createMediaZipExtractHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createMediaZipExtractHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createMediaZipExtractHandler; }
 });
 Object.defineProperty(exports, "createSetPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createSetPasswordHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createSetPasswordHandler; }
 });
 Object.defineProperty(exports, "createSettingsApiHandlers", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createSettingsApiHandlers; }
+  get: function () { return chunkCNAHVRRU_cjs.createSettingsApiHandlers; }
 });
 Object.defineProperty(exports, "createStorefrontApiHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createStorefrontApiHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createStorefrontApiHandler; }
 });
 Object.defineProperty(exports, "createUploadHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createUploadHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createUploadHandler; }
 });
 Object.defineProperty(exports, "createUserAuthApiRouter", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createUserAuthApiRouter; }
+  get: function () { return chunkCNAHVRRU_cjs.createUserAuthApiRouter; }
 });
 Object.defineProperty(exports, "createUserAvatarHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createUserAvatarHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createUserAvatarHandler; }
 });
 Object.defineProperty(exports, "createUserProfileHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createUserProfileHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createUserProfileHandler; }
 });
 Object.defineProperty(exports, "createUsersApiHandlers", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createUsersApiHandlers; }
+  get: function () { return chunkCNAHVRRU_cjs.createUsersApiHandlers; }
 });
 Object.defineProperty(exports, "createVendorDashboardHandler", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createVendorDashboardHandler; }
+  get: function () { return chunkCNAHVRRU_cjs.createVendorDashboardHandler; }
 });
 Object.defineProperty(exports, "createVendorOnboardHandlers", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.createVendorOnboardHandlers; }
+  get: function () { return chunkCNAHVRRU_cjs.createVendorOnboardHandlers; }
 });
 Object.defineProperty(exports, "getPublicSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.getPublicSettingsGroup; }
+  get: function () { return chunkCNAHVRRU_cjs.getPublicSettingsGroup; }
 });
 Object.defineProperty(exports, "mergeGuardrailsIntoSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.mergeGuardrailsIntoSystemPrompt; }
+  get: function () { return chunkCNAHVRRU_cjs.mergeGuardrailsIntoSystemPrompt; }
 });
 Object.defineProperty(exports, "parseLlmAgentValidationRules", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.parseLlmAgentValidationRules; }
+  get: function () { return chunkCNAHVRRU_cjs.parseLlmAgentValidationRules; }
 });
 Object.defineProperty(exports, "simpleDecrypt", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.simpleDecrypt; }
+  get: function () { return chunkCNAHVRRU_cjs.simpleDecrypt; }
 });
 Object.defineProperty(exports, "simpleEncrypt", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.simpleEncrypt; }
+  get: function () { return chunkCNAHVRRU_cjs.simpleEncrypt; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstAgentRules", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.validateUserMessageAgainstAgentRules; }
+  get: function () { return chunkCNAHVRRU_cjs.validateUserMessageAgainstAgentRules; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstStructuredRules", {
   enumerable: true,
-  get: function () { return chunkBSLNXKV2_cjs.validateUserMessageAgainstStructuredRules; }
+  get: function () { return chunkCNAHVRRU_cjs.validateUserMessageAgainstStructuredRules; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,

package/dist/api.js

@@ -1,4 +1,4 @@
-export { autoExpireOrderIfPaymentTimeExceeded, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-JAEUYYGA.js';
+export { autoExpireOrderIfPaymentTimeExceeded, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-UHT4INVW.js';
 import './chunk-GO7PPYNU.js';
 import './chunk-3K5AIEIZ.js';
 import './chunk-URN7GS23.js';

package/dist/{chunk-BSLNXKV2.cjs → chunk-CNAHVRRU.cjs}

@@ -3856,14 +3856,14 @@ function createCrudHandler(dataSource, entityMap, options) {
             if (Number.isFinite(n)) productWhere[key] = n;
           }
         }
-        const idsParam = searchParams.get("ids")?.trim();
-        if (idsParam) {
-          const ids = idsParam.split(",").map((s) => Number(s.trim())).filter((n) => Number.isFinite(n) && n > 0);
+        const idsParam2 = searchParams.get("ids")?.trim();
+        if (idsParam2) {
+          const ids = idsParam2.split(",").map((s) => Number(s.trim())).filter((n) => Number.isFinite(n) && n > 0);
           productWhere.id = ids.length > 0 ? typeorm.In(ids) : -1;
         } else {
-          const excludeIdsParam = searchParams.get("excludeIds")?.trim();
-          if (excludeIdsParam) {
-            const excludeIds = excludeIdsParam.split(",").map((s) => Number(s.trim())).filter((n) => Number.isFinite(n) && n > 0);
+          const excludeIdsParam2 = searchParams.get("excludeIds")?.trim();
+          if (excludeIdsParam2) {
+            const excludeIds = excludeIdsParam2.split(",").map((s) => Number(s.trim())).filter((n) => Number.isFinite(n) && n > 0);
             if (excludeIds.length > 0) productWhere.id = typeorm.Not(typeorm.In(excludeIds));
           }
         }
@@ -4140,6 +4140,24 @@ function createCrudHandler(dataSource, entityMap, options) {
         }
       }
       where = mergeDeletedFalseWhere(repo, where);
+      const idsParam = searchParams.get("ids")?.trim();
+      if (idsParam && columnNames.has("id")) {
+        const idList = idsParam.split(",").map((s) => Number(s.trim())).filter((n) => Number.isFinite(n) && n > 0);
+        if (idList.length > 0) {
+          where = mergeListWhereAnd(where, {
+            id: typeorm.In(idList)
+          });
+        }
+      }
+      const excludeIdsParam = searchParams.get("excludeIds")?.trim();
+      if (excludeIdsParam && columnNames.has("id")) {
+        const excludeIdList = excludeIdsParam.split(",").map((s) => Number(s.trim())).filter((n) => Number.isFinite(n) && n > 0);
+        if (excludeIdList.length > 0) {
+          where = mergeListWhereAnd(where, {
+            id: typeorm.Not(typeorm.In(excludeIdList))
+          });
+        }
+      }
       if (resourceUsesVendorScope(resource)) {
         const scope = await resolveScope();
         const catalogFlags = await getVendorCatalogCreateFlags(dataSource);
@@ -8820,25 +8838,79 @@ function createUploadHandler(config) {
     "application/x-zip-compressed"
   ];
   return /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async function POST(req) {
+    const reqId = `req-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    console.info("[upload] POST /api/upload start", {
+      reqId,
+      method: req.method,
+      contentType: req.headers.get("content-type"),
+      contentLength: req.headers.get("content-length"),
+      hasStorageConfig: storage != null
+    });
     const authErr = await requireAuth(req);
-    if (authErr) return authErr;
+    if (authErr) {
+      console.error("[upload] auth failed", {
+        reqId,
+        status: authErr.status
+      });
+      return authErr;
+    }
+    console.info("[upload] auth ok", {
+      reqId
+    });
     if (requireEntityPermission) {
       const pe = await requireEntityPermission(req, "upload", "create");
-      if (pe) return pe;
+      if (pe) {
+        console.error("[upload] permission denied", {
+          reqId,
+          status: pe.status
+        });
+        return pe;
+      }
+      console.info("[upload] permission ok", {
+        reqId,
+        entity: "upload",
+        action: "create"
+      });
     }
     try {
+      console.info("[upload] parsing formData", {
+        reqId
+      });
       const formData = await req.formData();
       const file = formData.get("file");
-      if (!file) return json({
-        error: "No file uploaded"
-      }, {
-        status: 400
-      });
-      if (!allowed.includes(file.type)) return json({
-        error: "File type not allowed"
-      }, {
-        status: 400
+      console.info("[upload] formData parsed", {
+        reqId,
+        hasFile: Boolean(file),
+        fileName: file?.name ?? null,
+        fileType: file?.type ?? null,
+        fileSize: file?.size ?? null,
+        formKeys: [
+          ...formData.keys()
+        ]
       });
+      if (!file) {
+        console.error("[upload] no file in formData", {
+          reqId
+        });
+        return json({
+          error: "No file uploaded"
+        }, {
+          status: 400
+        });
+      }
+      if (!allowed.includes(file.type)) {
+        console.error("[upload] file type not allowed", {
+          reqId,
+          fileType: file.type,
+          fileName: file.name,
+          allowed
+        });
+        return json({
+          error: "File type not allowed"
+        }, {
+          status: 400
+        });
+      }
       const defaultMax = 10 * 1024 * 1024;
       const maxZipBytes = 80 * 1024 * 1024;
       const maxVideoBytes = 100 * 1024 * 1024;
@@ -8846,25 +8918,51 @@ function createUploadHandler(config) {
       const isZip = file.type === "application/zip" || file.type === "application/x-zip-compressed";
       const isVideo = file.type === "video/mp4" || file.type === "video/webm" || file.type === "video/quicktime";
       const effectiveMax = isZip ? Math.max(baseMax, maxZipBytes) : isVideo ? Math.max(baseMax, maxVideoBytes) : baseMax;
-      if (file.size > effectiveMax) return json({
-        error: "File size exceeds limit"
-      }, {
-        status: 400
+      console.info("[upload] size check", {
+        reqId,
+        fileSize: file.size,
+        effectiveMax,
+        isZip,
+        isVideo,
+        isImage: file.type.startsWith("image/")
       });
+      if (file.size > effectiveMax) {
+        console.error("[upload] file too large", {
+          reqId,
+          fileSize: file.size,
+          effectiveMax,
+          fileName: file.name
+        });
+        return json({
+          error: "File size exceeds limit"
+        }, {
+          status: 400
+        });
+      }
       const parentRaw = formData.get("parentId");
       let parentId = null;
       if (parentRaw != null && String(parentRaw).trim() !== "") {
         const n = Number(parentRaw);
-        if (!Number.isFinite(n)) return json({
-          error: "Invalid parentId"
-        }, {
-          status: 400
-        });
+        if (!Number.isFinite(n)) {
+          console.error("[upload] invalid parentId", {
+            reqId,
+            parentRaw
+          });
+          return json({
+            error: "Invalid parentId"
+          }, {
+            status: 400
+          });
+        }
         parentId = n;
       }
       let folder = "";
       if (parentId != null) {
         if (!dataSource || !entityMap?.media) {
+          console.error("[upload] missing dataSource/entityMap for folder upload", {
+            reqId,
+            parentId
+          });
           return json({
             error: "Upload handler needs dataSource and entityMap for folder uploads"
           }, {
@@ -8878,6 +8976,12 @@ function createUploadHandler(config) {
           }
         });
         if (!p || p.kind !== "folder") {
+          console.error("[upload] parent is not a folder", {
+            reqId,
+            parentId,
+            found: Boolean(p),
+            kind: p ? p.kind : null
+          });
           return json({
             error: "parent must be a folder"
           }, {
@@ -8885,25 +8989,90 @@ function createUploadHandler(config) {
           });
         }
         folder = await relativePathFromMediaParentId(dataSource, entityMap, parentId);
+        console.info("[upload] resolved folder from parentId", {
+          reqId,
+          parentId,
+          folder
+        });
       } else {
         const folderRawLegacy = formData.get("folder") ?? formData.get("folderPath");
         if (folderRawLegacy && typeof folderRawLegacy === "string" && folderRawLegacy.trim()) {
           folder = sanitizeMediaFolderPath(folderRawLegacy);
+          console.info("[upload] resolved folder from legacy field", {
+            reqId,
+            folder
+          });
         }
       }
+      console.info("[upload] reading file into buffer", {
+        reqId,
+        fileName: file.name,
+        fileType: file.type,
+        fileSize: file.size
+      });
       const buffer = Buffer.from(await file.arrayBuffer());
       const fileName = `${Date.now()}-${file.name}`;
       const contentType = file.type || "application/octet-stream";
       const relativeUnderUploads = folder ? `${folder}/${fileName}` : fileName;
+      const storageKey = `uploads/${relativeUnderUploads}`;
+      console.info("[upload] S3/storage key prepared", {
+        reqId,
+        originalFileName: file.name,
+        stampedFileName: fileName,
+        folder: folder || "(root)",
+        relativeUnderUploads,
+        storageKey,
+        contentType,
+        bytes: buffer.length
+      });
       const raw = typeof storage === "function" ? storage() : storage;
+      console.info("[upload] resolving storage service", {
+        reqId,
+        storageKey,
+        storageIsFunction: typeof storage === "function",
+        rawIsPromise: raw instanceof Promise,
+        rawIsNullish: raw == null
+      });
       const storageService = raw instanceof Promise ? await raw : raw;
+      console.info("[upload] storage service resolved", {
+        reqId,
+        storageKey,
+        hasStorageService: Boolean(storageService)
+      });
       if (storageService) {
-        const fileUrl = await storageService.upload(buffer, `uploads/${relativeUnderUploads}`, contentType);
+        console.info("[upload] calling storage.upload", {
+          reqId,
+          storageKey,
+          contentType,
+          bytes: buffer.length
+        });
+        const uploadStarted = Date.now();
+        let fileUrl;
+        try {
+          fileUrl = await storageService.upload(buffer, storageKey, contentType);
+        } catch (storageErr) {
+          console.error("[upload] storage.upload threw", {
+            reqId,
+            storageKey,
+            contentType,
+            bytes: buffer.length,
+            ms: Date.now() - uploadStarted,
+            error: storageErr instanceof Error ? storageErr.message : String(storageErr),
+            name: storageErr instanceof Error ? storageErr.name : void 0,
+            stack: storageErr instanceof Error ? storageErr.stack : void 0,
+            code: storageErr && typeof storageErr === "object" && ("Code" in storageErr || "code" in storageErr) ? storageErr.Code ?? storageErr.code : void 0,
+            metadata: storageErr && typeof storageErr === "object" && "$metadata" in storageErr ? storageErr.$metadata : void 0
+          });
+          throw storageErr;
+        }
         console.info("[upload] stored via storage plugin", {
-          key: `uploads/${relativeUnderUploads}`,
+          reqId,
+          key: storageKey,
+          fullS3KeyHint: storageKey,
           contentType,
           bytes: buffer.length,
-          fileUrl
+          fileUrl,
+          ms: Date.now() - uploadStarted
         });
         return json({
           filePath: fileUrl,
@@ -8911,8 +9080,10 @@ function createUploadHandler(config) {
         });
       }
       console.warn("[upload] no storage plugin \u2014 writing local disk (broken on most deploys)", {
+        reqId,
         localUploadDir,
-        key: relativeUnderUploads
+        key: relativeUnderUploads,
+        storageKey
       });
       const fs2 = await import('fs/promises');
       const path2 = await import('path');
@@ -8923,6 +9094,12 @@ function createUploadHandler(config) {
       });
       await fs2.writeFile(filePath, buffer);
       const urlRel = `${localUploadDir.replace(/^\/+/, "").replace(/\\/g, "/")}/${relativeUnderUploads.replace(/\\/g, "/")}`;
+      console.info("[upload] local write ok", {
+        reqId,
+        diskPath: filePath,
+        filePath: `/${urlRel}`,
+        key: relativeUnderUploads
+      });
       return json({
         filePath: `/${urlRel}`,
         parentId
@@ -8931,11 +9108,13 @@ function createUploadHandler(config) {
       const message = err instanceof Error ? err.message : String(err);
       const awsMeta = err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0;
       console.error("[upload] File upload failed", {
+        reqId,
         error: message,
         stack: err instanceof Error ? err.stack : void 0,
         name: err instanceof Error ? err.name : void 0,
         code: err && typeof err === "object" && ("Code" in err || "code" in err) ? err.Code ?? err.code : void 0,
-        metadata: awsMeta
+        metadata: awsMeta,
+        raw: err instanceof Error ? void 0 : String(err)
       });
       if (/Failed to parse body as FormData/i.test(message)) {
         return json({
@@ -9272,13 +9451,43 @@ function createFormSaveHandlers(config) {
           }
         }
         if (Object.keys(formRow).length > 0) await formRepo().update(formId, formRow);
-        await fieldRepo().delete({
-          formId
-        });
+        const incomingFieldIds = /* @__PURE__ */ new Set();
         for (let i = 0; i < fields.length; i++) {
-          const row = normalizeFieldRow(fields[i], formId);
+          const f = fields[i];
+          const fieldId = f.id != null && Number.isFinite(Number(f.id)) && Number(f.id) > 0 ? Number(f.id) : null;
+          const row = normalizeFieldRow(f, formId);
           row.order = i + 1;
-          await fieldRepo().save(fieldRepo().create(row));
+          if (fieldId) {
+            const existingField = await fieldRepo().findOne({
+              where: {
+                id: fieldId,
+                formId
+              }
+            });
+            if (existingField) {
+              incomingFieldIds.add(fieldId);
+              await fieldRepo().update({
+                id: fieldId,
+                formId
+              }, row);
+              continue;
+            }
+          }
+          const created = await fieldRepo().save(fieldRepo().create(row));
+          if (created?.id) incomingFieldIds.add(created.id);
+        }
+        const allCurrentFields = await fieldRepo().find({
+          where: {
+            formId
+          }
+        });
+        for (const existingField of allCurrentFields) {
+          if (!incomingFieldIds.has(existingField.id)) {
+            await fieldRepo().delete({
+              id: existingField.id,
+              formId
+            });
+          }
         }
         const saved = await formRepo().findOne({
           where: {
@@ -9432,7 +9641,7 @@ function createFormSubmissionListHandler(config) {
       const limit = Math.min(100, Number(searchParams.get("limit")) || 10);
       const skip = (page - 1) * limit;
       const sortField = searchParams.get("sortField") || "createdAt";
-      const sortOrder = searchParams.get("sortOrder") === "desc" ? "DESC" : "ASC";
+      const sortOrder = searchParams.get("sortOrder") === "asc" ? "ASC" : "DESC";
       const [data, total] = await repo.findAndCount({
         skip,
         take: limit,
@@ -31204,7 +31413,7 @@ function createStorefrontApiHandler(config) {
     const meta = it.metadata && typeof it.metadata === "object" && !Array.isArray(it.metadata) ? it.metadata : {};
     const fromMeta = Number(meta.comboId ?? meta.combo_id);
     if (Number.isInteger(fromMeta) && fromMeta > 0) return fromMeta;
-    if (meta.isCombo === true || meta.type === "combo" || meta.lineType === "combo") {
+    if (meta.isCombo === true || meta.type === "combo" || meta.lineType === "combo" || meta.lineKind === "combo" || meta.itemType === "combo") {
       const pid = Number(it.productId);
       if (Number.isInteger(pid) && pid > 0) return pid;
     }
@@ -33333,7 +33542,10 @@ function createStorefrontApiHandler(config) {
             });
             if (existing) {
               await cartItemRepo().update(existing.id, {
-                quantity: existing.quantity + gi.quantity
+                quantity: gi.quantity,
+                ...gi.metadata ? {
+                  metadata: gi.metadata
+                } : {}
               });
             } else {
               await cartItemRepo().save(cartItemRepo().create({