@infuro/cms-core 1.0.65 → 1.0.67

package/dist/{chunk-YHEITFHR.cjs → chunk-BVLN75LP.cjs}

@@ -3,7 +3,7 @@
 var chunkWFMVD567_cjs = require('./chunk-WFMVD567.cjs');
 var chunkTHL5JDWJ_cjs = require('./chunk-THL5JDWJ.cjs');
 var chunkHY3AXLOI_cjs = require('./chunk-HY3AXLOI.cjs');
-var chunkNIRYYJIJ_cjs = require('./chunk-NIRYYJIJ.cjs');
+var chunk5MZFQRDW_cjs = require('./chunk-5MZFQRDW.cjs');
 var chunkH3IVLIPR_cjs = require('./chunk-H3IVLIPR.cjs');
 var chunk7NMT3GBR_cjs = require('./chunk-7NMT3GBR.cjs');
 var chunkXFDIIVZB_cjs = require('./chunk-XFDIIVZB.cjs');
@@ -12,9 +12,9 @@ var chunkUPLVMVRX_cjs = require('./chunk-UPLVMVRX.cjs');
 var chunkTZEMLHSP_cjs = require('./chunk-TZEMLHSP.cjs');
 var chunk3DZRIZOD_cjs = require('./chunk-3DZRIZOD.cjs');
 var chunkTJ2MIQUT_cjs = require('./chunk-TJ2MIQUT.cjs');
-var chunk4U6DATGZ_cjs = require('./chunk-4U6DATGZ.cjs');
+var chunkOV5TRZET_cjs = require('./chunk-OV5TRZET.cjs');
 var chunkOY2YTBMP_cjs = require('./chunk-OY2YTBMP.cjs');
-var chunkJ7FMZK66_cjs = require('./chunk-J7FMZK66.cjs');
+var chunkO4AFPDQ4_cjs = require('./chunk-O4AFPDQ4.cjs');
 var chunkD5FBNKQM_cjs = require('./chunk-D5FBNKQM.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 var typeorm = require('typeorm');
@@ -123,7 +123,7 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
         `, [
         primary.vendorRoleId
       ]);
-      vendorEntityPerms = chunkJ7FMZK66_cjs.permissionRowsToRecord(permRows);
+      vendorEntityPerms = chunkO4AFPDQ4_cjs.permissionRowsToRecord(permRows);
     } catch (err) {
       if (!isMissingVendorRoleSchemaError(err)) throw err;
     }
@@ -230,7 +230,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     ]);
     const resolvedId = Number(byEmailRows[0]?.id);
     if (!Number.isFinite(resolvedId)) {
-      chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
+      chunkO4AFPDQ4_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
         email: user.email,
         rawSessionId: user.id ?? null
       });
@@ -250,7 +250,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   const groupName = rows[0]?.groupName ?? user.groupName ?? null;
   const groupId = rows[0]?.groupId ?? user.groupId ?? void 0;
   const adminAccess = rows[0]?.adminAccess ?? user.adminAccess;
-  const isRBACAdmin = user.isRBACAdmin ?? chunkJ7FMZK66_cjs.isSuperAdmin({
+  const isRBACAdmin = user.isRBACAdmin ?? chunkO4AFPDQ4_cjs.isSuperAdmin({
     groupId,
     groupName,
     isRBACAdmin: user.isRBACAdmin
@@ -263,7 +263,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   };
   if (multiVendorEnabled) {
     ctx = await loadUserVendorContext(dataSource, id, user.activeVendorId);
-    flags = chunkJ7FMZK66_cjs.vendorPortalFlagsFromUser({
+    flags = chunkO4AFPDQ4_cjs.vendorPortalFlagsFromUser({
       email: user.email,
       isRBACAdmin,
       groupName,
@@ -298,7 +298,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     isVendorPortal: flags.isVendorPortal,
     isVendorOwner: flags.isVendorOwner
   };
-  chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser", {
+  chunkO4AFPDQ4_cjs.logRbac("hydrateVendorSessionUser", {
     email: user.email,
     userId: id,
     groupName,
@@ -911,7 +911,7 @@ function repoHasVendorIdColumn(repo) {
 }
 chunkUSNT2KNT_cjs.__name(repoHasVendorIdColumn, "repoHasVendorIdColumn");
 function resourceUsesVendorScope(resource) {
-  return resource === "vendors" || chunkJ7FMZK66_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
+  return resource === "vendors" || chunkO4AFPDQ4_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 chunkUSNT2KNT_cjs.__name(resourceUsesVendorScope, "resourceUsesVendorScope");
 function mergeWhereClause(where, extra) {
@@ -1401,7 +1401,7 @@ async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, c
   }
   let customerId = null;
   if (entityMap.customer) {
-    const ensured = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
+    const ensured = await chunkOV5TRZET_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
       name,
       email,
       phone,
@@ -1684,6 +1684,30 @@ function entityHasSoftDelete(repo) {
   return repo.metadata.columns.some((c) => c.propertyName === "deleted");
 }
 chunkUSNT2KNT_cjs.__name(entityHasSoftDelete, "entityHasSoftDelete");
+async function recordOrderAssigneeHistory(dataSource, entityMap, orderId, userId, vendorId) {
+  if (!entityMap.order_assignees) return 1;
+  const assigneeRepo = dataSource.getRepository(entityMap.order_assignees);
+  const maxRow = await assigneeRepo.findOne({
+    where: {
+      orderId
+    },
+    order: {
+      sortOrder: "DESC"
+    }
+  });
+  const currentMax = Number(maxRow?.sortOrder ?? 0);
+  const nextSortOrder = currentMax + 1;
+  await assigneeRepo.save({
+    orderId,
+    userId,
+    vendorId,
+    sortOrder: nextSortOrder,
+    assignedAt: /* @__PURE__ */ new Date()
+  });
+  console.log(`[ORDERS-DEBUG][ASSIGNEE_HISTORY] Recorded assignment for order ${orderId}: user ${userId}, vendor ${vendorId}, sortOrder ${nextSortOrder}`);
+  return nextSortOrder;
+}
+chunkUSNT2KNT_cjs.__name(recordOrderAssigneeHistory, "recordOrderAssigneeHistory");
 var LIST_QUERY_RESERVED = /* @__PURE__ */ new Set([
   "page",
   "limit",
@@ -3566,10 +3590,38 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").andWhere("order.deleted = :orderDel", {
+        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").leftJoinAndSelect("order.vendor", "vendor").andWhere("order.deleted = :orderDel", {
           orderDel: false
         }).orderBy(`order.${sortField2}`, sortOrderOrders).skip(skip).take(limit);
-        applyVendorScopeToQueryBuilder(qb, "order", scope);
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][LIST] Querying orders. Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorPortal: session?.isVendorPortal,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          vendorIds: session?.vendorIds,
+          activeVendorId: session?.activeVendorId
+        }, "Scope:", scope);
+        if (scope.type === "deny") {
+          qb.andWhere("1 = 0");
+        } else if (scope.type === "vendor") {
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          console.log("[ORDERS-DEBUG][LIST] Vendor scope applied. isOwner:", isOwner, "vendorId:", scope.vendorId);
+          if (isOwner) {
+            qb.andWhere('(order.vendorId = :vendorScopeId OR order.assignedUserId IN (SELECT vu."userId" FROM vendor_users vu WHERE vu."vendorId" = :vendorScopeId))', {
+              vendorScopeId: scope.vendorId
+            });
+          } else {
+            const teamMemberId = Number(session?.id);
+            console.log("[ORDERS-DEBUG][LIST] Team member scoping to teamMemberId:", teamMemberId);
+            qb.andWhere("order.assignedUserId = :teamMemberId", {
+              teamMemberId
+            });
+          }
+        }
         const vendorIdFilter = searchParams.get("vendorId")?.trim();
         if (vendorIdFilter) {
           const n = Number(vendorIdFilter);
@@ -3622,7 +3674,15 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
+        console.log("[ORDERS-DEBUG][LIST] Executing SQL:", qb.getSql(), "Params:", qb.getParameters());
         const [rows, total2] = await qb.getManyAndCount();
+        console.log("[ORDERS-DEBUG][LIST] Query result: total =", total2, "rows length =", rows.length, "Orders:", rows.map((r) => ({
+          id: r.id,
+          orderNumber: r.orderNumber,
+          vendorId: r.vendorId,
+          assignedUserId: r.assignedUserId,
+          status: r.status
+        })));
         const data2 = await Promise.all(rows.map(async (order) => {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
           const contact = order.contact;
@@ -3666,6 +3726,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           if (orderStatus === "cancelled" && rawPayStatus !== "paid" && rawPayStatus !== "captured" && rawPayStatus !== "refunded") {
             paymentStatus2 = "unpaid";
           }
+          const vendorObj = order.vendor;
           return {
             ...orderWithoutPayments,
             contact: contact ? {
@@ -3679,6 +3740,11 @@ function createCrudHandler(dataSource, entityMap, options) {
               name: assignedUserObj.name || assignedUserObj.email,
               email: assignedUserObj.email
             } : null,
+            vendor: vendorObj ? {
+              id: vendorObj.id,
+              name: vendorObj.name || vendorObj.slug || `Vendor #${vendorObj.id}`,
+              slug: vendorObj.slug
+            } : null,
             itemsSummary,
             paymentStatus: paymentStatus2
           };
@@ -4211,6 +4277,18 @@ function createCrudHandler(dataSource, entityMap, options) {
               isCatalog: true
             });
           }
+        } else if (resource === "orders" && scope.type === "vendor") {
+          const session = await getHydratedSessionUser?.() ?? null;
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          if (!isOwner) {
+            const teamMemberId = Number(session?.id);
+            where = mergeListWhereAnd(where, {
+              vendorId: scope.vendorId,
+              assignedUserId: teamMemberId
+            });
+          } else {
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
+          }
         } else {
           where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
         }
@@ -4437,7 +4515,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const savedCustomer = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
+        const savedCustomer = await chunkOV5TRZET_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
           phone,
@@ -5175,6 +5253,12 @@ function createCrudHandler(dataSource, entityMap, options) {
               shippingAddressId: savedShipping?.id ?? null
             });
           }
+          if (persistBody.assignedUserId) {
+            const initAssignee = Number(persistBody.assignedUserId);
+            if (Number.isFinite(initAssignee) && initAssignee > 0) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, created.id, initAssignee, Number(created.vendorId) || null);
+            }
+          }
           const reloadedOrder = await repo.findOne({
             where: {
               id: created.id,
@@ -5239,7 +5323,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           const orderIdForNotify = created.id;
           const finalCreatedStatus = String(created.status ?? createdStatus ?? "pending").toLowerCase();
           const initialPayStatus = String(persistBody.paymentStatus ?? body.paymentStatus ?? "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
             if (finalCreatedStatus === "pending") {
               if (initialPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", orderIdForNotify, {
@@ -5494,7 +5578,16 @@ function createCrudHandler(dataSource, entityMap, options) {
       const scope = await resolveScope();
       const flags = await getVendorCatalogCreateFlags(dataSource);
       if (scope.type !== "all") {
-        data = data.filter((row) => vendorScopeRowAccess(row, scope, resource, flags) === "ok");
+        const session = await getHydratedSessionUser?.() ?? null;
+        const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+        const teamMemberId = Number(session?.id);
+        data = data.filter((row) => {
+          if (vendorScopeRowAccess(row, scope, resource, flags) !== "ok") return false;
+          if (resource === "orders" && scope.type === "vendor" && !isOwner) {
+            return Number(row?.assignedUserId) === teamMemberId;
+          }
+          return true;
+        });
       }
       const excludeCols = /* @__PURE__ */ new Set([
         "deletedAt",
@@ -5532,6 +5625,51 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
     type: "all"
   }));
   async function vendorScopeAccessJson(row, scope, resource) {
+    if (!row) return json({
+      message: "Not found"
+    }, {
+      status: 404
+    });
+    if (resource === "orders" && scope.type === "vendor") {
+      const rowVendorId = Number(row?.vendorId);
+      let orderBelongsToVendorScope = rowVendorId === scope.vendorId;
+      if (!orderBelongsToVendorScope) {
+        const aId = Number(row?.assignedUserId);
+        if (Number.isFinite(aId) && aId > 0 && entityMap["vendor_users"]) {
+          const vuRepo = dataSource.getRepository(entityMap["vendor_users"]);
+          const isTeamMember = await vuRepo.count({
+            where: {
+              vendorId: scope.vendorId,
+              userId: aId
+            }
+          });
+          if (isTeamMember > 0) {
+            orderBelongsToVendorScope = true;
+          }
+        }
+      }
+      if (!orderBelongsToVendorScope) {
+        return json({
+          error: "Forbidden"
+        }, {
+          status: 403
+        });
+      }
+      const session = await getHydratedSessionUser?.() ?? null;
+      const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+      if (!isOwner) {
+        const sessionUserId = Number(session?.id);
+        const orderAssignee = Number(row?.assignedUserId);
+        if (!Number.isFinite(orderAssignee) || orderAssignee !== sessionUserId) {
+          return json({
+            error: "Forbidden: You can only access orders assigned directly to you"
+          }, {
+            status: 403
+          });
+        }
+      }
+      return null;
+    }
     const flags = await getVendorCatalogCreateFlags(dataSource);
     const access = vendorScopeRowAccess(row, scope, resource, flags);
     if (access === "ok") return null;
@@ -5656,6 +5794,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       if (resource === "orders") {
         const scope2 = await resolveScopeById();
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Fetching order id:", id, "Scope:", scope2, "Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          activeVendorId: session?.activeVendorId,
+          vendorIds: session?.vendorIds
+        });
         const order = await repo.findOne({
           where: {
             id: Number(id)
@@ -5668,14 +5817,26 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product",
             "items.product.collection",
             "payments",
-            "assignedUser"
+            "assignedUser",
+            "vendor"
           ]
         });
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Order found in DB:", order ? {
+          id: order.id,
+          orderNumber: order.orderNumber,
+          vendorId: order.vendorId,
+          assignedUserId: order.assignedUserId,
+          status: order.status
+        } : null);
         if (order) {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
         }
         const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
-        if (orderDenied) return orderDenied;
+        if (orderDenied) {
+          console.log("[ORDERS-DEBUG][GET_BY_ID] Access DENIED for order id:", id);
+          return orderDenied;
+        }
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Access GRANTED for order id:", id);
         const relatedOrders = await repo.find({
           where: {
             parentOrderId: Number(id)
@@ -6059,21 +6220,67 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             lines: []
           } : await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, effectiveCurrency, putDiscountId, Number.isFinite(putOrderVendorId) ? putOrderVendorId : null);
           const scalarUpdate = pickColumnUpdates(repo, rawBody);
-          if (rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
-            const aId = Number(rawBody.assignedUserId);
-            if (Number.isFinite(aId) && aId > 0) {
-              scalarUpdate.assignedUserId = aId;
-              scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
-            } else {
-              scalarUpdate.assignedUserId = null;
-              scalarUpdate.assignedAt = null;
+          if (rawBody && typeof rawBody === "object") {
+            if (scopePutEarly.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+              const vId = Number(rawBody.vendorId);
+              if (Number.isFinite(vId) && vId > 0) {
+                scalarUpdate.vendorId = vId;
+              }
+            }
+            if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
+              const aId = Number(rawBody.assignedUserId);
+              if (Number.isFinite(aId) && aId > 0) {
+                if (scopePutEarly.type === "vendor" && entityMap.vendor_users) {
+                  const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+                  const vuLink = await vuRepo.findOne({
+                    where: {
+                      vendorId: scopePutEarly.vendorId,
+                      userId: aId
+                    }
+                  });
+                  if (!vuLink) {
+                    return json({
+                      error: "Cannot assign order to a user outside your vendor team."
+                    }, {
+                      status: 403
+                    });
+                  }
+                  scalarUpdate.vendorId = scopePutEarly.vendorId;
+                } else if (scopePutEarly.type === "all" && entityMap.vendor_users) {
+                  if (entityMap.vendors) {
+                    const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                       FROM vendor_users vu
+                       JOIN vendors v ON v.id = vu."vendorId"
+                       WHERE vu."userId" = $1 AND v.deleted = false
+                       ORDER BY vu.id DESC
+                       LIMIT 1`, [
+                      aId
+                    ]);
+                    if (activeVu.length > 0 && activeVu[0].vendorId) {
+                      scalarUpdate.vendorId = Number(activeVu[0].vendorId);
+                    }
+                  }
+                }
+                const prevAssigned = Number(existingOrderRow?.assignedUserId);
+                const prevVendor = Number(existingOrderRow?.vendorId);
+                const targetVendor = Number.isFinite(Number(scalarUpdate.vendorId)) ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId) || null;
+                if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+                  await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+                }
+                scalarUpdate.assignedUserId = aId;
+                scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
+              } else {
+                scalarUpdate.assignedUserId = null;
+                scalarUpdate.assignedAt = null;
+              }
             }
           }
           if (scalarUpdate.status === "processing") {
             const effectiveAssignee = scalarUpdate.assignedUserId !== void 0 ? scalarUpdate.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-            if (!effectiveAssignee) {
+            const effectiveVendor = scalarUpdate.vendorId !== void 0 ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId);
+            if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
               return json({
-                error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+                error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
               }, {
                 status: 400
               });
@@ -6319,7 +6526,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
           const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
           if (assigneeUpdated) {
-            void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
               fireOrderNotificationTrigger("order_assigned", updatedOrder.id, {
                 dataSource,
                 entityMap
@@ -6336,7 +6543,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             const payments = Array.isArray(updatedOrder.payments) ? updatedOrder.payments : [];
             const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
             const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-            void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
               if (newStatus === "pending") {
                 if (curPayStatus === "failed") {
                   fireOrderNotificationTrigger("payment_failed", updatedOrder.id, {
@@ -6490,7 +6697,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       const updatePayload = rawBody && typeof rawBody === "object" ? pickColumnUpdates(repo, rawBody) : {};
       if (resourceUsesVendorScope(resource)) {
-        delete updatePayload.vendorId;
+        if (!(resource === "orders" && scopePut.type === "all")) {
+          delete updatePayload.vendorId;
+        }
       }
       if (resource === "contacts" && "type" in updatePayload) {
         const t = updatePayload.type;
@@ -6886,9 +7095,59 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         }
       }
       if (resource === "orders" && orderInvPrev && rawBody && typeof rawBody === "object") {
+        console.log("[ORDERS-DEBUG][UPDATE] PUT /api/orders/" + numericId, "Scope:", scopePut, "rawBody:", rawBody, "existingOrder:", {
+          id: existingOrderRow?.id,
+          vendorId: existingOrderRow?.vendorId,
+          assignedUserId: existingOrderRow?.assignedUserId,
+          status: existingOrderRow?.status
+        });
+        if (scopePut.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+          const vId = Number(rawBody.vendorId);
+          if (Number.isFinite(vId) && vId > 0) {
+            updatePayload.vendorId = vId;
+          }
+        }
         if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
           const aId = Number(rawBody.assignedUserId);
+          console.log("[ORDERS-DEBUG][UPDATE] Updating assignedUserId to:", aId);
           if (Number.isFinite(aId) && aId > 0) {
+            if (scopePut.type === "vendor" && entityMap.vendor_users) {
+              const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+              const vuLink = await vuRepo.findOne({
+                where: {
+                  vendorId: scopePut.vendorId,
+                  userId: aId
+                }
+              });
+              if (!vuLink) {
+                return json({
+                  error: "Cannot assign order to a user outside your vendor team."
+                }, {
+                  status: 403
+                });
+              }
+              updatePayload.vendorId = scopePut.vendorId;
+            } else if (scopePut.type === "all" && entityMap.vendor_users) {
+              if (entityMap.vendors) {
+                const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                   FROM vendor_users vu
+                   JOIN vendors v ON v.id = vu."vendorId"
+                   WHERE vu."userId" = $1 AND v.deleted = false
+                   ORDER BY vu.id DESC
+                   LIMIT 1`, [
+                  aId
+                ]);
+                if (activeVu.length > 0 && activeVu[0].vendorId) {
+                  updatePayload.vendorId = Number(activeVu[0].vendorId);
+                }
+              }
+            }
+            const prevAssigned = Number(existingOrderRow?.assignedUserId);
+            const prevVendor = Number(existingOrderRow?.vendorId);
+            const targetVendor = Number.isFinite(Number(updatePayload.vendorId)) ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId) || null;
+            if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+            }
             updatePayload.assignedUserId = aId;
             updatePayload.assignedAt = /* @__PURE__ */ new Date();
           } else {
@@ -6896,11 +7155,13 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             updatePayload.assignedAt = null;
           }
         }
+        console.log("[ORDERS-DEBUG][UPDATE] Final updatePayload for order:", updatePayload);
         if (updatePayload.status === "processing") {
           const effectiveAssignee = updatePayload.assignedUserId !== void 0 ? updatePayload.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-          if (!effectiveAssignee) {
+          const effectiveVendor = updatePayload.vendorId !== void 0 ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId);
+          if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
             return json({
-              error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+              error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
             }, {
               status: 400
             });
@@ -6990,7 +7251,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                     });
                   }
                   if (ordStatus === "pending" || ordStatus === "confirmed") {
-                    void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+                    void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
                       fireOrderNotificationTrigger("order_placed", pOrder, {
                         dataSource,
                         entityMap
@@ -7004,7 +7265,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                   }
                 }
               } else if (newPayStatus === "failed") {
-                void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_failed", pOrder, {
                     dataSource,
                     entityMap
@@ -7012,7 +7273,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                 }).catch(() => {
                 });
               } else if (newPayStatus === "refunded") {
-                void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_refund_initiated", pOrder, {
                     dataSource,
                     entityMap
@@ -7139,7 +7400,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
         const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
         if (assigneeUpdated) {
-          void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_assigned", ord.id, {
               dataSource,
               entityMap
@@ -7156,7 +7417,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const payments = Array.isArray(ord.payments) ? ord.payments : [];
           const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
           const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
             if (newStatus === "pending") {
               if (curPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", ord.id, {
@@ -7853,7 +8114,7 @@ function createInviteAcceptHandler(config) {
       }
       const { userId, email, vendorId } = validation.target;
       if (entityMap.contacts) {
-        await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+        await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
@@ -8946,7 +9207,7 @@ function createVendorDashboardHandler(config) {
       if (pe) return pe;
     }
     const user = await getSessionUser();
-    if (!user || !chunkJ7FMZK66_cjs.isVendorPortalUser(user)) {
+    if (!user || !chunkO4AFPDQ4_cjs.isVendorPortalUser(user)) {
       return json({
         error: "Forbidden"
       }, {
@@ -10508,11 +10769,11 @@ function createUsersApiHandlers(config) {
           adminAccess
         }));
         if (entityMap.contacts) {
-          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
+          await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
         }
         if (entityMap.customer) {
           const phone = typeof body.phone === "string" && body.phone.trim() ? body.phone.trim() : null;
-          await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+          await chunkOV5TRZET_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
             id: newUser.id,
             name: String(newUser.name ?? body.name),
             email: String(newUser.email),
@@ -11602,7 +11863,7 @@ function createChatHandlers(config) {
         const notifyEmailAgent = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT, {
           enabledOnly: false
         });
-        const emailTool = chunkNIRYYJIJ_cjs.resolveChatEmailToolSettings(llmSettings, {
+        const emailTool = chunk5MZFQRDW_cjs.resolveChatEmailToolSettings(llmSettings, {
           chatbotValidationRules: agentRow?.validationRules ?? null,
           notifyAgent: notifyEmailAgent ? {
             systemInstruction: notifyEmailAgent.systemInstruction,
@@ -11612,7 +11873,7 @@ function createChatHandlers(config) {
         const emailPlugin2 = cms.getPlugin("email");
         const convLeadSent = conv.leadEmailSentAt;
         const chatAgentFn = llm.chatAgent?.bind(llm);
-        console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline check", {
+        console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline check", {
           conversationId,
           enabled: emailTool.enabled,
           intentCount: emailTool.intents.length,
@@ -11626,27 +11887,27 @@ function createChatHandlers(config) {
           mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
         });
         if (!emailTool.enabled) {
-          console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_tool_disabled"
           });
         } else if (emailTool.intents.length === 0) {
-          console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "no_intents_configured"
           });
         } else if (!emailPlugin2) {
-          console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_plugin_missing"
           });
         } else if (!chatAgentFn) {
-          console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "llm_chat_agent_unavailable"
           });
         } else if (convLeadSent) {
-          console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "lead_email_already_sent",
             leadEmailSentAt: convLeadSent
@@ -11659,7 +11920,7 @@ function createChatHandlers(config) {
             }
           });
           if (!contactRow) {
-            console.warn(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+            console.warn(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
               conversationId,
               reason: "contact_not_found",
               contactId
@@ -11667,7 +11928,7 @@ function createChatHandlers(config) {
           } else {
             const c = contactRow;
             try {
-              const intent = await chunkNIRYYJIJ_cjs.detectChatLeadIntent({
+              const intent = await chunk5MZFQRDW_cjs.detectChatLeadIntent({
                 chatAgent: chatAgentFn
               }, {
                 settings: emailTool,
@@ -11681,15 +11942,15 @@ function createChatHandlers(config) {
                 model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
               });
               if (!intent.intent || !intent.emailTo) {
-                console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "no email sent", {
+                console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "no email sent", {
                   conversationId,
                   reason: intent.intent ? "missing_email_to" : "no_intent_match",
                   intentLabel: intent.intentLabel,
                   classifierReason: intent.reason
                 });
               } else {
-                const intentRecipients = chunkNIRYYJIJ_cjs.parseIntentRecipientEmails(intent.emailTo);
-                console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                const intentRecipients = chunk5MZFQRDW_cjs.parseIntentRecipientEmails(intent.emailTo);
+                console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
                   conversationId,
                   intent: intent.intent,
                   emailTo: intent.emailTo,
@@ -11700,7 +11961,7 @@ function createChatHandlers(config) {
                 const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
                 const storeSettings = await loadSettingsGroupMap(dataSource, entityMap, "store");
                 const companyDetails = chunkTZEMLHSP_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings, storeSettings);
-                const leadResult = await chunkNIRYYJIJ_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                const leadResult = await chunk5MZFQRDW_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
                   contactName: String(c.name ?? "").trim() || "Visitor",
                   contactEmail: String(c.email ?? "").trim(),
                   contactPhone: c.phone ?? null,
@@ -11708,7 +11969,7 @@ function createChatHandlers(config) {
                   latestMessage: message,
                   intentCode: intent.intent,
                   intentReason: intent.intentLabel || intent.reason,
-                  transcript: chunkNIRYYJIJ_cjs.buildTranscriptForLeadEmail(history, message),
+                  transcript: chunk5MZFQRDW_cjs.buildTranscriptForLeadEmail(history, message),
                   companyDetails,
                   recipients: intentRecipients.length > 0 ? intentRecipients : void 0
                 });
@@ -11716,13 +11977,13 @@ function createChatHandlers(config) {
                   await convRepo().update(conversationId, {
                     leadEmailSentAt: /* @__PURE__ */ new Date()
                   });
-                  console.info(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
+                  console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
                     conversationId,
                     sent: true,
                     recipients: leadResult.recipients
                   });
                 } else {
-                  console.warn(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
+                  console.warn(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
                     conversationId,
                     sent: false,
                     error: leadResult.error ?? "unknown",
@@ -11731,7 +11992,7 @@ function createChatHandlers(config) {
                 }
               }
             } catch (intentErr) {
-              console.warn(chunkNIRYYJIJ_cjs.CHAT_EMAIL_LOG, "pipeline error", {
+              console.warn(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline error", {
                 conversationId,
                 error: intentErr instanceof Error ? intentErr.message : String(intentErr)
               });
@@ -11748,7 +12009,7 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = chunkNIRYYJIJ_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
+          const systemPrompt = chunk5MZFQRDW_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
           const res = await llm.chatAgent({
             ...fromAgent,
             systemPrompt: systemPrompt || void 0,
@@ -11769,7 +12030,7 @@ ${contextParts.join("\n\n")}` : "";
               agentRow.systemInstruction?.trim(),
               ragSystem
             ].filter(Boolean).join("\n\n");
-            systemContent = chunkNIRYYJIJ_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
+            systemContent = chunk5MZFQRDW_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -13024,7 +13285,7 @@ function createDeviceTokensHandlers(config) {
         const title = body.title?.trim() || "Test Push Notification";
         const msgBody = body.body?.trim() || "Firebase Push Notification setup is working!";
         if (!token || token === "validate" || token === "validate_only") {
-          const valRes = await chunkNIRYYJIJ_cjs.validateFcmCredentials(dataSource, entityMap);
+          const valRes = await chunk5MZFQRDW_cjs.validateFcmCredentials(dataSource, entityMap);
           if (!valRes.success) {
             return json({
               success: false,
@@ -13041,7 +13302,7 @@ function createDeviceTokensHandlers(config) {
             clientEmail: valRes.clientEmail
           });
         }
-        const res = await chunkNIRYYJIJ_cjs.sendFcmPushNotification(dataSource, entityMap, {
+        const res = await chunk5MZFQRDW_cjs.sendFcmPushNotification(dataSource, entityMap, {
           token,
           title,
           body: msgBody,
@@ -13595,7 +13856,7 @@ chunkUSNT2KNT_cjs.__name(findActiveRefundPolicyForVendor, "findActiveRefundPolic
 // src/api/admin-roles-handlers.ts
 function createAdminRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
-  const baseEntities = chunkJ7FMZK66_cjs.getPermissionableEntityKeys(entityMap);
+  const baseEntities = chunkO4AFPDQ4_cjs.getPermissionableEntityKeys(entityMap);
   const allowEntities = /* @__PURE__ */ new Set([
     ...baseEntities,
     "users"
@@ -13610,7 +13871,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk4U6DATGZ_cjs.canManageRoles(u) && !chunkJ7FMZK66_cjs.canManageVendorRoles(u)) {
+    if (!chunkOV5TRZET_cjs.canManageRoles(u) && !chunkO4AFPDQ4_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -13621,11 +13882,11 @@ function createAdminRolesHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunkJ7FMZK66_cjs.canManageVendorRoles(u) && !chunk4U6DATGZ_cjs.canManageRoles(u);
+    return chunkO4AFPDQ4_cjs.canManageVendorRoles(u) && !chunkOV5TRZET_cjs.canManageRoles(u);
   }
   chunkUSNT2KNT_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
-    ...chunkJ7FMZK66_cjs.VENDOR_STORE_RBAC_ENTITIES,
+    ...chunkO4AFPDQ4_cjs.VENDOR_STORE_RBAC_ENTITIES,
     "dashboard",
     "settings"
   ].sort();
@@ -13782,7 +14043,7 @@ function createAdminRolesHandlers(config) {
         }, {
           status: 404
         });
-        if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name) && !chunkJ7FMZK66_cjs.isSuperAdminGroupName(name)) {
+        if (chunkO4AFPDQ4_cjs.isSuperAdminGroupName(g.name) && !chunkO4AFPDQ4_cjs.isSuperAdminGroupName(name)) {
           return json({
             error: "Cannot rename the administrator group"
           }, {
@@ -13839,7 +14100,7 @@ function createAdminRolesHandlers(config) {
       }, {
         status: 404
       });
-      if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name)) return json({
+      if (chunkO4AFPDQ4_cjs.isSuperAdminGroupName(g.name)) return json({
         error: "Cannot delete the administrator group"
       }, {
         status: 400
@@ -14037,7 +14298,7 @@ async function sendVendorOnboardEmails(input, deps) {
       getVendorEmails(deps)
     ]);
     const companyDetails = chunkTZEMLHSP_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings, storeSettings);
-    const configuredNotify = chunkNIRYYJIJ_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
+    const configuredNotify = chunk5MZFQRDW_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const ownerEmail = input.ownerEmail?.trim() || "";
     const ownerEmailLower = ownerEmail.toLowerCase();
     const sendToOwner = input.sendToOwner !== false;
@@ -14071,7 +14332,7 @@ chunkUSNT2KNT_cjs.__name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
 async function insertRolePermissions(exec, vendorRoleId, permissions) {
-  for (const entity of chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES) {
+  for (const entity of chunkO4AFPDQ4_cjs.VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
     await exec.query(`
@@ -14102,7 +14363,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     for (const r of existing) {
       roleIdsByName2[r.name] = Number(r.id);
       if (r.isOwnerRole) ownerRoleId2 = Number(r.id);
-      if (r.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
+      if (r.name === chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
     }
     return {
       roleIdsByName: roleIdsByName2,
@@ -14113,7 +14374,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
   const roleIdsByName = {};
   let ownerRoleId = 0;
   let viewerRoleId = 0;
-  for (const def of chunkJ7FMZK66_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
+  for (const def of chunkO4AFPDQ4_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
     const inserted = await exec.query(`
       INSERT INTO "vendor_roles"
         ("vendorId", "name", "description", "isSystem", "isOwnerRole")
@@ -14130,7 +14391,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     if (!roleId) continue;
     roleIdsByName[def.name] = roleId;
     if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
+    if (def.name === chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
     await insertRolePermissions(exec, roleId, def.permissions);
   }
   return {
@@ -14160,7 +14421,7 @@ async function backfillVendorUserRoleIds(em, vendorId, seeded) {
       vendorId
     ]);
   }
-  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME];
+  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME];
   if (viewerId) {
     await em.query(`
       UPDATE "vendor_users"
@@ -14186,7 +14447,7 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
     LIMIT 1
     `, [
     vendorId,
-    chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME
+    chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME
   ]);
   const id = rows[0]?.id;
   return id != null ? Number(id) : null;
@@ -14547,7 +14808,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.isPlatformAdministrator(u)) return json({
       error: "Forbidden",
       reason: "admin_only"
     }, {
@@ -14557,7 +14818,7 @@ function createVendorOnboardHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
-    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u);
     const candidates = [];
     if (scope.type === "vendor") candidates.push(scope.vendorId);
     if (scope.type === "all" || scope.type === "vendor") {
@@ -14611,7 +14872,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.isVendorPortalUser(u) && !chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) {
+    if (!chunkO4AFPDQ4_cjs.isVendorPortalUser(u) && !chunkO4AFPDQ4_cjs.isPlatformAdministrator(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -14639,7 +14900,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.canManageVendorTeam(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.canManageVendorTeam(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -14857,7 +15118,7 @@ function createVendorOnboardHandlers(config) {
           await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
-              name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+              name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
               deleted: false
             }
           });
@@ -14872,12 +15133,12 @@ function createVendorOnboardHandlers(config) {
           if (!ownerGroup) {
             try {
               await groupRepo.save(groupRepo.create({
-                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }));
               ownerGroup = await groupRepo.findOne({
                 where: {
-                  name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                  name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                   deleted: false
                 }
               });
@@ -14994,7 +15255,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkOV5TRZET_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -15494,7 +15755,7 @@ function createVendorOnboardHandlers(config) {
           if (!groupId) {
             const g = await groupRepo.findOne({
               where: {
-                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }
             }) ?? await groupRepo.findOne({
@@ -15594,7 +15855,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkOV5TRZET_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -16131,10 +16392,10 @@ chunkUSNT2KNT_cjs.__name(createVendorOnboardHandlers, "createVendorOnboardHandle
 function createVendorRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
   const vendorRoleEntities = [
-    ...chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES
+    ...chunkO4AFPDQ4_cjs.VENDOR_RBAC_ENTITIES
   ].sort();
   async function resolveActiveVendorId(u) {
-    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -16150,7 +16411,7 @@ function createVendorRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.canManageVendorRoles(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.canManageVendorRoles(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -25145,6 +25406,109 @@ _ts_decorate69([
 exports.OrderNotificationTrigger = _ts_decorate69([
   typeorm.Entity("order_notification_triggers")
 ], exports.OrderNotificationTrigger);
+function _ts_decorate70(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+chunkUSNT2KNT_cjs.__name(_ts_decorate70, "_ts_decorate");
+function _ts_metadata70(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+chunkUSNT2KNT_cjs.__name(_ts_metadata70, "_ts_metadata");
+exports.OrderAssignee = class OrderAssignee {
+  static {
+    chunkUSNT2KNT_cjs.__name(this, "OrderAssignee");
+  }
+  id;
+  orderId;
+  userId;
+  vendorId;
+  sortOrder;
+  assignedAt;
+  createdAt;
+  order;
+  user;
+  vendor;
+};
+_ts_decorate70([
+  typeorm.PrimaryGeneratedColumn(),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "id", void 0);
+_ts_decorate70([
+  typeorm.Column("int"),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "orderId", void 0);
+_ts_decorate70([
+  typeorm.Column("int"),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "userId", void 0);
+_ts_decorate70([
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata70("design:type", Object)
+], exports.OrderAssignee.prototype, "vendorId", void 0);
+_ts_decorate70([
+  typeorm.Column("int", {
+    default: 1
+  }),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "sortOrder", void 0);
+_ts_decorate70([
+  typeorm.Column({
+    type: "timestamp with time zone",
+    default: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(() => "CURRENT_TIMESTAMP", "default")
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], exports.OrderAssignee.prototype, "assignedAt", void 0);
+_ts_decorate70([
+  typeorm.CreateDateColumn({
+    type: "timestamp with time zone"
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], exports.OrderAssignee.prototype, "createdAt", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.Order, {
+    onDelete: "CASCADE"
+  }),
+  typeorm.JoinColumn({
+    name: "orderId"
+  }),
+  _ts_metadata70("design:type", typeof exports.Order === "undefined" ? Object : exports.Order)
+], exports.OrderAssignee.prototype, "order", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.User, {
+    onDelete: "CASCADE"
+  }),
+  typeorm.JoinColumn({
+    name: "userId"
+  }),
+  _ts_metadata70("design:type", typeof exports.User === "undefined" ? Object : exports.User)
+], exports.OrderAssignee.prototype, "user", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.Vendor, {
+    nullable: true,
+    onDelete: "SET NULL"
+  }),
+  typeorm.JoinColumn({
+    name: "vendorId"
+  }),
+  _ts_metadata70("design:type", Object)
+], exports.OrderAssignee.prototype, "vendor", void 0);
+exports.OrderAssignee = _ts_decorate70([
+  typeorm.Entity("order_assignees"),
+  typeorm.Index("idx_order_assignees_order", [
+    "orderId"
+  ]),
+  typeorm.Index("idx_order_assignees_user", [
+    "userId"
+  ]),
+  typeorm.Index("idx_order_assignees_vendor", [
+    "vendorId"
+  ])
+], exports.OrderAssignee);
 
 // src/entities/index.ts
 var CMS_ENTITY_MAP = {
@@ -25216,7 +25580,8 @@ var CMS_ENTITY_MAP = {
   attendees: exports.Attendee,
   order_notification_bindings: exports.OrderNotificationBinding,
   order_notification_triggers: exports.OrderNotificationTrigger,
-  user_device_tokens: exports.UserDeviceToken
+  user_device_tokens: exports.UserDeviceToken,
+  order_assignees: exports.OrderAssignee
 };
 
 // src/plugins/blog-generator/blog-generator-agent-defaults.ts
@@ -28324,7 +28689,7 @@ function slugify2(input) {
   return input.toLowerCase().trim().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 64) || "template";
 }
 chunkUSNT2KNT_cjs.__name(slugify2, "slugify");
-function createEmailMessageTemplatesHandlers(config) {
+function createTextMessageTemplatesHandlers(config, channel) {
   const { dataSource, entityMap, json, requireAuth, requireEntityPermission } = config;
   const templateRepo = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(() => dataSource.getRepository(entityMap.message_templates), "templateRepo");
   async function requireRead(req, entity) {
@@ -28347,6 +28712,10 @@ function createEmailMessageTemplatesHandlers(config) {
     return null;
   }
   chunkUSNT2KNT_cjs.__name(requireUpdate, "requireUpdate");
+  function isLegacyPushTemplate(row) {
+    return row.channel === "email" && typeof row.name === "string" && row.name.includes("_push_");
+  }
+  chunkUSNT2KNT_cjs.__name(isLegacyPushTemplate, "isLegacyPushTemplate");
   return {
     async listCached(req) {
       const err = await requireRead(req, "settings");
@@ -28354,15 +28723,19 @@ function createEmailMessageTemplatesHandlers(config) {
       try {
         const rows = await templateRepo().find({
           where: {
-            channel: "email",
             deleted: false
           },
           order: {
             name: "ASC"
           }
         });
+        const items = rows.filter((row) => {
+          const r = row;
+          if (channel === "email") return r.channel === "email" && !isLegacyPushTemplate(r);
+          return r.channel === "mobile" || isLegacyPushTemplate(r);
+        });
         return json({
-          items: rows
+          items
         });
       } catch {
         return json({
@@ -28403,7 +28776,7 @@ function createEmailMessageTemplatesHandlers(config) {
       let suffix = 1;
       while (await templateRepo().findOne({
         where: {
-          channel: "email",
+          channel,
           templateKey,
           deleted: false
         }
@@ -28412,7 +28785,7 @@ function createEmailMessageTemplatesHandlers(config) {
         templateKey = `${baseKey}_${suffix}`;
       }
       const row = await templateRepo().save(templateRepo().create({
-        channel: "email",
+        channel,
         templateKey,
         name,
         subject,
@@ -28450,7 +28823,6 @@ function createEmailMessageTemplatesHandlers(config) {
       const existing = await templateRepo().findOne({
         where: {
           id: numId,
-          channel: "email",
           deleted: false
         }
       });
@@ -28459,9 +28831,25 @@ function createEmailMessageTemplatesHandlers(config) {
       }, {
         status: 404
       });
+      const row = existing;
+      if (channel === "email" && row.channel !== "email") {
+        return json({
+          error: "Template not found"
+        }, {
+          status: 404
+        });
+      }
+      if (channel === "mobile" && row.channel !== "mobile" && !isLegacyPushTemplate(row)) {
+        return json({
+          error: "Template not found"
+        }, {
+          status: 404
+        });
+      }
       const patch = {
         updatedAt: /* @__PURE__ */ new Date()
       };
+      if (channel === "mobile") patch.channel = "mobile";
       if (typeof body.name === "string" && body.name.trim()) patch.name = body.name.trim();
       if (typeof body.subject === "string") patch.subject = body.subject;
       if (typeof body.body === "string") {
@@ -28484,7 +28872,15 @@ function createEmailMessageTemplatesHandlers(config) {
     }
   };
 }
+chunkUSNT2KNT_cjs.__name(createTextMessageTemplatesHandlers, "createTextMessageTemplatesHandlers");
+function createEmailMessageTemplatesHandlers(config) {
+  return createTextMessageTemplatesHandlers(config, "email");
+}
 chunkUSNT2KNT_cjs.__name(createEmailMessageTemplatesHandlers, "createEmailMessageTemplatesHandlers");
+function createMobileMessageTemplatesHandlers(config) {
+  return createTextMessageTemplatesHandlers(config, "mobile");
+}
+chunkUSNT2KNT_cjs.__name(createMobileMessageTemplatesHandlers, "createMobileMessageTemplatesHandlers");
 function connectionFromUrl(redisUrl) {
   const u = new URL(redisUrl);
   return {
@@ -28663,11 +29059,11 @@ function whatsappPlugin(config = {}) {
         db = await settingsLoader?.() ?? {};
       } catch {
       }
-      if (!chunkNIRYYJIJ_cjs.isWhatsAppPluginEnabled(db)) {
+      if (!chunk5MZFQRDW_cjs.isWhatsAppPluginEnabled(db)) {
         context.logger.warn("WhatsApp plugin skipped: disabled in Plugins \u2192 WhatsApp");
         return null;
       }
-      const svc = new chunkNIRYYJIJ_cjs.WhatsAppService(env, staticRest, settingsLoader, getMessageTemplateRow);
+      const svc = new chunk5MZFQRDW_cjs.WhatsAppService(env, staticRest, settingsLoader, getMessageTemplateRow);
       return {
         send: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((opts) => svc.send(opts), "send")
       };
@@ -28773,7 +29169,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
   }
   if (!cms.getPlugin("email")) {
     try {
-      const instance = await chunkNIRYYJIJ_cjs.emailPlugin({
+      const instance = await chunk5MZFQRDW_cjs.emailPlugin({
         type: "SMTP",
         from: config.SMTP_FROM ?? "no-reply@localhost",
         to: config.SMTP_TO ?? ""
@@ -28814,7 +29210,7 @@ function messagingPlugins(options) {
   const config = options.config ?? (typeof process !== "undefined" ? process.env : {});
   return [
     queuePlugin(),
-    chunkNIRYYJIJ_cjs.emailPlugin({
+    chunk5MZFQRDW_cjs.emailPlugin({
       type: "SMTP",
       from: config.SMTP_FROM ?? "no-reply@localhost",
       to: config.SMTP_TO ?? ""
@@ -28948,7 +29344,7 @@ function createCmsApiHandler(config) {
   } : void 0;
   const entityMap = withLlmKnowledgeEntityFallbacks(rawEntityMap);
   if (getCms) {
-    chunkNIRYYJIJ_cjs.initWhatsappTriggerDispatcher({
+    chunk5MZFQRDW_cjs.initWhatsappTriggerDispatcher({
       dataSource,
       entityMap,
       getCms
@@ -28961,7 +29357,7 @@ function createCmsApiHandler(config) {
   ] : baseCrudResources;
   const requireEntityPermissionEffective = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async (_req, entity, action) => {
     if (!resolveSessionUser) {
-      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
+      chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
         entity,
         action,
         hint: "Pass getSessionUser: auth.getAuthenticatedUser from createCmsAuthBundle()"
@@ -28971,7 +29367,7 @@ function createCmsApiHandler(config) {
       const raw = await resolveSessionUser();
       const u = await hydrateVendorSessionUser(dataSource, raw);
       if (!u?.email) {
-        chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: no session user", {
+        chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: no session user", {
           entity,
           action
         });
@@ -28981,13 +29377,13 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunk4U6DATGZ_cjs.sessionHasEntityAccess(u, entity, action);
-      await chunkJ7FMZK66_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
+      const allowed = chunkOV5TRZET_cjs.sessionHasEntityAccess(u, entity, action);
+      await chunkO4AFPDQ4_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
       });
       if (allowed) return null;
-      const { reason } = chunkJ7FMZK66_cjs.explainSessionEntityAccess(u, entity, action);
+      const { reason } = chunkO4AFPDQ4_cjs.explainSessionEntityAccess(u, entity, action);
       return config.json({
         error: "Forbidden",
         entity,
@@ -28998,7 +29394,7 @@ function createCmsApiHandler(config) {
       });
     }
     if (userRequireEntityPermission) {
-      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
+      chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
         entity,
         action
       });
@@ -29085,10 +29481,10 @@ function createCmsApiHandler(config) {
       getVendorScope: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
         if (!multiVendorEnabled) {
-          return chunkJ7FMZK66_cjs.resolveDisabledMultiVendorScope(dataSource);
+          return chunkO4AFPDQ4_cjs.resolveDisabledMultiVendorScope(dataSource);
         }
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-        return chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+        return chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
       }, "getVendorScope"),
       getHydratedSessionUser: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
@@ -29244,6 +29640,13 @@ function createCmsApiHandler(config) {
     requireAuth: config.requireAuth,
     requireEntityPermission: requireEntityPermissionEffective
   });
+  const mobileMessageTemplatesHandlers = createMobileMessageTemplatesHandlers({
+    dataSource,
+    entityMap,
+    json: config.json,
+    requireAuth: config.requireAuth,
+    requireEntityPermission: requireEntityPermissionEffective
+  });
   const deviceTokensHandlers = createDeviceTokensHandlers({
     dataSource,
     entityMap,
@@ -30278,9 +30681,16 @@ function createCmsApiHandler(config) {
         if (m === "GET") return emailMessageTemplatesHandlers.listCached(req);
         if (m === "POST") return emailMessageTemplatesHandlers.create(req);
       }
-      if (isMsgTemplatesRoute && (path2[1] === "email" || path2.length === 2) && path2.length === 3) {
+      if (isMsgTemplatesRoute && path2[1] === "mobile" && path2.length === 2) {
+        if (m === "GET") return mobileMessageTemplatesHandlers.listCached(req);
+        if (m === "POST") return mobileMessageTemplatesHandlers.create(req);
+      }
+      if (isMsgTemplatesRoute && (path2[1] === "email" || path2.length === 2) && path2.length === 3 && path2[1] !== "mobile") {
         if (m === "PATCH") return emailMessageTemplatesHandlers.update(req, path2[2]);
       }
+      if (isMsgTemplatesRoute && path2[1] === "mobile" && path2.length === 3) {
+        if (m === "PATCH") return mobileMessageTemplatesHandlers.update(req, path2[2]);
+      }
       if (path2[0] === "llm_agents") {
         if (!entityMap.llm_agents) {
           console.error(CMS_API_LOG, "llm_agents route: entity missing after merge", {
@@ -30422,7 +30832,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const result = await validateCoupon(dataSource, entityMap, couponCode, orderLinesNorm, currency, contactId, isAutomatic, discountId ?? void 0, vendorId);
@@ -30510,7 +30920,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
@@ -30723,7 +31133,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-Y7NZAALH.cjs');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-LL7ETKLU.cjs');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -30822,7 +31232,7 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((refundAmount) => {
-          void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
@@ -31067,8 +31477,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-RW5RSXH3.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DZAXK4GQ.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.getChannels(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "send" && m === "POST" && getCms) {
@@ -31082,8 +31492,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-RW5RSXH3.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DZAXK4GQ.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.sendOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "verify" && m === "POST" && getCms) {
@@ -31097,8 +31507,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-RW5RSXH3.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DZAXK4GQ.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.verifyOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "eligible-assignees" && m === "GET") {
@@ -31112,7 +31522,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-NPKD64P6.cjs');
+        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-KF7RMTV5.cjs');
         const handlers = createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionUser);
         return handlers.listEligibleAssignees(req, orderId);
       }
@@ -31222,7 +31632,7 @@ function createCmsApiHandler(config) {
           if (resolveSessionUser) {
             const raw = await resolveSessionUser();
             const u = await hydrateVendorSessionUser(dataSource, raw);
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") {
               scopedVendorIds = scope.vendorIds;
             }
@@ -31728,32 +32138,17 @@ function createStorefrontApiHandler(config) {
   const otpFlags = config.otpFlags;
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
-  function fireOrderPlacedNotification(orderId, isPaid) {
-    void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
-      fireOrderNotificationTrigger("order_placed", orderId, {
+  function fireStorefrontCheckoutNotifications(orderId) {
+    void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+      fireOrderNotificationTrigger("order_pending", orderId, {
         dataSource,
         entityMap
       }, {
         source: "storefront"
       });
-      if (isPaid) {
-        fireOrderNotificationTrigger("payment_success", orderId, {
-          dataSource,
-          entityMap
-        }, {
-          source: "storefront"
-        });
-      } else {
-        fireOrderNotificationTrigger("payment_failed", orderId, {
-          dataSource,
-          entityMap
-        }, {
-          source: "storefront"
-        });
-      }
     }).catch((err) => console.error("[notification-triggers] import failed", err));
   }
-  chunkUSNT2KNT_cjs.__name(fireOrderPlacedNotification, "fireOrderPlacedNotification");
+  chunkUSNT2KNT_cjs.__name(fireStorefrontCheckoutNotifications, "fireStorefrontCheckoutNotifications");
   const otpAllowPhoneLogin = config.otpAllowPhoneLogin !== false;
   function otpOff(key) {
     return !otpFlags || otpFlags[key] !== true;
@@ -33626,10 +34021,10 @@ function createStorefrontApiHandler(config) {
             adminAccess: false
           }));
           const userId = newUser.id;
-          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+          await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
           if (entityMap.customer) {
             const phone = typeof b.phone === "string" && b.phone.trim() ? String(b.phone).trim() : null;
-            await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+            await chunkOV5TRZET_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
               id: userId,
               name,
               email,
@@ -34250,6 +34645,7 @@ function createStorefrontApiHandler(config) {
             }));
           }
           await linkOrderContactToVendors(contactId, vendorRes.vendorIds);
+          fireStorefrontCheckoutNotifications(oid);
           return json({
             orderId: oid,
             orderNumber: ord.orderNumber,
@@ -34330,6 +34726,7 @@ function createStorefrontApiHandler(config) {
             cartId: cart.id
           });
           await cartRepo().delete(cart.id);
+          fireStorefrontCheckoutNotifications(oid);
           return json({
             orderId: oid,
             orderNumber: ord.orderNumber,
@@ -34672,7 +35069,7 @@ function createStorefrontApiHandler(config) {
             } catch {
             }
             try {
-              void import('./emit-order-notification-trigger-DR74TQXN.cjs').then(({ fireOrderNotificationTrigger }) => {
+              void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
                 fireOrderNotificationTrigger("order_cancelled", orderId, {
                   dataSource,
                   entityMap