@infuro/cms-core 1.0.66 → 1.0.67

package/dist/{chunk-QYRXLURF.cjs → chunk-BVLN75LP.cjs}

@@ -12,9 +12,9 @@ var chunkUPLVMVRX_cjs = require('./chunk-UPLVMVRX.cjs');
 var chunkTZEMLHSP_cjs = require('./chunk-TZEMLHSP.cjs');
 var chunk3DZRIZOD_cjs = require('./chunk-3DZRIZOD.cjs');
 var chunkTJ2MIQUT_cjs = require('./chunk-TJ2MIQUT.cjs');
-var chunk4U6DATGZ_cjs = require('./chunk-4U6DATGZ.cjs');
+var chunkOV5TRZET_cjs = require('./chunk-OV5TRZET.cjs');
 var chunkOY2YTBMP_cjs = require('./chunk-OY2YTBMP.cjs');
-var chunkJ7FMZK66_cjs = require('./chunk-J7FMZK66.cjs');
+var chunkO4AFPDQ4_cjs = require('./chunk-O4AFPDQ4.cjs');
 var chunkD5FBNKQM_cjs = require('./chunk-D5FBNKQM.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 var typeorm = require('typeorm');
@@ -123,7 +123,7 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
         `, [
         primary.vendorRoleId
       ]);
-      vendorEntityPerms = chunkJ7FMZK66_cjs.permissionRowsToRecord(permRows);
+      vendorEntityPerms = chunkO4AFPDQ4_cjs.permissionRowsToRecord(permRows);
     } catch (err) {
       if (!isMissingVendorRoleSchemaError(err)) throw err;
     }
@@ -230,7 +230,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     ]);
     const resolvedId = Number(byEmailRows[0]?.id);
     if (!Number.isFinite(resolvedId)) {
-      chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
+      chunkO4AFPDQ4_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
         email: user.email,
         rawSessionId: user.id ?? null
       });
@@ -250,7 +250,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   const groupName = rows[0]?.groupName ?? user.groupName ?? null;
   const groupId = rows[0]?.groupId ?? user.groupId ?? void 0;
   const adminAccess = rows[0]?.adminAccess ?? user.adminAccess;
-  const isRBACAdmin = user.isRBACAdmin ?? chunkJ7FMZK66_cjs.isSuperAdmin({
+  const isRBACAdmin = user.isRBACAdmin ?? chunkO4AFPDQ4_cjs.isSuperAdmin({
     groupId,
     groupName,
     isRBACAdmin: user.isRBACAdmin
@@ -263,7 +263,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   };
   if (multiVendorEnabled) {
     ctx = await loadUserVendorContext(dataSource, id, user.activeVendorId);
-    flags = chunkJ7FMZK66_cjs.vendorPortalFlagsFromUser({
+    flags = chunkO4AFPDQ4_cjs.vendorPortalFlagsFromUser({
       email: user.email,
       isRBACAdmin,
       groupName,
@@ -298,7 +298,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     isVendorPortal: flags.isVendorPortal,
     isVendorOwner: flags.isVendorOwner
   };
-  chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser", {
+  chunkO4AFPDQ4_cjs.logRbac("hydrateVendorSessionUser", {
     email: user.email,
     userId: id,
     groupName,
@@ -911,7 +911,7 @@ function repoHasVendorIdColumn(repo) {
 }
 chunkUSNT2KNT_cjs.__name(repoHasVendorIdColumn, "repoHasVendorIdColumn");
 function resourceUsesVendorScope(resource) {
-  return resource === "vendors" || chunkJ7FMZK66_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
+  return resource === "vendors" || chunkO4AFPDQ4_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 chunkUSNT2KNT_cjs.__name(resourceUsesVendorScope, "resourceUsesVendorScope");
 function mergeWhereClause(where, extra) {
@@ -1401,7 +1401,7 @@ async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, c
   }
   let customerId = null;
   if (entityMap.customer) {
-    const ensured = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
+    const ensured = await chunkOV5TRZET_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
       name,
       email,
       phone,
@@ -1684,6 +1684,30 @@ function entityHasSoftDelete(repo) {
   return repo.metadata.columns.some((c) => c.propertyName === "deleted");
 }
 chunkUSNT2KNT_cjs.__name(entityHasSoftDelete, "entityHasSoftDelete");
+async function recordOrderAssigneeHistory(dataSource, entityMap, orderId, userId, vendorId) {
+  if (!entityMap.order_assignees) return 1;
+  const assigneeRepo = dataSource.getRepository(entityMap.order_assignees);
+  const maxRow = await assigneeRepo.findOne({
+    where: {
+      orderId
+    },
+    order: {
+      sortOrder: "DESC"
+    }
+  });
+  const currentMax = Number(maxRow?.sortOrder ?? 0);
+  const nextSortOrder = currentMax + 1;
+  await assigneeRepo.save({
+    orderId,
+    userId,
+    vendorId,
+    sortOrder: nextSortOrder,
+    assignedAt: /* @__PURE__ */ new Date()
+  });
+  console.log(`[ORDERS-DEBUG][ASSIGNEE_HISTORY] Recorded assignment for order ${orderId}: user ${userId}, vendor ${vendorId}, sortOrder ${nextSortOrder}`);
+  return nextSortOrder;
+}
+chunkUSNT2KNT_cjs.__name(recordOrderAssigneeHistory, "recordOrderAssigneeHistory");
 var LIST_QUERY_RESERVED = /* @__PURE__ */ new Set([
   "page",
   "limit",
@@ -3566,10 +3590,38 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").andWhere("order.deleted = :orderDel", {
+        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").leftJoinAndSelect("order.vendor", "vendor").andWhere("order.deleted = :orderDel", {
           orderDel: false
         }).orderBy(`order.${sortField2}`, sortOrderOrders).skip(skip).take(limit);
-        applyVendorScopeToQueryBuilder(qb, "order", scope);
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][LIST] Querying orders. Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorPortal: session?.isVendorPortal,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          vendorIds: session?.vendorIds,
+          activeVendorId: session?.activeVendorId
+        }, "Scope:", scope);
+        if (scope.type === "deny") {
+          qb.andWhere("1 = 0");
+        } else if (scope.type === "vendor") {
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          console.log("[ORDERS-DEBUG][LIST] Vendor scope applied. isOwner:", isOwner, "vendorId:", scope.vendorId);
+          if (isOwner) {
+            qb.andWhere('(order.vendorId = :vendorScopeId OR order.assignedUserId IN (SELECT vu."userId" FROM vendor_users vu WHERE vu."vendorId" = :vendorScopeId))', {
+              vendorScopeId: scope.vendorId
+            });
+          } else {
+            const teamMemberId = Number(session?.id);
+            console.log("[ORDERS-DEBUG][LIST] Team member scoping to teamMemberId:", teamMemberId);
+            qb.andWhere("order.assignedUserId = :teamMemberId", {
+              teamMemberId
+            });
+          }
+        }
         const vendorIdFilter = searchParams.get("vendorId")?.trim();
         if (vendorIdFilter) {
           const n = Number(vendorIdFilter);
@@ -3622,7 +3674,15 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
+        console.log("[ORDERS-DEBUG][LIST] Executing SQL:", qb.getSql(), "Params:", qb.getParameters());
         const [rows, total2] = await qb.getManyAndCount();
+        console.log("[ORDERS-DEBUG][LIST] Query result: total =", total2, "rows length =", rows.length, "Orders:", rows.map((r) => ({
+          id: r.id,
+          orderNumber: r.orderNumber,
+          vendorId: r.vendorId,
+          assignedUserId: r.assignedUserId,
+          status: r.status
+        })));
         const data2 = await Promise.all(rows.map(async (order) => {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
           const contact = order.contact;
@@ -3666,6 +3726,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           if (orderStatus === "cancelled" && rawPayStatus !== "paid" && rawPayStatus !== "captured" && rawPayStatus !== "refunded") {
             paymentStatus2 = "unpaid";
           }
+          const vendorObj = order.vendor;
           return {
             ...orderWithoutPayments,
             contact: contact ? {
@@ -3679,6 +3740,11 @@ function createCrudHandler(dataSource, entityMap, options) {
               name: assignedUserObj.name || assignedUserObj.email,
               email: assignedUserObj.email
             } : null,
+            vendor: vendorObj ? {
+              id: vendorObj.id,
+              name: vendorObj.name || vendorObj.slug || `Vendor #${vendorObj.id}`,
+              slug: vendorObj.slug
+            } : null,
             itemsSummary,
             paymentStatus: paymentStatus2
           };
@@ -4211,6 +4277,18 @@ function createCrudHandler(dataSource, entityMap, options) {
               isCatalog: true
             });
           }
+        } else if (resource === "orders" && scope.type === "vendor") {
+          const session = await getHydratedSessionUser?.() ?? null;
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          if (!isOwner) {
+            const teamMemberId = Number(session?.id);
+            where = mergeListWhereAnd(where, {
+              vendorId: scope.vendorId,
+              assignedUserId: teamMemberId
+            });
+          } else {
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
+          }
         } else {
           where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
         }
@@ -4437,7 +4515,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const savedCustomer = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
+        const savedCustomer = await chunkOV5TRZET_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
           phone,
@@ -5175,6 +5253,12 @@ function createCrudHandler(dataSource, entityMap, options) {
               shippingAddressId: savedShipping?.id ?? null
             });
           }
+          if (persistBody.assignedUserId) {
+            const initAssignee = Number(persistBody.assignedUserId);
+            if (Number.isFinite(initAssignee) && initAssignee > 0) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, created.id, initAssignee, Number(created.vendorId) || null);
+            }
+          }
           const reloadedOrder = await repo.findOne({
             where: {
               id: created.id,
@@ -5494,7 +5578,16 @@ function createCrudHandler(dataSource, entityMap, options) {
       const scope = await resolveScope();
       const flags = await getVendorCatalogCreateFlags(dataSource);
       if (scope.type !== "all") {
-        data = data.filter((row) => vendorScopeRowAccess(row, scope, resource, flags) === "ok");
+        const session = await getHydratedSessionUser?.() ?? null;
+        const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+        const teamMemberId = Number(session?.id);
+        data = data.filter((row) => {
+          if (vendorScopeRowAccess(row, scope, resource, flags) !== "ok") return false;
+          if (resource === "orders" && scope.type === "vendor" && !isOwner) {
+            return Number(row?.assignedUserId) === teamMemberId;
+          }
+          return true;
+        });
       }
       const excludeCols = /* @__PURE__ */ new Set([
         "deletedAt",
@@ -5532,6 +5625,51 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
     type: "all"
   }));
   async function vendorScopeAccessJson(row, scope, resource) {
+    if (!row) return json({
+      message: "Not found"
+    }, {
+      status: 404
+    });
+    if (resource === "orders" && scope.type === "vendor") {
+      const rowVendorId = Number(row?.vendorId);
+      let orderBelongsToVendorScope = rowVendorId === scope.vendorId;
+      if (!orderBelongsToVendorScope) {
+        const aId = Number(row?.assignedUserId);
+        if (Number.isFinite(aId) && aId > 0 && entityMap["vendor_users"]) {
+          const vuRepo = dataSource.getRepository(entityMap["vendor_users"]);
+          const isTeamMember = await vuRepo.count({
+            where: {
+              vendorId: scope.vendorId,
+              userId: aId
+            }
+          });
+          if (isTeamMember > 0) {
+            orderBelongsToVendorScope = true;
+          }
+        }
+      }
+      if (!orderBelongsToVendorScope) {
+        return json({
+          error: "Forbidden"
+        }, {
+          status: 403
+        });
+      }
+      const session = await getHydratedSessionUser?.() ?? null;
+      const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+      if (!isOwner) {
+        const sessionUserId = Number(session?.id);
+        const orderAssignee = Number(row?.assignedUserId);
+        if (!Number.isFinite(orderAssignee) || orderAssignee !== sessionUserId) {
+          return json({
+            error: "Forbidden: You can only access orders assigned directly to you"
+          }, {
+            status: 403
+          });
+        }
+      }
+      return null;
+    }
     const flags = await getVendorCatalogCreateFlags(dataSource);
     const access = vendorScopeRowAccess(row, scope, resource, flags);
     if (access === "ok") return null;
@@ -5656,6 +5794,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       if (resource === "orders") {
         const scope2 = await resolveScopeById();
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Fetching order id:", id, "Scope:", scope2, "Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          activeVendorId: session?.activeVendorId,
+          vendorIds: session?.vendorIds
+        });
         const order = await repo.findOne({
           where: {
             id: Number(id)
@@ -5668,14 +5817,26 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product",
             "items.product.collection",
             "payments",
-            "assignedUser"
+            "assignedUser",
+            "vendor"
           ]
         });
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Order found in DB:", order ? {
+          id: order.id,
+          orderNumber: order.orderNumber,
+          vendorId: order.vendorId,
+          assignedUserId: order.assignedUserId,
+          status: order.status
+        } : null);
         if (order) {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
         }
         const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
-        if (orderDenied) return orderDenied;
+        if (orderDenied) {
+          console.log("[ORDERS-DEBUG][GET_BY_ID] Access DENIED for order id:", id);
+          return orderDenied;
+        }
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Access GRANTED for order id:", id);
         const relatedOrders = await repo.find({
           where: {
             parentOrderId: Number(id)
@@ -6059,21 +6220,67 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             lines: []
           } : await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, effectiveCurrency, putDiscountId, Number.isFinite(putOrderVendorId) ? putOrderVendorId : null);
           const scalarUpdate = pickColumnUpdates(repo, rawBody);
-          if (rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
-            const aId = Number(rawBody.assignedUserId);
-            if (Number.isFinite(aId) && aId > 0) {
-              scalarUpdate.assignedUserId = aId;
-              scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
-            } else {
-              scalarUpdate.assignedUserId = null;
-              scalarUpdate.assignedAt = null;
+          if (rawBody && typeof rawBody === "object") {
+            if (scopePutEarly.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+              const vId = Number(rawBody.vendorId);
+              if (Number.isFinite(vId) && vId > 0) {
+                scalarUpdate.vendorId = vId;
+              }
+            }
+            if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
+              const aId = Number(rawBody.assignedUserId);
+              if (Number.isFinite(aId) && aId > 0) {
+                if (scopePutEarly.type === "vendor" && entityMap.vendor_users) {
+                  const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+                  const vuLink = await vuRepo.findOne({
+                    where: {
+                      vendorId: scopePutEarly.vendorId,
+                      userId: aId
+                    }
+                  });
+                  if (!vuLink) {
+                    return json({
+                      error: "Cannot assign order to a user outside your vendor team."
+                    }, {
+                      status: 403
+                    });
+                  }
+                  scalarUpdate.vendorId = scopePutEarly.vendorId;
+                } else if (scopePutEarly.type === "all" && entityMap.vendor_users) {
+                  if (entityMap.vendors) {
+                    const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                       FROM vendor_users vu
+                       JOIN vendors v ON v.id = vu."vendorId"
+                       WHERE vu."userId" = $1 AND v.deleted = false
+                       ORDER BY vu.id DESC
+                       LIMIT 1`, [
+                      aId
+                    ]);
+                    if (activeVu.length > 0 && activeVu[0].vendorId) {
+                      scalarUpdate.vendorId = Number(activeVu[0].vendorId);
+                    }
+                  }
+                }
+                const prevAssigned = Number(existingOrderRow?.assignedUserId);
+                const prevVendor = Number(existingOrderRow?.vendorId);
+                const targetVendor = Number.isFinite(Number(scalarUpdate.vendorId)) ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId) || null;
+                if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+                  await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+                }
+                scalarUpdate.assignedUserId = aId;
+                scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
+              } else {
+                scalarUpdate.assignedUserId = null;
+                scalarUpdate.assignedAt = null;
+              }
             }
           }
           if (scalarUpdate.status === "processing") {
             const effectiveAssignee = scalarUpdate.assignedUserId !== void 0 ? scalarUpdate.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-            if (!effectiveAssignee) {
+            const effectiveVendor = scalarUpdate.vendorId !== void 0 ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId);
+            if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
               return json({
-                error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+                error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
               }, {
                 status: 400
               });
@@ -6490,7 +6697,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       const updatePayload = rawBody && typeof rawBody === "object" ? pickColumnUpdates(repo, rawBody) : {};
       if (resourceUsesVendorScope(resource)) {
-        delete updatePayload.vendorId;
+        if (!(resource === "orders" && scopePut.type === "all")) {
+          delete updatePayload.vendorId;
+        }
       }
       if (resource === "contacts" && "type" in updatePayload) {
         const t = updatePayload.type;
@@ -6886,9 +7095,59 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         }
       }
       if (resource === "orders" && orderInvPrev && rawBody && typeof rawBody === "object") {
+        console.log("[ORDERS-DEBUG][UPDATE] PUT /api/orders/" + numericId, "Scope:", scopePut, "rawBody:", rawBody, "existingOrder:", {
+          id: existingOrderRow?.id,
+          vendorId: existingOrderRow?.vendorId,
+          assignedUserId: existingOrderRow?.assignedUserId,
+          status: existingOrderRow?.status
+        });
+        if (scopePut.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+          const vId = Number(rawBody.vendorId);
+          if (Number.isFinite(vId) && vId > 0) {
+            updatePayload.vendorId = vId;
+          }
+        }
         if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
           const aId = Number(rawBody.assignedUserId);
+          console.log("[ORDERS-DEBUG][UPDATE] Updating assignedUserId to:", aId);
           if (Number.isFinite(aId) && aId > 0) {
+            if (scopePut.type === "vendor" && entityMap.vendor_users) {
+              const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+              const vuLink = await vuRepo.findOne({
+                where: {
+                  vendorId: scopePut.vendorId,
+                  userId: aId
+                }
+              });
+              if (!vuLink) {
+                return json({
+                  error: "Cannot assign order to a user outside your vendor team."
+                }, {
+                  status: 403
+                });
+              }
+              updatePayload.vendorId = scopePut.vendorId;
+            } else if (scopePut.type === "all" && entityMap.vendor_users) {
+              if (entityMap.vendors) {
+                const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                   FROM vendor_users vu
+                   JOIN vendors v ON v.id = vu."vendorId"
+                   WHERE vu."userId" = $1 AND v.deleted = false
+                   ORDER BY vu.id DESC
+                   LIMIT 1`, [
+                  aId
+                ]);
+                if (activeVu.length > 0 && activeVu[0].vendorId) {
+                  updatePayload.vendorId = Number(activeVu[0].vendorId);
+                }
+              }
+            }
+            const prevAssigned = Number(existingOrderRow?.assignedUserId);
+            const prevVendor = Number(existingOrderRow?.vendorId);
+            const targetVendor = Number.isFinite(Number(updatePayload.vendorId)) ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId) || null;
+            if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+            }
             updatePayload.assignedUserId = aId;
             updatePayload.assignedAt = /* @__PURE__ */ new Date();
           } else {
@@ -6896,11 +7155,13 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             updatePayload.assignedAt = null;
           }
         }
+        console.log("[ORDERS-DEBUG][UPDATE] Final updatePayload for order:", updatePayload);
         if (updatePayload.status === "processing") {
           const effectiveAssignee = updatePayload.assignedUserId !== void 0 ? updatePayload.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-          if (!effectiveAssignee) {
+          const effectiveVendor = updatePayload.vendorId !== void 0 ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId);
+          if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
             return json({
-              error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+              error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
             }, {
               status: 400
             });
@@ -7853,7 +8114,7 @@ function createInviteAcceptHandler(config) {
       }
       const { userId, email, vendorId } = validation.target;
       if (entityMap.contacts) {
-        await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+        await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
@@ -8946,7 +9207,7 @@ function createVendorDashboardHandler(config) {
       if (pe) return pe;
     }
     const user = await getSessionUser();
-    if (!user || !chunkJ7FMZK66_cjs.isVendorPortalUser(user)) {
+    if (!user || !chunkO4AFPDQ4_cjs.isVendorPortalUser(user)) {
       return json({
         error: "Forbidden"
       }, {
@@ -10508,11 +10769,11 @@ function createUsersApiHandlers(config) {
           adminAccess
         }));
         if (entityMap.contacts) {
-          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
+          await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
         }
         if (entityMap.customer) {
           const phone = typeof body.phone === "string" && body.phone.trim() ? body.phone.trim() : null;
-          await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+          await chunkOV5TRZET_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
             id: newUser.id,
             name: String(newUser.name ?? body.name),
             email: String(newUser.email),
@@ -13595,7 +13856,7 @@ chunkUSNT2KNT_cjs.__name(findActiveRefundPolicyForVendor, "findActiveRefundPolic
 // src/api/admin-roles-handlers.ts
 function createAdminRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
-  const baseEntities = chunkJ7FMZK66_cjs.getPermissionableEntityKeys(entityMap);
+  const baseEntities = chunkO4AFPDQ4_cjs.getPermissionableEntityKeys(entityMap);
   const allowEntities = /* @__PURE__ */ new Set([
     ...baseEntities,
     "users"
@@ -13610,7 +13871,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk4U6DATGZ_cjs.canManageRoles(u) && !chunkJ7FMZK66_cjs.canManageVendorRoles(u)) {
+    if (!chunkOV5TRZET_cjs.canManageRoles(u) && !chunkO4AFPDQ4_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -13621,11 +13882,11 @@ function createAdminRolesHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunkJ7FMZK66_cjs.canManageVendorRoles(u) && !chunk4U6DATGZ_cjs.canManageRoles(u);
+    return chunkO4AFPDQ4_cjs.canManageVendorRoles(u) && !chunkOV5TRZET_cjs.canManageRoles(u);
   }
   chunkUSNT2KNT_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
-    ...chunkJ7FMZK66_cjs.VENDOR_STORE_RBAC_ENTITIES,
+    ...chunkO4AFPDQ4_cjs.VENDOR_STORE_RBAC_ENTITIES,
     "dashboard",
     "settings"
   ].sort();
@@ -13782,7 +14043,7 @@ function createAdminRolesHandlers(config) {
         }, {
           status: 404
         });
-        if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name) && !chunkJ7FMZK66_cjs.isSuperAdminGroupName(name)) {
+        if (chunkO4AFPDQ4_cjs.isSuperAdminGroupName(g.name) && !chunkO4AFPDQ4_cjs.isSuperAdminGroupName(name)) {
           return json({
             error: "Cannot rename the administrator group"
           }, {
@@ -13839,7 +14100,7 @@ function createAdminRolesHandlers(config) {
       }, {
         status: 404
       });
-      if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name)) return json({
+      if (chunkO4AFPDQ4_cjs.isSuperAdminGroupName(g.name)) return json({
         error: "Cannot delete the administrator group"
       }, {
         status: 400
@@ -14071,7 +14332,7 @@ chunkUSNT2KNT_cjs.__name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
 async function insertRolePermissions(exec, vendorRoleId, permissions) {
-  for (const entity of chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES) {
+  for (const entity of chunkO4AFPDQ4_cjs.VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
     await exec.query(`
@@ -14102,7 +14363,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     for (const r of existing) {
       roleIdsByName2[r.name] = Number(r.id);
       if (r.isOwnerRole) ownerRoleId2 = Number(r.id);
-      if (r.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
+      if (r.name === chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
     }
     return {
       roleIdsByName: roleIdsByName2,
@@ -14113,7 +14374,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
   const roleIdsByName = {};
   let ownerRoleId = 0;
   let viewerRoleId = 0;
-  for (const def of chunkJ7FMZK66_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
+  for (const def of chunkO4AFPDQ4_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
     const inserted = await exec.query(`
       INSERT INTO "vendor_roles"
         ("vendorId", "name", "description", "isSystem", "isOwnerRole")
@@ -14130,7 +14391,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     if (!roleId) continue;
     roleIdsByName[def.name] = roleId;
     if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
+    if (def.name === chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
     await insertRolePermissions(exec, roleId, def.permissions);
   }
   return {
@@ -14160,7 +14421,7 @@ async function backfillVendorUserRoleIds(em, vendorId, seeded) {
       vendorId
     ]);
   }
-  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME];
+  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME];
   if (viewerId) {
     await em.query(`
       UPDATE "vendor_users"
@@ -14186,7 +14447,7 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
     LIMIT 1
     `, [
     vendorId,
-    chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME
+    chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME
   ]);
   const id = rows[0]?.id;
   return id != null ? Number(id) : null;
@@ -14547,7 +14808,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.isPlatformAdministrator(u)) return json({
       error: "Forbidden",
       reason: "admin_only"
     }, {
@@ -14557,7 +14818,7 @@ function createVendorOnboardHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
-    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u);
     const candidates = [];
     if (scope.type === "vendor") candidates.push(scope.vendorId);
     if (scope.type === "all" || scope.type === "vendor") {
@@ -14611,7 +14872,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.isVendorPortalUser(u) && !chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) {
+    if (!chunkO4AFPDQ4_cjs.isVendorPortalUser(u) && !chunkO4AFPDQ4_cjs.isPlatformAdministrator(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -14639,7 +14900,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.canManageVendorTeam(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.canManageVendorTeam(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -14857,7 +15118,7 @@ function createVendorOnboardHandlers(config) {
           await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
-              name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+              name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
               deleted: false
             }
           });
@@ -14872,12 +15133,12 @@ function createVendorOnboardHandlers(config) {
           if (!ownerGroup) {
             try {
               await groupRepo.save(groupRepo.create({
-                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }));
               ownerGroup = await groupRepo.findOne({
                 where: {
-                  name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                  name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                   deleted: false
                 }
               });
@@ -14994,7 +15255,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkOV5TRZET_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -15494,7 +15755,7 @@ function createVendorOnboardHandlers(config) {
           if (!groupId) {
             const g = await groupRepo.findOne({
               where: {
-                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }
             }) ?? await groupRepo.findOne({
@@ -15594,7 +15855,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkOV5TRZET_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -16131,10 +16392,10 @@ chunkUSNT2KNT_cjs.__name(createVendorOnboardHandlers, "createVendorOnboardHandle
 function createVendorRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
   const vendorRoleEntities = [
-    ...chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES
+    ...chunkO4AFPDQ4_cjs.VENDOR_RBAC_ENTITIES
   ].sort();
   async function resolveActiveVendorId(u) {
-    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -16150,7 +16411,7 @@ function createVendorRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.canManageVendorRoles(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.canManageVendorRoles(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -25145,6 +25406,109 @@ _ts_decorate69([
 exports.OrderNotificationTrigger = _ts_decorate69([
   typeorm.Entity("order_notification_triggers")
 ], exports.OrderNotificationTrigger);
+function _ts_decorate70(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+chunkUSNT2KNT_cjs.__name(_ts_decorate70, "_ts_decorate");
+function _ts_metadata70(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+chunkUSNT2KNT_cjs.__name(_ts_metadata70, "_ts_metadata");
+exports.OrderAssignee = class OrderAssignee {
+  static {
+    chunkUSNT2KNT_cjs.__name(this, "OrderAssignee");
+  }
+  id;
+  orderId;
+  userId;
+  vendorId;
+  sortOrder;
+  assignedAt;
+  createdAt;
+  order;
+  user;
+  vendor;
+};
+_ts_decorate70([
+  typeorm.PrimaryGeneratedColumn(),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "id", void 0);
+_ts_decorate70([
+  typeorm.Column("int"),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "orderId", void 0);
+_ts_decorate70([
+  typeorm.Column("int"),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "userId", void 0);
+_ts_decorate70([
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata70("design:type", Object)
+], exports.OrderAssignee.prototype, "vendorId", void 0);
+_ts_decorate70([
+  typeorm.Column("int", {
+    default: 1
+  }),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "sortOrder", void 0);
+_ts_decorate70([
+  typeorm.Column({
+    type: "timestamp with time zone",
+    default: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(() => "CURRENT_TIMESTAMP", "default")
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], exports.OrderAssignee.prototype, "assignedAt", void 0);
+_ts_decorate70([
+  typeorm.CreateDateColumn({
+    type: "timestamp with time zone"
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], exports.OrderAssignee.prototype, "createdAt", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.Order, {
+    onDelete: "CASCADE"
+  }),
+  typeorm.JoinColumn({
+    name: "orderId"
+  }),
+  _ts_metadata70("design:type", typeof exports.Order === "undefined" ? Object : exports.Order)
+], exports.OrderAssignee.prototype, "order", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.User, {
+    onDelete: "CASCADE"
+  }),
+  typeorm.JoinColumn({
+    name: "userId"
+  }),
+  _ts_metadata70("design:type", typeof exports.User === "undefined" ? Object : exports.User)
+], exports.OrderAssignee.prototype, "user", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.Vendor, {
+    nullable: true,
+    onDelete: "SET NULL"
+  }),
+  typeorm.JoinColumn({
+    name: "vendorId"
+  }),
+  _ts_metadata70("design:type", Object)
+], exports.OrderAssignee.prototype, "vendor", void 0);
+exports.OrderAssignee = _ts_decorate70([
+  typeorm.Entity("order_assignees"),
+  typeorm.Index("idx_order_assignees_order", [
+    "orderId"
+  ]),
+  typeorm.Index("idx_order_assignees_user", [
+    "userId"
+  ]),
+  typeorm.Index("idx_order_assignees_vendor", [
+    "vendorId"
+  ])
+], exports.OrderAssignee);
 
 // src/entities/index.ts
 var CMS_ENTITY_MAP = {
@@ -25216,7 +25580,8 @@ var CMS_ENTITY_MAP = {
   attendees: exports.Attendee,
   order_notification_bindings: exports.OrderNotificationBinding,
   order_notification_triggers: exports.OrderNotificationTrigger,
-  user_device_tokens: exports.UserDeviceToken
+  user_device_tokens: exports.UserDeviceToken,
+  order_assignees: exports.OrderAssignee
 };
 
 // src/plugins/blog-generator/blog-generator-agent-defaults.ts
@@ -28992,7 +29357,7 @@ function createCmsApiHandler(config) {
   ] : baseCrudResources;
   const requireEntityPermissionEffective = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async (_req, entity, action) => {
     if (!resolveSessionUser) {
-      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
+      chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
         entity,
         action,
         hint: "Pass getSessionUser: auth.getAuthenticatedUser from createCmsAuthBundle()"
@@ -29002,7 +29367,7 @@ function createCmsApiHandler(config) {
       const raw = await resolveSessionUser();
       const u = await hydrateVendorSessionUser(dataSource, raw);
       if (!u?.email) {
-        chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: no session user", {
+        chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: no session user", {
           entity,
           action
         });
@@ -29012,13 +29377,13 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunk4U6DATGZ_cjs.sessionHasEntityAccess(u, entity, action);
-      await chunkJ7FMZK66_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
+      const allowed = chunkOV5TRZET_cjs.sessionHasEntityAccess(u, entity, action);
+      await chunkO4AFPDQ4_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
       });
       if (allowed) return null;
-      const { reason } = chunkJ7FMZK66_cjs.explainSessionEntityAccess(u, entity, action);
+      const { reason } = chunkO4AFPDQ4_cjs.explainSessionEntityAccess(u, entity, action);
       return config.json({
         error: "Forbidden",
         entity,
@@ -29029,7 +29394,7 @@ function createCmsApiHandler(config) {
       });
     }
     if (userRequireEntityPermission) {
-      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
+      chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
         entity,
         action
       });
@@ -29116,10 +29481,10 @@ function createCmsApiHandler(config) {
       getVendorScope: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
         if (!multiVendorEnabled) {
-          return chunkJ7FMZK66_cjs.resolveDisabledMultiVendorScope(dataSource);
+          return chunkO4AFPDQ4_cjs.resolveDisabledMultiVendorScope(dataSource);
         }
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-        return chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+        return chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
       }, "getVendorScope"),
       getHydratedSessionUser: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
@@ -30467,7 +30832,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const result = await validateCoupon(dataSource, entityMap, couponCode, orderLinesNorm, currency, contactId, isAutomatic, discountId ?? void 0, vendorId);
@@ -30555,7 +30920,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
@@ -31112,8 +31477,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-NK65LOLV.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DZAXK4GQ.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.getChannels(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "send" && m === "POST" && getCms) {
@@ -31127,8 +31492,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-NK65LOLV.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DZAXK4GQ.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.sendOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "verify" && m === "POST" && getCms) {
@@ -31142,8 +31507,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-NK65LOLV.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DZAXK4GQ.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.verifyOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "eligible-assignees" && m === "GET") {
@@ -31157,7 +31522,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-NPKD64P6.cjs');
+        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-KF7RMTV5.cjs');
         const handlers = createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionUser);
         return handlers.listEligibleAssignees(req, orderId);
       }
@@ -31267,7 +31632,7 @@ function createCmsApiHandler(config) {
           if (resolveSessionUser) {
             const raw = await resolveSessionUser();
             const u = await hydrateVendorSessionUser(dataSource, raw);
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") {
               scopedVendorIds = scope.vendorIds;
             }
@@ -33656,10 +34021,10 @@ function createStorefrontApiHandler(config) {
             adminAccess: false
           }));
           const userId = newUser.id;
-          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+          await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
           if (entityMap.customer) {
             const phone = typeof b.phone === "string" && b.phone.trim() ? String(b.phone).trim() : null;
-            await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+            await chunkOV5TRZET_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
               id: userId,
               name,
               email,