@infuro/cms-core 1.0.66 → 1.0.68

package/dist/{chunk-QYRXLURF.cjs → chunk-22XKONB5.cjs}

@@ -1,20 +1,20 @@
 'use strict';
 
+var chunk7NMT3GBR_cjs = require('./chunk-7NMT3GBR.cjs');
 var chunkWFMVD567_cjs = require('./chunk-WFMVD567.cjs');
+var chunkTJ2MIQUT_cjs = require('./chunk-TJ2MIQUT.cjs');
 var chunkTHL5JDWJ_cjs = require('./chunk-THL5JDWJ.cjs');
 var chunkHY3AXLOI_cjs = require('./chunk-HY3AXLOI.cjs');
-var chunk5MZFQRDW_cjs = require('./chunk-5MZFQRDW.cjs');
+var chunkSMHQV3WL_cjs = require('./chunk-SMHQV3WL.cjs');
 var chunkH3IVLIPR_cjs = require('./chunk-H3IVLIPR.cjs');
-var chunk7NMT3GBR_cjs = require('./chunk-7NMT3GBR.cjs');
-var chunkXFDIIVZB_cjs = require('./chunk-XFDIIVZB.cjs');
-var chunkGLD263KW_cjs = require('./chunk-GLD263KW.cjs');
+var chunkUMC7W5G3_cjs = require('./chunk-UMC7W5G3.cjs');
+var chunkSUUD7OUG_cjs = require('./chunk-SUUD7OUG.cjs');
 var chunkUPLVMVRX_cjs = require('./chunk-UPLVMVRX.cjs');
 var chunkTZEMLHSP_cjs = require('./chunk-TZEMLHSP.cjs');
 var chunk3DZRIZOD_cjs = require('./chunk-3DZRIZOD.cjs');
-var chunkTJ2MIQUT_cjs = require('./chunk-TJ2MIQUT.cjs');
-var chunk4U6DATGZ_cjs = require('./chunk-4U6DATGZ.cjs');
+var chunkOV5TRZET_cjs = require('./chunk-OV5TRZET.cjs');
+var chunkO4AFPDQ4_cjs = require('./chunk-O4AFPDQ4.cjs');
 var chunkOY2YTBMP_cjs = require('./chunk-OY2YTBMP.cjs');
-var chunkJ7FMZK66_cjs = require('./chunk-J7FMZK66.cjs');
 var chunkD5FBNKQM_cjs = require('./chunk-D5FBNKQM.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 var typeorm = require('typeorm');
@@ -123,7 +123,7 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
         `, [
         primary.vendorRoleId
       ]);
-      vendorEntityPerms = chunkJ7FMZK66_cjs.permissionRowsToRecord(permRows);
+      vendorEntityPerms = chunkO4AFPDQ4_cjs.permissionRowsToRecord(permRows);
     } catch (err) {
       if (!isMissingVendorRoleSchemaError(err)) throw err;
     }
@@ -230,7 +230,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     ]);
     const resolvedId = Number(byEmailRows[0]?.id);
     if (!Number.isFinite(resolvedId)) {
-      chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
+      chunkO4AFPDQ4_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
         email: user.email,
         rawSessionId: user.id ?? null
       });
@@ -250,7 +250,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   const groupName = rows[0]?.groupName ?? user.groupName ?? null;
   const groupId = rows[0]?.groupId ?? user.groupId ?? void 0;
   const adminAccess = rows[0]?.adminAccess ?? user.adminAccess;
-  const isRBACAdmin = user.isRBACAdmin ?? chunkJ7FMZK66_cjs.isSuperAdmin({
+  const isRBACAdmin = user.isRBACAdmin ?? chunkO4AFPDQ4_cjs.isSuperAdmin({
     groupId,
     groupName,
     isRBACAdmin: user.isRBACAdmin
@@ -263,7 +263,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   };
   if (multiVendorEnabled) {
     ctx = await loadUserVendorContext(dataSource, id, user.activeVendorId);
-    flags = chunkJ7FMZK66_cjs.vendorPortalFlagsFromUser({
+    flags = chunkO4AFPDQ4_cjs.vendorPortalFlagsFromUser({
       email: user.email,
       isRBACAdmin,
       groupName,
@@ -298,7 +298,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     isVendorPortal: flags.isVendorPortal,
     isVendorOwner: flags.isVendorOwner
   };
-  chunkJ7FMZK66_cjs.logRbac("hydrateVendorSessionUser", {
+  chunkO4AFPDQ4_cjs.logRbac("hydrateVendorSessionUser", {
     email: user.email,
     userId: id,
     groupName,
@@ -911,7 +911,7 @@ function repoHasVendorIdColumn(repo) {
 }
 chunkUSNT2KNT_cjs.__name(repoHasVendorIdColumn, "repoHasVendorIdColumn");
 function resourceUsesVendorScope(resource) {
-  return resource === "vendors" || chunkJ7FMZK66_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
+  return resource === "vendors" || chunkO4AFPDQ4_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 chunkUSNT2KNT_cjs.__name(resourceUsesVendorScope, "resourceUsesVendorScope");
 function mergeWhereClause(where, extra) {
@@ -1401,7 +1401,7 @@ async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, c
   }
   let customerId = null;
   if (entityMap.customer) {
-    const ensured = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
+    const ensured = await chunkOV5TRZET_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
       name,
       email,
       phone,
@@ -1684,6 +1684,30 @@ function entityHasSoftDelete(repo) {
   return repo.metadata.columns.some((c) => c.propertyName === "deleted");
 }
 chunkUSNT2KNT_cjs.__name(entityHasSoftDelete, "entityHasSoftDelete");
+async function recordOrderAssigneeHistory(dataSource, entityMap, orderId, userId, vendorId) {
+  if (!entityMap.order_assignees) return 1;
+  const assigneeRepo = dataSource.getRepository(entityMap.order_assignees);
+  const maxRow = await assigneeRepo.findOne({
+    where: {
+      orderId
+    },
+    order: {
+      sortOrder: "DESC"
+    }
+  });
+  const currentMax = Number(maxRow?.sortOrder ?? 0);
+  const nextSortOrder = currentMax + 1;
+  await assigneeRepo.save({
+    orderId,
+    userId,
+    vendorId,
+    sortOrder: nextSortOrder,
+    assignedAt: /* @__PURE__ */ new Date()
+  });
+  console.log(`[ORDERS-DEBUG][ASSIGNEE_HISTORY] Recorded assignment for order ${orderId}: user ${userId}, vendor ${vendorId}, sortOrder ${nextSortOrder}`);
+  return nextSortOrder;
+}
+chunkUSNT2KNT_cjs.__name(recordOrderAssigneeHistory, "recordOrderAssigneeHistory");
 var LIST_QUERY_RESERVED = /* @__PURE__ */ new Set([
   "page",
   "limit",
@@ -3566,10 +3590,38 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").andWhere("order.deleted = :orderDel", {
+        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").leftJoinAndSelect("order.vendor", "vendor").andWhere("order.deleted = :orderDel", {
           orderDel: false
         }).orderBy(`order.${sortField2}`, sortOrderOrders).skip(skip).take(limit);
-        applyVendorScopeToQueryBuilder(qb, "order", scope);
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][LIST] Querying orders. Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorPortal: session?.isVendorPortal,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          vendorIds: session?.vendorIds,
+          activeVendorId: session?.activeVendorId
+        }, "Scope:", scope);
+        if (scope.type === "deny") {
+          qb.andWhere("1 = 0");
+        } else if (scope.type === "vendor") {
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          console.log("[ORDERS-DEBUG][LIST] Vendor scope applied. isOwner:", isOwner, "vendorId:", scope.vendorId);
+          if (isOwner) {
+            qb.andWhere('(order.vendorId = :vendorScopeId OR order.assignedUserId IN (SELECT vu."userId" FROM vendor_users vu WHERE vu."vendorId" = :vendorScopeId))', {
+              vendorScopeId: scope.vendorId
+            });
+          } else {
+            const teamMemberId = Number(session?.id);
+            console.log("[ORDERS-DEBUG][LIST] Team member scoping to teamMemberId:", teamMemberId);
+            qb.andWhere("order.assignedUserId = :teamMemberId", {
+              teamMemberId
+            });
+          }
+        }
         const vendorIdFilter = searchParams.get("vendorId")?.trim();
         if (vendorIdFilter) {
           const n = Number(vendorIdFilter);
@@ -3622,7 +3674,15 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
+        console.log("[ORDERS-DEBUG][LIST] Executing SQL:", qb.getSql(), "Params:", qb.getParameters());
         const [rows, total2] = await qb.getManyAndCount();
+        console.log("[ORDERS-DEBUG][LIST] Query result: total =", total2, "rows length =", rows.length, "Orders:", rows.map((r) => ({
+          id: r.id,
+          orderNumber: r.orderNumber,
+          vendorId: r.vendorId,
+          assignedUserId: r.assignedUserId,
+          status: r.status
+        })));
         const data2 = await Promise.all(rows.map(async (order) => {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
           const contact = order.contact;
@@ -3666,6 +3726,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           if (orderStatus === "cancelled" && rawPayStatus !== "paid" && rawPayStatus !== "captured" && rawPayStatus !== "refunded") {
             paymentStatus2 = "unpaid";
           }
+          const vendorObj = order.vendor;
           return {
             ...orderWithoutPayments,
             contact: contact ? {
@@ -3679,6 +3740,11 @@ function createCrudHandler(dataSource, entityMap, options) {
               name: assignedUserObj.name || assignedUserObj.email,
               email: assignedUserObj.email
             } : null,
+            vendor: vendorObj ? {
+              id: vendorObj.id,
+              name: vendorObj.name || vendorObj.slug || `Vendor #${vendorObj.id}`,
+              slug: vendorObj.slug
+            } : null,
             itemsSummary,
             paymentStatus: paymentStatus2
           };
@@ -4211,6 +4277,18 @@ function createCrudHandler(dataSource, entityMap, options) {
               isCatalog: true
             });
           }
+        } else if (resource === "orders" && scope.type === "vendor") {
+          const session = await getHydratedSessionUser?.() ?? null;
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          if (!isOwner) {
+            const teamMemberId = Number(session?.id);
+            where = mergeListWhereAnd(where, {
+              vendorId: scope.vendorId,
+              assignedUserId: teamMemberId
+            });
+          } else {
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
+          }
         } else {
           where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
         }
@@ -4437,7 +4515,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const savedCustomer = await chunk4U6DATGZ_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
+        const savedCustomer = await chunkOV5TRZET_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
           phone,
@@ -5175,6 +5253,12 @@ function createCrudHandler(dataSource, entityMap, options) {
               shippingAddressId: savedShipping?.id ?? null
             });
           }
+          if (persistBody.assignedUserId) {
+            const initAssignee = Number(persistBody.assignedUserId);
+            if (Number.isFinite(initAssignee) && initAssignee > 0) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, created.id, initAssignee, Number(created.vendorId) || null);
+            }
+          }
           const reloadedOrder = await repo.findOne({
             where: {
               id: created.id,
@@ -5239,7 +5323,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           const orderIdForNotify = created.id;
           const finalCreatedStatus = String(created.status ?? createdStatus ?? "pending").toLowerCase();
           const initialPayStatus = String(persistBody.paymentStatus ?? body.paymentStatus ?? "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
             if (finalCreatedStatus === "pending") {
               if (initialPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", orderIdForNotify, {
@@ -5494,7 +5578,16 @@ function createCrudHandler(dataSource, entityMap, options) {
       const scope = await resolveScope();
       const flags = await getVendorCatalogCreateFlags(dataSource);
       if (scope.type !== "all") {
-        data = data.filter((row) => vendorScopeRowAccess(row, scope, resource, flags) === "ok");
+        const session = await getHydratedSessionUser?.() ?? null;
+        const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+        const teamMemberId = Number(session?.id);
+        data = data.filter((row) => {
+          if (vendorScopeRowAccess(row, scope, resource, flags) !== "ok") return false;
+          if (resource === "orders" && scope.type === "vendor" && !isOwner) {
+            return Number(row?.assignedUserId) === teamMemberId;
+          }
+          return true;
+        });
       }
       const excludeCols = /* @__PURE__ */ new Set([
         "deletedAt",
@@ -5532,6 +5625,51 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
     type: "all"
   }));
   async function vendorScopeAccessJson(row, scope, resource) {
+    if (!row) return json({
+      message: "Not found"
+    }, {
+      status: 404
+    });
+    if (resource === "orders" && scope.type === "vendor") {
+      const rowVendorId = Number(row?.vendorId);
+      let orderBelongsToVendorScope = rowVendorId === scope.vendorId;
+      if (!orderBelongsToVendorScope) {
+        const aId = Number(row?.assignedUserId);
+        if (Number.isFinite(aId) && aId > 0 && entityMap["vendor_users"]) {
+          const vuRepo = dataSource.getRepository(entityMap["vendor_users"]);
+          const isTeamMember = await vuRepo.count({
+            where: {
+              vendorId: scope.vendorId,
+              userId: aId
+            }
+          });
+          if (isTeamMember > 0) {
+            orderBelongsToVendorScope = true;
+          }
+        }
+      }
+      if (!orderBelongsToVendorScope) {
+        return json({
+          error: "Forbidden"
+        }, {
+          status: 403
+        });
+      }
+      const session = await getHydratedSessionUser?.() ?? null;
+      const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+      if (!isOwner) {
+        const sessionUserId = Number(session?.id);
+        const orderAssignee = Number(row?.assignedUserId);
+        if (!Number.isFinite(orderAssignee) || orderAssignee !== sessionUserId) {
+          return json({
+            error: "Forbidden: You can only access orders assigned directly to you"
+          }, {
+            status: 403
+          });
+        }
+      }
+      return null;
+    }
     const flags = await getVendorCatalogCreateFlags(dataSource);
     const access = vendorScopeRowAccess(row, scope, resource, flags);
     if (access === "ok") return null;
@@ -5656,6 +5794,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       if (resource === "orders") {
         const scope2 = await resolveScopeById();
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Fetching order id:", id, "Scope:", scope2, "Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          activeVendorId: session?.activeVendorId,
+          vendorIds: session?.vendorIds
+        });
         const order = await repo.findOne({
           where: {
             id: Number(id)
@@ -5668,14 +5817,26 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product",
             "items.product.collection",
             "payments",
-            "assignedUser"
+            "assignedUser",
+            "vendor"
           ]
         });
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Order found in DB:", order ? {
+          id: order.id,
+          orderNumber: order.orderNumber,
+          vendorId: order.vendorId,
+          assignedUserId: order.assignedUserId,
+          status: order.status
+        } : null);
         if (order) {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
         }
         const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
-        if (orderDenied) return orderDenied;
+        if (orderDenied) {
+          console.log("[ORDERS-DEBUG][GET_BY_ID] Access DENIED for order id:", id);
+          return orderDenied;
+        }
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Access GRANTED for order id:", id);
         const relatedOrders = await repo.find({
           where: {
             parentOrderId: Number(id)
@@ -6059,21 +6220,67 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             lines: []
           } : await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, effectiveCurrency, putDiscountId, Number.isFinite(putOrderVendorId) ? putOrderVendorId : null);
           const scalarUpdate = pickColumnUpdates(repo, rawBody);
-          if (rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
-            const aId = Number(rawBody.assignedUserId);
-            if (Number.isFinite(aId) && aId > 0) {
-              scalarUpdate.assignedUserId = aId;
-              scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
-            } else {
-              scalarUpdate.assignedUserId = null;
-              scalarUpdate.assignedAt = null;
+          if (rawBody && typeof rawBody === "object") {
+            if (scopePutEarly.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+              const vId = Number(rawBody.vendorId);
+              if (Number.isFinite(vId) && vId > 0) {
+                scalarUpdate.vendorId = vId;
+              }
+            }
+            if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
+              const aId = Number(rawBody.assignedUserId);
+              if (Number.isFinite(aId) && aId > 0) {
+                if (scopePutEarly.type === "vendor" && entityMap.vendor_users) {
+                  const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+                  const vuLink = await vuRepo.findOne({
+                    where: {
+                      vendorId: scopePutEarly.vendorId,
+                      userId: aId
+                    }
+                  });
+                  if (!vuLink) {
+                    return json({
+                      error: "Cannot assign order to a user outside your vendor team."
+                    }, {
+                      status: 403
+                    });
+                  }
+                  scalarUpdate.vendorId = scopePutEarly.vendorId;
+                } else if (scopePutEarly.type === "all" && entityMap.vendor_users) {
+                  if (entityMap.vendors) {
+                    const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                       FROM vendor_users vu
+                       JOIN vendors v ON v.id = vu."vendorId"
+                       WHERE vu."userId" = $1 AND v.deleted = false
+                       ORDER BY vu.id DESC
+                       LIMIT 1`, [
+                      aId
+                    ]);
+                    if (activeVu.length > 0 && activeVu[0].vendorId) {
+                      scalarUpdate.vendorId = Number(activeVu[0].vendorId);
+                    }
+                  }
+                }
+                const prevAssigned = Number(existingOrderRow?.assignedUserId);
+                const prevVendor = Number(existingOrderRow?.vendorId);
+                const targetVendor = Number.isFinite(Number(scalarUpdate.vendorId)) ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId) || null;
+                if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+                  await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+                }
+                scalarUpdate.assignedUserId = aId;
+                scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
+              } else {
+                scalarUpdate.assignedUserId = null;
+                scalarUpdate.assignedAt = null;
+              }
             }
           }
           if (scalarUpdate.status === "processing") {
             const effectiveAssignee = scalarUpdate.assignedUserId !== void 0 ? scalarUpdate.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-            if (!effectiveAssignee) {
+            const effectiveVendor = scalarUpdate.vendorId !== void 0 ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId);
+            if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
               return json({
-                error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+                error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
               }, {
                 status: 400
               });
@@ -6319,7 +6526,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
           const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
           if (assigneeUpdated) {
-            void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
               fireOrderNotificationTrigger("order_assigned", updatedOrder.id, {
                 dataSource,
                 entityMap
@@ -6336,7 +6543,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             const payments = Array.isArray(updatedOrder.payments) ? updatedOrder.payments : [];
             const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
             const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-            void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
               if (newStatus === "pending") {
                 if (curPayStatus === "failed") {
                   fireOrderNotificationTrigger("payment_failed", updatedOrder.id, {
@@ -6490,7 +6697,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       const updatePayload = rawBody && typeof rawBody === "object" ? pickColumnUpdates(repo, rawBody) : {};
       if (resourceUsesVendorScope(resource)) {
-        delete updatePayload.vendorId;
+        if (!(resource === "orders" && scopePut.type === "all")) {
+          delete updatePayload.vendorId;
+        }
       }
       if (resource === "contacts" && "type" in updatePayload) {
         const t = updatePayload.type;
@@ -6886,9 +7095,59 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         }
       }
       if (resource === "orders" && orderInvPrev && rawBody && typeof rawBody === "object") {
+        console.log("[ORDERS-DEBUG][UPDATE] PUT /api/orders/" + numericId, "Scope:", scopePut, "rawBody:", rawBody, "existingOrder:", {
+          id: existingOrderRow?.id,
+          vendorId: existingOrderRow?.vendorId,
+          assignedUserId: existingOrderRow?.assignedUserId,
+          status: existingOrderRow?.status
+        });
+        if (scopePut.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+          const vId = Number(rawBody.vendorId);
+          if (Number.isFinite(vId) && vId > 0) {
+            updatePayload.vendorId = vId;
+          }
+        }
         if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
           const aId = Number(rawBody.assignedUserId);
+          console.log("[ORDERS-DEBUG][UPDATE] Updating assignedUserId to:", aId);
           if (Number.isFinite(aId) && aId > 0) {
+            if (scopePut.type === "vendor" && entityMap.vendor_users) {
+              const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+              const vuLink = await vuRepo.findOne({
+                where: {
+                  vendorId: scopePut.vendorId,
+                  userId: aId
+                }
+              });
+              if (!vuLink) {
+                return json({
+                  error: "Cannot assign order to a user outside your vendor team."
+                }, {
+                  status: 403
+                });
+              }
+              updatePayload.vendorId = scopePut.vendorId;
+            } else if (scopePut.type === "all" && entityMap.vendor_users) {
+              if (entityMap.vendors) {
+                const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                   FROM vendor_users vu
+                   JOIN vendors v ON v.id = vu."vendorId"
+                   WHERE vu."userId" = $1 AND v.deleted = false
+                   ORDER BY vu.id DESC
+                   LIMIT 1`, [
+                  aId
+                ]);
+                if (activeVu.length > 0 && activeVu[0].vendorId) {
+                  updatePayload.vendorId = Number(activeVu[0].vendorId);
+                }
+              }
+            }
+            const prevAssigned = Number(existingOrderRow?.assignedUserId);
+            const prevVendor = Number(existingOrderRow?.vendorId);
+            const targetVendor = Number.isFinite(Number(updatePayload.vendorId)) ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId) || null;
+            if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+            }
             updatePayload.assignedUserId = aId;
             updatePayload.assignedAt = /* @__PURE__ */ new Date();
           } else {
@@ -6896,11 +7155,13 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             updatePayload.assignedAt = null;
           }
         }
+        console.log("[ORDERS-DEBUG][UPDATE] Final updatePayload for order:", updatePayload);
         if (updatePayload.status === "processing") {
           const effectiveAssignee = updatePayload.assignedUserId !== void 0 ? updatePayload.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-          if (!effectiveAssignee) {
+          const effectiveVendor = updatePayload.vendorId !== void 0 ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId);
+          if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
             return json({
-              error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+              error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
             }, {
               status: 400
             });
@@ -6990,7 +7251,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                     });
                   }
                   if (ordStatus === "pending" || ordStatus === "confirmed") {
-                    void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+                    void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
                       fireOrderNotificationTrigger("order_placed", pOrder, {
                         dataSource,
                         entityMap
@@ -7004,7 +7265,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                   }
                 }
               } else if (newPayStatus === "failed") {
-                void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_failed", pOrder, {
                     dataSource,
                     entityMap
@@ -7012,7 +7273,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                 }).catch(() => {
                 });
               } else if (newPayStatus === "refunded") {
-                void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_refund_initiated", pOrder, {
                     dataSource,
                     entityMap
@@ -7139,7 +7400,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
         const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
         if (assigneeUpdated) {
-          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_assigned", ord.id, {
               dataSource,
               entityMap
@@ -7156,7 +7417,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const payments = Array.isArray(ord.payments) ? ord.payments : [];
           const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
           const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
             if (newStatus === "pending") {
               if (curPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", ord.id, {
@@ -7853,7 +8114,7 @@ function createInviteAcceptHandler(config) {
       }
       const { userId, email, vendorId } = validation.target;
       if (entityMap.contacts) {
-        await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+        await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
@@ -8946,7 +9207,7 @@ function createVendorDashboardHandler(config) {
       if (pe) return pe;
     }
     const user = await getSessionUser();
-    if (!user || !chunkJ7FMZK66_cjs.isVendorPortalUser(user)) {
+    if (!user || !chunkO4AFPDQ4_cjs.isVendorPortalUser(user)) {
       return json({
         error: "Forbidden"
       }, {
@@ -10275,7 +10536,7 @@ function createFormSubmissionHandler(config) {
                 label: f.label && String(f.label).trim() || `Field ${f.id}`,
                 value: formatSubmissionFieldValue(data[String(f.id)])
               }));
-              await chunkXFDIIVZB_cjs.queueEmail(cms, {
+              await chunkUMC7W5G3_cjs.queueEmail(cms, {
                 to,
                 templateName: "formSubmission",
                 ctx: {
@@ -10329,7 +10590,7 @@ function createUsersApiHandlers(config) {
     try {
       const cms = await getCms();
       const companyDetails = getCompanyDetails ? await getCompanyDetails() : {};
-      await chunkXFDIIVZB_cjs.queueEmail(cms, {
+      await chunkUMC7W5G3_cjs.queueEmail(cms, {
         to: toEmail,
         templateName: "invite",
         ctx: {
@@ -10508,11 +10769,11 @@ function createUsersApiHandlers(config) {
           adminAccess
         }));
         if (entityMap.contacts) {
-          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
+          await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
         }
         if (entityMap.customer) {
           const phone = typeof body.phone === "string" && body.phone.trim() ? body.phone.trim() : null;
-          await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+          await chunkOV5TRZET_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
             id: newUser.id,
             name: String(newUser.name ?? body.name),
             email: String(newUser.email),
@@ -11602,7 +11863,7 @@ function createChatHandlers(config) {
         const notifyEmailAgent = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT, {
           enabledOnly: false
         });
-        const emailTool = chunk5MZFQRDW_cjs.resolveChatEmailToolSettings(llmSettings, {
+        const emailTool = chunkSMHQV3WL_cjs.resolveChatEmailToolSettings(llmSettings, {
           chatbotValidationRules: agentRow?.validationRules ?? null,
           notifyAgent: notifyEmailAgent ? {
             systemInstruction: notifyEmailAgent.systemInstruction,
@@ -11612,7 +11873,7 @@ function createChatHandlers(config) {
         const emailPlugin2 = cms.getPlugin("email");
         const convLeadSent = conv.leadEmailSentAt;
         const chatAgentFn = llm.chatAgent?.bind(llm);
-        console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline check", {
+        console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline check", {
           conversationId,
           enabled: emailTool.enabled,
           intentCount: emailTool.intents.length,
@@ -11626,27 +11887,27 @@ function createChatHandlers(config) {
           mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
         });
         if (!emailTool.enabled) {
-          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_tool_disabled"
           });
         } else if (emailTool.intents.length === 0) {
-          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "no_intents_configured"
           });
         } else if (!emailPlugin2) {
-          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_plugin_missing"
           });
         } else if (!chatAgentFn) {
-          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "llm_chat_agent_unavailable"
           });
         } else if (convLeadSent) {
-          console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "lead_email_already_sent",
             leadEmailSentAt: convLeadSent
@@ -11659,7 +11920,7 @@ function createChatHandlers(config) {
             }
           });
           if (!contactRow) {
-            console.warn(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+            console.warn(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
               conversationId,
               reason: "contact_not_found",
               contactId
@@ -11667,7 +11928,7 @@ function createChatHandlers(config) {
           } else {
             const c = contactRow;
             try {
-              const intent = await chunk5MZFQRDW_cjs.detectChatLeadIntent({
+              const intent = await chunkSMHQV3WL_cjs.detectChatLeadIntent({
                 chatAgent: chatAgentFn
               }, {
                 settings: emailTool,
@@ -11681,15 +11942,15 @@ function createChatHandlers(config) {
                 model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
               });
               if (!intent.intent || !intent.emailTo) {
-                console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "no email sent", {
+                console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "no email sent", {
                   conversationId,
                   reason: intent.intent ? "missing_email_to" : "no_intent_match",
                   intentLabel: intent.intentLabel,
                   classifierReason: intent.reason
                 });
               } else {
-                const intentRecipients = chunk5MZFQRDW_cjs.parseIntentRecipientEmails(intent.emailTo);
-                console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                const intentRecipients = chunkSMHQV3WL_cjs.parseIntentRecipientEmails(intent.emailTo);
+                console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
                   conversationId,
                   intent: intent.intent,
                   emailTo: intent.emailTo,
@@ -11700,7 +11961,7 @@ function createChatHandlers(config) {
                 const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
                 const storeSettings = await loadSettingsGroupMap(dataSource, entityMap, "store");
                 const companyDetails = chunkTZEMLHSP_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings, storeSettings);
-                const leadResult = await chunk5MZFQRDW_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                const leadResult = await chunkSMHQV3WL_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
                   contactName: String(c.name ?? "").trim() || "Visitor",
                   contactEmail: String(c.email ?? "").trim(),
                   contactPhone: c.phone ?? null,
@@ -11708,7 +11969,7 @@ function createChatHandlers(config) {
                   latestMessage: message,
                   intentCode: intent.intent,
                   intentReason: intent.intentLabel || intent.reason,
-                  transcript: chunk5MZFQRDW_cjs.buildTranscriptForLeadEmail(history, message),
+                  transcript: chunkSMHQV3WL_cjs.buildTranscriptForLeadEmail(history, message),
                   companyDetails,
                   recipients: intentRecipients.length > 0 ? intentRecipients : void 0
                 });
@@ -11716,13 +11977,13 @@ function createChatHandlers(config) {
                   await convRepo().update(conversationId, {
                     leadEmailSentAt: /* @__PURE__ */ new Date()
                   });
-                  console.info(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
+                  console.info(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
                     conversationId,
                     sent: true,
                     recipients: leadResult.recipients
                   });
                 } else {
-                  console.warn(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
+                  console.warn(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
                     conversationId,
                     sent: false,
                     error: leadResult.error ?? "unknown",
@@ -11731,7 +11992,7 @@ function createChatHandlers(config) {
                 }
               }
             } catch (intentErr) {
-              console.warn(chunk5MZFQRDW_cjs.CHAT_EMAIL_LOG, "pipeline error", {
+              console.warn(chunkSMHQV3WL_cjs.CHAT_EMAIL_LOG, "pipeline error", {
                 conversationId,
                 error: intentErr instanceof Error ? intentErr.message : String(intentErr)
               });
@@ -11748,7 +12009,7 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = chunk5MZFQRDW_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
+          const systemPrompt = chunkSMHQV3WL_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
           const res = await llm.chatAgent({
             ...fromAgent,
             systemPrompt: systemPrompt || void 0,
@@ -11769,7 +12030,7 @@ ${contextParts.join("\n\n")}` : "";
               agentRow.systemInstruction?.trim(),
               ragSystem
             ].filter(Boolean).join("\n\n");
-            systemContent = chunk5MZFQRDW_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
+            systemContent = chunkSMHQV3WL_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -13024,7 +13285,7 @@ function createDeviceTokensHandlers(config) {
         const title = body.title?.trim() || "Test Push Notification";
         const msgBody = body.body?.trim() || "Firebase Push Notification setup is working!";
         if (!token || token === "validate" || token === "validate_only") {
-          const valRes = await chunk5MZFQRDW_cjs.validateFcmCredentials(dataSource, entityMap);
+          const valRes = await chunkSMHQV3WL_cjs.validateFcmCredentials(dataSource, entityMap);
           if (!valRes.success) {
             return json({
               success: false,
@@ -13041,7 +13302,7 @@ function createDeviceTokensHandlers(config) {
             clientEmail: valRes.clientEmail
           });
         }
-        const res = await chunk5MZFQRDW_cjs.sendFcmPushNotification(dataSource, entityMap, {
+        const res = await chunkSMHQV3WL_cjs.sendFcmPushNotification(dataSource, entityMap, {
           token,
           title,
           body: msgBody,
@@ -13595,7 +13856,7 @@ chunkUSNT2KNT_cjs.__name(findActiveRefundPolicyForVendor, "findActiveRefundPolic
 // src/api/admin-roles-handlers.ts
 function createAdminRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
-  const baseEntities = chunkJ7FMZK66_cjs.getPermissionableEntityKeys(entityMap);
+  const baseEntities = chunkO4AFPDQ4_cjs.getPermissionableEntityKeys(entityMap);
   const allowEntities = /* @__PURE__ */ new Set([
     ...baseEntities,
     "users"
@@ -13610,7 +13871,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunk4U6DATGZ_cjs.canManageRoles(u) && !chunkJ7FMZK66_cjs.canManageVendorRoles(u)) {
+    if (!chunkOV5TRZET_cjs.canManageRoles(u) && !chunkO4AFPDQ4_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -13621,11 +13882,11 @@ function createAdminRolesHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunkJ7FMZK66_cjs.canManageVendorRoles(u) && !chunk4U6DATGZ_cjs.canManageRoles(u);
+    return chunkO4AFPDQ4_cjs.canManageVendorRoles(u) && !chunkOV5TRZET_cjs.canManageRoles(u);
   }
   chunkUSNT2KNT_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
-    ...chunkJ7FMZK66_cjs.VENDOR_STORE_RBAC_ENTITIES,
+    ...chunkO4AFPDQ4_cjs.VENDOR_STORE_RBAC_ENTITIES,
     "dashboard",
     "settings"
   ].sort();
@@ -13782,7 +14043,7 @@ function createAdminRolesHandlers(config) {
         }, {
           status: 404
         });
-        if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name) && !chunkJ7FMZK66_cjs.isSuperAdminGroupName(name)) {
+        if (chunkO4AFPDQ4_cjs.isSuperAdminGroupName(g.name) && !chunkO4AFPDQ4_cjs.isSuperAdminGroupName(name)) {
           return json({
             error: "Cannot rename the administrator group"
           }, {
@@ -13839,7 +14100,7 @@ function createAdminRolesHandlers(config) {
       }, {
         status: 404
       });
-      if (chunkJ7FMZK66_cjs.isSuperAdminGroupName(g.name)) return json({
+      if (chunkO4AFPDQ4_cjs.isSuperAdminGroupName(g.name)) return json({
         error: "Cannot delete the administrator group"
       }, {
         status: 400
@@ -14037,7 +14298,7 @@ async function sendVendorOnboardEmails(input, deps) {
       getVendorEmails(deps)
     ]);
     const companyDetails = chunkTZEMLHSP_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings, storeSettings);
-    const configuredNotify = chunk5MZFQRDW_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
+    const configuredNotify = chunkSMHQV3WL_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const ownerEmail = input.ownerEmail?.trim() || "";
     const ownerEmailLower = ownerEmail.toLowerCase();
     const sendToOwner = input.sendToOwner !== false;
@@ -14047,7 +14308,7 @@ async function sendVendorOnboardEmails(input, deps) {
     ];
     const notifyEmails = Array.from(new Set(combined.map((e) => e.trim().toLowerCase()).filter((e) => e && e !== ownerEmailLower && !vendorEmailSet.has(e))));
     const cms = await deps.getCms();
-    await chunkXFDIIVZB_cjs.queueVendorOnboardEmails(cms, {
+    await chunkUMC7W5G3_cjs.queueVendorOnboardEmails(cms, {
       vendorName: input.vendorName,
       vendorSlug: input.vendorSlug,
       ownerName: input.ownerName,
@@ -14071,7 +14332,7 @@ chunkUSNT2KNT_cjs.__name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
 async function insertRolePermissions(exec, vendorRoleId, permissions) {
-  for (const entity of chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES) {
+  for (const entity of chunkO4AFPDQ4_cjs.VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
     await exec.query(`
@@ -14102,7 +14363,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     for (const r of existing) {
       roleIdsByName2[r.name] = Number(r.id);
       if (r.isOwnerRole) ownerRoleId2 = Number(r.id);
-      if (r.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
+      if (r.name === chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
     }
     return {
       roleIdsByName: roleIdsByName2,
@@ -14113,7 +14374,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
   const roleIdsByName = {};
   let ownerRoleId = 0;
   let viewerRoleId = 0;
-  for (const def of chunkJ7FMZK66_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
+  for (const def of chunkO4AFPDQ4_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
     const inserted = await exec.query(`
       INSERT INTO "vendor_roles"
         ("vendorId", "name", "description", "isSystem", "isOwnerRole")
@@ -14130,7 +14391,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     if (!roleId) continue;
     roleIdsByName[def.name] = roleId;
     if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
+    if (def.name === chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
     await insertRolePermissions(exec, roleId, def.permissions);
   }
   return {
@@ -14160,7 +14421,7 @@ async function backfillVendorUserRoleIds(em, vendorId, seeded) {
       vendorId
     ]);
   }
-  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME];
+  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME];
   if (viewerId) {
     await em.query(`
       UPDATE "vendor_users"
@@ -14186,7 +14447,7 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
     LIMIT 1
     `, [
     vendorId,
-    chunkJ7FMZK66_cjs.VENDOR_VIEWER_ROLE_NAME
+    chunkO4AFPDQ4_cjs.VENDOR_VIEWER_ROLE_NAME
   ]);
   const id = rows[0]?.id;
   return id != null ? Number(id) : null;
@@ -14547,7 +14808,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.isPlatformAdministrator(u)) return json({
       error: "Forbidden",
       reason: "admin_only"
     }, {
@@ -14557,7 +14818,7 @@ function createVendorOnboardHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
-    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u);
     const candidates = [];
     if (scope.type === "vendor") candidates.push(scope.vendorId);
     if (scope.type === "all" || scope.type === "vendor") {
@@ -14611,7 +14872,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.isVendorPortalUser(u) && !chunkJ7FMZK66_cjs.isPlatformAdministrator(u)) {
+    if (!chunkO4AFPDQ4_cjs.isVendorPortalUser(u) && !chunkO4AFPDQ4_cjs.isPlatformAdministrator(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -14639,7 +14900,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.canManageVendorTeam(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.canManageVendorTeam(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -14857,7 +15118,7 @@ function createVendorOnboardHandlers(config) {
           await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
-              name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+              name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
               deleted: false
             }
           });
@@ -14872,12 +15133,12 @@ function createVendorOnboardHandlers(config) {
           if (!ownerGroup) {
             try {
               await groupRepo.save(groupRepo.create({
-                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }));
               ownerGroup = await groupRepo.findOne({
                 where: {
-                  name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                  name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                   deleted: false
                 }
               });
@@ -14994,7 +15255,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkOV5TRZET_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -15291,6 +15552,7 @@ function createVendorOnboardHandlers(config) {
           state: vp?.state ?? null,
           postalCode: vp?.postalCode ?? null,
           blocked: u?.blocked ?? false,
+          inviteStatus: u?.inviteStatus ?? (u?.password ? "active" : "pending"),
           groupName: u?.group?.name ?? null
         };
       });
@@ -15494,7 +15756,7 @@ function createVendorOnboardHandlers(config) {
           if (!groupId) {
             const g = await groupRepo.findOne({
               where: {
-                name: chunkJ7FMZK66_cjs.VENDOR_GROUP_NAME,
+                name: chunkO4AFPDQ4_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }
             }) ?? await groupRepo.findOne({
@@ -15594,7 +15856,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunk4U6DATGZ_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkOV5TRZET_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -15764,14 +16026,24 @@ function createVendorOnboardHandlers(config) {
             });
           }
         }
-        const token = String(user.inviteToken ?? "").trim();
-        if (!token || user.inviteStatus !== "pending") {
+        const hasPassword = !!(user.password && String(user.password).trim());
+        const isPending = user.inviteStatus === "pending" || !hasPassword;
+        if (!isPending) {
           return json({
-            error: "No pending invite for this user"
+            error: "User has already accepted the invite"
           }, {
             status: 400
           });
         }
+        let token = String(user.inviteToken ?? "").trim();
+        if (!token) {
+          token = newUserInviteToken();
+          await dataSource.getRepository(entityMap.users).update(user.id, {
+            inviteToken: token,
+            inviteStatus: "pending",
+            password: null
+          });
+        }
         const inviteLink = buildUserInviteLink(baseUrl, token);
         const emailSent = await trySendVendorOnboardEmails({
           vendorName,
@@ -16131,10 +16403,10 @@ chunkUSNT2KNT_cjs.__name(createVendorOnboardHandlers, "createVendorOnboardHandle
 function createVendorRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
   const vendorRoleEntities = [
-    ...chunkJ7FMZK66_cjs.VENDOR_RBAC_ENTITIES
+    ...chunkO4AFPDQ4_cjs.VENDOR_RBAC_ENTITIES
   ].sort();
   async function resolveActiveVendorId(u) {
-    const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -16150,7 +16422,7 @@ function createVendorRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkJ7FMZK66_cjs.canManageVendorRoles(u)) return json({
+    if (!chunkO4AFPDQ4_cjs.canManageVendorRoles(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -25145,6 +25417,109 @@ _ts_decorate69([
 exports.OrderNotificationTrigger = _ts_decorate69([
   typeorm.Entity("order_notification_triggers")
 ], exports.OrderNotificationTrigger);
+function _ts_decorate70(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+chunkUSNT2KNT_cjs.__name(_ts_decorate70, "_ts_decorate");
+function _ts_metadata70(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+chunkUSNT2KNT_cjs.__name(_ts_metadata70, "_ts_metadata");
+exports.OrderAssignee = class OrderAssignee {
+  static {
+    chunkUSNT2KNT_cjs.__name(this, "OrderAssignee");
+  }
+  id;
+  orderId;
+  userId;
+  vendorId;
+  sortOrder;
+  assignedAt;
+  createdAt;
+  order;
+  user;
+  vendor;
+};
+_ts_decorate70([
+  typeorm.PrimaryGeneratedColumn(),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "id", void 0);
+_ts_decorate70([
+  typeorm.Column("int"),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "orderId", void 0);
+_ts_decorate70([
+  typeorm.Column("int"),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "userId", void 0);
+_ts_decorate70([
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata70("design:type", Object)
+], exports.OrderAssignee.prototype, "vendorId", void 0);
+_ts_decorate70([
+  typeorm.Column("int", {
+    default: 1
+  }),
+  _ts_metadata70("design:type", Number)
+], exports.OrderAssignee.prototype, "sortOrder", void 0);
+_ts_decorate70([
+  typeorm.Column({
+    type: "timestamp with time zone",
+    default: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(() => "CURRENT_TIMESTAMP", "default")
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], exports.OrderAssignee.prototype, "assignedAt", void 0);
+_ts_decorate70([
+  typeorm.CreateDateColumn({
+    type: "timestamp with time zone"
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], exports.OrderAssignee.prototype, "createdAt", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.Order, {
+    onDelete: "CASCADE"
+  }),
+  typeorm.JoinColumn({
+    name: "orderId"
+  }),
+  _ts_metadata70("design:type", typeof exports.Order === "undefined" ? Object : exports.Order)
+], exports.OrderAssignee.prototype, "order", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.User, {
+    onDelete: "CASCADE"
+  }),
+  typeorm.JoinColumn({
+    name: "userId"
+  }),
+  _ts_metadata70("design:type", typeof exports.User === "undefined" ? Object : exports.User)
+], exports.OrderAssignee.prototype, "user", void 0);
+_ts_decorate70([
+  typeorm.ManyToOne(() => exports.Vendor, {
+    nullable: true,
+    onDelete: "SET NULL"
+  }),
+  typeorm.JoinColumn({
+    name: "vendorId"
+  }),
+  _ts_metadata70("design:type", Object)
+], exports.OrderAssignee.prototype, "vendor", void 0);
+exports.OrderAssignee = _ts_decorate70([
+  typeorm.Entity("order_assignees"),
+  typeorm.Index("idx_order_assignees_order", [
+    "orderId"
+  ]),
+  typeorm.Index("idx_order_assignees_user", [
+    "userId"
+  ]),
+  typeorm.Index("idx_order_assignees_vendor", [
+    "vendorId"
+  ])
+], exports.OrderAssignee);
 
 // src/entities/index.ts
 var CMS_ENTITY_MAP = {
@@ -25216,7 +25591,8 @@ var CMS_ENTITY_MAP = {
   attendees: exports.Attendee,
   order_notification_bindings: exports.OrderNotificationBinding,
   order_notification_triggers: exports.OrderNotificationTrigger,
-  user_device_tokens: exports.UserDeviceToken
+  user_device_tokens: exports.UserDeviceToken,
+  order_assignees: exports.OrderAssignee
 };
 
 // src/plugins/blog-generator/blog-generator-agent-defaults.ts
@@ -28694,11 +29070,11 @@ function whatsappPlugin(config = {}) {
         db = await settingsLoader?.() ?? {};
       } catch {
       }
-      if (!chunk5MZFQRDW_cjs.isWhatsAppPluginEnabled(db)) {
+      if (!chunkSMHQV3WL_cjs.isWhatsAppPluginEnabled(db)) {
         context.logger.warn("WhatsApp plugin skipped: disabled in Plugins \u2192 WhatsApp");
         return null;
       }
-      const svc = new chunk5MZFQRDW_cjs.WhatsAppService(env, staticRest, settingsLoader, getMessageTemplateRow);
+      const svc = new chunkSMHQV3WL_cjs.WhatsAppService(env, staticRest, settingsLoader, getMessageTemplateRow);
       return {
         send: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((opts) => svc.send(opts), "send")
       };
@@ -28771,7 +29147,7 @@ function createMessageTemplateRowLoader(dataSource, entityMap) {
 }
 chunkUSNT2KNT_cjs.__name(createMessageTemplateRowLoader, "createMessageTemplateRowLoader");
 function registerMessagingQueueProcessors(cms, entityMap) {
-  chunkXFDIIVZB_cjs.registerEmailQueueProcessor(cms, {
+  chunkUMC7W5G3_cjs.registerEmailQueueProcessor(cms, {
     getDataSource: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => cms.dataSource, "getDataSource"),
     entityMap
   });
@@ -28804,7 +29180,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
   }
   if (!cms.getPlugin("email")) {
     try {
-      const instance = await chunk5MZFQRDW_cjs.emailPlugin({
+      const instance = await chunkSMHQV3WL_cjs.emailPlugin({
         type: "SMTP",
         from: config.SMTP_FROM ?? "no-reply@localhost",
         to: config.SMTP_TO ?? ""
@@ -28845,7 +29221,7 @@ function messagingPlugins(options) {
   const config = options.config ?? (typeof process !== "undefined" ? process.env : {});
   return [
     queuePlugin(),
-    chunk5MZFQRDW_cjs.emailPlugin({
+    chunkSMHQV3WL_cjs.emailPlugin({
       type: "SMTP",
       from: config.SMTP_FROM ?? "no-reply@localhost",
       to: config.SMTP_TO ?? ""
@@ -28979,7 +29355,7 @@ function createCmsApiHandler(config) {
   } : void 0;
   const entityMap = withLlmKnowledgeEntityFallbacks(rawEntityMap);
   if (getCms) {
-    chunk5MZFQRDW_cjs.initWhatsappTriggerDispatcher({
+    chunkSMHQV3WL_cjs.initWhatsappTriggerDispatcher({
       dataSource,
       entityMap,
       getCms
@@ -28992,7 +29368,7 @@ function createCmsApiHandler(config) {
   ] : baseCrudResources;
   const requireEntityPermissionEffective = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async (_req, entity, action) => {
     if (!resolveSessionUser) {
-      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
+      chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
         entity,
         action,
         hint: "Pass getSessionUser: auth.getAuthenticatedUser from createCmsAuthBundle()"
@@ -29002,7 +29378,7 @@ function createCmsApiHandler(config) {
       const raw = await resolveSessionUser();
       const u = await hydrateVendorSessionUser(dataSource, raw);
       if (!u?.email) {
-        chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: no session user", {
+        chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: no session user", {
           entity,
           action
         });
@@ -29012,13 +29388,13 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunk4U6DATGZ_cjs.sessionHasEntityAccess(u, entity, action);
-      await chunkJ7FMZK66_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
+      const allowed = chunkOV5TRZET_cjs.sessionHasEntityAccess(u, entity, action);
+      await chunkO4AFPDQ4_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
       });
       if (allowed) return null;
-      const { reason } = chunkJ7FMZK66_cjs.explainSessionEntityAccess(u, entity, action);
+      const { reason } = chunkO4AFPDQ4_cjs.explainSessionEntityAccess(u, entity, action);
       return config.json({
         error: "Forbidden",
         entity,
@@ -29029,7 +29405,7 @@ function createCmsApiHandler(config) {
       });
     }
     if (userRequireEntityPermission) {
-      chunkJ7FMZK66_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
+      chunkO4AFPDQ4_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
         entity,
         action
       });
@@ -29072,7 +29448,7 @@ function createCmsApiHandler(config) {
         companyDetails
       };
       if (queue) {
-        const { queueEmail: queueEmail2 } = await import('./email-queue-4OY45JIU.cjs');
+        const { queueEmail: queueEmail2 } = await import('./email-queue-K4E4OFI7.cjs');
         await queueEmail2(cms, {
           to: opts.to,
           templateName: "passwordReset",
@@ -29116,10 +29492,10 @@ function createCmsApiHandler(config) {
       getVendorScope: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
         if (!multiVendorEnabled) {
-          return chunkJ7FMZK66_cjs.resolveDisabledMultiVendorScope(dataSource);
+          return chunkO4AFPDQ4_cjs.resolveDisabledMultiVendorScope(dataSource);
         }
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-        return chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+        return chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
       }, "getVendorScope"),
       getHydratedSessionUser: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
@@ -30082,6 +30458,110 @@ function createCmsApiHandler(config) {
           return socialMediaHandlers.publishBlogToFacebook(req, id);
         }
       }
+      if (path2[0] === "settings" && path2.length === 2 && path2[1] === "invoice-preview" && m === "GET") {
+        const a = await config.requireAuth(req);
+        if (a) return a;
+        const pe = await requireEntityPermissionEffective(req, "settings", "read");
+        if (pe) return pe;
+        const url = new URL(req.url);
+        const templateParam = url.searchParams.get("template") || "classic";
+        const qrParam = url.searchParams.get("qr");
+        const configRepo = dataSource.getRepository(entityMap.configs);
+        const rows = await configRepo.find({
+          where: {
+            settings: "store",
+            deleted: false
+          }
+        });
+        const storeMap = {};
+        for (const r of rows) {
+          storeMap[r.key] = r.value;
+        }
+        const { normalizeInvoiceTemplateId } = await import('./invoice-templates-RB462AQN.cjs');
+        const { generateLocalInvoicePdf } = await import('./generate-local-invoice-pdf-BQTCL5MW.cjs');
+        const { resolveInvoiceAssetUrl } = await import('./resolve-invoice-asset-url-JEZRENJW.cjs');
+        const templateId = normalizeInvoiceTemplateId(templateParam);
+        const includeQr = qrParam != null ? qrParam === "1" || qrParam === "true" : storeMap.invoice_include_qr === "true";
+        const sampleInput = {
+          templateId,
+          orderNumber: "SAMPLE-10024",
+          orderDate: (/* @__PURE__ */ new Date()).toISOString(),
+          currency: storeMap.currency || "INR",
+          company: {
+            name: storeMap.companyName || storeMap.invoiceCompanyName || "ETOE Services",
+            supportEmail: storeMap.companyEmail || storeMap.invoiceEmail || "support@example.com",
+            supportPhone: storeMap.companyPhone || storeMap.invoicePhone || "+91 98765 43210",
+            address: storeMap.companyAddress || storeMap.invoiceAddress || "65 Sanjay Nagar B, Kalwar Road, Jhotwara, Jaipur, Rajasthan, 302012, India",
+            logoUrl: resolveInvoiceAssetUrl(storeMap.invoiceLogoUrl || storeMap.companyLogo || storeMap.logo)
+          },
+          customerName: "Sahil Sharma",
+          customerEmail: "sahil@example.com",
+          customerPhone: "+91 98875 51178",
+          billingAddress: {
+            line1: "65 Sanjay Nagar B, Kalwar Road",
+            city: "Jaipur",
+            state: "Rajasthan",
+            postalCode: "302012",
+            country: "India"
+          },
+          shippingAddress: {
+            line1: "65 Sanjay Nagar B, Kalwar Road",
+            city: "Jaipur",
+            state: "Rajasthan",
+            postalCode: "302012",
+            country: "India"
+          },
+          serviceDate: (/* @__PURE__ */ new Date()).toISOString(),
+          timeSlot: "6:00 PM",
+          assignedTo: "Raaj Sharma",
+          qrToken: "sample-track-token-12345",
+          qrData: "https://etoe.in/track/sample-track-token-12345",
+          includeQrCode: includeQr,
+          lineItems: [
+            {
+              name: "Complete Home Deep Cleaning Service",
+              sku: "ETOE-HDC-001",
+              quantity: 1,
+              unitPrice: 3499,
+              tax: 0,
+              total: 3499
+            },
+            {
+              name: "Kitchen & Bathroom Sanitization Add-on",
+              sku: "ETOE-SAN-002",
+              quantity: 1,
+              unitPrice: 999,
+              tax: 0,
+              total: 999
+            }
+          ],
+          subtotal: 4498,
+          discount: 499,
+          tax: 0,
+          total: 3999
+        };
+        try {
+          const bytes = await generateLocalInvoicePdf(sampleInput);
+          return new Response(Buffer.from(bytes), {
+            status: 200,
+            headers: {
+              "Content-Type": "application/pdf",
+              "Content-Disposition": `inline; filename="preview-invoice-${templateId}.pdf"`
+            }
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.error("[invoice-preview] failed", {
+            templateId,
+            error: msg
+          });
+          return config.json({
+            error: `Preview generation failed: ${msg}`
+          }, {
+            status: 500
+          });
+        }
+      }
       if (path2[0] === "settings" && path2.length === 2 && settingsHandlers) {
         const group = path2[1];
         const isPublic = group === "multi_vendor" || group === "turnstile" || group === "auth_providers" || settingsConfig?.publicGetGroups?.includes(group);
@@ -30386,7 +30866,7 @@ function createCmsApiHandler(config) {
         const pe = await requireEntityPermissionEffective(req, "orders", "read");
         if (pe) return pe;
         const cms = await getCms();
-        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-YUSPZ7CE.cjs');
+        const { streamOrderInvoicePdf: streamOrderInvoicePdf2 } = await import('./erp-order-invoice-AZ5MX2JB.cjs');
         const oid = Number(path2[1]);
         if (!Number.isFinite(oid)) return config.json({
           error: "Invalid id"
@@ -30467,7 +30947,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const result = await validateCoupon(dataSource, entityMap, couponCode, orderLinesNorm, currency, contactId, isAutomatic, discountId ?? void 0, vendorId);
@@ -30555,7 +31035,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
@@ -30768,7 +31248,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-LL7ETKLU.cjs');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-6HCJ6Q75.cjs');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -30867,7 +31347,7 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((refundAmount) => {
-          void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
@@ -31112,8 +31592,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-NK65LOLV.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DDQREULW.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.getChannels(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "send" && m === "POST" && getCms) {
@@ -31127,8 +31607,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-NK65LOLV.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DDQREULW.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.sendOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "verify" && m === "POST" && getCms) {
@@ -31142,8 +31622,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-NK65LOLV.cjs');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-DDQREULW.cjs');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.verifyOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "eligible-assignees" && m === "GET") {
@@ -31157,7 +31637,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-NPKD64P6.cjs');
+        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-KF7RMTV5.cjs');
         const handlers = createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionUser);
         return handlers.listEligibleAssignees(req, orderId);
       }
@@ -31267,7 +31747,7 @@ function createCmsApiHandler(config) {
           if (resolveSessionUser) {
             const raw = await resolveSessionUser();
             const u = await hydrateVendorSessionUser(dataSource, raw);
-            const scope = chunkJ7FMZK66_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkO4AFPDQ4_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") {
               scopedVendorIds = scope.vendorIds;
             }
@@ -31590,12 +32070,12 @@ async function refreshOrderFromErp(cms, dataSource, entityMap, submission, order
     const r1 = await submission.postErpReadAction("get-order-status", {
       platformOrderId: refId
     });
-    const d1 = r1.ok ? chunkGLD263KW_cjs.unwrapErpReadData(r1.json) : null;
+    const d1 = r1.ok ? chunkSUUD7OUG_cjs.unwrapErpReadData(r1.json) : null;
     if (d1) {
       const mapped = mapErpSaleStatusToOrderStatus(typeof d1.status === "string" ? d1.status : typeof d1.orderStatus === "string" ? d1.orderStatus : typeof d1.state === "string" ? d1.state : void 0);
       if (mapped) newStatus = mapped;
-      fulfillment = chunkGLD263KW_cjs.mapErpPayloadToFulfillment(d1);
-      const refs = chunkGLD263KW_cjs.extractChildOrderRefsFromSalePayload(d1);
+      fulfillment = chunkSUUD7OUG_cjs.mapErpPayloadToFulfillment(d1);
+      const refs = chunkSUUD7OUG_cjs.extractChildOrderRefsFromSalePayload(d1);
       if (refs.length) {
         await ensureChildOrdersFromRefs(orderRepo, order, refs, order.contactId, String(order.currency || "INR"));
       }
@@ -31603,16 +32083,16 @@ async function refreshOrderFromErp(cms, dataSource, entityMap, submission, order
     const r2 = await submission.postErpReadAction("get-fulfillment-status", {
       platformOrderId: refId
     });
-    const d2 = r2.ok ? chunkGLD263KW_cjs.unwrapErpReadData(r2.json) : null;
+    const d2 = r2.ok ? chunkSUUD7OUG_cjs.unwrapErpReadData(r2.json) : null;
     if (d2) {
-      fulfillment = deepMergeFulfillment(fulfillment, chunkGLD263KW_cjs.mapErpPayloadToFulfillment(d2));
+      fulfillment = deepMergeFulfillment(fulfillment, chunkSUUD7OUG_cjs.mapErpPayloadToFulfillment(d2));
     }
     const r3 = await submission.postErpReadAction("get-invoice", {
       platformOrderId: refId
     });
-    const d3 = r3.ok ? chunkGLD263KW_cjs.unwrapErpReadData(r3.json) : null;
+    const d3 = r3.ok ? chunkSUUD7OUG_cjs.unwrapErpReadData(r3.json) : null;
     if (d3) {
-      invoiceNumber = chunkGLD263KW_cjs.mapErpPayloadToInvoiceNumber(d3);
+      invoiceNumber = chunkSUUD7OUG_cjs.mapErpPayloadToInvoiceNumber(d3);
       invoiceId = pickInvoiceId(d3);
     }
     const oid = order.id;
@@ -31648,10 +32128,10 @@ async function refreshOrderFromErp(cms, dataSource, entityMap, submission, order
     const r = await submission.postErpReadAction("get-return-status", {
       platformReturnId
     });
-    const d = r.ok ? chunkGLD263KW_cjs.unwrapErpReadData(r.json) : null;
+    const d = r.ok ? chunkSUUD7OUG_cjs.unwrapErpReadData(r.json) : null;
     if (!d) return;
     const mapped = mapErpSaleStatusToOrderStatus(typeof d.status === "string" ? d.status : typeof d.returnStatus === "string" ? d.returnStatus : void 0);
-    const fulfillment = chunkGLD263KW_cjs.mapErpPayloadToFulfillment(d);
+    const fulfillment = chunkSUUD7OUG_cjs.mapErpPayloadToFulfillment(d);
     const patch = {};
     if (fulfillment !== void 0) patch.fulfillment = fulfillment;
     const nextMeta = Object.keys(patch).length ? mergeOrderMetadataPatch(meta, patch) : meta;
@@ -31774,7 +32254,7 @@ function createStorefrontApiHandler(config) {
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
   function fireStorefrontCheckoutNotifications(orderId) {
-    void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+    void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
       fireOrderNotificationTrigger("order_pending", orderId, {
         dataSource,
         entityMap
@@ -33458,7 +33938,7 @@ function createStorefrontApiHandler(config) {
                 status: 503
               });
               const companyDetails = getCompanyDetails ? await getCompanyDetails() : {};
-              await chunkXFDIIVZB_cjs.queueEmail(cms, {
+              await chunkUMC7W5G3_cjs.queueEmail(cms, {
                 to: identifier,
                 templateName: "otp",
                 ctx: {
@@ -33656,10 +34136,10 @@ function createStorefrontApiHandler(config) {
             adminAccess: false
           }));
           const userId = newUser.id;
-          await chunk4U6DATGZ_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+          await chunkOV5TRZET_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
           if (entityMap.customer) {
             const phone = typeof b.phone === "string" && b.phone.trim() ? String(b.phone).trim() : null;
-            await chunk4U6DATGZ_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+            await chunkOV5TRZET_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
               id: userId,
               name,
               email,
@@ -33683,7 +34163,7 @@ function createStorefrontApiHandler(config) {
               const companyDetails = getCompanyDetails ? await getCompanyDetails() : {};
               const base = (publicSiteUrl || "").replace(/\/$/, "").trim() || "http://localhost:3000";
               const verifyEmailUrl = `${base}/verify-email?token=${encodeURIComponent(rawToken)}`;
-              await chunkXFDIIVZB_cjs.queueEmail(cms, {
+              await chunkUMC7W5G3_cjs.queueEmail(cms, {
                 to: email,
                 templateName: "signup",
                 ctx: {
@@ -34497,7 +34977,7 @@ function createStorefrontApiHandler(config) {
             status: 400
           });
           const cms = await getCms();
-          return chunkGLD263KW_cjs.streamOrderInvoicePdf(cms, dataSource, entityMap, orderId, {
+          return chunkSUUD7OUG_cjs.streamOrderInvoicePdf(cms, dataSource, entityMap, orderId, {
             ownerContactId: contact.id
           });
         }
@@ -34538,7 +35018,9 @@ function createStorefrontApiHandler(config) {
             },
             relations: [
               "items",
-              "items.product"
+              "items.product",
+              "assignedUser",
+              "payments"
             ]
           });
           if (!order) return json({
@@ -34564,7 +35046,9 @@ function createStorefrontApiHandler(config) {
               },
               relations: [
                 "items",
-                "items.product"
+                "items.product",
+                "assignedUser",
+                "payments"
               ]
             });
           }
@@ -34630,6 +35114,17 @@ function createStorefrontApiHandler(config) {
               currency: o.currency,
               createdAt: o.createdAt,
               metadata: o.metadata ?? null,
+              assignedUser: o.assignedUser ? {
+                id: o.assignedUser.id,
+                name: o.assignedUser.name,
+                phone: o.assignedUser.phone
+              } : null,
+              payments: Array.isArray(o.payments) ? o.payments.map((pm) => ({
+                id: pm.id,
+                amount: pm.amount,
+                method: pm.method,
+                status: pm.status
+              })) : [],
               items: lines
             },
             relatedOrders: relatedOrders.map((r) => ({
@@ -34704,7 +35199,7 @@ function createStorefrontApiHandler(config) {
             } catch {
             }
             try {
-              void import('./emit-order-notification-trigger-ZD5YN3JM.cjs').then(({ fireOrderNotificationTrigger }) => {
+              void import('./emit-order-notification-trigger-ROASTYQP.cjs').then(({ fireOrderNotificationTrigger }) => {
                 fireOrderNotificationTrigger("order_cancelled", orderId, {
                   dataSource,
                   entityMap