@infuro/cms-core 1.0.69 → 1.0.70

package/dist/{chunk-DBBYLSQP.js → chunk-7NQMGB2S.js}

@@ -1,17 +1,17 @@
+import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, validateFcmCredentials, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, WhatsAppService, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-3LF4RYAJ.js';
+import { normalizePhoneE164, generateNumericOtp, createOtpChallenge, verifyAndConsumeOtpChallenge } from './chunk-ECUGNV2I.js';
+import { registerWhatsAppQueueProcessor, queueSms } from './chunk-K6JT7BKY.js';
 import { inviteStatusForActivation } from './chunk-ZMIMKNSQ.js';
-import { normalizePhoneE164, generateNumericOtp, createOtpChallenge, queueSms, verifyAndConsumeOtpChallenge } from './chunk-53AMBXMM.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-5NVGWJSY.js';
 import { JOB_RUNNER_QUEUE } from './chunk-2BNVRFUQ.js';
 import { validateInventoryForConfirmedOrderLines, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, orderInventorySnapshotFromRow, validateInventoryForOrderBecomingConfirmed } from './chunk-JYRFSFXH.js';
-import { resolveChatEmailToolSettings, CHAT_EMAIL_LOG, detectChatLeadIntent, parseIntentRecipientEmails, sendChatLeadEmail, buildTranscriptForLeadEmail, buildChatbotSystemPromptWithEmailTool, validateFcmCredentials, sendFcmPushNotification, parseEmailRecipientsFromConfig, isWhatsAppPluginEnabled, WhatsAppService, emailPlugin, initWhatsappTriggerDispatcher } from './chunk-RBKVMHBH.js';
-import { registerWhatsAppQueueProcessor } from './chunk-3XCTGADT.js';
 import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } from './chunk-LJ5C4RBF.js';
 import { unwrapErpReadData, mapErpPayloadToFulfillment, extractChildOrderRefsFromSalePayload, mapErpPayloadToInvoiceNumber, streamOrderInvoicePdf } from './chunk-PQJIJ4ZX.js';
 import { isErpIntegrationEnabled } from './chunk-WQZ4AH2P.js';
 import { mergeEmailLayoutCompanyDetails } from './chunk-YDMHG6BA.js';
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MGT4DJ2D.js';
-import { ensureCustomerRecord, linkUnclaimedContactToUser, ensureCustomerForUser, canManageRoles, sessionHasEntityAccess } from './chunk-D4LR3S77.js';
-import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-DWNQTFJ5.js';
+import { ensureCustomerRecord, linkUnclaimedContactToUser, ensureCustomerForUser, canManageRoles, sessionHasEntityAccess } from './chunk-NQF6H656.js';
+import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-CJY2HUJC.js';
 import { retireSoftDeletedUniqueValue, activeUniqueValueExists } from './chunk-BK5XW5XH.js';
 import { queueErp } from './chunk-7QJI56OL.js';
 import { __name } from './chunk-5BKT4CS5.js';
@@ -1698,6 +1698,82 @@ async function recordOrderAssigneeHistory(dataSource, entityMap, orderId, userId
   return nextSortOrder;
 }
 __name(recordOrderAssigneeHistory, "recordOrderAssigneeHistory");
+async function validateAssigneeOrderPermission(dataSource, entityMap, userId) {
+  if (!Number.isFinite(userId) || userId <= 0) return {
+    valid: true
+  };
+  if (entityMap.users) {
+    const uRepo = dataSource.getRepository(entityMap.users);
+    const u = await uRepo.findOne({
+      where: {
+        id: userId,
+        deleted: false
+      },
+      relations: [
+        "group"
+      ]
+    });
+    if (!u) {
+      return {
+        valid: false,
+        error: "Assignee user not found."
+      };
+    }
+    const userRow = u;
+    if (userRow.adminAccess) {
+      return {
+        valid: true
+      };
+    }
+    if (userRow.group?.name && userRow.group.name.toLowerCase() === "customer") {
+      return {
+        valid: false,
+        error: "Customer accounts cannot be assigned to orders."
+      };
+    }
+  }
+  if (entityMap.vendor_users) {
+    const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+    const vuLinks = await vuRepo.find({
+      where: {
+        userId
+      },
+      relations: [
+        "vendorRole",
+        "vendorRole.permissions"
+      ]
+    });
+    if (vuLinks && vuLinks.length > 0) {
+      let anyRoleHasAccess = false;
+      for (const vu of vuLinks) {
+        const r = vu.vendorRole;
+        if (r) {
+          if (r.isOwnerRole) {
+            anyRoleHasAccess = true;
+            break;
+          }
+          if (Array.isArray(r.permissions)) {
+            const orderPerm = r.permissions.find((p) => String(p?.entity).toLowerCase() === "orders");
+            if (orderPerm && orderPerm.canRead) {
+              anyRoleHasAccess = true;
+              break;
+            }
+          }
+        }
+      }
+      if (!anyRoleHasAccess) {
+        return {
+          valid: false,
+          error: "Cannot assign order: This team member does not have permission to access orders. Please grant order access in Roles & Permissions."
+        };
+      }
+    }
+  }
+  return {
+    valid: true
+  };
+}
+__name(validateAssigneeOrderPermission, "validateAssigneeOrderPermission");
 var LIST_QUERY_RESERVED = /* @__PURE__ */ new Set([
   "page",
   "limit",
@@ -5112,6 +5188,16 @@ function createCrudHandler(dataSource, entityMap, options) {
           persistBody.orderNumber = `ORD00${randomPart}`;
           persistBody.qrToken = crypto2.randomBytes(16).toString("hex");
         }
+        if (resource === "orders" && persistBody.assignedUserId) {
+          const assignCheck = await validateAssigneeOrderPermission(dataSource, entityMap, Number(persistBody.assignedUserId));
+          if (!assignCheck.valid) {
+            return json({
+              error: assignCheck.error ?? "Invalid order assignee"
+            }, {
+              status: 400
+            });
+          }
+        }
         await retireSoftDeletedUniquesFromBody(repo, persistBody);
         created = await repo.save(repo.create(persistBody));
         if (resource === "orders") {
@@ -5313,7 +5399,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           const orderIdForNotify = created.id;
           const finalCreatedStatus = String(created.status ?? createdStatus ?? "pending").toLowerCase();
           const initialPayStatus = String(persistBody.paymentStatus ?? body.paymentStatus ?? "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
             if (finalCreatedStatus === "pending") {
               if (initialPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", orderIdForNotify, {
@@ -6220,6 +6306,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
               const aId = Number(rawBody.assignedUserId);
               if (Number.isFinite(aId) && aId > 0) {
+                const assignCheck = await validateAssigneeOrderPermission(dataSource, entityMap, aId);
+                if (!assignCheck.valid) {
+                  return json({
+                    error: assignCheck.error ?? "Invalid order assignee"
+                  }, {
+                    status: 400
+                  });
+                }
                 if (scopePutEarly.type === "vendor" && entityMap.vendor_users) {
                   const vuRepo = dataSource.getRepository(entityMap.vendor_users);
                   const vuLink = await vuRepo.findOne({
@@ -6516,7 +6610,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
           const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
           if (assigneeUpdated) {
-            void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
               fireOrderNotificationTrigger("order_assigned", updatedOrder.id, {
                 dataSource,
                 entityMap
@@ -6533,7 +6627,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             const payments = Array.isArray(updatedOrder.payments) ? updatedOrder.payments : [];
             const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
             const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-            void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
               if (newStatus === "pending") {
                 if (curPayStatus === "failed") {
                   fireOrderNotificationTrigger("payment_failed", updatedOrder.id, {
@@ -7101,6 +7195,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const aId = Number(rawBody.assignedUserId);
           console.log("[ORDERS-DEBUG][UPDATE] Updating assignedUserId to:", aId);
           if (Number.isFinite(aId) && aId > 0) {
+            const assignCheck = await validateAssigneeOrderPermission(dataSource, entityMap, aId);
+            if (!assignCheck.valid) {
+              return json({
+                error: assignCheck.error ?? "Invalid order assignee"
+              }, {
+                status: 400
+              });
+            }
             if (scopePut.type === "vendor" && entityMap.vendor_users) {
               const vuRepo = dataSource.getRepository(entityMap.vendor_users);
               const vuLink = await vuRepo.findOne({
@@ -7241,7 +7343,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                     });
                   }
                   if (ordStatus === "pending" || ordStatus === "confirmed") {
-                    void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+                    void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
                       fireOrderNotificationTrigger("order_placed", pOrder, {
                         dataSource,
                         entityMap
@@ -7255,7 +7357,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                   }
                 }
               } else if (newPayStatus === "failed") {
-                void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_failed", pOrder, {
                     dataSource,
                     entityMap
@@ -7263,7 +7365,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                 }).catch(() => {
                 });
               } else if (newPayStatus === "refunded") {
-                void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_refund_initiated", pOrder, {
                     dataSource,
                     entityMap
@@ -7390,7 +7492,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
         const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
         if (assigneeUpdated) {
-          void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_assigned", ord.id, {
               dataSource,
               entityMap
@@ -7407,7 +7509,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const payments = Array.isArray(ord.payments) ? ord.payments : [];
           const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
           const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
             if (newStatus === "pending") {
               if (curPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", ord.id, {
@@ -29036,6 +29138,7 @@ function whatsappPlugin(config = {}) {
       const { getWhatsAppSettings, getMessageTemplateRow, ...staticRest } = config;
       let settingsLoader = getWhatsAppSettings;
       if (!settingsLoader && context.dataSource) {
+        const encKey = resolveSettingsEncryptionKey(env);
         settingsLoader = /* @__PURE__ */ __name(async () => {
           try {
             const ds = context.dataSource;
@@ -29046,10 +29149,18 @@ function whatsappPlugin(config = {}) {
                 deleted: false
               }
             });
-            return Object.fromEntries(rows.map((r) => [
-              r.key,
-              r.value
-            ]));
+            const result = {};
+            for (const r of rows) {
+              let val = String(r.value ?? "");
+              if (r.encrypted && encKey) {
+                try {
+                  val = simpleDecrypt(val, encKey);
+                } catch {
+                }
+              }
+              result[r.key] = val;
+            }
+            return result;
           } catch {
             return {};
           }
@@ -31238,7 +31349,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-FS54ANAV.js');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-Z3MXNF4U.js');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -31337,7 +31448,7 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ __name((refundAmount) => {
-          void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
@@ -31582,7 +31693,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-FIW7PZ6W.js');
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-KHLZQQJX.js');
         const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.getChannels(req, orderId);
       }
@@ -31597,7 +31708,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-FIW7PZ6W.js');
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-KHLZQQJX.js');
         const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.sendOtp(req, orderId);
       }
@@ -31612,7 +31723,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-FIW7PZ6W.js');
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-KHLZQQJX.js');
         const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.verifyOtp(req, orderId);
       }
@@ -31627,7 +31738,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-F7WOZHOG.js');
+        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-YCT3Q3KC.js');
         const handlers = createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionUser);
         return handlers.listEligibleAssignees(req, orderId);
       }
@@ -32244,7 +32355,7 @@ function createStorefrontApiHandler(config) {
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
   function fireStorefrontCheckoutNotifications(orderId) {
-    void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+    void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
       fireOrderNotificationTrigger("order_pending", orderId, {
         dataSource,
         entityMap
@@ -35189,7 +35300,7 @@ function createStorefrontApiHandler(config) {
             } catch {
             }
             try {
-              void import('./emit-order-notification-trigger-XKN2TWVF.js').then(({ fireOrderNotificationTrigger }) => {
+              void import('./emit-order-notification-trigger-TBXAZAPS.js').then(({ fireOrderNotificationTrigger }) => {
                 fireOrderNotificationTrigger("order_cancelled", orderId, {
                   dataSource,
                   entityMap

package/dist/{chunk-DWNQTFJ5.js → chunk-CJY2HUJC.js}

@@ -70,24 +70,6 @@ function hasEntityPermission(record, entity, action) {
 }
 __name(hasEntityPermission, "hasEntityPermission");
 
-// src/auth/role-helpers.ts
-var SUPER_ADMIN_GROUP_ID = 1;
-var VENDOR_ADMIN_GROUP_ID = 5;
-function isSuperAdmin(user) {
-  if (!user) return false;
-  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
-  if (user.isRBACAdmin === true) return true;
-  return isSuperAdminGroupName(user.groupName);
-}
-__name(isSuperAdmin, "isSuperAdmin");
-function isVendorAdmin(user) {
-  if (!user?.email || isSuperAdmin(user)) return false;
-  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
-  if ((user.vendorIds?.length ?? 0) > 0) return true;
-  return isVendorGroupName(user.groupName);
-}
-__name(isVendorAdmin, "isVendorAdmin");
-
 // src/auth/vendor-scope.ts
 var DEFAULT_VENDOR_SLUG = "default";
 async function resolveDefaultVendorId(dataSource) {
@@ -231,6 +213,24 @@ function vendorPortalFlagsFromUser(input) {
 }
 __name(vendorPortalFlagsFromUser, "vendorPortalFlagsFromUser");
 
+// src/auth/role-helpers.ts
+var SUPER_ADMIN_GROUP_ID = 1;
+var VENDOR_ADMIN_GROUP_ID = 5;
+function isSuperAdmin(user) {
+  if (!user) return false;
+  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
+  if (user.isRBACAdmin === true) return true;
+  return isSuperAdminGroupName(user.groupName);
+}
+__name(isSuperAdmin, "isSuperAdmin");
+function isVendorAdmin(user) {
+  if (!user?.email || isSuperAdmin(user)) return false;
+  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
+  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  return isVendorGroupName(user.groupName);
+}
+__name(isVendorAdmin, "isVendorAdmin");
+
 // src/lib/vendor-role-defaults.ts
 var VENDOR_RBAC_ENTITIES = [
   ...VENDOR_STORE_RBAC_ENTITIES,
@@ -623,7 +623,7 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
     const id = Number(user.id);
     if (Number.isFinite(id)) {
       try {
-        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-IRKT6G62.js');
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-JK3U5UZK.js');
         dbPermissions = await loadDbPermissionsForUser(dataSource, id);
       } catch (e) {
         dbPermissions = {

package/dist/{chunk-SWSTGV4F.cjs → chunk-CKTRA3Q2.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkQXAQ3V7R_cjs = require('./chunk-QXAQ3V7R.cjs');
-var chunkLXWF6T7F_cjs = require('./chunk-LXWF6T7F.cjs');
+var chunkFNLF6G2N_cjs = require('./chunk-FNLF6G2N.cjs');
+var chunkLCZZ3S4I_cjs = require('./chunk-LCZZ3S4I.cjs');
 var chunk4WZNRVEZ_cjs = require('./chunk-4WZNRVEZ.cjs');
 var chunkCTTV375J_cjs = require('./chunk-CTTV375J.cjs');
 var chunkXHPRD45G_cjs = require('./chunk-XHPRD45G.cjs');
@@ -15,12 +15,12 @@ var _GoogleProvider__default = /*#__PURE__*/_interopDefault(_GoogleProvider);
 
 // src/auth/seed-permissions.ts
 async function seedAdministratorPermissions(dataSource, entityMap) {
-  const entities = chunkLXWF6T7F_cjs.getPermissionableEntityKeys(entityMap);
+  const entities = chunkLCZZ3S4I_cjs.getPermissionableEntityKeys(entityMap);
   const groupRepo = dataSource.getRepository(entityMap.user_groups);
   const permRepo = dataSource.getRepository(entityMap.permissions);
   const adminGroup = await groupRepo.findOne({
     where: {
-      name: chunkLXWF6T7F_cjs.ADMIN_GROUP_NAME,
+      name: chunkLCZZ3S4I_cjs.ADMIN_GROUP_NAME,
       deleted: false
     }
   });
@@ -260,13 +260,13 @@ async function createCustomerUserFromGoogleOAuth(input) {
     }
     if (input.entityMap.contacts) {
       try {
-        await chunkQXAQ3V7R_cjs.linkUnclaimedContactToUser(input.dataSource, input.entityMap.contacts, userId, email);
+        await chunkFNLF6G2N_cjs.linkUnclaimedContactToUser(input.dataSource, input.entityMap.contacts, userId, email);
       } catch {
       }
     }
     if (input.entityMap.customer) {
       try {
-        await chunkQXAQ3V7R_cjs.ensureCustomerForUser(input.dataSource, input.entityMap.customer, {
+        await chunkFNLF6G2N_cjs.ensureCustomerForUser(input.dataSource, input.entityMap.customer, {
           id: userId,
           name: displayName,
           email,
@@ -387,18 +387,18 @@ async function checkMultiVendorEnabledViaSettingsApi() {
 chunkXHPRD45G_cjs.__name(checkMultiVendorEnabledViaSettingsApi, "checkMultiVendorEnabledViaSettingsApi");
 function sessionUserFromNextAuthUser(user) {
   const g = user.group;
-  const isRBACAdmin = chunkLXWF6T7F_cjs.isSuperAdmin({
+  const isRBACAdmin = chunkLCZZ3S4I_cjs.isSuperAdmin({
     groupId: user.groupId ?? void 0,
     groupName: g?.name,
     isRBACAdmin: false
   });
-  const entityPerms = chunkLXWF6T7F_cjs.permissionRowsToRecord(g?.permissions);
+  const entityPerms = chunkLCZZ3S4I_cjs.permissionRowsToRecord(g?.permissions);
   const rawAdminAccess = user.adminAccess;
   const adminAccess = rawAdminAccess === true ? true : rawAdminAccess === false ? false : void 0;
   const vendorIds = user.vendorIds ?? [];
   const vendorRole = user.vendorRole ?? null;
   const isVendorRoleOwner = user.isVendorRoleOwner ?? false;
-  const { isVendorPortal, isVendorOwner: isVendorOwner2 } = chunkLXWF6T7F_cjs.vendorPortalFlagsFromUser({
+  const { isVendorPortal, isVendorOwner: isVendorOwner2 } = chunkLCZZ3S4I_cjs.vendorPortalFlagsFromUser({
     email: user.email,
     isRBACAdmin,
     groupName: g?.name,

package/dist/{chunk-53AMBXMM.js → chunk-ECUGNV2I.js}

@@ -2,62 +2,6 @@ import { __name } from './chunk-5BKT4CS5.js';
 import { createHmac, timingSafeEqual, randomInt } from 'crypto';
 import { MoreThan, IsNull } from 'typeorm';
 
-// src/plugins/sms/sms-queue.ts
-var SMS_QUEUE_NAME = "sms";
-function registerSmsQueueProcessor(cms) {
-  const queue = cms.getPlugin("queue");
-  const sms = cms.getPlugin("sms");
-  if (!queue || !sms || typeof sms.send !== "function") return;
-  queue.registerProcessor(SMS_QUEUE_NAME, async (data) => {
-    const payload = data;
-    if (!payload.to) return;
-    if (payload.templateKey?.trim()) {
-      await sms.send({
-        to: payload.to,
-        templateKey: payload.templateKey.trim(),
-        variables: payload.variables,
-        otpCode: payload.otpCode
-      });
-      return;
-    }
-    if (!payload.body?.trim()) return;
-    await sms.send({
-      to: payload.to,
-      body: payload.body,
-      otpCode: payload.otpCode,
-      variables: payload.variables
-    });
-  });
-}
-__name(registerSmsQueueProcessor, "registerSmsQueueProcessor");
-async function queueSms(cms, payload) {
-  const queue = cms.getPlugin("queue");
-  const sms = cms.getPlugin("sms");
-  if (queue) {
-    await queue.add(SMS_QUEUE_NAME, payload);
-    return;
-  }
-  if (sms && typeof sms.send === "function") {
-    if (payload.templateKey?.trim()) {
-      await sms.send({
-        to: payload.to,
-        templateKey: payload.templateKey.trim(),
-        variables: payload.variables,
-        otpCode: payload.otpCode
-      });
-      return;
-    }
-    if (payload.body?.trim()) {
-      await sms.send({
-        to: payload.to,
-        body: payload.body,
-        otpCode: payload.otpCode,
-        variables: payload.variables
-      });
-    }
-  }
-}
-__name(queueSms, "queueSms");
 var OTP_TTL_MS = 10 * 60 * 1e3;
 var MAX_SENDS_PER_HOUR = 5;
 var MAX_VERIFY_ATTEMPTS = 8;
@@ -196,4 +140,4 @@ async function verifyAndConsumeOtpChallenge(dataSource, entityMap, input) {
 }
 __name(verifyAndConsumeOtpChallenge, "verifyAndConsumeOtpChallenge");
 
-export { countRecentOtpSends, createOtpChallenge, generateNumericOtp, hashOtpCode, normalizePhoneE164, queueSms, registerSmsQueueProcessor, verifyAndConsumeOtpChallenge, verifyOtpCodeHash };
+export { countRecentOtpSends, createOtpChallenge, generateNumericOtp, hashOtpCode, normalizePhoneE164, verifyAndConsumeOtpChallenge, verifyOtpCodeHash };

package/dist/{chunk-QXAQ3V7R.cjs → chunk-FNLF6G2N.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkLXWF6T7F_cjs = require('./chunk-LXWF6T7F.cjs');
+var chunkLCZZ3S4I_cjs = require('./chunk-LCZZ3S4I.cjs');
 var chunkXHPRD45G_cjs = require('./chunk-XHPRD45G.cjs');
 var typeorm = require('typeorm');
 
@@ -273,7 +273,7 @@ var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set([
   "permissions"
 ]);
 function sessionHasEntityAccess(user, entity, action) {
-  return chunkLXWF6T7F_cjs.explainSessionEntityAccess(user, entity, action).allowed;
+  return chunkLCZZ3S4I_cjs.explainSessionEntityAccess(user, entity, action).allowed;
 }
 chunkXHPRD45G_cjs.__name(sessionHasEntityAccess, "sessionHasEntityAccess");
 function canManageRoles(user) {
@@ -364,8 +364,8 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
       }
       const u = session.user;
       const allowed = sessionHasEntityAccess(u, entity, action);
-      const { reason } = chunkLXWF6T7F_cjs.explainSessionEntityAccess(u, entity, action);
-      chunkLXWF6T7F_cjs.logRbac("authHelpers.requireEntityPermission", {
+      const { reason } = chunkLCZZ3S4I_cjs.explainSessionEntityAccess(u, entity, action);
+      chunkLCZZ3S4I_cjs.logRbac("authHelpers.requireEntityPermission", {
         entity,
         action,
         allowed,
@@ -397,10 +397,10 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
       }
       const u = session.user;
       if (u.isRBACAdmin) return null;
-      if (chunkLXWF6T7F_cjs.isVendorPortalUser(u)) return null;
+      if (chunkLCZZ3S4I_cjs.isVendorPortalUser(u)) return null;
       if (u.adminAccess === true) return null;
       if (u.adminAccess === false) {
-        chunkLXWF6T7F_cjs.logRbac("requireAdminAccess denied (adminAccess:false)", {
+        chunkLCZZ3S4I_cjs.logRbac("requireAdminAccess denied (adminAccess:false)", {
           email: u.email,
           groupName: u.groupName,
           isVendorPortal: u.isVendorPortal
@@ -412,7 +412,7 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
           status: 403
         });
       }
-      chunkLXWF6T7F_cjs.logRbac("requireAdminAccess denied (no matching rule)", {
+      chunkLCZZ3S4I_cjs.logRbac("requireAdminAccess denied (no matching rule)", {
         email: u.email,
         adminAccess: u.adminAccess,
         groupName: u.groupName,

package/dist/{chunk-T47VP2ZT.js → chunk-HZZTDM5J.js}

@@ -1,4 +1,4 @@
-import { notifyLog, notificationTriggerEmitter, maskNotifyPhone } from './chunk-WHMIWJL7.js';
+import { notifyLog, notificationTriggerEmitter, maskNotifyPhone } from './chunk-W2ZTGLUH.js';
 import { __name } from './chunk-5BKT4CS5.js';
 
 // src/lib/emit-order-notification-trigger.ts
@@ -94,7 +94,7 @@ async function emitOrderNotificationTrigger(triggerKey, orderId, deps, extra) {
       orderId
     });
     try {
-      const { dispatchOrderNotificationDirectly } = await import('./order-notification-dispatcher-FS54ANAV.js');
+      const { dispatchOrderNotificationDirectly } = await import('./order-notification-dispatcher-Z3MXNF4U.js');
       await dispatchOrderNotificationDirectly(triggerKey, triggerPayload, deps.dataSource, deps.entityMap);
     } catch (err) {
       notifyLog.error("TRIGGER", "direct dispatch failed", {

package/dist/{chunk-3XCTGADT.js → chunk-K6JT7BKY.js}

@@ -1,5 +1,62 @@
 import { __name } from './chunk-5BKT4CS5.js';
 
+// src/plugins/sms/sms-queue.ts
+var SMS_QUEUE_NAME = "sms";
+function registerSmsQueueProcessor(cms) {
+  const queue = cms.getPlugin("queue");
+  const sms = cms.getPlugin("sms");
+  if (!queue || !sms || typeof sms.send !== "function") return;
+  queue.registerProcessor(SMS_QUEUE_NAME, async (data) => {
+    const payload = data;
+    if (!payload.to) return;
+    if (payload.templateKey?.trim()) {
+      await sms.send({
+        to: payload.to,
+        templateKey: payload.templateKey.trim(),
+        variables: payload.variables,
+        otpCode: payload.otpCode
+      });
+      return;
+    }
+    if (!payload.body?.trim()) return;
+    await sms.send({
+      to: payload.to,
+      body: payload.body,
+      otpCode: payload.otpCode,
+      variables: payload.variables
+    });
+  });
+}
+__name(registerSmsQueueProcessor, "registerSmsQueueProcessor");
+async function queueSms(cms, payload) {
+  const queue = cms.getPlugin("queue");
+  const sms = cms.getPlugin("sms");
+  if (queue) {
+    await queue.add(SMS_QUEUE_NAME, payload);
+    return;
+  }
+  if (sms && typeof sms.send === "function") {
+    if (payload.templateKey?.trim()) {
+      await sms.send({
+        to: payload.to,
+        templateKey: payload.templateKey.trim(),
+        variables: payload.variables,
+        otpCode: payload.otpCode
+      });
+      return;
+    }
+    if (payload.body?.trim()) {
+      await sms.send({
+        to: payload.to,
+        body: payload.body,
+        otpCode: payload.otpCode,
+        variables: payload.variables
+      });
+    }
+  }
+}
+__name(queueSms, "queueSms");
+
 // src/plugins/whatsapp/whatsapp-queue.ts
 var WHATSAPP_QUEUE_NAME = "whatsapp";
 function maskPhone(raw) {
@@ -80,4 +137,4 @@ async function queueWhatsApp(cms, payload) {
 }
 __name(queueWhatsApp, "queueWhatsApp");
 
-export { queueWhatsApp, registerWhatsAppQueueProcessor };
+export { queueSms, queueWhatsApp, registerSmsQueueProcessor, registerWhatsAppQueueProcessor };

package/dist/{chunk-M5QDJOUP.cjs → chunk-K742UE6S.cjs}

@@ -65,6 +65,7 @@ var notifyLog = {
   trigger: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((message, data) => write("info", "TRIGGER", message, data), "trigger"),
   email: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((message, data) => write("info", "EMAIL", message, data), "email"),
   whatsapp: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((message, data) => write("info", "WHATSAPP", message, data), "whatsapp"),
+  sms: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((message, data) => write("info", "SMS", message, data), "sms"),
   push: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((message, data) => write("info", "PUSH", message, data), "push"),
   skip: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((channel, message, data) => write("warn", `SKIP ${channel}`, message, data), "skip"),
   error: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((channel, message, data) => write("error", channel, message, data), "error")