@infuro/cms-core 1.0.69 → 1.0.70

package/dist/{chunk-QL44NCZC.cjs → chunk-OP624LWU.cjs}

@@ -1,19 +1,19 @@
 'use strict';
 
+var chunkTTOEY7AH_cjs = require('./chunk-TTOEY7AH.cjs');
+var chunkKB7EBYPR_cjs = require('./chunk-KB7EBYPR.cjs');
+var chunkKJB5LBFQ_cjs = require('./chunk-KJB5LBFQ.cjs');
 var chunk3LQS4ATQ_cjs = require('./chunk-3LQS4ATQ.cjs');
-var chunk6MM5OMRL_cjs = require('./chunk-6MM5OMRL.cjs');
 var chunkJRW3GQD4_cjs = require('./chunk-JRW3GQD4.cjs');
 var chunkY54WDY2O_cjs = require('./chunk-Y54WDY2O.cjs');
 var chunkPRXVSSIF_cjs = require('./chunk-PRXVSSIF.cjs');
-var chunk747MJJCZ_cjs = require('./chunk-747MJJCZ.cjs');
-var chunkOXFC3DAM_cjs = require('./chunk-OXFC3DAM.cjs');
 var chunk4MNVIGVJ_cjs = require('./chunk-4MNVIGVJ.cjs');
 var chunkBQQMTQ4C_cjs = require('./chunk-BQQMTQ4C.cjs');
 var chunkRQCXRCYM_cjs = require('./chunk-RQCXRCYM.cjs');
 var chunkEYUBL7YH_cjs = require('./chunk-EYUBL7YH.cjs');
 var chunk3ASNJS2H_cjs = require('./chunk-3ASNJS2H.cjs');
-var chunkQXAQ3V7R_cjs = require('./chunk-QXAQ3V7R.cjs');
-var chunkLXWF6T7F_cjs = require('./chunk-LXWF6T7F.cjs');
+var chunkFNLF6G2N_cjs = require('./chunk-FNLF6G2N.cjs');
+var chunkLCZZ3S4I_cjs = require('./chunk-LCZZ3S4I.cjs');
 var chunk4WZNRVEZ_cjs = require('./chunk-4WZNRVEZ.cjs');
 var chunkWXH3GMCF_cjs = require('./chunk-WXH3GMCF.cjs');
 var chunkXHPRD45G_cjs = require('./chunk-XHPRD45G.cjs');
@@ -123,7 +123,7 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
         `, [
         primary.vendorRoleId
       ]);
-      vendorEntityPerms = chunkLXWF6T7F_cjs.permissionRowsToRecord(permRows);
+      vendorEntityPerms = chunkLCZZ3S4I_cjs.permissionRowsToRecord(permRows);
     } catch (err) {
       if (!isMissingVendorRoleSchemaError(err)) throw err;
     }
@@ -230,7 +230,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     ]);
     const resolvedId = Number(byEmailRows[0]?.id);
     if (!Number.isFinite(resolvedId)) {
-      chunkLXWF6T7F_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
+      chunkLCZZ3S4I_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
         email: user.email,
         rawSessionId: user.id ?? null
       });
@@ -250,7 +250,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   const groupName = rows[0]?.groupName ?? user.groupName ?? null;
   const groupId = rows[0]?.groupId ?? user.groupId ?? void 0;
   const adminAccess = rows[0]?.adminAccess ?? user.adminAccess;
-  const isRBACAdmin = user.isRBACAdmin ?? chunkLXWF6T7F_cjs.isSuperAdmin({
+  const isRBACAdmin = user.isRBACAdmin ?? chunkLCZZ3S4I_cjs.isSuperAdmin({
     groupId,
     groupName,
     isRBACAdmin: user.isRBACAdmin
@@ -263,7 +263,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   };
   if (multiVendorEnabled) {
     ctx = await loadUserVendorContext(dataSource, id, user.activeVendorId);
-    flags = chunkLXWF6T7F_cjs.vendorPortalFlagsFromUser({
+    flags = chunkLCZZ3S4I_cjs.vendorPortalFlagsFromUser({
       email: user.email,
       isRBACAdmin,
       groupName,
@@ -298,7 +298,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     isVendorPortal: flags.isVendorPortal,
     isVendorOwner: flags.isVendorOwner
   };
-  chunkLXWF6T7F_cjs.logRbac("hydrateVendorSessionUser", {
+  chunkLCZZ3S4I_cjs.logRbac("hydrateVendorSessionUser", {
     email: user.email,
     userId: id,
     groupName,
@@ -911,7 +911,7 @@ function repoHasVendorIdColumn(repo) {
 }
 chunkXHPRD45G_cjs.__name(repoHasVendorIdColumn, "repoHasVendorIdColumn");
 function resourceUsesVendorScope(resource) {
-  return resource === "vendors" || chunkLXWF6T7F_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
+  return resource === "vendors" || chunkLCZZ3S4I_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 chunkXHPRD45G_cjs.__name(resourceUsesVendorScope, "resourceUsesVendorScope");
 function mergeWhereClause(where, extra) {
@@ -1401,7 +1401,7 @@ async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, c
   }
   let customerId = null;
   if (entityMap.customer) {
-    const ensured = await chunkQXAQ3V7R_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
+    const ensured = await chunkFNLF6G2N_cjs.ensureCustomerRecord(dataSource, entityMap.customer, {
       name,
       email,
       phone,
@@ -1708,6 +1708,82 @@ async function recordOrderAssigneeHistory(dataSource, entityMap, orderId, userId
   return nextSortOrder;
 }
 chunkXHPRD45G_cjs.__name(recordOrderAssigneeHistory, "recordOrderAssigneeHistory");
+async function validateAssigneeOrderPermission(dataSource, entityMap, userId) {
+  if (!Number.isFinite(userId) || userId <= 0) return {
+    valid: true
+  };
+  if (entityMap.users) {
+    const uRepo = dataSource.getRepository(entityMap.users);
+    const u = await uRepo.findOne({
+      where: {
+        id: userId,
+        deleted: false
+      },
+      relations: [
+        "group"
+      ]
+    });
+    if (!u) {
+      return {
+        valid: false,
+        error: "Assignee user not found."
+      };
+    }
+    const userRow = u;
+    if (userRow.adminAccess) {
+      return {
+        valid: true
+      };
+    }
+    if (userRow.group?.name && userRow.group.name.toLowerCase() === "customer") {
+      return {
+        valid: false,
+        error: "Customer accounts cannot be assigned to orders."
+      };
+    }
+  }
+  if (entityMap.vendor_users) {
+    const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+    const vuLinks = await vuRepo.find({
+      where: {
+        userId
+      },
+      relations: [
+        "vendorRole",
+        "vendorRole.permissions"
+      ]
+    });
+    if (vuLinks && vuLinks.length > 0) {
+      let anyRoleHasAccess = false;
+      for (const vu of vuLinks) {
+        const r = vu.vendorRole;
+        if (r) {
+          if (r.isOwnerRole) {
+            anyRoleHasAccess = true;
+            break;
+          }
+          if (Array.isArray(r.permissions)) {
+            const orderPerm = r.permissions.find((p) => String(p?.entity).toLowerCase() === "orders");
+            if (orderPerm && orderPerm.canRead) {
+              anyRoleHasAccess = true;
+              break;
+            }
+          }
+        }
+      }
+      if (!anyRoleHasAccess) {
+        return {
+          valid: false,
+          error: "Cannot assign order: This team member does not have permission to access orders. Please grant order access in Roles & Permissions."
+        };
+      }
+    }
+  }
+  return {
+    valid: true
+  };
+}
+chunkXHPRD45G_cjs.__name(validateAssigneeOrderPermission, "validateAssigneeOrderPermission");
 var LIST_QUERY_RESERVED = /* @__PURE__ */ new Set([
   "page",
   "limit",
@@ -4515,7 +4591,7 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const savedCustomer = await chunkQXAQ3V7R_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
+        const savedCustomer = await chunkFNLF6G2N_cjs.ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
           phone,
@@ -5122,6 +5198,16 @@ function createCrudHandler(dataSource, entityMap, options) {
           persistBody.orderNumber = `ORD00${randomPart}`;
           persistBody.qrToken = crypto2__default.default.randomBytes(16).toString("hex");
         }
+        if (resource === "orders" && persistBody.assignedUserId) {
+          const assignCheck = await validateAssigneeOrderPermission(dataSource, entityMap, Number(persistBody.assignedUserId));
+          if (!assignCheck.valid) {
+            return json({
+              error: assignCheck.error ?? "Invalid order assignee"
+            }, {
+              status: 400
+            });
+          }
+        }
         await retireSoftDeletedUniquesFromBody(repo, persistBody);
         created = await repo.save(repo.create(persistBody));
         if (resource === "orders") {
@@ -5323,7 +5409,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           const orderIdForNotify = created.id;
           const finalCreatedStatus = String(created.status ?? createdStatus ?? "pending").toLowerCase();
           const initialPayStatus = String(persistBody.paymentStatus ?? body.paymentStatus ?? "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
             if (finalCreatedStatus === "pending") {
               if (initialPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", orderIdForNotify, {
@@ -6230,6 +6316,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
               const aId = Number(rawBody.assignedUserId);
               if (Number.isFinite(aId) && aId > 0) {
+                const assignCheck = await validateAssigneeOrderPermission(dataSource, entityMap, aId);
+                if (!assignCheck.valid) {
+                  return json({
+                    error: assignCheck.error ?? "Invalid order assignee"
+                  }, {
+                    status: 400
+                  });
+                }
                 if (scopePutEarly.type === "vendor" && entityMap.vendor_users) {
                   const vuRepo = dataSource.getRepository(entityMap.vendor_users);
                   const vuLink = await vuRepo.findOne({
@@ -6526,7 +6620,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
           const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
           if (assigneeUpdated) {
-            void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
               fireOrderNotificationTrigger("order_assigned", updatedOrder.id, {
                 dataSource,
                 entityMap
@@ -6543,7 +6637,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             const payments = Array.isArray(updatedOrder.payments) ? updatedOrder.payments : [];
             const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
             const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-            void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+            void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
               if (newStatus === "pending") {
                 if (curPayStatus === "failed") {
                   fireOrderNotificationTrigger("payment_failed", updatedOrder.id, {
@@ -7111,6 +7205,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const aId = Number(rawBody.assignedUserId);
           console.log("[ORDERS-DEBUG][UPDATE] Updating assignedUserId to:", aId);
           if (Number.isFinite(aId) && aId > 0) {
+            const assignCheck = await validateAssigneeOrderPermission(dataSource, entityMap, aId);
+            if (!assignCheck.valid) {
+              return json({
+                error: assignCheck.error ?? "Invalid order assignee"
+              }, {
+                status: 400
+              });
+            }
             if (scopePut.type === "vendor" && entityMap.vendor_users) {
               const vuRepo = dataSource.getRepository(entityMap.vendor_users);
               const vuLink = await vuRepo.findOne({
@@ -7251,7 +7353,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                     });
                   }
                   if (ordStatus === "pending" || ordStatus === "confirmed") {
-                    void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+                    void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
                       fireOrderNotificationTrigger("order_placed", pOrder, {
                         dataSource,
                         entityMap
@@ -7265,7 +7367,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                   }
                 }
               } else if (newPayStatus === "failed") {
-                void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_failed", pOrder, {
                     dataSource,
                     entityMap
@@ -7273,7 +7375,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
                 }).catch(() => {
                 });
               } else if (newPayStatus === "refunded") {
-                void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+                void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
                   fireOrderNotificationTrigger("payment_refund_initiated", pOrder, {
                     dataSource,
                     entityMap
@@ -7400,7 +7502,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         const paymentUpdated = Boolean(rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null);
         const assigneeUpdated = Boolean(rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0 && Number(rawBody.assignedUserId) > 0 && Number(rawBody.assignedUserId) !== Number(existingOrderRow?.assignedUserId));
         if (assigneeUpdated) {
-          void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_assigned", ord.id, {
               dataSource,
               entityMap
@@ -7417,7 +7519,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           const payments = Array.isArray(ord.payments) ? ord.payments : [];
           const bodyPayStatus = rawBody && typeof rawBody === "object" && rawBody.paymentStatus != null ? String(rawBody.paymentStatus).toLowerCase() : null;
           const curPayStatus = bodyPayStatus || String(payments[0]?.status || "unpaid").toLowerCase();
-          void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
             if (newStatus === "pending") {
               if (curPayStatus === "failed") {
                 fireOrderNotificationTrigger("payment_failed", ord.id, {
@@ -8114,7 +8216,7 @@ function createInviteAcceptHandler(config) {
       }
       const { userId, email, vendorId } = validation.target;
       if (entityMap.contacts) {
-        await chunkQXAQ3V7R_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+        await chunkFNLF6G2N_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
       }
       if (beforeActivate) await beforeActivate(email, userId);
       const hashedPassword = await hashPassword(password);
@@ -9207,7 +9309,7 @@ function createVendorDashboardHandler(config) {
       if (pe) return pe;
     }
     const user = await getSessionUser();
-    if (!user || !chunkLXWF6T7F_cjs.isVendorPortalUser(user)) {
+    if (!user || !chunkLCZZ3S4I_cjs.isVendorPortalUser(user)) {
       return json({
         error: "Forbidden"
       }, {
@@ -10769,11 +10871,11 @@ function createUsersApiHandlers(config) {
           adminAccess
         }));
         if (entityMap.contacts) {
-          await chunkQXAQ3V7R_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
+          await chunkFNLF6G2N_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, newUser.id, newUser.email);
         }
         if (entityMap.customer) {
           const phone = typeof body.phone === "string" && body.phone.trim() ? body.phone.trim() : null;
-          await chunkQXAQ3V7R_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+          await chunkFNLF6G2N_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
             id: newUser.id,
             name: String(newUser.name ?? body.name),
             email: String(newUser.email),
@@ -11863,7 +11965,7 @@ function createChatHandlers(config) {
         const notifyEmailAgent = await findLlmAgentByScope(dataSource, entityMap, LLM_AGENT_SCOPE_EMAIL_INTENT_CHATBOT, {
           enabledOnly: false
         });
-        const emailTool = chunk747MJJCZ_cjs.resolveChatEmailToolSettings(llmSettings, {
+        const emailTool = chunkTTOEY7AH_cjs.resolveChatEmailToolSettings(llmSettings, {
           chatbotValidationRules: agentRow?.validationRules ?? null,
           notifyAgent: notifyEmailAgent ? {
             systemInstruction: notifyEmailAgent.systemInstruction,
@@ -11873,7 +11975,7 @@ function createChatHandlers(config) {
         const emailPlugin2 = cms.getPlugin("email");
         const convLeadSent = conv.leadEmailSentAt;
         const chatAgentFn = llm.chatAgent?.bind(llm);
-        console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline check", {
+        console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline check", {
           conversationId,
           enabled: emailTool.enabled,
           intentCount: emailTool.intents.length,
@@ -11887,27 +11989,27 @@ function createChatHandlers(config) {
           mergedPromptIncludesNotify: Boolean(notifyEmailAgent?.systemInstruction?.trim())
         });
         if (!emailTool.enabled) {
-          console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_tool_disabled"
           });
         } else if (emailTool.intents.length === 0) {
-          console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "no_intents_configured"
           });
         } else if (!emailPlugin2) {
-          console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "email_plugin_missing"
           });
         } else if (!chatAgentFn) {
-          console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "llm_chat_agent_unavailable"
           });
         } else if (convLeadSent) {
-          console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+          console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
             conversationId,
             reason: "lead_email_already_sent",
             leadEmailSentAt: convLeadSent
@@ -11920,7 +12022,7 @@ function createChatHandlers(config) {
             }
           });
           if (!contactRow) {
-            console.warn(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
+            console.warn(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline skipped", {
               conversationId,
               reason: "contact_not_found",
               contactId
@@ -11928,7 +12030,7 @@ function createChatHandlers(config) {
           } else {
             const c = contactRow;
             try {
-              const intent = await chunk747MJJCZ_cjs.detectChatLeadIntent({
+              const intent = await chunkTTOEY7AH_cjs.detectChatLeadIntent({
                 chatAgent: chatAgentFn
               }, {
                 settings: emailTool,
@@ -11942,15 +12044,15 @@ function createChatHandlers(config) {
                 model: agentRow?.model?.trim() || notifyEmailAgent?.model?.trim() || void 0
               });
               if (!intent.intent || !intent.emailTo) {
-                console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "no email sent", {
+                console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "no email sent", {
                   conversationId,
                   reason: intent.intent ? "missing_email_to" : "no_intent_match",
                   intentLabel: intent.intentLabel,
                   classifierReason: intent.reason
                 });
               } else {
-                const intentRecipients = chunk747MJJCZ_cjs.parseIntentRecipientEmails(intent.emailTo);
-                console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
+                const intentRecipients = chunkTTOEY7AH_cjs.parseIntentRecipientEmails(intent.emailTo);
+                console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "intent matched \u2014 sending", {
                   conversationId,
                   intent: intent.intent,
                   emailTo: intent.emailTo,
@@ -11961,7 +12063,7 @@ function createChatHandlers(config) {
                 const brandingSettings = await loadSettingsGroupMap(dataSource, entityMap, "branding");
                 const storeSettings = await loadSettingsGroupMap(dataSource, entityMap, "store");
                 const companyDetails = chunkEYUBL7YH_cjs.mergeEmailLayoutCompanyDetails(brandingSettings, emailSettings, storeSettings);
-                const leadResult = await chunk747MJJCZ_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
+                const leadResult = await chunkTTOEY7AH_cjs.sendChatLeadEmail(cms, emailSettings, brandingSettings, {
                   contactName: String(c.name ?? "").trim() || "Visitor",
                   contactEmail: String(c.email ?? "").trim(),
                   contactPhone: c.phone ?? null,
@@ -11969,7 +12071,7 @@ function createChatHandlers(config) {
                   latestMessage: message,
                   intentCode: intent.intent,
                   intentReason: intent.intentLabel || intent.reason,
-                  transcript: chunk747MJJCZ_cjs.buildTranscriptForLeadEmail(history, message),
+                  transcript: chunkTTOEY7AH_cjs.buildTranscriptForLeadEmail(history, message),
                   companyDetails,
                   recipients: intentRecipients.length > 0 ? intentRecipients : void 0
                 });
@@ -11977,13 +12079,13 @@ function createChatHandlers(config) {
                   await convRepo().update(conversationId, {
                     leadEmailSentAt: /* @__PURE__ */ new Date()
                   });
-                  console.info(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
+                  console.info(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "lead email recorded", {
                     conversationId,
                     sent: true,
                     recipients: leadResult.recipients
                   });
                 } else {
-                  console.warn(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
+                  console.warn(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "lead email not sent", {
                     conversationId,
                     sent: false,
                     error: leadResult.error ?? "unknown",
@@ -11992,7 +12094,7 @@ function createChatHandlers(config) {
                 }
               }
             } catch (intentErr) {
-              console.warn(chunk747MJJCZ_cjs.CHAT_EMAIL_LOG, "pipeline error", {
+              console.warn(chunkTTOEY7AH_cjs.CHAT_EMAIL_LOG, "pipeline error", {
                 conversationId,
                 error: intentErr instanceof Error ? intentErr.message : String(intentErr)
               });
@@ -12009,7 +12111,7 @@ function createChatHandlers(config) {
         });
         if (agentRow && llm.chatAgent) {
           const fromAgent = llmAgentToChatAgentOptions(agentRow);
-          const systemPrompt = chunk747MJJCZ_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
+          const systemPrompt = chunkTTOEY7AH_cjs.buildChatbotSystemPromptWithEmailTool(fromAgent.systemPrompt, parsedValidation.guardrailsForPrompt, emailTool);
           const res = await llm.chatAgent({
             ...fromAgent,
             systemPrompt: systemPrompt || void 0,
@@ -12030,7 +12132,7 @@ ${contextParts.join("\n\n")}` : "";
               agentRow.systemInstruction?.trim(),
               ragSystem
             ].filter(Boolean).join("\n\n");
-            systemContent = chunk747MJJCZ_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
+            systemContent = chunkTTOEY7AH_cjs.buildChatbotSystemPromptWithEmailTool(mergedBase || defaultSystem, parsedValidation.guardrailsForPrompt, emailTool) || defaultSystem;
           } else {
             systemContent = ragSystem || defaultSystem;
           }
@@ -13285,7 +13387,7 @@ function createDeviceTokensHandlers(config) {
         const title = body.title?.trim() || "Test Push Notification";
         const msgBody = body.body?.trim() || "Firebase Push Notification setup is working!";
         if (!token || token === "validate" || token === "validate_only") {
-          const valRes = await chunk747MJJCZ_cjs.validateFcmCredentials(dataSource, entityMap);
+          const valRes = await chunkTTOEY7AH_cjs.validateFcmCredentials(dataSource, entityMap);
           if (!valRes.success) {
             return json({
               success: false,
@@ -13302,7 +13404,7 @@ function createDeviceTokensHandlers(config) {
             clientEmail: valRes.clientEmail
           });
         }
-        const res = await chunk747MJJCZ_cjs.sendFcmPushNotification(dataSource, entityMap, {
+        const res = await chunkTTOEY7AH_cjs.sendFcmPushNotification(dataSource, entityMap, {
           token,
           title,
           body: msgBody,
@@ -13856,7 +13958,7 @@ chunkXHPRD45G_cjs.__name(findActiveRefundPolicyForVendor, "findActiveRefundPolic
 // src/api/admin-roles-handlers.ts
 function createAdminRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
-  const baseEntities = chunkLXWF6T7F_cjs.getPermissionableEntityKeys(entityMap);
+  const baseEntities = chunkLCZZ3S4I_cjs.getPermissionableEntityKeys(entityMap);
   const allowEntities = /* @__PURE__ */ new Set([
     ...baseEntities,
     "users"
@@ -13871,7 +13973,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkQXAQ3V7R_cjs.canManageRoles(u) && !chunkLXWF6T7F_cjs.canManageVendorRoles(u)) {
+    if (!chunkFNLF6G2N_cjs.canManageRoles(u) && !chunkLCZZ3S4I_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -13882,11 +13984,11 @@ function createAdminRolesHandlers(config) {
   }
   chunkXHPRD45G_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunkLXWF6T7F_cjs.canManageVendorRoles(u) && !chunkQXAQ3V7R_cjs.canManageRoles(u);
+    return chunkLCZZ3S4I_cjs.canManageVendorRoles(u) && !chunkFNLF6G2N_cjs.canManageRoles(u);
   }
   chunkXHPRD45G_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
-    ...chunkLXWF6T7F_cjs.VENDOR_STORE_RBAC_ENTITIES,
+    ...chunkLCZZ3S4I_cjs.VENDOR_STORE_RBAC_ENTITIES,
     "dashboard",
     "settings"
   ].sort();
@@ -14043,7 +14145,7 @@ function createAdminRolesHandlers(config) {
         }, {
           status: 404
         });
-        if (chunkLXWF6T7F_cjs.isSuperAdminGroupName(g.name) && !chunkLXWF6T7F_cjs.isSuperAdminGroupName(name)) {
+        if (chunkLCZZ3S4I_cjs.isSuperAdminGroupName(g.name) && !chunkLCZZ3S4I_cjs.isSuperAdminGroupName(name)) {
           return json({
             error: "Cannot rename the administrator group"
           }, {
@@ -14100,7 +14202,7 @@ function createAdminRolesHandlers(config) {
       }, {
         status: 404
       });
-      if (chunkLXWF6T7F_cjs.isSuperAdminGroupName(g.name)) return json({
+      if (chunkLCZZ3S4I_cjs.isSuperAdminGroupName(g.name)) return json({
         error: "Cannot delete the administrator group"
       }, {
         status: 400
@@ -14298,7 +14400,7 @@ async function sendVendorOnboardEmails(input, deps) {
       getVendorEmails(deps)
     ]);
     const companyDetails = chunkEYUBL7YH_cjs.mergeEmailLayoutCompanyDetails(branding, emailSettings, storeSettings);
-    const configuredNotify = chunk747MJJCZ_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
+    const configuredNotify = chunkTTOEY7AH_cjs.parseEmailRecipientsFromConfig(emailSettings.salesTeamEmails ?? emailSettings.salesTeamEmail);
     const ownerEmail = input.ownerEmail?.trim() || "";
     const ownerEmailLower = ownerEmail.toLowerCase();
     const sendToOwner = input.sendToOwner !== false;
@@ -14332,7 +14434,7 @@ chunkXHPRD45G_cjs.__name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
 async function insertRolePermissions(exec, vendorRoleId, permissions) {
-  for (const entity of chunkLXWF6T7F_cjs.VENDOR_RBAC_ENTITIES) {
+  for (const entity of chunkLCZZ3S4I_cjs.VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
     await exec.query(`
@@ -14363,7 +14465,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     for (const r of existing) {
       roleIdsByName2[r.name] = Number(r.id);
       if (r.isOwnerRole) ownerRoleId2 = Number(r.id);
-      if (r.name === chunkLXWF6T7F_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
+      if (r.name === chunkLCZZ3S4I_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
     }
     return {
       roleIdsByName: roleIdsByName2,
@@ -14374,7 +14476,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
   const roleIdsByName = {};
   let ownerRoleId = 0;
   let viewerRoleId = 0;
-  for (const def of chunkLXWF6T7F_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
+  for (const def of chunkLCZZ3S4I_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
     const inserted = await exec.query(`
       INSERT INTO "vendor_roles"
         ("vendorId", "name", "description", "isSystem", "isOwnerRole")
@@ -14391,7 +14493,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     if (!roleId) continue;
     roleIdsByName[def.name] = roleId;
     if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === chunkLXWF6T7F_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
+    if (def.name === chunkLCZZ3S4I_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
     await insertRolePermissions(exec, roleId, def.permissions);
   }
   return {
@@ -14421,7 +14523,7 @@ async function backfillVendorUserRoleIds(em, vendorId, seeded) {
       vendorId
     ]);
   }
-  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkLXWF6T7F_cjs.VENDOR_VIEWER_ROLE_NAME];
+  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkLCZZ3S4I_cjs.VENDOR_VIEWER_ROLE_NAME];
   if (viewerId) {
     await em.query(`
       UPDATE "vendor_users"
@@ -14447,7 +14549,7 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
     LIMIT 1
     `, [
     vendorId,
-    chunkLXWF6T7F_cjs.VENDOR_VIEWER_ROLE_NAME
+    chunkLCZZ3S4I_cjs.VENDOR_VIEWER_ROLE_NAME
   ]);
   const id = rows[0]?.id;
   return id != null ? Number(id) : null;
@@ -14808,7 +14910,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkLXWF6T7F_cjs.isPlatformAdministrator(u)) return json({
+    if (!chunkLCZZ3S4I_cjs.isPlatformAdministrator(u)) return json({
       error: "Forbidden",
       reason: "admin_only"
     }, {
@@ -14818,7 +14920,7 @@ function createVendorOnboardHandlers(config) {
   }
   chunkXHPRD45G_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
-    const scope = chunkLXWF6T7F_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkLCZZ3S4I_cjs.resolveVendorScopeFromSessionUser(u);
     const candidates = [];
     if (scope.type === "vendor") candidates.push(scope.vendorId);
     if (scope.type === "all" || scope.type === "vendor") {
@@ -14872,7 +14974,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkLXWF6T7F_cjs.isVendorPortalUser(u) && !chunkLXWF6T7F_cjs.isPlatformAdministrator(u)) {
+    if (!chunkLCZZ3S4I_cjs.isVendorPortalUser(u) && !chunkLCZZ3S4I_cjs.isPlatformAdministrator(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -14900,7 +15002,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkLXWF6T7F_cjs.canManageVendorTeam(u)) return json({
+    if (!chunkLCZZ3S4I_cjs.canManageVendorTeam(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -15118,7 +15220,7 @@ function createVendorOnboardHandlers(config) {
           await chunk4WZNRVEZ_cjs.retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
-              name: chunkLXWF6T7F_cjs.VENDOR_GROUP_NAME,
+              name: chunkLCZZ3S4I_cjs.VENDOR_GROUP_NAME,
               deleted: false
             }
           });
@@ -15133,12 +15235,12 @@ function createVendorOnboardHandlers(config) {
           if (!ownerGroup) {
             try {
               await groupRepo.save(groupRepo.create({
-                name: chunkLXWF6T7F_cjs.VENDOR_GROUP_NAME,
+                name: chunkLCZZ3S4I_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }));
               ownerGroup = await groupRepo.findOne({
                 where: {
-                  name: chunkLXWF6T7F_cjs.VENDOR_GROUP_NAME,
+                  name: chunkLCZZ3S4I_cjs.VENDOR_GROUP_NAME,
                   deleted: false
                 }
               });
@@ -15255,7 +15357,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunkQXAQ3V7R_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkFNLF6G2N_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -15756,7 +15858,7 @@ function createVendorOnboardHandlers(config) {
           if (!groupId) {
             const g = await groupRepo.findOne({
               where: {
-                name: chunkLXWF6T7F_cjs.VENDOR_GROUP_NAME,
+                name: chunkLCZZ3S4I_cjs.VENDOR_GROUP_NAME,
                 deleted: false
               }
             }) ?? await groupRepo.findOne({
@@ -15856,7 +15958,7 @@ function createVendorOnboardHandlers(config) {
           }
           if (entityMap.customer) {
             try {
-              await chunkQXAQ3V7R_cjs.ensureCustomerForUser(em, entityMap.customer, {
+              await chunkFNLF6G2N_cjs.ensureCustomerForUser(em, entityMap.customer, {
                 id: newUser.id,
                 name: userName,
                 email: userEmail,
@@ -16403,10 +16505,10 @@ chunkXHPRD45G_cjs.__name(createVendorOnboardHandlers, "createVendorOnboardHandle
 function createVendorRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
   const vendorRoleEntities = [
-    ...chunkLXWF6T7F_cjs.VENDOR_RBAC_ENTITIES
+    ...chunkLCZZ3S4I_cjs.VENDOR_RBAC_ENTITIES
   ].sort();
   async function resolveActiveVendorId(u) {
-    const scope = chunkLXWF6T7F_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkLCZZ3S4I_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -16422,7 +16524,7 @@ function createVendorRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkLXWF6T7F_cjs.canManageVendorRoles(u)) return json({
+    if (!chunkLCZZ3S4I_cjs.canManageVendorRoles(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -29046,6 +29148,7 @@ function whatsappPlugin(config = {}) {
       const { getWhatsAppSettings, getMessageTemplateRow, ...staticRest } = config;
       let settingsLoader = getWhatsAppSettings;
       if (!settingsLoader && context.dataSource) {
+        const encKey = resolveSettingsEncryptionKey(env);
         settingsLoader = /* @__PURE__ */ chunkXHPRD45G_cjs.__name(async () => {
           try {
             const ds = context.dataSource;
@@ -29056,10 +29159,18 @@ function whatsappPlugin(config = {}) {
                 deleted: false
               }
             });
-            return Object.fromEntries(rows.map((r) => [
-              r.key,
-              r.value
-            ]));
+            const result = {};
+            for (const r of rows) {
+              let val = String(r.value ?? "");
+              if (r.encrypted && encKey) {
+                try {
+                  val = simpleDecrypt(val, encKey);
+                } catch {
+                }
+              }
+              result[r.key] = val;
+            }
+            return result;
           } catch {
             return {};
           }
@@ -29070,11 +29181,11 @@ function whatsappPlugin(config = {}) {
         db = await settingsLoader?.() ?? {};
       } catch {
       }
-      if (!chunk747MJJCZ_cjs.isWhatsAppPluginEnabled(db)) {
+      if (!chunkTTOEY7AH_cjs.isWhatsAppPluginEnabled(db)) {
         context.logger.warn("WhatsApp plugin skipped: disabled in Plugins \u2192 WhatsApp");
         return null;
       }
-      const svc = new chunk747MJJCZ_cjs.WhatsAppService(env, staticRest, settingsLoader, getMessageTemplateRow);
+      const svc = new chunkTTOEY7AH_cjs.WhatsAppService(env, staticRest, settingsLoader, getMessageTemplateRow);
       return {
         send: /* @__PURE__ */ chunkXHPRD45G_cjs.__name((opts) => svc.send(opts), "send")
       };
@@ -29151,7 +29262,7 @@ function registerMessagingQueueProcessors(cms, entityMap) {
     getDataSource: /* @__PURE__ */ chunkXHPRD45G_cjs.__name(async () => cms.dataSource, "getDataSource"),
     entityMap
   });
-  chunkOXFC3DAM_cjs.registerWhatsAppQueueProcessor(cms);
+  chunkKJB5LBFQ_cjs.registerWhatsAppQueueProcessor(cms);
 }
 chunkXHPRD45G_cjs.__name(registerMessagingQueueProcessors, "registerMessagingQueueProcessors");
 async function ensureMessagingPluginsOnCms(base, options) {
@@ -29180,7 +29291,7 @@ async function ensureMessagingPluginsOnCms(base, options) {
   }
   if (!cms.getPlugin("email")) {
     try {
-      const instance = await chunk747MJJCZ_cjs.emailPlugin({
+      const instance = await chunkTTOEY7AH_cjs.emailPlugin({
         type: "SMTP",
         from: config.SMTP_FROM ?? "no-reply@localhost",
         to: config.SMTP_TO ?? ""
@@ -29221,7 +29332,7 @@ function messagingPlugins(options) {
   const config = options.config ?? (typeof process !== "undefined" ? process.env : {});
   return [
     queuePlugin(),
-    chunk747MJJCZ_cjs.emailPlugin({
+    chunkTTOEY7AH_cjs.emailPlugin({
       type: "SMTP",
       from: config.SMTP_FROM ?? "no-reply@localhost",
       to: config.SMTP_TO ?? ""
@@ -29355,7 +29466,7 @@ function createCmsApiHandler(config) {
   } : void 0;
   const entityMap = withLlmKnowledgeEntityFallbacks(rawEntityMap);
   if (getCms) {
-    chunk747MJJCZ_cjs.initWhatsappTriggerDispatcher({
+    chunkTTOEY7AH_cjs.initWhatsappTriggerDispatcher({
       dataSource,
       entityMap,
       getCms
@@ -29368,7 +29479,7 @@ function createCmsApiHandler(config) {
   ] : baseCrudResources;
   const requireEntityPermissionEffective = /* @__PURE__ */ chunkXHPRD45G_cjs.__name(async (_req, entity, action) => {
     if (!resolveSessionUser) {
-      chunkLXWF6T7F_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
+      chunkLCZZ3S4I_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
         entity,
         action,
         hint: "Pass getSessionUser: auth.getAuthenticatedUser from createCmsAuthBundle()"
@@ -29378,7 +29489,7 @@ function createCmsApiHandler(config) {
       const raw = await resolveSessionUser();
       const u = await hydrateVendorSessionUser(dataSource, raw);
       if (!u?.email) {
-        chunkLXWF6T7F_cjs.logRbac("requireEntityPermission: no session user", {
+        chunkLCZZ3S4I_cjs.logRbac("requireEntityPermission: no session user", {
           entity,
           action
         });
@@ -29388,13 +29499,13 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunkQXAQ3V7R_cjs.sessionHasEntityAccess(u, entity, action);
-      await chunkLXWF6T7F_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
+      const allowed = chunkFNLF6G2N_cjs.sessionHasEntityAccess(u, entity, action);
+      await chunkLCZZ3S4I_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
       });
       if (allowed) return null;
-      const { reason } = chunkLXWF6T7F_cjs.explainSessionEntityAccess(u, entity, action);
+      const { reason } = chunkLCZZ3S4I_cjs.explainSessionEntityAccess(u, entity, action);
       return config.json({
         error: "Forbidden",
         entity,
@@ -29405,7 +29516,7 @@ function createCmsApiHandler(config) {
       });
     }
     if (userRequireEntityPermission) {
-      chunkLXWF6T7F_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
+      chunkLCZZ3S4I_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
         entity,
         action
       });
@@ -29492,10 +29603,10 @@ function createCmsApiHandler(config) {
       getVendorScope: /* @__PURE__ */ chunkXHPRD45G_cjs.__name(async () => {
         const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
         if (!multiVendorEnabled) {
-          return chunkLXWF6T7F_cjs.resolveDisabledMultiVendorScope(dataSource);
+          return chunkLCZZ3S4I_cjs.resolveDisabledMultiVendorScope(dataSource);
         }
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-        return chunkLXWF6T7F_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+        return chunkLCZZ3S4I_cjs.resolveVendorScopeFromSessionUser(u ?? null);
       }, "getVendorScope"),
       getHydratedSessionUser: /* @__PURE__ */ chunkXHPRD45G_cjs.__name(async () => {
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
@@ -30947,7 +31058,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkLXWF6T7F_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkLCZZ3S4I_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const result = await validateCoupon(dataSource, entityMap, couponCode, orderLinesNorm, currency, contactId, isAutomatic, discountId ?? void 0, vendorId);
@@ -31035,7 +31146,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkLXWF6T7F_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkLCZZ3S4I_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
@@ -31248,7 +31359,7 @@ function createCmsApiHandler(config) {
             status: 400
           });
         }
-        const { resendOrderNotification } = await import('./order-notification-dispatcher-GG5C4LKZ.cjs');
+        const { resendOrderNotification } = await import('./order-notification-dispatcher-37KDVHBM.cjs');
         const result = await resendOrderNotification(triggerKey, orderId, {
           dataSource,
           entityMap,
@@ -31347,7 +31458,7 @@ function createCmsApiHandler(config) {
           status: "cancelled"
         });
         const fireOrderCancelledNotification = /* @__PURE__ */ chunkXHPRD45G_cjs.__name((refundAmount) => {
-          void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+          void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
             fireOrderNotificationTrigger("order_cancelled", orderId, {
               dataSource,
               entityMap
@@ -31592,7 +31703,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-LNAZTMTS.cjs');
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-2ZKRK5SN.cjs');
         const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.getChannels(req, orderId);
       }
@@ -31607,7 +31718,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-LNAZTMTS.cjs');
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-2ZKRK5SN.cjs');
         const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.sendOtp(req, orderId);
       }
@@ -31622,7 +31733,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-LNAZTMTS.cjs');
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-2ZKRK5SN.cjs');
         const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.verifyOtp(req, orderId);
       }
@@ -31637,7 +31748,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-JEJ5IDID.cjs');
+        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-E6PQZP4H.cjs');
         const handlers = createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionUser);
         return handlers.listEligibleAssignees(req, orderId);
       }
@@ -31747,7 +31858,7 @@ function createCmsApiHandler(config) {
           if (resolveSessionUser) {
             const raw = await resolveSessionUser();
             const u = await hydrateVendorSessionUser(dataSource, raw);
-            const scope = chunkLXWF6T7F_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkLCZZ3S4I_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") {
               scopedVendorIds = scope.vendorIds;
             }
@@ -32254,7 +32365,7 @@ function createStorefrontApiHandler(config) {
   const otpPepper = config.otpPepper;
   const defaultPhoneCc = config.defaultPhoneCountryCode;
   function fireStorefrontCheckoutNotifications(orderId) {
-    void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+    void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
       fireOrderNotificationTrigger("order_pending", orderId, {
         dataSource,
         entityMap
@@ -33834,7 +33945,7 @@ function createStorefrontApiHandler(config) {
                   status: 403
                 });
               }
-              const p = chunk6MM5OMRL_cjs.normalizePhoneE164(phoneIn, defaultPhoneCc);
+              const p = chunkKB7EBYPR_cjs.normalizePhoneE164(phoneIn, defaultPhoneCc);
               if (!p) return json({
                 error: "Invalid phone"
               }, {
@@ -33887,7 +33998,7 @@ function createStorefrontApiHandler(config) {
             }, {
               status: 401
             });
-            const p = chunk6MM5OMRL_cjs.normalizePhoneE164(phoneIn, defaultPhoneCc);
+            const p = chunkKB7EBYPR_cjs.normalizePhoneE164(phoneIn, defaultPhoneCc);
             if (!p) return json({
               error: "Valid phone required"
             }, {
@@ -33911,8 +34022,8 @@ function createStorefrontApiHandler(config) {
               });
             }
           }
-          const code = chunk6MM5OMRL_cjs.generateNumericOtp(6);
-          const created = await chunk6MM5OMRL_cjs.createOtpChallenge(dataSource, entityMap, {
+          const code = chunkKB7EBYPR_cjs.generateNumericOtp(6);
+          const created = await chunkKB7EBYPR_cjs.createOtpChallenge(dataSource, entityMap, {
             purpose,
             channel,
             identifier,
@@ -33953,7 +34064,7 @@ function createStorefrontApiHandler(config) {
                 status: 503
               });
               const templateKey = purpose === "verify_phone" ? "auth.otp_verify_phone" : "auth.otp_login";
-              await chunk6MM5OMRL_cjs.queueSms(cms, {
+              await chunkKJB5LBFQ_cjs.queueSms(cms, {
                 to: identifier,
                 templateKey,
                 variables: {
@@ -33986,7 +34097,7 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 400
           });
-          const v = await chunk6MM5OMRL_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
+          const v = await chunkKB7EBYPR_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
             purpose: "verify_email",
             identifier: email,
             code,
@@ -34036,13 +34147,13 @@ function createStorefrontApiHandler(config) {
           const b = await req.json().catch(() => ({}));
           const phoneRaw = typeof b.phone === "string" ? b.phone.trim() : "";
           const code = typeof b.code === "string" ? b.code.trim() : "";
-          const phone = chunk6MM5OMRL_cjs.normalizePhoneE164(phoneRaw, defaultPhoneCc);
+          const phone = chunkKB7EBYPR_cjs.normalizePhoneE164(phoneRaw, defaultPhoneCc);
           if (!phone || !code) return json({
             error: "phone and code required"
           }, {
             status: 400
           });
-          const v = await chunk6MM5OMRL_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
+          const v = await chunkKB7EBYPR_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
             purpose: "verify_phone",
             identifier: phone,
             code,
@@ -34136,10 +34247,10 @@ function createStorefrontApiHandler(config) {
             adminAccess: false
           }));
           const userId = newUser.id;
-          await chunkQXAQ3V7R_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
+          await chunkFNLF6G2N_cjs.linkUnclaimedContactToUser(dataSource, entityMap.contacts, userId, email);
           if (entityMap.customer) {
             const phone = typeof b.phone === "string" && b.phone.trim() ? String(b.phone).trim() : null;
-            await chunkQXAQ3V7R_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
+            await chunkFNLF6G2N_cjs.ensureCustomerForUser(dataSource, entityMap.customer, {
               id: userId,
               name,
               email,
@@ -35199,7 +35310,7 @@ function createStorefrontApiHandler(config) {
             } catch {
             }
             try {
-              void import('./emit-order-notification-trigger-X36V4DOH.cjs').then(({ fireOrderNotificationTrigger }) => {
+              void import('./emit-order-notification-trigger-I4HQSTEN.cjs').then(({ fireOrderNotificationTrigger }) => {
                 fireOrderNotificationTrigger("order_cancelled", orderId, {
                   dataSource,
                   entityMap