@infuro/cms-core 1.0.40 → 1.0.42

package/dist/{chunk-T7GCOO5Y.cjs → chunk-GINYYPXK.cjs}

@@ -7,8 +7,8 @@ var chunkXW5ATPRW_cjs = require('./chunk-XW5ATPRW.cjs');
 var chunk3DZRIZOD_cjs = require('./chunk-3DZRIZOD.cjs');
 var chunkSPQFNIYJ_cjs = require('./chunk-SPQFNIYJ.cjs');
 var chunkXQ3QUHWR_cjs = require('./chunk-XQ3QUHWR.cjs');
-var chunkOIGCAGH7_cjs = require('./chunk-OIGCAGH7.cjs');
-var chunkWMXPKKXU_cjs = require('./chunk-WMXPKKXU.cjs');
+var chunkZMRQ72F6_cjs = require('./chunk-ZMRQ72F6.cjs');
+var chunkX6UQFV4X_cjs = require('./chunk-X6UQFV4X.cjs');
 var chunkD5FBNKQM_cjs = require('./chunk-D5FBNKQM.cjs');
 var chunkUPLVMVRX_cjs = require('./chunk-UPLVMVRX.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
@@ -87,7 +87,7 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
         `, [
         primary.vendorRoleId
       ]);
-      vendorEntityPerms = chunkWMXPKKXU_cjs.permissionRowsToRecord(permRows);
+      vendorEntityPerms = chunkX6UQFV4X_cjs.permissionRowsToRecord(permRows);
     } catch (err) {
       if (!isMissingVendorRoleSchemaError(err)) throw err;
     }
@@ -104,6 +104,79 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
 }
 chunkUSNT2KNT_cjs.__name(loadUserVendorContext, "loadUserVendorContext");
 
+// src/lib/vendor-catalog-create-flags.ts
+var ALL_OFF = {
+  categories: false,
+  collections: false,
+  brands: false
+};
+var cachedFlags = null;
+function invalidateVendorCatalogCreateFlagsCache() {
+  cachedFlags = null;
+}
+chunkUSNT2KNT_cjs.__name(invalidateVendorCatalogCreateFlagsCache, "invalidateVendorCatalogCreateFlagsCache");
+function parseTrue(value) {
+  return value === "true";
+}
+chunkUSNT2KNT_cjs.__name(parseTrue, "parseTrue");
+async function isMultiVendorEnabled(dataSource) {
+  try {
+    const rows = await dataSource.query(`
+      SELECT value FROM configs
+      WHERE settings = 'multi_vendor' AND key = 'enabled' AND deleted = false
+      LIMIT 1
+      `);
+    return rows.length === 0 || rows[0].value !== "false";
+  } catch {
+    return true;
+  }
+}
+chunkUSNT2KNT_cjs.__name(isMultiVendorEnabled, "isMultiVendorEnabled");
+async function getVendorCatalogCreateFlags(dataSource) {
+  if (cachedFlags !== null) return cachedFlags;
+  const multiVendorEnabled = await isMultiVendorEnabled(dataSource);
+  if (!multiVendorEnabled) {
+    cachedFlags = {
+      ...ALL_OFF
+    };
+    return cachedFlags;
+  }
+  try {
+    const rows = await dataSource.query(`
+      SELECT key, value FROM configs
+      WHERE settings = 'multi_vendor'
+        AND key IN (
+          'vendorCanCreateCategories',
+          'vendorCanCreateCollections',
+          'vendorCanCreateBrands'
+        )
+        AND deleted = false
+      `);
+    const map = new Map(rows.map((r) => [
+      r.key,
+      r.value
+    ]));
+    cachedFlags = {
+      categories: parseTrue(map.get("vendorCanCreateCategories")),
+      collections: parseTrue(map.get("vendorCanCreateCollections")),
+      brands: parseTrue(map.get("vendorCanCreateBrands"))
+    };
+  } catch {
+    cachedFlags = {
+      ...ALL_OFF
+    };
+  }
+  return cachedFlags;
+}
+chunkUSNT2KNT_cjs.__name(getVendorCatalogCreateFlags, "getVendorCatalogCreateFlags");
+function vendorCanCreateResource(resource, flags) {
+  if (resource === "product_categories") return flags.categories;
+  if (resource === "collections") return flags.collections;
+  if (resource === "brands") return flags.brands;
+  return false;
+}
+chunkUSNT2KNT_cjs.__name(vendorCanCreateResource, "vendorCanCreateResource");
+
 // src/lib/hydrate-vendor-session-user.ts
 async function hydrateVendorSessionUser(dataSource, user) {
   if (!user?.email) return user;
@@ -120,7 +193,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     ]);
     const resolvedId = Number(byEmailRows[0]?.id);
     if (!Number.isFinite(resolvedId)) {
-      chunkWMXPKKXU_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
+      chunkX6UQFV4X_cjs.logRbac("hydrateVendorSessionUser: unable to resolve numeric user id", {
         email: user.email,
         rawSessionId: user.id ?? null
       });
@@ -140,7 +213,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   const groupName = rows[0]?.groupName ?? user.groupName ?? null;
   const groupId = rows[0]?.groupId ?? user.groupId ?? void 0;
   const adminAccess = rows[0]?.adminAccess ?? user.adminAccess;
-  const isRBACAdmin = user.isRBACAdmin ?? chunkWMXPKKXU_cjs.isSuperAdmin({
+  const isRBACAdmin = user.isRBACAdmin ?? chunkX6UQFV4X_cjs.isSuperAdmin({
     groupId,
     groupName,
     isRBACAdmin: user.isRBACAdmin
@@ -153,7 +226,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
   };
   if (multiVendorEnabled) {
     ctx = await loadUserVendorContext(dataSource, id, user.activeVendorId);
-    flags = chunkWMXPKKXU_cjs.vendorPortalFlagsFromUser({
+    flags = chunkX6UQFV4X_cjs.vendorPortalFlagsFromUser({
       email: user.email,
       isRBACAdmin,
       groupName,
@@ -188,7 +261,7 @@ async function hydrateVendorSessionUser(dataSource, user) {
     isVendorPortal: flags.isVendorPortal,
     isVendorOwner: flags.isVendorOwner
   };
-  chunkWMXPKKXU_cjs.logRbac("hydrateVendorSessionUser", {
+  chunkX6UQFV4X_cjs.logRbac("hydrateVendorSessionUser", {
     email: user.email,
     userId: id,
     groupName,
@@ -206,6 +279,7 @@ chunkUSNT2KNT_cjs.__name(hydrateVendorSessionUser, "hydrateVendorSessionUser");
 var cachedMultiVendorEnabled = null;
 function invalidateMultiVendorCache() {
   cachedMultiVendorEnabled = null;
+  invalidateVendorCatalogCreateFlagsCache();
 }
 chunkUSNT2KNT_cjs.__name(invalidateMultiVendorCache, "invalidateMultiVendorCache");
 async function checkMultiVendorEnabled(dataSource) {
@@ -244,6 +318,279 @@ async function checkEventsEnabled(dataSource) {
 }
 chunkUSNT2KNT_cjs.__name(checkEventsEnabled, "checkEventsEnabled");
 
+// src/lib/product-approval.ts
+var PRODUCT_APPROVAL_STATUSES = [
+  "pending",
+  "approved",
+  "rejected"
+];
+var APPROVAL_SET = new Set(PRODUCT_APPROVAL_STATUSES);
+var PRODUCT_STATUSES = /* @__PURE__ */ new Set([
+  "draft",
+  "available",
+  "reserved",
+  "sold"
+]);
+var cachedRequireApproval = null;
+function invalidateRequireProductApprovalCache() {
+  cachedRequireApproval = null;
+}
+chunkUSNT2KNT_cjs.__name(invalidateRequireProductApprovalCache, "invalidateRequireProductApprovalCache");
+function parseTrue2(value) {
+  return value === "true";
+}
+chunkUSNT2KNT_cjs.__name(parseTrue2, "parseTrue");
+async function getRequireProductApproval(dataSource) {
+  if (cachedRequireApproval !== null) return cachedRequireApproval;
+  const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
+  if (!multiVendorEnabled) {
+    cachedRequireApproval = false;
+    return false;
+  }
+  try {
+    const rows = await dataSource.query(`
+      SELECT value FROM configs
+      WHERE settings = 'multi_vendor' AND key = 'requireProductApproval' AND deleted = false
+      LIMIT 1
+      `);
+    cachedRequireApproval = rows.length > 0 && parseTrue2(rows[0].value);
+  } catch {
+    cachedRequireApproval = false;
+  }
+  return cachedRequireApproval;
+}
+chunkUSNT2KNT_cjs.__name(getRequireProductApproval, "getRequireProductApproval");
+function applyVendorProductCreateApproval(persistBody, opts) {
+  if (!opts.isVendor || !opts.requireApproval) return;
+  persistBody.approvalStatus = "pending";
+  if (persistBody.status === "available") persistBody.status = "draft";
+  persistBody.rejectionReason = null;
+  persistBody.rejectedAt = null;
+  persistBody.rejectedBy = null;
+}
+chunkUSNT2KNT_cjs.__name(applyVendorProductCreateApproval, "applyVendorProductCreateApproval");
+function assertProductApprovalUpdate(opts) {
+  const fromApproval = opts.fromApproval == null || opts.fromApproval === "" ? null : String(opts.fromApproval);
+  const toApproval = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  const fromStatus = String(opts.fromStatus || "draft");
+  const toStatus = String(opts.toStatus || fromStatus);
+  if (opts.statusChanged && !PRODUCT_STATUSES.has(toStatus)) {
+    return {
+      ok: false,
+      error: `Invalid product status: ${toStatus}`
+    };
+  }
+  if (opts.approvalChanged && toApproval != null && !APPROVAL_SET.has(toApproval)) {
+    return {
+      ok: false,
+      error: `Invalid approval status: ${toApproval}`
+    };
+  }
+  if (!opts.requireApproval) {
+    if (opts.isVendor && opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.isVendor) {
+    if (opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    if (opts.statusChanged && toStatus === "available" && fromApproval !== "approved") {
+      return {
+        ok: false,
+        error: "Product must be approved before it can be available"
+      };
+    }
+    if (fromApproval === "rejected" && opts.statusChanged && toStatus === "available") {
+      return {
+        ok: false,
+        error: "Rejected product cannot be made available"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.approvalChanged && toApproval === "rejected") {
+    const reason = String(opts.rejectionReason ?? "").trim();
+    if (!reason) return {
+      ok: false,
+      error: "Rejection reason is required"
+    };
+  }
+  return {
+    ok: true
+  };
+}
+chunkUSNT2KNT_cjs.__name(assertProductApprovalUpdate, "assertProductApprovalUpdate");
+function applyApprovalStatusSideEffects(updatePayload, opts) {
+  const to = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  if (to == null) return;
+  if (to === "approved") {
+    updatePayload.approvalStatus = "approved";
+    updatePayload.status = "available";
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    return;
+  }
+  if (to === "rejected") {
+    updatePayload.approvalStatus = "rejected";
+    updatePayload.rejectionReason = String(opts.rejectionReason ?? "").trim();
+    updatePayload.rejectedAt = /* @__PURE__ */ new Date();
+    updatePayload.rejectedBy = opts.rejectedBy != null && Number.isFinite(opts.rejectedBy) ? opts.rejectedBy : null;
+    const nextStatus = "status" in updatePayload ? String(updatePayload.status) : opts.currentStatus;
+    if (nextStatus === "available") updatePayload.status = "draft";
+    return;
+  }
+  if (to === "pending") {
+    updatePayload.approvalStatus = "pending";
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    const nextStatus = "status" in updatePayload ? String(updatePayload.status) : opts.currentStatus;
+    if (nextStatus === "available") updatePayload.status = "draft";
+  }
+}
+chunkUSNT2KNT_cjs.__name(applyApprovalStatusSideEffects, "applyApprovalStatusSideEffects");
+
+// src/lib/event-approval.ts
+var EVENT_APPROVAL_STATUSES = [
+  "pending",
+  "approved",
+  "rejected"
+];
+var APPROVAL_SET2 = new Set(EVENT_APPROVAL_STATUSES);
+var cachedRequireApproval2 = null;
+function invalidateRequireEventApprovalCache() {
+  cachedRequireApproval2 = null;
+}
+chunkUSNT2KNT_cjs.__name(invalidateRequireEventApprovalCache, "invalidateRequireEventApprovalCache");
+function parseTrue3(value) {
+  return value === "true";
+}
+chunkUSNT2KNT_cjs.__name(parseTrue3, "parseTrue");
+async function getRequireEventApproval(dataSource) {
+  if (cachedRequireApproval2 !== null) return cachedRequireApproval2;
+  const [eventsOn, multiVendorOn] = await Promise.all([
+    checkEventsEnabled(dataSource),
+    checkMultiVendorEnabled(dataSource)
+  ]);
+  if (!eventsOn || !multiVendorOn) {
+    cachedRequireApproval2 = false;
+    return false;
+  }
+  try {
+    const rows = await dataSource.query(`
+      SELECT value FROM configs
+      WHERE settings = 'events' AND key = 'requireEventApproval' AND deleted = false
+      LIMIT 1
+      `);
+    cachedRequireApproval2 = rows.length > 0 && parseTrue3(rows[0].value);
+  } catch {
+    cachedRequireApproval2 = false;
+  }
+  return cachedRequireApproval2;
+}
+chunkUSNT2KNT_cjs.__name(getRequireEventApproval, "getRequireEventApproval");
+function applyVendorEventCreateApproval(persistBody, opts) {
+  if (!opts.isVendor || !opts.requireApproval) return;
+  persistBody.approvalStatus = "pending";
+  persistBody.isActive = false;
+  persistBody.rejectionReason = null;
+  persistBody.rejectedAt = null;
+  persistBody.rejectedBy = null;
+}
+chunkUSNT2KNT_cjs.__name(applyVendorEventCreateApproval, "applyVendorEventCreateApproval");
+function assertEventApprovalUpdate(opts) {
+  const fromApproval = opts.fromApproval == null || opts.fromApproval === "" ? null : String(opts.fromApproval);
+  const toApproval = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  if (opts.approvalChanged && toApproval != null && !APPROVAL_SET2.has(toApproval)) {
+    return {
+      ok: false,
+      error: `Invalid approval status: ${toApproval}`
+    };
+  }
+  if (!opts.requireApproval) {
+    if (opts.isVendor && opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.isVendor) {
+    if (opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    if (opts.activeChanged && opts.toActive && fromApproval !== "approved") {
+      return {
+        ok: false,
+        error: "Event must be approved before it can be activated"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.approvalChanged && toApproval === "rejected") {
+    const reason = String(opts.rejectionReason ?? "").trim();
+    if (!reason) return {
+      ok: false,
+      error: "Rejection reason is required"
+    };
+  }
+  return {
+    ok: true
+  };
+}
+chunkUSNT2KNT_cjs.__name(assertEventApprovalUpdate, "assertEventApprovalUpdate");
+function applyEventApprovalStatusSideEffects(updatePayload, opts) {
+  const to = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  if (to == null) return;
+  if (to === "approved") {
+    updatePayload.approvalStatus = "approved";
+    updatePayload.isActive = true;
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    return;
+  }
+  if (to === "rejected") {
+    updatePayload.approvalStatus = "rejected";
+    updatePayload.rejectionReason = String(opts.rejectionReason ?? "").trim();
+    updatePayload.rejectedAt = /* @__PURE__ */ new Date();
+    updatePayload.rejectedBy = opts.rejectedBy != null && Number.isFinite(opts.rejectedBy) ? opts.rejectedBy : null;
+    const nextActive = "isActive" in updatePayload ? Boolean(updatePayload.isActive) : opts.currentActive;
+    if (nextActive) updatePayload.isActive = false;
+    return;
+  }
+  if (to === "pending") {
+    updatePayload.approvalStatus = "pending";
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    const nextActive = "isActive" in updatePayload ? Boolean(updatePayload.isActive) : opts.currentActive;
+    if (nextActive) updatePayload.isActive = false;
+  }
+}
+chunkUSNT2KNT_cjs.__name(applyEventApprovalStatusSideEffects, "applyEventApprovalStatusSideEffects");
+
 // src/lib/default-vendor-id.ts
 function getDefaultVendorId() {
   const raw = process.env.DEFAULT_VENDOR_ID;
@@ -279,17 +626,20 @@ async function assertCatalogCategoryId(dataSource, categoriesEntity, categoryId,
   const row = await repo.findOne({
     where: {
       id,
-      deleted: false,
-      isCatalog: true
+      deleted: false
     }
   });
   if (!row) {
     return "Invalid catalog category. Choose one of the platform product category types.";
   }
-  return null;
+  if (row.isCatalog === true) return null;
+  if (options?.allowVendorId != null && Number(row.vendorId) === options.allowVendorId && row.isCatalog !== true) {
+    return null;
+  }
+  return "Invalid catalog category. Choose one of the platform product category types.";
 }
 chunkUSNT2KNT_cjs.__name(assertCatalogCategoryId, "assertCatalogCategoryId");
-async function assertVendorOwnedCollectionForProduct(dataSource, collectionsEntity, collectionId, categoryId, vendorId) {
+async function assertCollectionForVendorProduct(dataSource, collectionsEntity, collectionId, categoryId, vendorId, options) {
   const cid = Number(collectionId);
   if (!Number.isFinite(cid) || cid <= 0) return null;
   if (!collectionsEntity) return "Collections are not configured";
@@ -300,11 +650,13 @@ async function assertVendorOwnedCollectionForProduct(dataSource, collectionsEnti
       deleted: false
     }
   });
-  if (!row || row.isCatalog === true) {
-    return "Invalid collection. Choose one of your collections in this category.";
+  if (!row) {
+    return "Invalid collection. Choose a valid collection in this category.";
   }
-  if (Number(row.vendorId) !== vendorId) {
-    return "Invalid collection. Choose one of your collections in this category.";
+  const isCatalog = row.isCatalog === true;
+  const isOwn = Number(row.vendorId) === vendorId && !isCatalog;
+  if (!isCatalog && !(options?.allowVendorOwned && isOwn)) {
+    return "Invalid collection. Choose one of the platform collections (or your own if allowed).";
   }
   const catId = Number(categoryId);
   if (Number.isFinite(catId) && catId > 0 && Number(row.categoryId) !== catId) {
@@ -312,7 +664,7 @@ async function assertVendorOwnedCollectionForProduct(dataSource, collectionsEnti
   }
   return null;
 }
-chunkUSNT2KNT_cjs.__name(assertVendorOwnedCollectionForProduct, "assertVendorOwnedCollectionForProduct");
+chunkUSNT2KNT_cjs.__name(assertCollectionForVendorProduct, "assertCollectionForVendorProduct");
 
 // src/lib/catalog-collection.ts
 function isCatalogCollectionRow(row) {
@@ -326,16 +678,69 @@ function applyPlatformCatalogCollectionFields(persistBody) {
 }
 chunkUSNT2KNT_cjs.__name(applyPlatformCatalogCollectionFields, "applyPlatformCatalogCollectionFields");
 
+// src/lib/catalog-brand.ts
+function isCatalogBrandRow(row) {
+  return row?.isCatalog === true;
+}
+chunkUSNT2KNT_cjs.__name(isCatalogBrandRow, "isCatalogBrandRow");
+function applyPlatformCatalogBrandFields(persistBody) {
+  persistBody.isCatalog = true;
+  delete persistBody.vendorId;
+  persistBody.vendorId = getDefaultVendorId();
+}
+chunkUSNT2KNT_cjs.__name(applyPlatformCatalogBrandFields, "applyPlatformCatalogBrandFields");
+
 // src/api/vendor-scope-crud.ts
+var CATALOG_LIST_RESOURCES = /* @__PURE__ */ new Set([
+  "product_categories",
+  "collections",
+  "brands"
+]);
 function repoHasVendorIdColumn(repo) {
   return repo.metadata.columns.some((c) => c.propertyName === "vendorId");
 }
 chunkUSNT2KNT_cjs.__name(repoHasVendorIdColumn, "repoHasVendorIdColumn");
 function resourceUsesVendorScope(resource) {
-  return resource === "vendors" || chunkWMXPKKXU_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
+  return resource === "vendors" || chunkX6UQFV4X_cjs.VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 chunkUSNT2KNT_cjs.__name(resourceUsesVendorScope, "resourceUsesVendorScope");
-function mergeVendorScopeIntoWhere(where, scope, resource) {
+function mergeWhereClause(where, extra) {
+  if (Array.isArray(where)) {
+    return where.map((w) => ({
+      ...w,
+      ...extra
+    }));
+  }
+  if (where && typeof where === "object" && Object.keys(where).length > 0) {
+    return {
+      ...where,
+      ...extra
+    };
+  }
+  return extra;
+}
+chunkUSNT2KNT_cjs.__name(mergeWhereClause, "mergeWhereClause");
+function mergeCatalogOrOwnWhere(where, vendorId) {
+  const catalog = mergeWhereClause(where, {
+    isCatalog: true
+  });
+  const own = mergeWhereClause(where, {
+    vendorId,
+    isCatalog: false
+  });
+  const catalogArr = Array.isArray(catalog) ? catalog : [
+    catalog
+  ];
+  const ownArr = Array.isArray(own) ? own : [
+    own
+  ];
+  return [
+    ...catalogArr,
+    ...ownArr
+  ];
+}
+chunkUSNT2KNT_cjs.__name(mergeCatalogOrOwnWhere, "mergeCatalogOrOwnWhere");
+function mergeVendorScopeIntoWhere(where, scope, resource, flags) {
   if (scope.type === "all") return where;
   if (scope.type === "deny") {
     if (resource === "vendors") {
@@ -352,38 +757,20 @@ function mergeVendorScopeIntoWhere(where, scope, resource) {
       id: typeorm.In(scope.vendorIds)
     });
   }
-  if (resource === "product_categories" && scope.type === "vendor") {
+  if (CATALOG_LIST_RESOURCES.has(resource) && scope.type === "vendor") {
+    const canCreate = flags ? vendorCanCreateResource(resource, flags) : false;
+    if (canCreate) {
+      return mergeCatalogOrOwnWhere(where, scope.vendorId);
+    }
     return mergeWhereClause(where, {
       isCatalog: true
     });
   }
-  if (resource === "collections" && scope.type === "vendor") {
-    return mergeWhereClause(where, {
-      vendorId: scope.vendorId,
-      isCatalog: false
-    });
-  }
   return mergeWhereClause(where, {
     vendorId: scope.vendorId
   });
 }
 chunkUSNT2KNT_cjs.__name(mergeVendorScopeIntoWhere, "mergeVendorScopeIntoWhere");
-function mergeWhereClause(where, extra) {
-  if (Array.isArray(where)) {
-    return where.map((w) => ({
-      ...w,
-      ...extra
-    }));
-  }
-  if (where && typeof where === "object" && Object.keys(where).length > 0) {
-    return {
-      ...where,
-      ...extra
-    };
-  }
-  return extra;
-}
-chunkUSNT2KNT_cjs.__name(mergeWhereClause, "mergeWhereClause");
 function applyVendorScopeToQueryBuilder(qb, alias, scope) {
   if (scope.type === "all") return;
   if (scope.type === "deny") {
@@ -395,7 +782,7 @@ function applyVendorScopeToQueryBuilder(qb, alias, scope) {
   });
 }
 chunkUSNT2KNT_cjs.__name(applyVendorScopeToQueryBuilder, "applyVendorScopeToQueryBuilder");
-function rowMatchesVendorScope(row, scope, resource) {
+function rowMatchesVendorScope(row, scope, resource, flags) {
   if (!row) return false;
   if (scope.type === "all") return true;
   if (scope.type === "deny") return false;
@@ -403,27 +790,32 @@ function rowMatchesVendorScope(row, scope, resource) {
     const id = Number(row.id);
     return scope.vendorIds.includes(id);
   }
-  if (resource === "product_categories" && scope.type === "vendor") {
-    return isCatalogCategoryRow(row);
-  }
-  if (resource === "collections" && scope.type === "vendor") {
-    return Number(row.vendorId) === scope.vendorId && !isCatalogCollectionRow(row);
+  if (CATALOG_LIST_RESOURCES.has(resource) && scope.type === "vendor") {
+    const isCatalog = resource === "product_categories" ? isCatalogCategoryRow(row) : resource === "collections" ? isCatalogCollectionRow(row) : isCatalogBrandRow(row);
+    if (isCatalog) return true;
+    const canCreate = flags ? vendorCanCreateResource(resource, flags) : false;
+    return canCreate && Number(row.vendorId) === scope.vendorId && !isCatalog;
   }
   return Number(row.vendorId) === scope.vendorId;
 }
 chunkUSNT2KNT_cjs.__name(rowMatchesVendorScope, "rowMatchesVendorScope");
-function vendorCannotMutateCatalogCategories(resource, scope) {
-  return resource === "product_categories" && scope.type === "vendor";
-}
-chunkUSNT2KNT_cjs.__name(vendorCannotMutateCatalogCategories, "vendorCannotMutateCatalogCategories");
-function vendorCannotMutateCatalogCollections(resource, scope, body) {
-  if (resource !== "collections" || scope.type !== "vendor") return false;
+function vendorCannotMutateCatalogResource(resource, scope, flags, body) {
+  if (scope.type !== "vendor" || !CATALOG_LIST_RESOURCES.has(resource)) return false;
+  if (!vendorCanCreateResource(resource, flags)) return true;
   return body?.isCatalog === true;
 }
-chunkUSNT2KNT_cjs.__name(vendorCannotMutateCatalogCollections, "vendorCannotMutateCatalogCollections");
-function vendorScopeRowAccess(row, scope, resource) {
+chunkUSNT2KNT_cjs.__name(vendorCannotMutateCatalogResource, "vendorCannotMutateCatalogResource");
+function vendorCannotMutateExistingCatalogRow(resource, scope, row) {
+  if (scope.type !== "vendor" || !CATALOG_LIST_RESOURCES.has(resource) || !row) return false;
+  if (resource === "product_categories") return isCatalogCategoryRow(row);
+  if (resource === "collections") return isCatalogCollectionRow(row);
+  if (resource === "brands") return isCatalogBrandRow(row);
+  return false;
+}
+chunkUSNT2KNT_cjs.__name(vendorCannotMutateExistingCatalogRow, "vendorCannotMutateExistingCatalogRow");
+function vendorScopeRowAccess(row, scope, resource, flags) {
   if (!row) return "not_found";
-  if (rowMatchesVendorScope(row, scope, resource)) return "ok";
+  if (rowMatchesVendorScope(row, scope, resource, flags)) return "ok";
   return scope.type === "vendor" ? "forbidden" : "not_found";
 }
 chunkUSNT2KNT_cjs.__name(vendorScopeRowAccess, "vendorScopeRowAccess");
@@ -455,14 +847,7 @@ function requireVendorIdForScopedCreate(resource, persistBody, scope, repo, cont
       ok: true
     };
   }
-  if (resource === "collections" && persistBody.isCatalog === true) {
-    delete persistBody.vendorId;
-    persistBody.vendorId = getDefaultVendorId();
-    return {
-      ok: true
-    };
-  }
-  if (resource === "product_categories" && persistBody.isCatalog === true) {
+  if ((resource === "collections" || resource === "product_categories" || resource === "brands") && persistBody.isCatalog === true) {
     delete persistBody.vendorId;
     persistBody.vendorId = getDefaultVendorId();
     return {
@@ -474,7 +859,7 @@ function requireVendorIdForScopedCreate(resource, persistBody, scope, repo, cont
   };
   enforceVendorIdOnCreateBody(persistBody, scope, repo);
   if (scope.type === "vendor") {
-    if (resource === "collections") {
+    if (resource === "collections" || resource === "product_categories" || resource === "brands") {
       persistBody.isCatalog = false;
     }
     return {
@@ -3421,6 +3806,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         const scope = await resolveScope();
         const repo2 = dataSource.getRepository(entity);
         const statusFilter = searchParams.get("status")?.trim();
+        const approvalStatusFilter = searchParams.get("approvalStatus")?.trim();
         const inventory = searchParams.get("inventory")?.trim();
         let productWhere = {
           deleted: false,
@@ -3428,6 +3814,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         };
         productWhere = mergeVendorScopeIntoWhere(productWhere, scope, resource);
         if (statusFilter) productWhere.status = statusFilter;
+        if (approvalStatusFilter) productWhere.approvalStatus = approvalStatusFilter;
         if (inventory === "in_stock") productWhere.quantity = typeorm.MoreThan(0);
         if (inventory === "out_of_stock") productWhere.quantity = 0;
         for (const key of [
@@ -3728,6 +4115,7 @@ function createCrudHandler(dataSource, entityMap, options) {
       where = mergeDeletedFalseWhere(repo, where);
       if (resourceUsesVendorScope(resource)) {
         const scope = await resolveScope();
+        const catalogFlags = await getVendorCatalogCreateFlags(dataSource);
         if (scope.type === "deny") {
           where = resource === "vendors" ? {
             id: -1
@@ -3736,7 +4124,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           };
         } else if (resource === "collections") {
           if (scope.type === "vendor") {
-            where = mergeVendorScopeIntoWhere(where, scope, resource);
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
           } else if (searchParams.get("isCatalog") !== "true") {
             where = mergeListWhereAnd(where, {
               isCatalog: false
@@ -3744,14 +4132,22 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
         } else if (resource === "product_categories") {
           if (scope.type === "vendor") {
-            where = mergeVendorScopeIntoWhere(where, scope, resource);
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
+          } else if (searchParams.get("isCatalog") !== "false") {
+            where = mergeListWhereAnd(where, {
+              isCatalog: true
+            });
+          }
+        } else if (resource === "brands") {
+          if (scope.type === "vendor") {
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
           } else if (searchParams.get("isCatalog") !== "false") {
             where = mergeListWhereAnd(where, {
               isCatalog: true
             });
           }
         } else {
-          where = mergeVendorScopeIntoWhere(where, scope, resource);
+          where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
         }
       }
       let data;
@@ -3821,16 +4217,11 @@ function createCrudHandler(dataSource, entityMap, options) {
         });
       }
       const body = rawPostBody;
-      if (vendorCannotMutateCatalogCategories(resource, scopePost)) {
+      const catalogFlagsPost = await getVendorCatalogCreateFlags(dataSource);
+      if (vendorCannotMutateCatalogResource(resource, scopePost, catalogFlagsPost, body)) {
+        const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : resource === "brands" ? "Brands" : "This resource";
         return json({
-          error: "Categories are managed by the platform administrator"
-        }, {
-          status: 403
-        });
-      }
-      if (vendorCannotMutateCatalogCollections(resource, scopePost, body)) {
-        return json({
-          error: "Collections are managed by the platform administrator"
+          error: `${label} are managed by the platform administrator`
         }, {
           status: 403
         });
@@ -4215,8 +4606,15 @@ function createCrudHandler(dataSource, entityMap, options) {
       }
       if (resource === "products") {
         const scopeForProduct = await resolveScope();
+        const productFlags = await getVendorCatalogCreateFlags(dataSource);
+        const requireApproval = await getRequireProductApproval(dataSource);
+        applyVendorProductCreateApproval(persistBody, {
+          isVendor: scopeForProduct.type === "vendor",
+          requireApproval
+        });
         const categoryErr = await assertCatalogCategoryId(dataSource, entityMap.product_categories, persistBody.categoryId, {
-          required: scopeForProduct.type === "vendor"
+          required: scopeForProduct.type === "vendor",
+          allowVendorId: scopeForProduct.type === "vendor" && productFlags.categories ? scopeForProduct.vendorId : void 0
         });
         if (categoryErr) return json({
           error: categoryErr
@@ -4225,7 +4623,9 @@ function createCrudHandler(dataSource, entityMap, options) {
         });
         if (scopeForProduct.type === "vendor") {
           if (entityMap.collections && persistBody.collectionId != null && persistBody.collectionId !== "") {
-            const collectionErr = await assertVendorOwnedCollectionForProduct(dataSource, entityMap.collections, persistBody.collectionId, persistBody.categoryId, scopeForProduct.vendorId);
+            const collectionErr = await assertCollectionForVendorProduct(dataSource, entityMap.collections, persistBody.collectionId, persistBody.categoryId, scopeForProduct.vendorId, {
+              allowVendorOwned: productFlags.collections
+            });
             if (collectionErr) return json({
               error: collectionErr
             }, {
@@ -4234,6 +4634,14 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
         }
       }
+      if (resource === "events") {
+        const scopeForEvent = await resolveScope();
+        const requireEventApproval = await getRequireEventApproval(dataSource);
+        applyVendorEventCreateApproval(persistBody, {
+          isVendor: scopeForEvent.type === "vendor",
+          requireApproval: requireEventApproval
+        });
+      }
       if (resource === "collections" && scopePost.type === "vendor") {
         const categoryErr = await assertCatalogCategoryId(dataSource, entityMap.product_categories, persistBody.categoryId, {
           required: true
@@ -4438,7 +4846,27 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
         }
       }
-      if (!((resource === "collections" || resource === "product_categories") && persistBody.isCatalog === true)) {
+      if (resource === "brands" && scopeCreate.type === "all") {
+        applyPlatformCatalogBrandFields(persistBody);
+        const slug = String(persistBody.slug ?? "").trim();
+        if (slug) {
+          const dup = await repo.findOne({
+            where: {
+              slug,
+              isCatalog: true,
+              deleted: false
+            }
+          });
+          if (dup) {
+            return json({
+              error: "A catalog brand with this slug already exists"
+            }, {
+              status: 400
+            });
+          }
+        }
+      }
+      if (!((resource === "collections" || resource === "product_categories" || resource === "brands") && persistBody.isCatalog === true)) {
         await tryAssignSingleVendorOnAdminCreate(resource, scopeCreate, persistBody);
       }
       const vendorIdCheck = requireVendorIdForScopedCreate(resource, persistBody, scopeCreate, repo, await vendorCreateContext(body));
@@ -4918,13 +5346,14 @@ function createCrudHandler(dataSource, entityMap, options) {
 }
 chunkUSNT2KNT_cjs.__name(createCrudHandler, "createCrudHandler");
 function createCrudByIdHandler(dataSource, entityMap, options) {
-  const { requireAuth, json, requireEntityPermission: reqPerm, getCms, getDeletedByUserId, getVendorScope } = options;
+  const { requireAuth, json, requireEntityPermission: reqPerm, getCms, getDeletedByUserId, getVendorScope, getHydratedSessionUser } = options;
   const syncContactRowToErp = makeContactErpSync(dataSource, entityMap, getCms);
   const resolveScopeById = getVendorScope ?? (async () => ({
     type: "all"
   }));
-  function vendorScopeAccessJson(row, scope, resource) {
-    const access = vendorScopeRowAccess(row, scope, resource);
+  async function vendorScopeAccessJson(row, scope, resource) {
+    const flags = await getVendorCatalogCreateFlags(dataSource);
+    const access = vendorScopeRowAccess(row, scope, resource, flags);
     if (access === "ok") return null;
     if (access === "forbidden") return json({
       error: "Forbidden"
@@ -5004,7 +5433,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "rules"
           ]
         });
-        const discountDenied = vendorScopeAccessJson(discount, scope2, resource);
+        const discountDenied = await vendorScopeAccessJson(discount, scope2, resource);
         if (discountDenied) return discountDenied;
         const flatRules = discount.rules ?? [];
         const nestedRules = nestDiscountRules2(flatRules);
@@ -5062,7 +5491,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "payments"
           ]
         });
-        const orderDenied = vendorScopeAccessJson(order, scope2, resource);
+        const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
         if (orderDenied) return orderDenied;
         const relatedOrders = await repo.find({
           where: {
@@ -5126,7 +5555,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "contact"
           ]
         });
-        const paymentDenied = vendorScopeAccessJson(payment, scope2, resource);
+        const paymentDenied = await vendorScopeAccessJson(payment, scope2, resource);
         if (paymentDenied) return paymentDenied;
         const p = payment;
         const order = p.order;
@@ -5165,7 +5594,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "attributes.attribute"
           ]
         });
-        const productDenied = vendorScopeAccessJson(product, scope2, resource);
+        const productDenied = await vendorScopeAccessJson(product, scope2, resource);
         if (productDenied) return productDenied;
         return product ? json(hydrateProductDisplayName(product)) : json({
           message: "Not found"
@@ -5183,7 +5612,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "contact"
           ]
         });
-        const vcDenied = vendorScopeAccessJson(row, scope2, resource);
+        const vcDenied = await vendorScopeAccessJson(row, scope2, resource);
         if (vcDenied) return vcDenied;
         const contact = row.contact;
         return json({
@@ -5206,7 +5635,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product"
           ]
         });
-        const comboDenied = vendorScopeAccessJson(combo, scope2, resource);
+        const comboDenied = await vendorScopeAccessJson(combo, scope2, resource);
         if (comboDenied) return comboDenied;
         return combo ? json(combo) : json({
           message: "Not found"
@@ -5243,7 +5672,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         where: idWhere
       });
       if (resourceUsesVendorScope(resource)) {
-        const itemDenied = vendorScopeAccessJson(item, scope, resource);
+        const itemDenied = await vendorScopeAccessJson(item, scope, resource);
         if (itemDenied) return itemDenied;
       } else if (!item) {
         return json({
@@ -5272,16 +5701,11 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       const rawBody = await req.json();
       const scopePutEarly = await resolveScopeById();
-      if (vendorCannotMutateCatalogCategories(resource, scopePutEarly)) {
+      const catalogFlagsPut = await getVendorCatalogCreateFlags(dataSource);
+      if (vendorCannotMutateCatalogResource(resource, scopePutEarly, catalogFlagsPut, rawBody ?? void 0)) {
+        const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : resource === "brands" ? "Brands" : "This resource";
         return json({
-          error: "Categories are managed by the platform administrator"
-        }, {
-          status: 403
-        });
-      }
-      if (vendorCannotMutateCatalogCollections(resource, scopePutEarly, rawBody ?? void 0)) {
-        return json({
-          error: "Collections are managed by the platform administrator"
+          error: `${label} are managed by the platform administrator`
         }, {
           status: 403
         });
@@ -5647,7 +6071,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             id: numericId
           }
         });
-        const discountPutDenied = vendorScopeAccessJson(existing, scopePut2, resource);
+        const discountPutDenied = await vendorScopeAccessJson(existing, scopePut2, resource);
         if (discountPutDenied) return discountPutDenied;
         const updatePayload2 = pickColumnUpdates(repo, rawBody);
         delete updatePayload2.vendorId;
@@ -5705,8 +6129,16 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         const existingScope = await repo.findOne({
           where: idWhereCheck
         });
-        const scopePutDenied = vendorScopeAccessJson(existingScope, scopePut, resource);
+        const scopePutDenied = await vendorScopeAccessJson(existingScope, scopePut, resource);
         if (scopePutDenied) return scopePutDenied;
+        if (vendorCannotMutateExistingCatalogRow(resource, scopePut, existingScope)) {
+          const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : "Brands";
+          return json({
+            error: `${label} are managed by the platform administrator`
+          }, {
+            status: 403
+          });
+        }
       }
       const updatePayload = rawBody && typeof rawBody === "object" ? pickColumnUpdates(repo, rawBody) : {};
       if (resourceUsesVendorScope(resource)) {
@@ -5853,7 +6285,8 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         });
         const mergedCategoryId = "categoryId" in updatePayload ? updatePayload.categoryId : currentRow.categoryId;
         const categoryErr = await assertCatalogCategoryId(dataSource, entityMap.product_categories, "categoryId" in updatePayload ? updatePayload.categoryId : mergedCategoryId, {
-          required: scopePut.type === "vendor"
+          required: scopePut.type === "vendor",
+          allowVendorId: scopePut.type === "vendor" && catalogFlagsPut.categories ? scopePut.vendorId : void 0
         });
         if (categoryErr) return json({
           error: categoryErr
@@ -5862,7 +6295,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         });
         if (scopePut.type === "vendor") {
           if (entityMap.collections && "collectionId" in updatePayload && updatePayload.collectionId != null) {
-            const collectionErr = await assertVendorOwnedCollectionForProduct(dataSource, entityMap.collections, updatePayload.collectionId, mergedCategoryId, scopePut.vendorId);
+            const collectionErr = await assertCollectionForVendorProduct(dataSource, entityMap.collections, updatePayload.collectionId, mergedCategoryId, scopePut.vendorId, {
+              allowVendorOwned: catalogFlagsPut.collections
+            });
             if (collectionErr) return json({
               error: collectionErr
             }, {
@@ -5870,6 +6305,88 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             });
           }
         }
+        if ("status" in updatePayload || "approvalStatus" in updatePayload || "rejectionReason" in updatePayload) {
+          const fromStatus = String(currentRow.status ?? "draft");
+          const toStatus = String("status" in updatePayload ? updatePayload.status ?? fromStatus : fromStatus);
+          const fromApproval = currentRow.approvalStatus;
+          const toApproval = "approvalStatus" in updatePayload ? updatePayload.approvalStatus : fromApproval;
+          const requireApproval = await getRequireProductApproval(dataSource);
+          const reasonFromBody = "rejectionReason" in updatePayload ? updatePayload.rejectionReason : currentRow.rejectionReason;
+          const reasonStr = typeof reasonFromBody === "string" ? reasonFromBody : reasonFromBody == null ? null : String(reasonFromBody);
+          const transition = assertProductApprovalUpdate({
+            fromApproval,
+            toApproval,
+            fromStatus,
+            toStatus,
+            isVendor: scopePut.type === "vendor",
+            requireApproval,
+            approvalChanged: "approvalStatus" in updatePayload,
+            statusChanged: "status" in updatePayload,
+            rejectionReason: reasonStr
+          });
+          if (!transition.ok) return json({
+            error: transition.error
+          }, {
+            status: 400
+          });
+          if ("approvalStatus" in updatePayload && scopePut.type !== "vendor") {
+            const session = await getHydratedSessionUser?.() ?? null;
+            const rejectedByRaw = session?.id != null ? Number(session.id) : null;
+            applyApprovalStatusSideEffects(updatePayload, {
+              toApproval,
+              currentStatus: fromStatus,
+              rejectionReason: reasonStr,
+              rejectedBy: Number.isFinite(rejectedByRaw) ? rejectedByRaw : null
+            });
+          }
+        }
+      }
+      if (resource === "events") {
+        const currentEvent = await repo.findOne({
+          where: {
+            id: numericId,
+            deleted: false
+          }
+        });
+        if (!currentEvent) return json({
+          message: "Not found"
+        }, {
+          status: 404
+        });
+        if ("isActive" in updatePayload || "approvalStatus" in updatePayload || "rejectionReason" in updatePayload) {
+          const fromActive = Boolean(currentEvent.isActive);
+          const toActive = "isActive" in updatePayload ? Boolean(updatePayload.isActive) : fromActive;
+          const fromApproval = currentEvent.approvalStatus;
+          const toApproval = "approvalStatus" in updatePayload ? updatePayload.approvalStatus : fromApproval;
+          const requireEventApproval = await getRequireEventApproval(dataSource);
+          const reasonFromBody = "rejectionReason" in updatePayload ? updatePayload.rejectionReason : currentEvent.rejectionReason;
+          const reasonStr = typeof reasonFromBody === "string" ? reasonFromBody : reasonFromBody == null ? null : String(reasonFromBody);
+          const transition = assertEventApprovalUpdate({
+            fromApproval,
+            toApproval,
+            toActive,
+            isVendor: scopePut.type === "vendor",
+            requireApproval: requireEventApproval,
+            approvalChanged: "approvalStatus" in updatePayload,
+            activeChanged: "isActive" in updatePayload,
+            rejectionReason: reasonStr
+          });
+          if (!transition.ok) return json({
+            error: transition.error
+          }, {
+            status: 400
+          });
+          if ("approvalStatus" in updatePayload && scopePut.type !== "vendor") {
+            const session = await getHydratedSessionUser?.() ?? null;
+            const rejectedByRaw = session?.id != null ? Number(session.id) : null;
+            applyEventApprovalStatusSideEffects(updatePayload, {
+              toApproval,
+              currentActive: fromActive,
+              rejectionReason: reasonStr,
+              rejectedBy: Number.isFinite(rejectedByRaw) ? rejectedByRaw : null
+            });
+          }
+        }
       }
       if (resource === "product_categories" && scopePut.type === "all") {
         const existingCatalogCat = await repo.findOne({
@@ -5927,6 +6444,34 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
       }
+      if (resource === "brands" && scopePut.type === "all") {
+        const existingCatalogBrand = await repo.findOne({
+          where: {
+            id: numericId,
+            deleted: false
+          }
+        });
+        if (existingCatalogBrand && existingCatalogBrand.isCatalog === true) {
+          applyPlatformCatalogBrandFields(updatePayload);
+          const slug = String(updatePayload.slug ?? existingCatalogBrand.slug ?? "").trim();
+          if (slug && "slug" in updatePayload) {
+            const dup = await repo.findOne({
+              where: {
+                slug,
+                isCatalog: true,
+                deleted: false
+              }
+            });
+            if (dup && Number(dup.id) !== numericId) {
+              return json({
+                error: "A catalog brand with this slug already exists"
+              }, {
+                status: 400
+              });
+            }
+          }
+        }
+      }
       if (resource === "addresses" && Object.keys(updatePayload).length > 0) {
         const currentRow = await repo.findOne({
           where: {
@@ -6082,9 +6627,11 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       const authError = await authz(req, resource, "delete");
       if (authError) return authError;
       const scopeDeleteEarly = await resolveScopeById();
-      if (vendorCannotMutateCatalogCategories(resource, scopeDeleteEarly)) {
+      const catalogFlagsDelete = await getVendorCatalogCreateFlags(dataSource);
+      if (vendorCannotMutateCatalogResource(resource, scopeDeleteEarly, catalogFlagsDelete)) {
+        const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : resource === "brands" ? "Brands" : "This resource";
         return json({
-          error: "Categories are managed by the platform administrator"
+          error: `${label} are managed by the platform administrator`
         }, {
           status: 403
         });
@@ -6113,7 +6660,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         });
         if (resourceUsesVendorScope(resource)) {
-          const deleteDenied = vendorScopeAccessJson(existing, scopeDelete, resource);
+          const deleteDenied = await vendorScopeAccessJson(existing, scopeDelete, resource);
           if (deleteDenied) return deleteDenied;
         } else if (!existing) {
           return json({
@@ -6171,7 +6718,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             id: numericId
           }
         });
-        const hardDeleteDenied = vendorScopeAccessJson(existingHard, scopeDelete, resource);
+        const hardDeleteDenied = await vendorScopeAccessJson(existingHard, scopeDelete, resource);
         if (hardDeleteDenied) return hardDeleteDenied;
       }
       const result = await repo.delete(numericId);
@@ -7649,7 +8196,7 @@ function createVendorDashboardHandler(config) {
       if (pe) return pe;
     }
     const user = await getSessionUser();
-    if (!user || !chunkWMXPKKXU_cjs.isVendorPortalUser(user)) {
+    if (!user || !chunkX6UQFV4X_cjs.isVendorPortalUser(user)) {
       return json({
         error: "Forbidden"
       }, {
@@ -11468,7 +12015,7 @@ chunkUSNT2KNT_cjs.__name(findActiveRefundPolicyForVendor, "findActiveRefundPolic
 // src/api/admin-roles-handlers.ts
 function createAdminRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
-  const baseEntities = chunkWMXPKKXU_cjs.getPermissionableEntityKeys(entityMap);
+  const baseEntities = chunkX6UQFV4X_cjs.getPermissionableEntityKeys(entityMap);
   const allowEntities = /* @__PURE__ */ new Set([
     ...baseEntities,
     "users"
@@ -11483,7 +12030,7 @@ function createAdminRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkOIGCAGH7_cjs.canManageRoles(u) && !chunkWMXPKKXU_cjs.canManageVendorRoles(u)) {
+    if (!chunkZMRQ72F6_cjs.canManageRoles(u) && !chunkX6UQFV4X_cjs.canManageVendorRoles(u)) {
       return json({
         error: "Forbidden"
       }, {
@@ -11494,11 +12041,11 @@ function createAdminRolesHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gate, "gate");
   function isVendorRolesOnly(u) {
-    return chunkWMXPKKXU_cjs.canManageVendorRoles(u) && !chunkOIGCAGH7_cjs.canManageRoles(u);
+    return chunkX6UQFV4X_cjs.canManageVendorRoles(u) && !chunkZMRQ72F6_cjs.canManageRoles(u);
   }
   chunkUSNT2KNT_cjs.__name(isVendorRolesOnly, "isVendorRolesOnly");
   const vendorRoleEntities = [
-    ...chunkWMXPKKXU_cjs.VENDOR_STORE_RBAC_ENTITIES,
+    ...chunkX6UQFV4X_cjs.VENDOR_STORE_RBAC_ENTITIES,
     "dashboard",
     "settings"
   ].sort();
@@ -11655,7 +12202,7 @@ function createAdminRolesHandlers(config) {
         }, {
           status: 404
         });
-        if (chunkWMXPKKXU_cjs.isSuperAdminGroupName(g.name) && !chunkWMXPKKXU_cjs.isSuperAdminGroupName(name)) {
+        if (chunkX6UQFV4X_cjs.isSuperAdminGroupName(g.name) && !chunkX6UQFV4X_cjs.isSuperAdminGroupName(name)) {
           return json({
             error: "Cannot rename the administrator group"
           }, {
@@ -11712,7 +12259,7 @@ function createAdminRolesHandlers(config) {
       }, {
         status: 404
       });
-      if (chunkWMXPKKXU_cjs.isSuperAdminGroupName(g.name)) return json({
+      if (chunkX6UQFV4X_cjs.isSuperAdminGroupName(g.name)) return json({
         error: "Cannot delete the administrator group"
       }, {
         status: 400
@@ -11880,7 +12427,7 @@ chunkUSNT2KNT_cjs.__name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
 async function insertRolePermissions(exec, vendorRoleId, permissions) {
-  for (const entity of chunkWMXPKKXU_cjs.VENDOR_RBAC_ENTITIES) {
+  for (const entity of chunkX6UQFV4X_cjs.VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
     await exec.query(`
@@ -11911,7 +12458,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     for (const r of existing) {
       roleIdsByName2[r.name] = Number(r.id);
       if (r.isOwnerRole) ownerRoleId2 = Number(r.id);
-      if (r.name === chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
+      if (r.name === chunkX6UQFV4X_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId2 = Number(r.id);
     }
     return {
       roleIdsByName: roleIdsByName2,
@@ -11922,7 +12469,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
   const roleIdsByName = {};
   let ownerRoleId = 0;
   let viewerRoleId = 0;
-  for (const def of chunkWMXPKKXU_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
+  for (const def of chunkX6UQFV4X_cjs.DEFAULT_VENDOR_ROLE_DEFS) {
     const inserted = await exec.query(`
       INSERT INTO "vendor_roles"
         ("vendorId", "name", "description", "isSystem", "isOwnerRole")
@@ -11939,7 +12486,7 @@ async function seedVendorDefaultRoles(em, vendorId) {
     if (!roleId) continue;
     roleIdsByName[def.name] = roleId;
     if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
+    if (def.name === chunkX6UQFV4X_cjs.VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
     await insertRolePermissions(exec, roleId, def.permissions);
   }
   return {
@@ -11960,7 +12507,7 @@ async function backfillVendorUserRoleIds(em, vendorId, seeded) {
       vendorId
     ]);
   }
-  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME];
+  const viewerId = seeded.viewerRoleId || seeded.roleIdsByName[chunkX6UQFV4X_cjs.VENDOR_VIEWER_ROLE_NAME];
   if (viewerId) {
     await em.query(`
       UPDATE "vendor_users"
@@ -11986,7 +12533,7 @@ async function getDefaultStaffRoleIdForVendor(em, vendorId) {
     LIMIT 1
     `, [
     vendorId,
-    chunkWMXPKKXU_cjs.VENDOR_VIEWER_ROLE_NAME
+    chunkX6UQFV4X_cjs.VENDOR_VIEWER_ROLE_NAME
   ]);
   const id = rows[0]?.id;
   return id != null ? Number(id) : null;
@@ -12162,7 +12709,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkWMXPKKXU_cjs.isPlatformAdministrator(u)) return json({
+    if (!chunkX6UQFV4X_cjs.isPlatformAdministrator(u)) return json({
       error: "Forbidden",
       reason: "admin_only"
     }, {
@@ -12172,7 +12719,7 @@ function createVendorOnboardHandlers(config) {
   }
   chunkUSNT2KNT_cjs.__name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
-    const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -12188,7 +12735,7 @@ function createVendorOnboardHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkWMXPKKXU_cjs.canManageVendorTeam(u)) return json({
+    if (!chunkX6UQFV4X_cjs.canManageVendorTeam(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -12266,6 +12813,13 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
+        if (body.activation === "password" || body.user?.password) {
+          return json({
+            error: "Setting a password during vendor onboard is no longer supported. Create the vendor, then send an invite or copy the invite link so the owner can set their own password."
+          }, {
+            status: 400
+          });
+        }
         const profile = parseVendorProfileFromBody(body.vendor, {
           defaultRegistrationStatus: "approved"
         });
@@ -12275,34 +12829,8 @@ function createVendorOnboardHandlers(config) {
         }, {
           status: 400
         });
-        const activation = body.activation === "password" ? "password" : "invite";
-        const sendOwnerEmail = body.sendOwnerEmail !== false && body.sendInviteEmail !== false;
-        let ownerPasswordHash = null;
-        if (activation === "password") {
-          const plain = body.user?.password?.trim();
-          if (!plain) {
-            return json({
-              error: "Password is required when activating with a set password"
-            }, {
-              status: 400
-            });
-          }
-          if (plain.length < minPasswordLength) {
-            return json({
-              error: `Password must be at least ${minPasswordLength} characters`
-            }, {
-              status: 400
-            });
-          }
-          if (!hashPassword) {
-            return json({
-              error: "Password hashing is not configured on the server"
-            }, {
-              status: 501
-            });
-          }
-          ownerPasswordHash = await hashPassword(plain);
-        }
+        const activation = "invite";
+        const ownerPasswordHash = null;
         const slug = trimOrNull(body.vendor?.slug) || slugify(vendorName);
         if (!slug) return json({
           error: "Could not derive vendor slug"
@@ -12323,19 +12851,19 @@ function createVendorOnboardHandlers(config) {
           if (dupVendor) throw new Error("VENDOR_SLUG_EXISTS");
           let ownerGroup = await groupRepo.findOne({
             where: {
-              name: chunkWMXPKKXU_cjs.VENDOR_OWNER_GROUP_NAME,
+              name: chunkX6UQFV4X_cjs.VENDOR_OWNER_GROUP_NAME,
               deleted: false
             }
           });
           if (!ownerGroup) {
             try {
               await groupRepo.save(groupRepo.create({
-                name: chunkWMXPKKXU_cjs.VENDOR_OWNER_GROUP_NAME,
+                name: chunkX6UQFV4X_cjs.VENDOR_OWNER_GROUP_NAME,
                 deleted: false
               }));
               ownerGroup = await groupRepo.findOne({
                 where: {
-                  name: chunkWMXPKKXU_cjs.VENDOR_OWNER_GROUP_NAME,
+                  name: chunkX6UQFV4X_cjs.VENDOR_OWNER_GROUP_NAME,
                   deleted: false
                 }
               });
@@ -12359,7 +12887,7 @@ function createVendorOnboardHandlers(config) {
               email: userEmail,
               phone: ownerPhone,
               password: ownerPasswordHash,
-              blocked: activation === "invite",
+              blocked: true,
               groupId: ownerGroup.id,
               adminAccess: true,
               updatedAt: /* @__PURE__ */ new Date()
@@ -12376,15 +12904,14 @@ function createVendorOnboardHandlers(config) {
             email: userEmail,
             phone: ownerPhone,
             password: ownerPasswordHash,
-            blocked: activation === "invite",
+            blocked: true,
             groupId: ownerGroup.id,
             adminAccess: true
           }));
-          const baseMetadata = buildVendorMetadata(null, {
+          const metadata = applyRotatingVendorInvite(buildVendorMetadata(null, {
             ownerDesignation,
             termsAccepted: true
-          });
-          const metadata = activation === "invite" ? applyRotatingVendorInvite(baseMetadata) : baseMetadata;
+          }));
           const vendor = await vendorRepo.save(vendorRepo.create({
             name: vendorName,
             slug,
@@ -12452,39 +12979,14 @@ function createVendorOnboardHandlers(config) {
           };
         });
         let inviteLink;
-        let emailSent = false;
-        if (activation === "invite") {
-          const token = readVendorInviteToken(result.vendor.metadata);
-          if (token) {
-            inviteLink = buildVendorInviteLink(baseUrl, token);
-          }
-        }
-        if (sendOwnerEmail) {
-          emailSent = await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: true
-          });
-        } else if (getCms) {
-          await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: false
-          });
+        const token = readVendorInviteToken(result.vendor.metadata);
+        if (token) {
+          inviteLink = buildVendorInviteLink(baseUrl, token);
         }
-        const message = activation === "password" ? emailSent ? "Vendor onboarded successfully. Welcome email sent to the owner." : sendOwnerEmail ? "Vendor onboarded successfully. Owner can sign in with the password you set (welcome email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Owner can sign in with the password you set." : emailSent ? "Vendor onboarded successfully. Invite email sent." : sendOwnerEmail ? "Vendor onboarded successfully. Invite link created (email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Share the invite link with the owner.";
         return json({
-          message,
+          message: "Vendor created successfully.",
           activation,
-          emailSent,
+          emailSent: false,
           vendor: result.vendor,
           user: {
             id: result.user.id,
@@ -12519,9 +13021,11 @@ function createVendorOnboardHandlers(config) {
         });
       }
       let sendEmail = true;
+      let rotate = true;
       try {
         const body = await req.json().catch(() => ({}));
         if (body.sendEmail === false) sendEmail = false;
+        if (body.rotate === false) rotate = false;
       } catch {
       }
       try {
@@ -12587,12 +13091,16 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
-        const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
-        await vendorRepo.update(vendorId, {
-          metadata: rotatedMetadata,
-          inviteStatus: "pending"
-        });
-        const token = readVendorInviteToken(rotatedMetadata);
+        const nextMetadata = rotate ? applyRotatingVendorInvite(v.metadata) : {
+          ...v.metadata ?? {}
+        };
+        if (rotate || v.inviteStatus !== "pending") {
+          await vendorRepo.update(vendorId, {
+            metadata: nextMetadata,
+            inviteStatus: "pending"
+          });
+        }
+        const token = readVendorInviteToken(nextMetadata);
         if (!token) {
           return json({
             error: "Failed to generate invite token"
@@ -12613,8 +13121,9 @@ function createVendorOnboardHandlers(config) {
             sendToOwner: true
           });
         }
+        const rotatedNote = rotate ? " Previous invite link is no longer valid." : "";
         return json({
-          message: emailSent ? "Invite resent. Previous invite link is no longer valid." : sendEmail ? "New invite link created (email may not have been sent \u2014 check email plugin). Previous link is invalid." : "New invite link created. Previous invite link is no longer valid.",
+          message: emailSent ? `Invite email sent.${rotatedNote}` : sendEmail ? `Invite link ready (email may not have been sent \u2014 check email plugin).${rotatedNote}` : rotate ? "New invite link created. Previous invite link is no longer valid." : "Invite link ready.",
           emailSent,
           inviteLink,
           inviteStatus: "pending"
@@ -12814,7 +13323,7 @@ function createVendorOnboardHandlers(config) {
           if (!groupId) {
             const g = await groupRepo.findOne({
               where: {
-                name: chunkWMXPKKXU_cjs.VENDOR_OWNER_GROUP_NAME,
+                name: chunkX6UQFV4X_cjs.VENDOR_OWNER_GROUP_NAME,
                 deleted: false
               }
             });
@@ -13124,10 +13633,10 @@ chunkUSNT2KNT_cjs.__name(createVendorOnboardHandlers, "createVendorOnboardHandle
 function createVendorRolesHandlers(config) {
   const { dataSource, entityMap, json, getSessionUser } = config;
   const vendorRoleEntities = [
-    ...chunkWMXPKKXU_cjs.VENDOR_RBAC_ENTITIES
+    ...chunkX6UQFV4X_cjs.VENDOR_RBAC_ENTITIES
   ].sort();
   async function resolveActiveVendorId(u) {
-    const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u);
+    const scope = chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser(u);
     if (scope.type === "vendor") return scope.vendorId;
     if (scope.type === "all") {
       const id = u.activeVendorId ?? u.vendorIds?.[0];
@@ -13143,7 +13652,7 @@ function createVendorRolesHandlers(config) {
     }, {
       status: 401
     });
-    if (!chunkWMXPKKXU_cjs.canManageVendorRoles(u)) return json({
+    if (!chunkX6UQFV4X_cjs.canManageVendorRoles(u)) return json({
       error: "Forbidden"
     }, {
       status: 403
@@ -17082,6 +17591,7 @@ exports.Brand = class Brand {
     chunkUSNT2KNT_cjs.__name(this, "Brand");
   }
   id;
+  /** Null for platform catalog brands (`isCatalog`). */
   vendorId;
   name;
   slug;
@@ -17089,6 +17599,8 @@ exports.Brand = class Brand {
   metadata;
   description;
   active;
+  /** Platform-wide catalog brand — vendors pick these on products unless allowed to create their own. */
+  isCatalog;
   sortOrder;
   createdAt;
   updatedAt;
@@ -17108,8 +17620,10 @@ _ts_decorate30([
   _ts_metadata30("design:type", Number)
 ], exports.Brand.prototype, "id", void 0);
 _ts_decorate30([
-  typeorm.Column("int"),
-  _ts_metadata30("design:type", Number)
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata30("design:type", Object)
 ], exports.Brand.prototype, "vendorId", void 0);
 _ts_decorate30([
   typeorm.Column("varchar"),
@@ -17143,6 +17657,12 @@ _ts_decorate30([
   }),
   _ts_metadata30("design:type", Boolean)
 ], exports.Brand.prototype, "active", void 0);
+_ts_decorate30([
+  typeorm.Column("boolean", {
+    default: false
+  }),
+  _ts_metadata30("design:type", Boolean)
+], exports.Brand.prototype, "isCatalog", void 0);
 _ts_decorate30([
   typeorm.Column("int", {
     default: 0
@@ -17202,12 +17722,13 @@ _ts_decorate30([
 ], exports.Brand.prototype, "seoId", void 0);
 _ts_decorate30([
   typeorm.ManyToOne(() => exports.Vendor, {
-    onDelete: "RESTRICT"
+    onDelete: "RESTRICT",
+    nullable: true
   }),
   typeorm.JoinColumn({
     name: "vendorId"
   }),
-  _ts_metadata30("design:type", typeof exports.Vendor === "undefined" ? Object : exports.Vendor)
+  _ts_metadata30("design:type", Object)
 ], exports.Brand.prototype, "vendor", void 0);
 _ts_decorate30([
   typeorm.ManyToOne(() => exports.Seo, {
@@ -17491,6 +18012,14 @@ exports.Product = class Product {
   currencyPrices;
   quantity;
   status;
+  /**
+  * Separate from catalog status. Used when multi_vendor.requireProductApproval is on.
+  * `approved` also forces `status = available` (live).
+  */
+  approvalStatus;
+  rejectionReason;
+  rejectedAt;
+  rejectedBy;
   featured;
   metadata;
   createdAt;
@@ -17614,6 +18143,31 @@ _ts_decorate32([
   }),
   _ts_metadata32("design:type", String)
 ], exports.Product.prototype, "status", void 0);
+_ts_decorate32([
+  typeorm.Column("varchar", {
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], exports.Product.prototype, "approvalStatus", void 0);
+_ts_decorate32([
+  typeorm.Column("text", {
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], exports.Product.prototype, "rejectionReason", void 0);
+_ts_decorate32([
+  typeorm.Column({
+    type: "timestamptz",
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], exports.Product.prototype, "rejectedAt", void 0);
+_ts_decorate32([
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], exports.Product.prototype, "rejectedBy", void 0);
 _ts_decorate32([
   typeorm.Column("boolean", {
     default: false
@@ -20702,6 +21256,14 @@ exports.Event = class Event {
   expectedSpeakers;
   expectedParticipants;
   isActive;
+  /**
+  * Separate from isActive. Used when events.requireEventApproval is on.
+  * `approved` also forces `isActive = true` (live).
+  */
+  approvalStatus;
+  rejectionReason;
+  rejectedAt;
+  rejectedBy;
   comingSoon;
   bannerImageUrl;
   logoUrl;
@@ -20796,6 +21358,31 @@ _ts_decorate60([
   }),
   _ts_metadata60("design:type", Boolean)
 ], exports.Event.prototype, "isActive", void 0);
+_ts_decorate60([
+  typeorm.Column("varchar", {
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], exports.Event.prototype, "approvalStatus", void 0);
+_ts_decorate60([
+  typeorm.Column("text", {
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], exports.Event.prototype, "rejectionReason", void 0);
+_ts_decorate60([
+  typeorm.Column({
+    type: "timestamptz",
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], exports.Event.prototype, "rejectedAt", void 0);
+_ts_decorate60([
+  typeorm.Column("int", {
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], exports.Event.prototype, "rejectedBy", void 0);
 _ts_decorate60([
   typeorm.Column("boolean", {
     default: false
@@ -21356,18 +21943,20 @@ _ts_decorate63([
 ], exports.Combo.prototype, "desc", void 0);
 _ts_decorate63([
   typeorm.Column({
-    type: "integer"
+    type: "integer",
+    nullable: true
   }),
-  _ts_metadata63("design:type", Number)
+  _ts_metadata63("design:type", Object)
 ], exports.Combo.prototype, "eventId", void 0);
 _ts_decorate63([
   typeorm.ManyToOne(() => exports.Event, {
-    onDelete: "CASCADE"
+    onDelete: "CASCADE",
+    nullable: true
   }),
   typeorm.JoinColumn({
     name: "eventId"
   }),
-  _ts_metadata63("design:type", typeof exports.Event === "undefined" ? Object : exports.Event)
+  _ts_metadata63("design:type", Object)
 ], exports.Combo.prototype, "event", void 0);
 _ts_decorate63([
   typeorm.Column({
@@ -25627,7 +26216,7 @@ function createCmsApiHandler(config) {
   ] : baseCrudResources;
   const requireEntityPermissionEffective = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async (_req, entity, action) => {
     if (!resolveSessionUser) {
-      chunkWMXPKKXU_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
+      chunkX6UQFV4X_cjs.logRbac("requireEntityPermission: getSessionUser not passed \u2014 vendor store APIs may 403", {
         entity,
         action,
         hint: "Pass getSessionUser: auth.getAuthenticatedUser from createCmsAuthBundle()"
@@ -25637,7 +26226,7 @@ function createCmsApiHandler(config) {
       const raw = await resolveSessionUser();
       const u = await hydrateVendorSessionUser(dataSource, raw);
       if (!u?.email) {
-        chunkWMXPKKXU_cjs.logRbac("requireEntityPermission: no session user", {
+        chunkX6UQFV4X_cjs.logRbac("requireEntityPermission: no session user", {
           entity,
           action
         });
@@ -25647,13 +26236,13 @@ function createCmsApiHandler(config) {
           status: 401
         });
       }
-      const allowed = chunkOIGCAGH7_cjs.sessionHasEntityAccess(u, entity, action);
-      await chunkWMXPKKXU_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
+      const allowed = chunkZMRQ72F6_cjs.sessionHasEntityAccess(u, entity, action);
+      await chunkX6UQFV4X_cjs.logEntityAccessDecision(dataSource, "cmsApi.requireEntityPermission", u, entity, action, {
         allowed,
         resolvePath: "hydrated_session"
       });
       if (allowed) return null;
-      const { reason } = chunkWMXPKKXU_cjs.explainSessionEntityAccess(u, entity, action);
+      const { reason } = chunkX6UQFV4X_cjs.explainSessionEntityAccess(u, entity, action);
       return config.json({
         error: "Forbidden",
         entity,
@@ -25664,7 +26253,7 @@ function createCmsApiHandler(config) {
       });
     }
     if (userRequireEntityPermission) {
-      chunkWMXPKKXU_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
+      chunkX6UQFV4X_cjs.logRbac("requireEntityPermission: using app callback only (no getSessionUser)", {
         entity,
         action
       });
@@ -25751,10 +26340,10 @@ function createCmsApiHandler(config) {
       getVendorScope: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
         if (!multiVendorEnabled) {
-          return chunkWMXPKKXU_cjs.resolveDisabledMultiVendorScope(dataSource);
+          return chunkX6UQFV4X_cjs.resolveDisabledMultiVendorScope(dataSource);
         }
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-        return chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+        return chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser(u ?? null);
       }, "getVendorScope"),
       getHydratedSessionUser: /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async () => {
         const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
@@ -26680,16 +27269,24 @@ function createCmsApiHandler(config) {
           if (pe) return pe;
           if (group === "multi_vendor") {
             invalidateMultiVendorCache();
+            invalidateVendorCatalogCreateFlagsCache();
+            invalidateRequireProductApprovalCache();
+            invalidateRequireEventApprovalCache();
           }
           if (group === "events") {
             invalidateEventsCache();
+            invalidateRequireEventApprovalCache();
           }
           const res = await settingsHandlers.PUT(req, group);
           if (group === "multi_vendor") {
             invalidateMultiVendorCache();
+            invalidateVendorCatalogCreateFlagsCache();
+            invalidateRequireProductApprovalCache();
+            invalidateRequireEventApprovalCache();
           }
           if (group === "events") {
             invalidateEventsCache();
+            invalidateRequireEventApprovalCache();
           }
           return res;
         }
@@ -27013,7 +27610,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const result = await validateCoupon(dataSource, entityMap, couponCode, orderLinesNorm, currency, contactId, isAutomatic, discountId ?? void 0, vendorId);
@@ -27093,7 +27690,7 @@ function createCmsApiHandler(config) {
           let vendorId = null;
           if (resolveSessionUser) {
             const u = await hydrateVendorSessionUser(dataSource, await resolveSessionUser());
-            const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") vendorId = scope.vendorId;
           }
           const orderLinesNorm = normalizeOrderLinesInput(body?.orderLines);
@@ -27707,7 +28304,7 @@ function createCmsApiHandler(config) {
           if (resolveSessionUser) {
             const raw = await resolveSessionUser();
             const u = await hydrateVendorSessionUser(dataSource, raw);
-            const scope = chunkWMXPKKXU_cjs.resolveVendorScopeFromSessionUser(u ?? null);
+            const scope = chunkX6UQFV4X_cjs.resolveVendorScopeFromSessionUser(u ?? null);
             if (scope.type === "vendor") {
               scopedVendorIds = scope.vendorIds;
             }
@@ -31006,10 +31603,16 @@ exports.BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG = BLOG_METADATA_ENRICHER_LLM_AGENT
 exports.BlogGeneratorService = BlogGeneratorService;
 exports.CMS_ENTITY_MAP = CMS_ENTITY_MAP;
 exports.ZIP_MIME_TYPES = ZIP_MIME_TYPES;
+exports.applyApprovalStatusSideEffects = applyApprovalStatusSideEffects;
+exports.applyEventApprovalStatusSideEffects = applyEventApprovalStatusSideEffects;
 exports.applyRotatingVendorInvite = applyRotatingVendorInvite;
 exports.applyVendorCustomersContactFilter = applyVendorCustomersContactFilter;
+exports.applyVendorEventCreateApproval = applyVendorEventCreateApproval;
+exports.applyVendorProductCreateApproval = applyVendorProductCreateApproval;
 exports.assertCaptchaOk = assertCaptchaOk;
 exports.assertContactAllowedForVendorOrder = assertContactAllowedForVendorOrder;
+exports.assertEventApprovalUpdate = assertEventApprovalUpdate;
+exports.assertProductApprovalUpdate = assertProductApprovalUpdate;
 exports.buildBlogMetadataUserPrompt = buildBlogMetadataUserPrompt;
 exports.buildCronFromSchedule = buildCronFromSchedule;
 exports.buildRssUserPromptFromFeeds = buildRssUserPromptFromFeeds;
@@ -31062,11 +31665,17 @@ exports.findVendorByInviteToken = findVendorByInviteToken;
 exports.formatTierRange = formatTierRange;
 exports.generateNumericOtp = generateNumericOtp;
 exports.getPublicSettingsGroup = getPublicSettingsGroup;
+exports.getRequireEventApproval = getRequireEventApproval;
+exports.getRequireProductApproval = getRequireProductApproval;
 exports.getRssArticleSummaryFromItem = getRssArticleSummaryFromItem;
+exports.getVendorCatalogCreateFlags = getVendorCatalogCreateFlags;
 exports.hashOtpCode = hashOtpCode;
 exports.hydrateVendorSessionUser = hydrateVendorSessionUser;
 exports.invalidateEventsCache = invalidateEventsCache;
 exports.invalidateMultiVendorCache = invalidateMultiVendorCache;
+exports.invalidateRequireEventApprovalCache = invalidateRequireEventApprovalCache;
+exports.invalidateRequireProductApprovalCache = invalidateRequireProductApprovalCache;
+exports.invalidateVendorCatalogCreateFlagsCache = invalidateVendorCatalogCreateFlagsCache;
 exports.isCustomerTypeContact = isCustomerTypeContact;
 exports.isZipMedia = isZipMedia;
 exports.linkUnclaimedContactToUser = linkUnclaimedContactToUser;