@infuro/cms-core 1.0.40 → 1.0.42

package/dist/{chunk-RCMUL6SZ.js → chunk-W2NL365N.js}

@@ -5,8 +5,8 @@ import { queueEmail, queueVendorOnboardEmails, registerEmailQueueProcessor } fro
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MQBT33IV.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-KFFB6EMZ.js';
 import { JOB_RUNNER_QUEUE } from './chunk-GO7PPYNU.js';
-import { canManageRoles, sessionHasEntityAccess } from './chunk-UXMDSNIG.js';
-import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_OWNER_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-P7QCLE5W.js';
+import { canManageRoles, sessionHasEntityAccess } from './chunk-BLR6H5GL.js';
+import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_OWNER_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-DN65KDIA.js';
 import { queueErp } from './chunk-SYBOCAWB.js';
 import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { __name } from './chunk-SHUYVCID.js';
@@ -94,6 +94,79 @@ async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
 }
 __name(loadUserVendorContext, "loadUserVendorContext");
 
+// src/lib/vendor-catalog-create-flags.ts
+var ALL_OFF = {
+  categories: false,
+  collections: false,
+  brands: false
+};
+var cachedFlags = null;
+function invalidateVendorCatalogCreateFlagsCache() {
+  cachedFlags = null;
+}
+__name(invalidateVendorCatalogCreateFlagsCache, "invalidateVendorCatalogCreateFlagsCache");
+function parseTrue(value) {
+  return value === "true";
+}
+__name(parseTrue, "parseTrue");
+async function isMultiVendorEnabled(dataSource) {
+  try {
+    const rows = await dataSource.query(`
+      SELECT value FROM configs
+      WHERE settings = 'multi_vendor' AND key = 'enabled' AND deleted = false
+      LIMIT 1
+      `);
+    return rows.length === 0 || rows[0].value !== "false";
+  } catch {
+    return true;
+  }
+}
+__name(isMultiVendorEnabled, "isMultiVendorEnabled");
+async function getVendorCatalogCreateFlags(dataSource) {
+  if (cachedFlags !== null) return cachedFlags;
+  const multiVendorEnabled = await isMultiVendorEnabled(dataSource);
+  if (!multiVendorEnabled) {
+    cachedFlags = {
+      ...ALL_OFF
+    };
+    return cachedFlags;
+  }
+  try {
+    const rows = await dataSource.query(`
+      SELECT key, value FROM configs
+      WHERE settings = 'multi_vendor'
+        AND key IN (
+          'vendorCanCreateCategories',
+          'vendorCanCreateCollections',
+          'vendorCanCreateBrands'
+        )
+        AND deleted = false
+      `);
+    const map = new Map(rows.map((r) => [
+      r.key,
+      r.value
+    ]));
+    cachedFlags = {
+      categories: parseTrue(map.get("vendorCanCreateCategories")),
+      collections: parseTrue(map.get("vendorCanCreateCollections")),
+      brands: parseTrue(map.get("vendorCanCreateBrands"))
+    };
+  } catch {
+    cachedFlags = {
+      ...ALL_OFF
+    };
+  }
+  return cachedFlags;
+}
+__name(getVendorCatalogCreateFlags, "getVendorCatalogCreateFlags");
+function vendorCanCreateResource(resource, flags) {
+  if (resource === "product_categories") return flags.categories;
+  if (resource === "collections") return flags.collections;
+  if (resource === "brands") return flags.brands;
+  return false;
+}
+__name(vendorCanCreateResource, "vendorCanCreateResource");
+
 // src/lib/hydrate-vendor-session-user.ts
 async function hydrateVendorSessionUser(dataSource, user) {
   if (!user?.email) return user;
@@ -196,6 +269,7 @@ __name(hydrateVendorSessionUser, "hydrateVendorSessionUser");
 var cachedMultiVendorEnabled = null;
 function invalidateMultiVendorCache() {
   cachedMultiVendorEnabled = null;
+  invalidateVendorCatalogCreateFlagsCache();
 }
 __name(invalidateMultiVendorCache, "invalidateMultiVendorCache");
 async function checkMultiVendorEnabled(dataSource) {
@@ -234,6 +308,279 @@ async function checkEventsEnabled(dataSource) {
 }
 __name(checkEventsEnabled, "checkEventsEnabled");
 
+// src/lib/product-approval.ts
+var PRODUCT_APPROVAL_STATUSES = [
+  "pending",
+  "approved",
+  "rejected"
+];
+var APPROVAL_SET = new Set(PRODUCT_APPROVAL_STATUSES);
+var PRODUCT_STATUSES = /* @__PURE__ */ new Set([
+  "draft",
+  "available",
+  "reserved",
+  "sold"
+]);
+var cachedRequireApproval = null;
+function invalidateRequireProductApprovalCache() {
+  cachedRequireApproval = null;
+}
+__name(invalidateRequireProductApprovalCache, "invalidateRequireProductApprovalCache");
+function parseTrue2(value) {
+  return value === "true";
+}
+__name(parseTrue2, "parseTrue");
+async function getRequireProductApproval(dataSource) {
+  if (cachedRequireApproval !== null) return cachedRequireApproval;
+  const multiVendorEnabled = await checkMultiVendorEnabled(dataSource);
+  if (!multiVendorEnabled) {
+    cachedRequireApproval = false;
+    return false;
+  }
+  try {
+    const rows = await dataSource.query(`
+      SELECT value FROM configs
+      WHERE settings = 'multi_vendor' AND key = 'requireProductApproval' AND deleted = false
+      LIMIT 1
+      `);
+    cachedRequireApproval = rows.length > 0 && parseTrue2(rows[0].value);
+  } catch {
+    cachedRequireApproval = false;
+  }
+  return cachedRequireApproval;
+}
+__name(getRequireProductApproval, "getRequireProductApproval");
+function applyVendorProductCreateApproval(persistBody, opts) {
+  if (!opts.isVendor || !opts.requireApproval) return;
+  persistBody.approvalStatus = "pending";
+  if (persistBody.status === "available") persistBody.status = "draft";
+  persistBody.rejectionReason = null;
+  persistBody.rejectedAt = null;
+  persistBody.rejectedBy = null;
+}
+__name(applyVendorProductCreateApproval, "applyVendorProductCreateApproval");
+function assertProductApprovalUpdate(opts) {
+  const fromApproval = opts.fromApproval == null || opts.fromApproval === "" ? null : String(opts.fromApproval);
+  const toApproval = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  const fromStatus = String(opts.fromStatus || "draft");
+  const toStatus = String(opts.toStatus || fromStatus);
+  if (opts.statusChanged && !PRODUCT_STATUSES.has(toStatus)) {
+    return {
+      ok: false,
+      error: `Invalid product status: ${toStatus}`
+    };
+  }
+  if (opts.approvalChanged && toApproval != null && !APPROVAL_SET.has(toApproval)) {
+    return {
+      ok: false,
+      error: `Invalid approval status: ${toApproval}`
+    };
+  }
+  if (!opts.requireApproval) {
+    if (opts.isVendor && opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.isVendor) {
+    if (opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    if (opts.statusChanged && toStatus === "available" && fromApproval !== "approved") {
+      return {
+        ok: false,
+        error: "Product must be approved before it can be available"
+      };
+    }
+    if (fromApproval === "rejected" && opts.statusChanged && toStatus === "available") {
+      return {
+        ok: false,
+        error: "Rejected product cannot be made available"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.approvalChanged && toApproval === "rejected") {
+    const reason = String(opts.rejectionReason ?? "").trim();
+    if (!reason) return {
+      ok: false,
+      error: "Rejection reason is required"
+    };
+  }
+  return {
+    ok: true
+  };
+}
+__name(assertProductApprovalUpdate, "assertProductApprovalUpdate");
+function applyApprovalStatusSideEffects(updatePayload, opts) {
+  const to = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  if (to == null) return;
+  if (to === "approved") {
+    updatePayload.approvalStatus = "approved";
+    updatePayload.status = "available";
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    return;
+  }
+  if (to === "rejected") {
+    updatePayload.approvalStatus = "rejected";
+    updatePayload.rejectionReason = String(opts.rejectionReason ?? "").trim();
+    updatePayload.rejectedAt = /* @__PURE__ */ new Date();
+    updatePayload.rejectedBy = opts.rejectedBy != null && Number.isFinite(opts.rejectedBy) ? opts.rejectedBy : null;
+    const nextStatus = "status" in updatePayload ? String(updatePayload.status) : opts.currentStatus;
+    if (nextStatus === "available") updatePayload.status = "draft";
+    return;
+  }
+  if (to === "pending") {
+    updatePayload.approvalStatus = "pending";
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    const nextStatus = "status" in updatePayload ? String(updatePayload.status) : opts.currentStatus;
+    if (nextStatus === "available") updatePayload.status = "draft";
+  }
+}
+__name(applyApprovalStatusSideEffects, "applyApprovalStatusSideEffects");
+
+// src/lib/event-approval.ts
+var EVENT_APPROVAL_STATUSES = [
+  "pending",
+  "approved",
+  "rejected"
+];
+var APPROVAL_SET2 = new Set(EVENT_APPROVAL_STATUSES);
+var cachedRequireApproval2 = null;
+function invalidateRequireEventApprovalCache() {
+  cachedRequireApproval2 = null;
+}
+__name(invalidateRequireEventApprovalCache, "invalidateRequireEventApprovalCache");
+function parseTrue3(value) {
+  return value === "true";
+}
+__name(parseTrue3, "parseTrue");
+async function getRequireEventApproval(dataSource) {
+  if (cachedRequireApproval2 !== null) return cachedRequireApproval2;
+  const [eventsOn, multiVendorOn] = await Promise.all([
+    checkEventsEnabled(dataSource),
+    checkMultiVendorEnabled(dataSource)
+  ]);
+  if (!eventsOn || !multiVendorOn) {
+    cachedRequireApproval2 = false;
+    return false;
+  }
+  try {
+    const rows = await dataSource.query(`
+      SELECT value FROM configs
+      WHERE settings = 'events' AND key = 'requireEventApproval' AND deleted = false
+      LIMIT 1
+      `);
+    cachedRequireApproval2 = rows.length > 0 && parseTrue3(rows[0].value);
+  } catch {
+    cachedRequireApproval2 = false;
+  }
+  return cachedRequireApproval2;
+}
+__name(getRequireEventApproval, "getRequireEventApproval");
+function applyVendorEventCreateApproval(persistBody, opts) {
+  if (!opts.isVendor || !opts.requireApproval) return;
+  persistBody.approvalStatus = "pending";
+  persistBody.isActive = false;
+  persistBody.rejectionReason = null;
+  persistBody.rejectedAt = null;
+  persistBody.rejectedBy = null;
+}
+__name(applyVendorEventCreateApproval, "applyVendorEventCreateApproval");
+function assertEventApprovalUpdate(opts) {
+  const fromApproval = opts.fromApproval == null || opts.fromApproval === "" ? null : String(opts.fromApproval);
+  const toApproval = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  if (opts.approvalChanged && toApproval != null && !APPROVAL_SET2.has(toApproval)) {
+    return {
+      ok: false,
+      error: `Invalid approval status: ${toApproval}`
+    };
+  }
+  if (!opts.requireApproval) {
+    if (opts.isVendor && opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.isVendor) {
+    if (opts.approvalChanged) {
+      return {
+        ok: false,
+        error: "Vendors cannot change approval status"
+      };
+    }
+    if (opts.activeChanged && opts.toActive && fromApproval !== "approved") {
+      return {
+        ok: false,
+        error: "Event must be approved before it can be activated"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  if (opts.approvalChanged && toApproval === "rejected") {
+    const reason = String(opts.rejectionReason ?? "").trim();
+    if (!reason) return {
+      ok: false,
+      error: "Rejection reason is required"
+    };
+  }
+  return {
+    ok: true
+  };
+}
+__name(assertEventApprovalUpdate, "assertEventApprovalUpdate");
+function applyEventApprovalStatusSideEffects(updatePayload, opts) {
+  const to = opts.toApproval == null || opts.toApproval === "" ? null : String(opts.toApproval);
+  if (to == null) return;
+  if (to === "approved") {
+    updatePayload.approvalStatus = "approved";
+    updatePayload.isActive = true;
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    return;
+  }
+  if (to === "rejected") {
+    updatePayload.approvalStatus = "rejected";
+    updatePayload.rejectionReason = String(opts.rejectionReason ?? "").trim();
+    updatePayload.rejectedAt = /* @__PURE__ */ new Date();
+    updatePayload.rejectedBy = opts.rejectedBy != null && Number.isFinite(opts.rejectedBy) ? opts.rejectedBy : null;
+    const nextActive = "isActive" in updatePayload ? Boolean(updatePayload.isActive) : opts.currentActive;
+    if (nextActive) updatePayload.isActive = false;
+    return;
+  }
+  if (to === "pending") {
+    updatePayload.approvalStatus = "pending";
+    updatePayload.rejectionReason = null;
+    updatePayload.rejectedAt = null;
+    updatePayload.rejectedBy = null;
+    const nextActive = "isActive" in updatePayload ? Boolean(updatePayload.isActive) : opts.currentActive;
+    if (nextActive) updatePayload.isActive = false;
+  }
+}
+__name(applyEventApprovalStatusSideEffects, "applyEventApprovalStatusSideEffects");
+
 // src/lib/default-vendor-id.ts
 function getDefaultVendorId() {
   const raw = process.env.DEFAULT_VENDOR_ID;
@@ -269,17 +616,20 @@ async function assertCatalogCategoryId(dataSource, categoriesEntity, categoryId,
   const row = await repo.findOne({
     where: {
       id,
-      deleted: false,
-      isCatalog: true
+      deleted: false
     }
   });
   if (!row) {
     return "Invalid catalog category. Choose one of the platform product category types.";
   }
-  return null;
+  if (row.isCatalog === true) return null;
+  if (options?.allowVendorId != null && Number(row.vendorId) === options.allowVendorId && row.isCatalog !== true) {
+    return null;
+  }
+  return "Invalid catalog category. Choose one of the platform product category types.";
 }
 __name(assertCatalogCategoryId, "assertCatalogCategoryId");
-async function assertVendorOwnedCollectionForProduct(dataSource, collectionsEntity, collectionId, categoryId, vendorId) {
+async function assertCollectionForVendorProduct(dataSource, collectionsEntity, collectionId, categoryId, vendorId, options) {
   const cid = Number(collectionId);
   if (!Number.isFinite(cid) || cid <= 0) return null;
   if (!collectionsEntity) return "Collections are not configured";
@@ -290,11 +640,13 @@ async function assertVendorOwnedCollectionForProduct(dataSource, collectionsEnti
       deleted: false
     }
   });
-  if (!row || row.isCatalog === true) {
-    return "Invalid collection. Choose one of your collections in this category.";
+  if (!row) {
+    return "Invalid collection. Choose a valid collection in this category.";
   }
-  if (Number(row.vendorId) !== vendorId) {
-    return "Invalid collection. Choose one of your collections in this category.";
+  const isCatalog = row.isCatalog === true;
+  const isOwn = Number(row.vendorId) === vendorId && !isCatalog;
+  if (!isCatalog && !(options?.allowVendorOwned && isOwn)) {
+    return "Invalid collection. Choose one of the platform collections (or your own if allowed).";
   }
   const catId = Number(categoryId);
   if (Number.isFinite(catId) && catId > 0 && Number(row.categoryId) !== catId) {
@@ -302,7 +654,7 @@ async function assertVendorOwnedCollectionForProduct(dataSource, collectionsEnti
   }
   return null;
 }
-__name(assertVendorOwnedCollectionForProduct, "assertVendorOwnedCollectionForProduct");
+__name(assertCollectionForVendorProduct, "assertCollectionForVendorProduct");
 
 // src/lib/catalog-collection.ts
 function isCatalogCollectionRow(row) {
@@ -316,7 +668,24 @@ function applyPlatformCatalogCollectionFields(persistBody) {
 }
 __name(applyPlatformCatalogCollectionFields, "applyPlatformCatalogCollectionFields");
 
+// src/lib/catalog-brand.ts
+function isCatalogBrandRow(row) {
+  return row?.isCatalog === true;
+}
+__name(isCatalogBrandRow, "isCatalogBrandRow");
+function applyPlatformCatalogBrandFields(persistBody) {
+  persistBody.isCatalog = true;
+  delete persistBody.vendorId;
+  persistBody.vendorId = getDefaultVendorId();
+}
+__name(applyPlatformCatalogBrandFields, "applyPlatformCatalogBrandFields");
+
 // src/api/vendor-scope-crud.ts
+var CATALOG_LIST_RESOURCES = /* @__PURE__ */ new Set([
+  "product_categories",
+  "collections",
+  "brands"
+]);
 function repoHasVendorIdColumn(repo) {
   return repo.metadata.columns.some((c) => c.propertyName === "vendorId");
 }
@@ -325,7 +694,43 @@ function resourceUsesVendorScope(resource) {
   return resource === "vendors" || VENDOR_SCOPED_STORE_ENTITIES.has(resource);
 }
 __name(resourceUsesVendorScope, "resourceUsesVendorScope");
-function mergeVendorScopeIntoWhere(where, scope, resource) {
+function mergeWhereClause(where, extra) {
+  if (Array.isArray(where)) {
+    return where.map((w) => ({
+      ...w,
+      ...extra
+    }));
+  }
+  if (where && typeof where === "object" && Object.keys(where).length > 0) {
+    return {
+      ...where,
+      ...extra
+    };
+  }
+  return extra;
+}
+__name(mergeWhereClause, "mergeWhereClause");
+function mergeCatalogOrOwnWhere(where, vendorId) {
+  const catalog = mergeWhereClause(where, {
+    isCatalog: true
+  });
+  const own = mergeWhereClause(where, {
+    vendorId,
+    isCatalog: false
+  });
+  const catalogArr = Array.isArray(catalog) ? catalog : [
+    catalog
+  ];
+  const ownArr = Array.isArray(own) ? own : [
+    own
+  ];
+  return [
+    ...catalogArr,
+    ...ownArr
+  ];
+}
+__name(mergeCatalogOrOwnWhere, "mergeCatalogOrOwnWhere");
+function mergeVendorScopeIntoWhere(where, scope, resource, flags) {
   if (scope.type === "all") return where;
   if (scope.type === "deny") {
     if (resource === "vendors") {
@@ -342,38 +747,20 @@ function mergeVendorScopeIntoWhere(where, scope, resource) {
       id: In(scope.vendorIds)
     });
   }
-  if (resource === "product_categories" && scope.type === "vendor") {
+  if (CATALOG_LIST_RESOURCES.has(resource) && scope.type === "vendor") {
+    const canCreate = flags ? vendorCanCreateResource(resource, flags) : false;
+    if (canCreate) {
+      return mergeCatalogOrOwnWhere(where, scope.vendorId);
+    }
     return mergeWhereClause(where, {
       isCatalog: true
     });
   }
-  if (resource === "collections" && scope.type === "vendor") {
-    return mergeWhereClause(where, {
-      vendorId: scope.vendorId,
-      isCatalog: false
-    });
-  }
   return mergeWhereClause(where, {
     vendorId: scope.vendorId
   });
 }
 __name(mergeVendorScopeIntoWhere, "mergeVendorScopeIntoWhere");
-function mergeWhereClause(where, extra) {
-  if (Array.isArray(where)) {
-    return where.map((w) => ({
-      ...w,
-      ...extra
-    }));
-  }
-  if (where && typeof where === "object" && Object.keys(where).length > 0) {
-    return {
-      ...where,
-      ...extra
-    };
-  }
-  return extra;
-}
-__name(mergeWhereClause, "mergeWhereClause");
 function applyVendorScopeToQueryBuilder(qb, alias, scope) {
   if (scope.type === "all") return;
   if (scope.type === "deny") {
@@ -385,7 +772,7 @@ function applyVendorScopeToQueryBuilder(qb, alias, scope) {
   });
 }
 __name(applyVendorScopeToQueryBuilder, "applyVendorScopeToQueryBuilder");
-function rowMatchesVendorScope(row, scope, resource) {
+function rowMatchesVendorScope(row, scope, resource, flags) {
   if (!row) return false;
   if (scope.type === "all") return true;
   if (scope.type === "deny") return false;
@@ -393,27 +780,32 @@ function rowMatchesVendorScope(row, scope, resource) {
     const id = Number(row.id);
     return scope.vendorIds.includes(id);
   }
-  if (resource === "product_categories" && scope.type === "vendor") {
-    return isCatalogCategoryRow(row);
-  }
-  if (resource === "collections" && scope.type === "vendor") {
-    return Number(row.vendorId) === scope.vendorId && !isCatalogCollectionRow(row);
+  if (CATALOG_LIST_RESOURCES.has(resource) && scope.type === "vendor") {
+    const isCatalog = resource === "product_categories" ? isCatalogCategoryRow(row) : resource === "collections" ? isCatalogCollectionRow(row) : isCatalogBrandRow(row);
+    if (isCatalog) return true;
+    const canCreate = flags ? vendorCanCreateResource(resource, flags) : false;
+    return canCreate && Number(row.vendorId) === scope.vendorId && !isCatalog;
   }
   return Number(row.vendorId) === scope.vendorId;
 }
 __name(rowMatchesVendorScope, "rowMatchesVendorScope");
-function vendorCannotMutateCatalogCategories(resource, scope) {
-  return resource === "product_categories" && scope.type === "vendor";
-}
-__name(vendorCannotMutateCatalogCategories, "vendorCannotMutateCatalogCategories");
-function vendorCannotMutateCatalogCollections(resource, scope, body) {
-  if (resource !== "collections" || scope.type !== "vendor") return false;
+function vendorCannotMutateCatalogResource(resource, scope, flags, body) {
+  if (scope.type !== "vendor" || !CATALOG_LIST_RESOURCES.has(resource)) return false;
+  if (!vendorCanCreateResource(resource, flags)) return true;
   return body?.isCatalog === true;
 }
-__name(vendorCannotMutateCatalogCollections, "vendorCannotMutateCatalogCollections");
-function vendorScopeRowAccess(row, scope, resource) {
+__name(vendorCannotMutateCatalogResource, "vendorCannotMutateCatalogResource");
+function vendorCannotMutateExistingCatalogRow(resource, scope, row) {
+  if (scope.type !== "vendor" || !CATALOG_LIST_RESOURCES.has(resource) || !row) return false;
+  if (resource === "product_categories") return isCatalogCategoryRow(row);
+  if (resource === "collections") return isCatalogCollectionRow(row);
+  if (resource === "brands") return isCatalogBrandRow(row);
+  return false;
+}
+__name(vendorCannotMutateExistingCatalogRow, "vendorCannotMutateExistingCatalogRow");
+function vendorScopeRowAccess(row, scope, resource, flags) {
   if (!row) return "not_found";
-  if (rowMatchesVendorScope(row, scope, resource)) return "ok";
+  if (rowMatchesVendorScope(row, scope, resource, flags)) return "ok";
   return scope.type === "vendor" ? "forbidden" : "not_found";
 }
 __name(vendorScopeRowAccess, "vendorScopeRowAccess");
@@ -445,14 +837,7 @@ function requireVendorIdForScopedCreate(resource, persistBody, scope, repo, cont
       ok: true
     };
   }
-  if (resource === "collections" && persistBody.isCatalog === true) {
-    delete persistBody.vendorId;
-    persistBody.vendorId = getDefaultVendorId();
-    return {
-      ok: true
-    };
-  }
-  if (resource === "product_categories" && persistBody.isCatalog === true) {
+  if ((resource === "collections" || resource === "product_categories" || resource === "brands") && persistBody.isCatalog === true) {
     delete persistBody.vendorId;
     persistBody.vendorId = getDefaultVendorId();
     return {
@@ -464,7 +849,7 @@ function requireVendorIdForScopedCreate(resource, persistBody, scope, repo, cont
   };
   enforceVendorIdOnCreateBody(persistBody, scope, repo);
   if (scope.type === "vendor") {
-    if (resource === "collections") {
+    if (resource === "collections" || resource === "product_categories" || resource === "brands") {
       persistBody.isCatalog = false;
     }
     return {
@@ -3411,6 +3796,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         const scope = await resolveScope();
         const repo2 = dataSource.getRepository(entity);
         const statusFilter = searchParams.get("status")?.trim();
+        const approvalStatusFilter = searchParams.get("approvalStatus")?.trim();
         const inventory = searchParams.get("inventory")?.trim();
         let productWhere = {
           deleted: false,
@@ -3418,6 +3804,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         };
         productWhere = mergeVendorScopeIntoWhere(productWhere, scope, resource);
         if (statusFilter) productWhere.status = statusFilter;
+        if (approvalStatusFilter) productWhere.approvalStatus = approvalStatusFilter;
         if (inventory === "in_stock") productWhere.quantity = MoreThan(0);
         if (inventory === "out_of_stock") productWhere.quantity = 0;
         for (const key of [
@@ -3718,6 +4105,7 @@ function createCrudHandler(dataSource, entityMap, options) {
       where = mergeDeletedFalseWhere(repo, where);
       if (resourceUsesVendorScope(resource)) {
         const scope = await resolveScope();
+        const catalogFlags = await getVendorCatalogCreateFlags(dataSource);
         if (scope.type === "deny") {
           where = resource === "vendors" ? {
             id: -1
@@ -3726,7 +4114,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           };
         } else if (resource === "collections") {
           if (scope.type === "vendor") {
-            where = mergeVendorScopeIntoWhere(where, scope, resource);
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
           } else if (searchParams.get("isCatalog") !== "true") {
             where = mergeListWhereAnd(where, {
               isCatalog: false
@@ -3734,14 +4122,22 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
         } else if (resource === "product_categories") {
           if (scope.type === "vendor") {
-            where = mergeVendorScopeIntoWhere(where, scope, resource);
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
+          } else if (searchParams.get("isCatalog") !== "false") {
+            where = mergeListWhereAnd(where, {
+              isCatalog: true
+            });
+          }
+        } else if (resource === "brands") {
+          if (scope.type === "vendor") {
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
           } else if (searchParams.get("isCatalog") !== "false") {
             where = mergeListWhereAnd(where, {
               isCatalog: true
             });
           }
         } else {
-          where = mergeVendorScopeIntoWhere(where, scope, resource);
+          where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
         }
       }
       let data;
@@ -3811,16 +4207,11 @@ function createCrudHandler(dataSource, entityMap, options) {
         });
       }
       const body = rawPostBody;
-      if (vendorCannotMutateCatalogCategories(resource, scopePost)) {
+      const catalogFlagsPost = await getVendorCatalogCreateFlags(dataSource);
+      if (vendorCannotMutateCatalogResource(resource, scopePost, catalogFlagsPost, body)) {
+        const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : resource === "brands" ? "Brands" : "This resource";
         return json({
-          error: "Categories are managed by the platform administrator"
-        }, {
-          status: 403
-        });
-      }
-      if (vendorCannotMutateCatalogCollections(resource, scopePost, body)) {
-        return json({
-          error: "Collections are managed by the platform administrator"
+          error: `${label} are managed by the platform administrator`
         }, {
           status: 403
         });
@@ -4205,8 +4596,15 @@ function createCrudHandler(dataSource, entityMap, options) {
       }
       if (resource === "products") {
         const scopeForProduct = await resolveScope();
+        const productFlags = await getVendorCatalogCreateFlags(dataSource);
+        const requireApproval = await getRequireProductApproval(dataSource);
+        applyVendorProductCreateApproval(persistBody, {
+          isVendor: scopeForProduct.type === "vendor",
+          requireApproval
+        });
         const categoryErr = await assertCatalogCategoryId(dataSource, entityMap.product_categories, persistBody.categoryId, {
-          required: scopeForProduct.type === "vendor"
+          required: scopeForProduct.type === "vendor",
+          allowVendorId: scopeForProduct.type === "vendor" && productFlags.categories ? scopeForProduct.vendorId : void 0
         });
         if (categoryErr) return json({
           error: categoryErr
@@ -4215,7 +4613,9 @@ function createCrudHandler(dataSource, entityMap, options) {
         });
         if (scopeForProduct.type === "vendor") {
           if (entityMap.collections && persistBody.collectionId != null && persistBody.collectionId !== "") {
-            const collectionErr = await assertVendorOwnedCollectionForProduct(dataSource, entityMap.collections, persistBody.collectionId, persistBody.categoryId, scopeForProduct.vendorId);
+            const collectionErr = await assertCollectionForVendorProduct(dataSource, entityMap.collections, persistBody.collectionId, persistBody.categoryId, scopeForProduct.vendorId, {
+              allowVendorOwned: productFlags.collections
+            });
             if (collectionErr) return json({
               error: collectionErr
             }, {
@@ -4224,6 +4624,14 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
         }
       }
+      if (resource === "events") {
+        const scopeForEvent = await resolveScope();
+        const requireEventApproval = await getRequireEventApproval(dataSource);
+        applyVendorEventCreateApproval(persistBody, {
+          isVendor: scopeForEvent.type === "vendor",
+          requireApproval: requireEventApproval
+        });
+      }
       if (resource === "collections" && scopePost.type === "vendor") {
         const categoryErr = await assertCatalogCategoryId(dataSource, entityMap.product_categories, persistBody.categoryId, {
           required: true
@@ -4428,7 +4836,27 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
         }
       }
-      if (!((resource === "collections" || resource === "product_categories") && persistBody.isCatalog === true)) {
+      if (resource === "brands" && scopeCreate.type === "all") {
+        applyPlatformCatalogBrandFields(persistBody);
+        const slug = String(persistBody.slug ?? "").trim();
+        if (slug) {
+          const dup = await repo.findOne({
+            where: {
+              slug,
+              isCatalog: true,
+              deleted: false
+            }
+          });
+          if (dup) {
+            return json({
+              error: "A catalog brand with this slug already exists"
+            }, {
+              status: 400
+            });
+          }
+        }
+      }
+      if (!((resource === "collections" || resource === "product_categories" || resource === "brands") && persistBody.isCatalog === true)) {
         await tryAssignSingleVendorOnAdminCreate(resource, scopeCreate, persistBody);
       }
       const vendorIdCheck = requireVendorIdForScopedCreate(resource, persistBody, scopeCreate, repo, await vendorCreateContext(body));
@@ -4908,13 +5336,14 @@ function createCrudHandler(dataSource, entityMap, options) {
 }
 __name(createCrudHandler, "createCrudHandler");
 function createCrudByIdHandler(dataSource, entityMap, options) {
-  const { requireAuth, json, requireEntityPermission: reqPerm, getCms, getDeletedByUserId, getVendorScope } = options;
+  const { requireAuth, json, requireEntityPermission: reqPerm, getCms, getDeletedByUserId, getVendorScope, getHydratedSessionUser } = options;
   const syncContactRowToErp = makeContactErpSync(dataSource, entityMap, getCms);
   const resolveScopeById = getVendorScope ?? (async () => ({
     type: "all"
   }));
-  function vendorScopeAccessJson(row, scope, resource) {
-    const access = vendorScopeRowAccess(row, scope, resource);
+  async function vendorScopeAccessJson(row, scope, resource) {
+    const flags = await getVendorCatalogCreateFlags(dataSource);
+    const access = vendorScopeRowAccess(row, scope, resource, flags);
     if (access === "ok") return null;
     if (access === "forbidden") return json({
       error: "Forbidden"
@@ -4994,7 +5423,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "rules"
           ]
         });
-        const discountDenied = vendorScopeAccessJson(discount, scope2, resource);
+        const discountDenied = await vendorScopeAccessJson(discount, scope2, resource);
         if (discountDenied) return discountDenied;
         const flatRules = discount.rules ?? [];
         const nestedRules = nestDiscountRules2(flatRules);
@@ -5052,7 +5481,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "payments"
           ]
         });
-        const orderDenied = vendorScopeAccessJson(order, scope2, resource);
+        const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
         if (orderDenied) return orderDenied;
         const relatedOrders = await repo.find({
           where: {
@@ -5116,7 +5545,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "contact"
           ]
         });
-        const paymentDenied = vendorScopeAccessJson(payment, scope2, resource);
+        const paymentDenied = await vendorScopeAccessJson(payment, scope2, resource);
         if (paymentDenied) return paymentDenied;
         const p = payment;
         const order = p.order;
@@ -5155,7 +5584,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "attributes.attribute"
           ]
         });
-        const productDenied = vendorScopeAccessJson(product, scope2, resource);
+        const productDenied = await vendorScopeAccessJson(product, scope2, resource);
         if (productDenied) return productDenied;
         return product ? json(hydrateProductDisplayName(product)) : json({
           message: "Not found"
@@ -5173,7 +5602,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "contact"
           ]
         });
-        const vcDenied = vendorScopeAccessJson(row, scope2, resource);
+        const vcDenied = await vendorScopeAccessJson(row, scope2, resource);
         if (vcDenied) return vcDenied;
         const contact = row.contact;
         return json({
@@ -5196,7 +5625,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product"
           ]
         });
-        const comboDenied = vendorScopeAccessJson(combo, scope2, resource);
+        const comboDenied = await vendorScopeAccessJson(combo, scope2, resource);
         if (comboDenied) return comboDenied;
         return combo ? json(combo) : json({
           message: "Not found"
@@ -5233,7 +5662,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         where: idWhere
       });
       if (resourceUsesVendorScope(resource)) {
-        const itemDenied = vendorScopeAccessJson(item, scope, resource);
+        const itemDenied = await vendorScopeAccessJson(item, scope, resource);
         if (itemDenied) return itemDenied;
       } else if (!item) {
         return json({
@@ -5262,16 +5691,11 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       const rawBody = await req.json();
       const scopePutEarly = await resolveScopeById();
-      if (vendorCannotMutateCatalogCategories(resource, scopePutEarly)) {
+      const catalogFlagsPut = await getVendorCatalogCreateFlags(dataSource);
+      if (vendorCannotMutateCatalogResource(resource, scopePutEarly, catalogFlagsPut, rawBody ?? void 0)) {
+        const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : resource === "brands" ? "Brands" : "This resource";
         return json({
-          error: "Categories are managed by the platform administrator"
-        }, {
-          status: 403
-        });
-      }
-      if (vendorCannotMutateCatalogCollections(resource, scopePutEarly, rawBody ?? void 0)) {
-        return json({
-          error: "Collections are managed by the platform administrator"
+          error: `${label} are managed by the platform administrator`
         }, {
           status: 403
         });
@@ -5637,7 +6061,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             id: numericId
           }
         });
-        const discountPutDenied = vendorScopeAccessJson(existing, scopePut2, resource);
+        const discountPutDenied = await vendorScopeAccessJson(existing, scopePut2, resource);
         if (discountPutDenied) return discountPutDenied;
         const updatePayload2 = pickColumnUpdates(repo, rawBody);
         delete updatePayload2.vendorId;
@@ -5695,8 +6119,16 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         const existingScope = await repo.findOne({
           where: idWhereCheck
         });
-        const scopePutDenied = vendorScopeAccessJson(existingScope, scopePut, resource);
+        const scopePutDenied = await vendorScopeAccessJson(existingScope, scopePut, resource);
         if (scopePutDenied) return scopePutDenied;
+        if (vendorCannotMutateExistingCatalogRow(resource, scopePut, existingScope)) {
+          const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : "Brands";
+          return json({
+            error: `${label} are managed by the platform administrator`
+          }, {
+            status: 403
+          });
+        }
       }
       const updatePayload = rawBody && typeof rawBody === "object" ? pickColumnUpdates(repo, rawBody) : {};
       if (resourceUsesVendorScope(resource)) {
@@ -5843,7 +6275,8 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         });
         const mergedCategoryId = "categoryId" in updatePayload ? updatePayload.categoryId : currentRow.categoryId;
         const categoryErr = await assertCatalogCategoryId(dataSource, entityMap.product_categories, "categoryId" in updatePayload ? updatePayload.categoryId : mergedCategoryId, {
-          required: scopePut.type === "vendor"
+          required: scopePut.type === "vendor",
+          allowVendorId: scopePut.type === "vendor" && catalogFlagsPut.categories ? scopePut.vendorId : void 0
         });
         if (categoryErr) return json({
           error: categoryErr
@@ -5852,7 +6285,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         });
         if (scopePut.type === "vendor") {
           if (entityMap.collections && "collectionId" in updatePayload && updatePayload.collectionId != null) {
-            const collectionErr = await assertVendorOwnedCollectionForProduct(dataSource, entityMap.collections, updatePayload.collectionId, mergedCategoryId, scopePut.vendorId);
+            const collectionErr = await assertCollectionForVendorProduct(dataSource, entityMap.collections, updatePayload.collectionId, mergedCategoryId, scopePut.vendorId, {
+              allowVendorOwned: catalogFlagsPut.collections
+            });
             if (collectionErr) return json({
               error: collectionErr
             }, {
@@ -5860,6 +6295,88 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             });
           }
         }
+        if ("status" in updatePayload || "approvalStatus" in updatePayload || "rejectionReason" in updatePayload) {
+          const fromStatus = String(currentRow.status ?? "draft");
+          const toStatus = String("status" in updatePayload ? updatePayload.status ?? fromStatus : fromStatus);
+          const fromApproval = currentRow.approvalStatus;
+          const toApproval = "approvalStatus" in updatePayload ? updatePayload.approvalStatus : fromApproval;
+          const requireApproval = await getRequireProductApproval(dataSource);
+          const reasonFromBody = "rejectionReason" in updatePayload ? updatePayload.rejectionReason : currentRow.rejectionReason;
+          const reasonStr = typeof reasonFromBody === "string" ? reasonFromBody : reasonFromBody == null ? null : String(reasonFromBody);
+          const transition = assertProductApprovalUpdate({
+            fromApproval,
+            toApproval,
+            fromStatus,
+            toStatus,
+            isVendor: scopePut.type === "vendor",
+            requireApproval,
+            approvalChanged: "approvalStatus" in updatePayload,
+            statusChanged: "status" in updatePayload,
+            rejectionReason: reasonStr
+          });
+          if (!transition.ok) return json({
+            error: transition.error
+          }, {
+            status: 400
+          });
+          if ("approvalStatus" in updatePayload && scopePut.type !== "vendor") {
+            const session = await getHydratedSessionUser?.() ?? null;
+            const rejectedByRaw = session?.id != null ? Number(session.id) : null;
+            applyApprovalStatusSideEffects(updatePayload, {
+              toApproval,
+              currentStatus: fromStatus,
+              rejectionReason: reasonStr,
+              rejectedBy: Number.isFinite(rejectedByRaw) ? rejectedByRaw : null
+            });
+          }
+        }
+      }
+      if (resource === "events") {
+        const currentEvent = await repo.findOne({
+          where: {
+            id: numericId,
+            deleted: false
+          }
+        });
+        if (!currentEvent) return json({
+          message: "Not found"
+        }, {
+          status: 404
+        });
+        if ("isActive" in updatePayload || "approvalStatus" in updatePayload || "rejectionReason" in updatePayload) {
+          const fromActive = Boolean(currentEvent.isActive);
+          const toActive = "isActive" in updatePayload ? Boolean(updatePayload.isActive) : fromActive;
+          const fromApproval = currentEvent.approvalStatus;
+          const toApproval = "approvalStatus" in updatePayload ? updatePayload.approvalStatus : fromApproval;
+          const requireEventApproval = await getRequireEventApproval(dataSource);
+          const reasonFromBody = "rejectionReason" in updatePayload ? updatePayload.rejectionReason : currentEvent.rejectionReason;
+          const reasonStr = typeof reasonFromBody === "string" ? reasonFromBody : reasonFromBody == null ? null : String(reasonFromBody);
+          const transition = assertEventApprovalUpdate({
+            fromApproval,
+            toApproval,
+            toActive,
+            isVendor: scopePut.type === "vendor",
+            requireApproval: requireEventApproval,
+            approvalChanged: "approvalStatus" in updatePayload,
+            activeChanged: "isActive" in updatePayload,
+            rejectionReason: reasonStr
+          });
+          if (!transition.ok) return json({
+            error: transition.error
+          }, {
+            status: 400
+          });
+          if ("approvalStatus" in updatePayload && scopePut.type !== "vendor") {
+            const session = await getHydratedSessionUser?.() ?? null;
+            const rejectedByRaw = session?.id != null ? Number(session.id) : null;
+            applyEventApprovalStatusSideEffects(updatePayload, {
+              toApproval,
+              currentActive: fromActive,
+              rejectionReason: reasonStr,
+              rejectedBy: Number.isFinite(rejectedByRaw) ? rejectedByRaw : null
+            });
+          }
+        }
       }
       if (resource === "product_categories" && scopePut.type === "all") {
         const existingCatalogCat = await repo.findOne({
@@ -5917,6 +6434,34 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
       }
+      if (resource === "brands" && scopePut.type === "all") {
+        const existingCatalogBrand = await repo.findOne({
+          where: {
+            id: numericId,
+            deleted: false
+          }
+        });
+        if (existingCatalogBrand && existingCatalogBrand.isCatalog === true) {
+          applyPlatformCatalogBrandFields(updatePayload);
+          const slug = String(updatePayload.slug ?? existingCatalogBrand.slug ?? "").trim();
+          if (slug && "slug" in updatePayload) {
+            const dup = await repo.findOne({
+              where: {
+                slug,
+                isCatalog: true,
+                deleted: false
+              }
+            });
+            if (dup && Number(dup.id) !== numericId) {
+              return json({
+                error: "A catalog brand with this slug already exists"
+              }, {
+                status: 400
+              });
+            }
+          }
+        }
+      }
       if (resource === "addresses" && Object.keys(updatePayload).length > 0) {
         const currentRow = await repo.findOne({
           where: {
@@ -6072,9 +6617,11 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       const authError = await authz(req, resource, "delete");
       if (authError) return authError;
       const scopeDeleteEarly = await resolveScopeById();
-      if (vendorCannotMutateCatalogCategories(resource, scopeDeleteEarly)) {
+      const catalogFlagsDelete = await getVendorCatalogCreateFlags(dataSource);
+      if (vendorCannotMutateCatalogResource(resource, scopeDeleteEarly, catalogFlagsDelete)) {
+        const label = resource === "product_categories" ? "Categories" : resource === "collections" ? "Collections" : resource === "brands" ? "Brands" : "This resource";
         return json({
-          error: "Categories are managed by the platform administrator"
+          error: `${label} are managed by the platform administrator`
         }, {
           status: 403
         });
@@ -6103,7 +6650,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         });
         if (resourceUsesVendorScope(resource)) {
-          const deleteDenied = vendorScopeAccessJson(existing, scopeDelete, resource);
+          const deleteDenied = await vendorScopeAccessJson(existing, scopeDelete, resource);
           if (deleteDenied) return deleteDenied;
         } else if (!existing) {
           return json({
@@ -6161,7 +6708,7 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             id: numericId
           }
         });
-        const hardDeleteDenied = vendorScopeAccessJson(existingHard, scopeDelete, resource);
+        const hardDeleteDenied = await vendorScopeAccessJson(existingHard, scopeDelete, resource);
         if (hardDeleteDenied) return hardDeleteDenied;
       }
       const result = await repo.delete(numericId);
@@ -12256,6 +12803,13 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
+        if (body.activation === "password" || body.user?.password) {
+          return json({
+            error: "Setting a password during vendor onboard is no longer supported. Create the vendor, then send an invite or copy the invite link so the owner can set their own password."
+          }, {
+            status: 400
+          });
+        }
         const profile = parseVendorProfileFromBody(body.vendor, {
           defaultRegistrationStatus: "approved"
         });
@@ -12265,34 +12819,8 @@ function createVendorOnboardHandlers(config) {
         }, {
           status: 400
         });
-        const activation = body.activation === "password" ? "password" : "invite";
-        const sendOwnerEmail = body.sendOwnerEmail !== false && body.sendInviteEmail !== false;
-        let ownerPasswordHash = null;
-        if (activation === "password") {
-          const plain = body.user?.password?.trim();
-          if (!plain) {
-            return json({
-              error: "Password is required when activating with a set password"
-            }, {
-              status: 400
-            });
-          }
-          if (plain.length < minPasswordLength) {
-            return json({
-              error: `Password must be at least ${minPasswordLength} characters`
-            }, {
-              status: 400
-            });
-          }
-          if (!hashPassword) {
-            return json({
-              error: "Password hashing is not configured on the server"
-            }, {
-              status: 501
-            });
-          }
-          ownerPasswordHash = await hashPassword(plain);
-        }
+        const activation = "invite";
+        const ownerPasswordHash = null;
         const slug = trimOrNull(body.vendor?.slug) || slugify(vendorName);
         if (!slug) return json({
           error: "Could not derive vendor slug"
@@ -12349,7 +12877,7 @@ function createVendorOnboardHandlers(config) {
               email: userEmail,
               phone: ownerPhone,
               password: ownerPasswordHash,
-              blocked: activation === "invite",
+              blocked: true,
               groupId: ownerGroup.id,
               adminAccess: true,
               updatedAt: /* @__PURE__ */ new Date()
@@ -12366,15 +12894,14 @@ function createVendorOnboardHandlers(config) {
             email: userEmail,
             phone: ownerPhone,
             password: ownerPasswordHash,
-            blocked: activation === "invite",
+            blocked: true,
             groupId: ownerGroup.id,
             adminAccess: true
           }));
-          const baseMetadata = buildVendorMetadata(null, {
+          const metadata = applyRotatingVendorInvite(buildVendorMetadata(null, {
             ownerDesignation,
             termsAccepted: true
-          });
-          const metadata = activation === "invite" ? applyRotatingVendorInvite(baseMetadata) : baseMetadata;
+          }));
           const vendor = await vendorRepo.save(vendorRepo.create({
             name: vendorName,
             slug,
@@ -12442,39 +12969,14 @@ function createVendorOnboardHandlers(config) {
           };
         });
         let inviteLink;
-        let emailSent = false;
-        if (activation === "invite") {
-          const token = readVendorInviteToken(result.vendor.metadata);
-          if (token) {
-            inviteLink = buildVendorInviteLink(baseUrl, token);
-          }
-        }
-        if (sendOwnerEmail) {
-          emailSent = await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: true
-          });
-        } else if (getCms) {
-          await trySendVendorOnboardEmails({
-            vendorName,
-            vendorSlug: slug,
-            ownerName: userName,
-            ownerEmail: userEmail,
-            activation,
-            inviteLink,
-            sendToOwner: false
-          });
+        const token = readVendorInviteToken(result.vendor.metadata);
+        if (token) {
+          inviteLink = buildVendorInviteLink(baseUrl, token);
         }
-        const message = activation === "password" ? emailSent ? "Vendor onboarded successfully. Welcome email sent to the owner." : sendOwnerEmail ? "Vendor onboarded successfully. Owner can sign in with the password you set (welcome email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Owner can sign in with the password you set." : emailSent ? "Vendor onboarded successfully. Invite email sent." : sendOwnerEmail ? "Vendor onboarded successfully. Invite link created (email may not have been sent \u2014 check email plugin)." : "Vendor onboarded successfully. Share the invite link with the owner.";
         return json({
-          message,
+          message: "Vendor created successfully.",
           activation,
-          emailSent,
+          emailSent: false,
           vendor: result.vendor,
           user: {
             id: result.user.id,
@@ -12509,9 +13011,11 @@ function createVendorOnboardHandlers(config) {
         });
       }
       let sendEmail = true;
+      let rotate = true;
       try {
         const body = await req.json().catch(() => ({}));
         if (body.sendEmail === false) sendEmail = false;
+        if (body.rotate === false) rotate = false;
       } catch {
       }
       try {
@@ -12577,12 +13081,16 @@ function createVendorOnboardHandlers(config) {
             status: 400
           });
         }
-        const rotatedMetadata = applyRotatingVendorInvite(v.metadata);
-        await vendorRepo.update(vendorId, {
-          metadata: rotatedMetadata,
-          inviteStatus: "pending"
-        });
-        const token = readVendorInviteToken(rotatedMetadata);
+        const nextMetadata = rotate ? applyRotatingVendorInvite(v.metadata) : {
+          ...v.metadata ?? {}
+        };
+        if (rotate || v.inviteStatus !== "pending") {
+          await vendorRepo.update(vendorId, {
+            metadata: nextMetadata,
+            inviteStatus: "pending"
+          });
+        }
+        const token = readVendorInviteToken(nextMetadata);
         if (!token) {
           return json({
             error: "Failed to generate invite token"
@@ -12603,8 +13111,9 @@ function createVendorOnboardHandlers(config) {
             sendToOwner: true
           });
         }
+        const rotatedNote = rotate ? " Previous invite link is no longer valid." : "";
         return json({
-          message: emailSent ? "Invite resent. Previous invite link is no longer valid." : sendEmail ? "New invite link created (email may not have been sent \u2014 check email plugin). Previous link is invalid." : "New invite link created. Previous invite link is no longer valid.",
+          message: emailSent ? `Invite email sent.${rotatedNote}` : sendEmail ? `Invite link ready (email may not have been sent \u2014 check email plugin).${rotatedNote}` : rotate ? "New invite link created. Previous invite link is no longer valid." : "Invite link ready.",
           emailSent,
           inviteLink,
           inviteStatus: "pending"
@@ -17072,6 +17581,7 @@ var Brand = class {
     __name(this, "Brand");
   }
   id;
+  /** Null for platform catalog brands (`isCatalog`). */
   vendorId;
   name;
   slug;
@@ -17079,6 +17589,8 @@ var Brand = class {
   metadata;
   description;
   active;
+  /** Platform-wide catalog brand — vendors pick these on products unless allowed to create their own. */
+  isCatalog;
   sortOrder;
   createdAt;
   updatedAt;
@@ -17098,8 +17610,10 @@ _ts_decorate30([
   _ts_metadata30("design:type", Number)
 ], Brand.prototype, "id", void 0);
 _ts_decorate30([
-  Column("int"),
-  _ts_metadata30("design:type", Number)
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata30("design:type", Object)
 ], Brand.prototype, "vendorId", void 0);
 _ts_decorate30([
   Column("varchar"),
@@ -17133,6 +17647,12 @@ _ts_decorate30([
   }),
   _ts_metadata30("design:type", Boolean)
 ], Brand.prototype, "active", void 0);
+_ts_decorate30([
+  Column("boolean", {
+    default: false
+  }),
+  _ts_metadata30("design:type", Boolean)
+], Brand.prototype, "isCatalog", void 0);
 _ts_decorate30([
   Column("int", {
     default: 0
@@ -17192,12 +17712,13 @@ _ts_decorate30([
 ], Brand.prototype, "seoId", void 0);
 _ts_decorate30([
   ManyToOne(() => Vendor, {
-    onDelete: "RESTRICT"
+    onDelete: "RESTRICT",
+    nullable: true
   }),
   JoinColumn({
     name: "vendorId"
   }),
-  _ts_metadata30("design:type", typeof Vendor === "undefined" ? Object : Vendor)
+  _ts_metadata30("design:type", Object)
 ], Brand.prototype, "vendor", void 0);
 _ts_decorate30([
   ManyToOne(() => Seo, {
@@ -17481,6 +18002,14 @@ var Product = class {
   currencyPrices;
   quantity;
   status;
+  /**
+  * Separate from catalog status. Used when multi_vendor.requireProductApproval is on.
+  * `approved` also forces `status = available` (live).
+  */
+  approvalStatus;
+  rejectionReason;
+  rejectedAt;
+  rejectedBy;
   featured;
   metadata;
   createdAt;
@@ -17604,6 +18133,31 @@ _ts_decorate32([
   }),
   _ts_metadata32("design:type", String)
 ], Product.prototype, "status", void 0);
+_ts_decorate32([
+  Column("varchar", {
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], Product.prototype, "approvalStatus", void 0);
+_ts_decorate32([
+  Column("text", {
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], Product.prototype, "rejectionReason", void 0);
+_ts_decorate32([
+  Column({
+    type: "timestamptz",
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], Product.prototype, "rejectedAt", void 0);
+_ts_decorate32([
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata32("design:type", Object)
+], Product.prototype, "rejectedBy", void 0);
 _ts_decorate32([
   Column("boolean", {
     default: false
@@ -20692,6 +21246,14 @@ var Event = class {
   expectedSpeakers;
   expectedParticipants;
   isActive;
+  /**
+  * Separate from isActive. Used when events.requireEventApproval is on.
+  * `approved` also forces `isActive = true` (live).
+  */
+  approvalStatus;
+  rejectionReason;
+  rejectedAt;
+  rejectedBy;
   comingSoon;
   bannerImageUrl;
   logoUrl;
@@ -20786,6 +21348,31 @@ _ts_decorate60([
   }),
   _ts_metadata60("design:type", Boolean)
 ], Event.prototype, "isActive", void 0);
+_ts_decorate60([
+  Column("varchar", {
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], Event.prototype, "approvalStatus", void 0);
+_ts_decorate60([
+  Column("text", {
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], Event.prototype, "rejectionReason", void 0);
+_ts_decorate60([
+  Column({
+    type: "timestamptz",
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], Event.prototype, "rejectedAt", void 0);
+_ts_decorate60([
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata60("design:type", Object)
+], Event.prototype, "rejectedBy", void 0);
 _ts_decorate60([
   Column("boolean", {
     default: false
@@ -21346,18 +21933,20 @@ _ts_decorate63([
 ], Combo.prototype, "desc", void 0);
 _ts_decorate63([
   Column({
-    type: "integer"
+    type: "integer",
+    nullable: true
   }),
-  _ts_metadata63("design:type", Number)
+  _ts_metadata63("design:type", Object)
 ], Combo.prototype, "eventId", void 0);
 _ts_decorate63([
   ManyToOne(() => Event, {
-    onDelete: "CASCADE"
+    onDelete: "CASCADE",
+    nullable: true
   }),
   JoinColumn({
     name: "eventId"
   }),
-  _ts_metadata63("design:type", typeof Event === "undefined" ? Object : Event)
+  _ts_metadata63("design:type", Object)
 ], Combo.prototype, "event", void 0);
 _ts_decorate63([
   Column({
@@ -26670,16 +27259,24 @@ function createCmsApiHandler(config) {
           if (pe) return pe;
           if (group === "multi_vendor") {
             invalidateMultiVendorCache();
+            invalidateVendorCatalogCreateFlagsCache();
+            invalidateRequireProductApprovalCache();
+            invalidateRequireEventApprovalCache();
           }
           if (group === "events") {
             invalidateEventsCache();
+            invalidateRequireEventApprovalCache();
           }
           const res = await settingsHandlers.PUT(req, group);
           if (group === "multi_vendor") {
             invalidateMultiVendorCache();
+            invalidateVendorCatalogCreateFlagsCache();
+            invalidateRequireProductApprovalCache();
+            invalidateRequireEventApprovalCache();
           }
           if (group === "events") {
             invalidateEventsCache();
+            invalidateRequireEventApprovalCache();
           }
           return res;
         }
@@ -30984,4 +31581,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyRotatingVendorInvite, applyVendorCustomersContactFilter, assertCaptchaOk, assertContactAllowedForVendorOrder, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRssArticleSummaryFromItem, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };