@infuro/cms-core 1.0.43 → 1.0.45

package/dist/{chunk-IX7X4ILO.js → chunk-MVXLRANV.js}

@@ -10,7 +10,7 @@ import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUse
 import { queueErp } from './chunk-SYBOCAWB.js';
 import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { __name } from './chunk-SHUYVCID.js';
-import { PrimaryGeneratedColumn, Column, Entity, ManyToOne, JoinColumn, OneToMany, Index, ManyToMany, JoinTable, Unique, CreateDateColumn, UpdateDateColumn, In, IsNull, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan } from 'typeorm';
+import { PrimaryGeneratedColumn, Column, Entity, ManyToOne, JoinColumn, OneToMany, Index, ManyToMany, JoinTable, Unique, CreateDateColumn, UpdateDateColumn, In, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan, IsNull } from 'typeorm';
 import { Country, State, City } from 'country-state-city';
 import crypto2, { randomBytes, randomUUID, createHmac, timingSafeEqual, randomInt } from 'crypto';
 import Parser from 'rss-parser';
@@ -36,6 +36,7 @@ async function queryVendorLinks(dataSource, userId) {
         vr."name" AS "vendorRoleName",
         vr."isOwnerRole" AS "isOwnerRole"
       FROM "vendor_users" vu
+      INNER JOIN "vendors" v ON v.id = vu."vendorId" AND v.deleted = false
       LEFT JOIN "vendor_roles" vr ON vr.id = vu."vendorRoleId" AND vr.deleted = false
       WHERE vu."userId" = $1
       ORDER BY vu.id ASC
@@ -45,10 +46,11 @@ async function queryVendorLinks(dataSource, userId) {
   } catch (err) {
     if (!isMissingVendorRoleSchemaError(err)) throw err;
     const legacy = await dataSource.query(`
-      SELECT "vendorId", "role"
-      FROM "vendor_users"
-      WHERE "userId" = $1
-      ORDER BY id ASC
+      SELECT vu."vendorId" AS "vendorId", vu."role" AS "role"
+      FROM "vendor_users" vu
+      INNER JOIN "vendors" v ON v.id = vu."vendorId" AND v.deleted = false
+      WHERE vu."userId" = $1
+      ORDER BY vu.id ASC
       `, [
       userId
     ]);
@@ -62,8 +64,36 @@ async function queryVendorLinks(dataSource, userId) {
   }
 }
 __name(queryVendorLinks, "queryVendorLinks");
+async function queryOwnedVendorIds(dataSource, userId) {
+  try {
+    const rows = await dataSource.query(`
+      SELECT id
+      FROM "vendors"
+      WHERE "userId" = $1 AND deleted = false
+      ORDER BY id ASC
+      `, [
+      userId
+    ]);
+    return rows.map((r) => Number(r.id)).filter((id) => Number.isFinite(id) && id > 0);
+  } catch {
+    return [];
+  }
+}
+__name(queryOwnedVendorIds, "queryOwnedVendorIds");
 async function loadUserVendorContext(dataSource, userId, preferredVendorId) {
   const rows = await queryVendorLinks(dataSource, userId);
+  const linkIds = new Set(rows.map((r) => Number(r.vendorId)));
+  for (const ownedId of await queryOwnedVendorIds(dataSource, userId)) {
+    if (linkIds.has(ownedId)) continue;
+    rows.push({
+      vendorId: ownedId,
+      role: "owner",
+      vendorRoleId: null,
+      vendorRoleName: null,
+      isOwnerRole: true
+    });
+    linkIds.add(ownedId);
+  }
   const vendorIds = rows.map((r) => Number(r.vendorId));
   const activeRow = preferredVendorId != null ? rows.find((r) => Number(r.vendorId) === preferredVendorId) : void 0;
   const primary = activeRow ?? rows[0];
@@ -452,6 +482,41 @@ function applyApprovalStatusSideEffects(updatePayload, opts) {
   }
 }
 __name(applyApprovalStatusSideEffects, "applyApprovalStatusSideEffects");
+async function syncProductVariantsStatusWithProduct(dataSource, entityMap, productId, productStatus) {
+  if (!entityMap.product_variants || !Number.isFinite(productId) || productId < 1) return;
+  const status = String(productStatus || "draft");
+  const repo = dataSource.getRepository(entityMap.product_variants);
+  if (status === "available") {
+    await repo.createQueryBuilder().update().set({
+      status: "available"
+    }).where('"productId" = :productId', {
+      productId
+    }).andWhere("status = :from", {
+      from: "draft"
+    }).execute();
+    return;
+  }
+  if (status === "draft") {
+    await repo.createQueryBuilder().update().set({
+      status: "draft"
+    }).where('"productId" = :productId', {
+      productId
+    }).andWhere("status = :from", {
+      from: "available"
+    }).execute();
+  }
+}
+__name(syncProductVariantsStatusWithProduct, "syncProductVariantsStatusWithProduct");
+function coerceVariantStatusForProduct(variantStatus, productStatus, opts) {
+  const next = String(variantStatus ?? "draft").trim() || "draft";
+  const productLive = String(productStatus ?? "draft") === "available";
+  const approvalOk = !opts?.requireApproval || String(opts?.approvalStatus ?? "") === "approved";
+  if (!productLive || !approvalOk) {
+    return "draft";
+  }
+  return next;
+}
+__name(coerceVariantStatusForProduct, "coerceVariantStatusForProduct");
 
 // src/lib/event-approval.ts
 var EVENT_APPROVAL_STATUSES = [
@@ -1055,11 +1120,118 @@ function pgErrorCode(err) {
   return driver?.code ?? err.code;
 }
 __name(pgErrorCode, "pgErrorCode");
-function customerPhoneForUser(userId, phone) {
+function normalizeCustomerPhone(phone) {
   const p = typeof phone === "string" ? phone.trim() : "";
-  return p || `u-${userId}`;
+  return p || null;
+}
+__name(normalizeCustomerPhone, "normalizeCustomerPhone");
+function isSyntheticCustomerPhone(phone) {
+  const p = String(phone ?? "").trim();
+  if (!p) return true;
+  if (p.startsWith("e-") || p.startsWith("u-")) return true;
+  if (p.includes("@")) return true;
+  return false;
+}
+__name(isSyntheticCustomerPhone, "isSyntheticCustomerPhone");
+function customerPhoneForUser(_userId, phone) {
+  return normalizeCustomerPhone(phone);
 }
 __name(customerPhoneForUser, "customerPhoneForUser");
+function customerPhoneForEmail(_email, phone) {
+  return normalizeCustomerPhone(phone);
+}
+__name(customerPhoneForEmail, "customerPhoneForEmail");
+function resolveNextPhone(inputPhone, existingPhone) {
+  if (inputPhone) return inputPhone;
+  const existing = normalizeCustomerPhone(existingPhone);
+  if (!existing || isSyntheticCustomerPhone(existing)) return null;
+  return existing;
+}
+__name(resolveNextPhone, "resolveNextPhone");
+async function ensureCustomerRecord(dsOrEm, customerEntity, input) {
+  const repo = dsOrEm.getRepository(customerEntity);
+  const email = normalizeEmail(input.email);
+  if (!email) return null;
+  const name = String(input.name ?? "").trim() || email.split("@")[0] || "Customer";
+  const userId = input.userId != null && Number.isFinite(Number(input.userId)) && Number(input.userId) > 0 ? Number(input.userId) : null;
+  const phone = normalizeCustomerPhone(input.phone);
+  let row = await repo.findOne({
+    where: {
+      email,
+      deleted: false
+    }
+  });
+  if (!row) {
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+  }
+  if (row) {
+    const existingUserId = row.userId;
+    if (userId != null && existingUserId != null && existingUserId !== userId) {
+      return null;
+    }
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    const patch = {
+      name,
+      phone: nextPhone,
+      deleted: false,
+      deletedAt: null,
+      deletedBy: null,
+      updatedAt: /* @__PURE__ */ new Date()
+    };
+    if (userId != null && existingUserId == null) {
+      patch.userId = userId;
+    }
+    await repo.update(row.id, patch);
+    return {
+      id: row.id
+    };
+  }
+  try {
+    const created = await repo.save(repo.create({
+      userId,
+      name,
+      email,
+      phone,
+      deleted: false
+    }));
+    return {
+      id: created.id
+    };
+  } catch (err) {
+    const code = pgErrorCode(err);
+    if (code === "25P02") throw err;
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+    if (row) {
+      const existingUserId = row.userId;
+      if (userId != null && existingUserId != null && existingUserId !== userId) return null;
+      await repo.update(row.id, {
+        name,
+        phone: resolveNextPhone(phone, row.phone),
+        ...userId != null && existingUserId == null ? {
+          userId
+        } : {},
+        deleted: false,
+        deletedAt: null,
+        deletedBy: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return {
+        id: row.id
+      };
+    }
+    if (code === "23505") return null;
+    throw err;
+  }
+}
+__name(ensureCustomerRecord, "ensureCustomerRecord");
 async function restoreCustomerRow(repo, row, user, name, email, phone) {
   const id = row.id;
   await repo.update(id, {
@@ -1081,7 +1253,7 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
   const repo = dsOrEm.getRepository(customerEntity);
   const email = normalizeEmail(user.email);
   const name = String(user.name ?? "").trim() || email.split("@")[0] || "User";
-  const phone = customerPhoneForUser(user.id, overrides?.phone ?? user.phone);
+  const phone = normalizeCustomerPhone(overrides?.phone ?? user.phone);
   let row = await repo.findOne({
     where: {
       userId: user.id,
@@ -1089,10 +1261,11 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
     }
   });
   if (row) {
+    const nextPhone = resolveNextPhone(phone, row.phone);
     await repo.update(row.id, {
       name,
       email,
-      phone,
+      phone: nextPhone,
       updatedAt: /* @__PURE__ */ new Date()
     });
     return {
@@ -1110,10 +1283,11 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
     if (existingUserId != null && existingUserId !== user.id) {
       return null;
     }
+    const nextPhone = resolveNextPhone(phone, row.phone);
     await repo.update(row.id, {
       userId: user.id,
       name,
-      phone,
+      phone: nextPhone,
       updatedAt: /* @__PURE__ */ new Date()
     });
     return {
@@ -1128,21 +1302,23 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
   if (deletedByEmail) {
     const existingUserId = deletedByEmail.userId;
     if (existingUserId != null && existingUserId !== user.id) return null;
-    return restoreCustomerRow(repo, deletedByEmail, user, name, email, phone);
+    return restoreCustomerRow(repo, deletedByEmail, user, name, email, resolveNextPhone(phone, deletedByEmail.phone));
   }
-  const deletedByPhone = await repo.findOne({
-    where: {
-      phone
-    }
-  });
-  if (deletedByPhone) {
-    const existingUserId = deletedByPhone.userId;
-    if (existingUserId != null && existingUserId !== user.id) {
-      return ensureCustomerForUser(dsOrEm, customerEntity, user, {
-        phone: `u-${user.id}-${Date.now()}`
-      });
+  if (phone) {
+    const deletedByPhone = await repo.findOne({
+      where: {
+        phone
+      }
+    });
+    if (deletedByPhone) {
+      const existingUserId = deletedByPhone.userId;
+      if (existingUserId != null && existingUserId !== user.id) {
+        return ensureCustomerForUser(dsOrEm, customerEntity, user, {
+          phone: null
+        });
+      }
+      return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
     }
-    return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
   }
   try {
     const created = await repo.save(repo.create({
@@ -1163,34 +1339,22 @@ async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
         userId: user.id
       }
     });
-    if (row) return restoreCustomerRow(repo, row, user, name, email, phone);
+    if (row) {
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
+    }
     row = await repo.findOne({
       where: {
         email
       }
     });
     if (row && (row.userId ?? user.id) === user.id) {
-      return restoreCustomerRow(repo, row, user, name, email, phone);
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
     }
     if (code === "23505") return null;
     throw err;
   }
 }
 __name(ensureCustomerForUser, "ensureCustomerForUser");
-async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
-  const repo = dataSource.getRepository(contactsEntity);
-  const found = await repo.findOne({
-    where: {
-      email,
-      userId: IsNull(),
-      deleted: false
-    }
-  });
-  if (found) await repo.update(found.id, {
-    userId
-  });
-}
-__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
 
 // src/lib/vendor-customer-contacts.ts
 function isCustomerTypeContact(type) {
@@ -1283,8 +1447,27 @@ function resolveVendorIdForContactCheck(scope, bodyOrRow) {
   return Number.isFinite(n) ? n : null;
 }
 __name(resolveVendorIdForContactCheck, "resolveVendorIdForContactCheck");
+function uniquePositiveIds(ids) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of ids) {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0 || seen.has(n)) continue;
+    seen.add(n);
+    out.push(n);
+  }
+  return out;
+}
+__name(uniquePositiveIds, "uniquePositiveIds");
 async function ensureVendorCustomerForOrderContact(dataSource, entityMap, vendorId, contactId, details) {
-  if (!Number.isFinite(vendorId) || !Number.isFinite(contactId)) return;
+  await ensureVendorCustomersForOrder(dataSource, entityMap, [
+    vendorId
+  ], contactId, details);
+}
+__name(ensureVendorCustomerForOrderContact, "ensureVendorCustomerForOrderContact");
+async function ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, contactId, details) {
+  const vendors = uniquePositiveIds(vendorIds);
+  if (vendors.length === 0 || !Number.isFinite(contactId) || contactId <= 0) return;
   const vcEntity = entityMap.vendor_customers;
   const contactEntity = entityMap.contacts;
   if (!vcEntity || !contactEntity) return;
@@ -1310,96 +1493,61 @@ async function ensureVendorCustomerForOrderContact(dataSource, entityMap, vendor
   }
   let customerId = null;
   if (entityMap.customer) {
-    const customerRepo = dataSource.getRepository(entityMap.customer);
-    const existingCustomer = await customerRepo.findOne({
-      where: {
-        email,
-        deleted: false
-      }
+    const ensured = await ensureCustomerRecord(dataSource, entityMap.customer, {
+      name,
+      email,
+      phone,
+      userId: null
     });
-    if (existingCustomer) {
-      customerId = Number(existingCustomer.id);
-    } else if (entityMap.users) {
-      const userRepo = dataSource.getRepository(entityMap.users);
-      let user = await userRepo.findOne({
+    if (ensured) customerId = ensured.id;
+  }
+  for (const vendorId of vendors) {
+    if (customerId != null) {
+      const byCustomer = await vcRepo.findOne({
         where: {
-          email,
-          deleted: false
+          vendorId,
+          customerId
         }
       });
-      if (!user) {
-        let groupId = null;
-        if (entityMap.user_groups) {
-          const userGroupRepo = dataSource.getRepository(entityMap.user_groups);
-          const customerGroup = await userGroupRepo.findOne({
-            where: {
-              name: "Customer",
-              deleted: false
-            }
+      if (byCustomer) {
+        const existingContactId = byCustomer.contactId;
+        if (existingContactId == null) {
+          await vcRepo.update(byCustomer.id, {
+            contactId
           });
-          if (customerGroup) groupId = Number(customerGroup.id);
         }
-        user = await userRepo.save(userRepo.create({
-          name,
-          email,
-          phone,
-          password: null,
-          blocked: false,
-          groupId,
-          adminAccess: false
-        }));
+        continue;
       }
-      const userId = Number(user.id);
-      await linkUnclaimedContactToUser(dataSource, contactEntity, userId, email);
-      const ensured = await ensureCustomerForUser(dataSource, entityMap.customer, {
-        id: userId,
-        name,
-        email,
-        phone
-      }, {
-        phone
-      });
-      if (ensured) customerId = ensured.id;
     }
-  }
-  if (customerId != null) {
-    const byCustomer = await vcRepo.findOne({
+    const byContact = await vcRepo.findOne({
       where: {
         vendorId,
-        customerId
+        contactId
       }
     });
-    if (byCustomer) {
-      const existingContactId = byCustomer.contactId;
-      if (existingContactId == null) {
-        await vcRepo.update(byCustomer.id, {
-          contactId
+    if (byContact) {
+      if (customerId != null && byContact.customerId == null) {
+        await vcRepo.update(byContact.id, {
+          customerId
         });
       }
-      return;
+      continue;
     }
-  }
-  const byContact = await vcRepo.findOne({
-    where: {
-      vendorId,
-      contactId
+    if (customerId != null) {
+      await vcRepo.save(vcRepo.create({
+        vendorId,
+        customerId,
+        contactId
+      }));
+    } else {
+      await vcRepo.save(vcRepo.create({
+        vendorId,
+        contactId
+      }));
     }
-  });
-  if (byContact) return;
-  if (customerId != null) {
-    await vcRepo.save(vcRepo.create({
-      vendorId,
-      customerId,
-      contactId
-    }));
-    return;
   }
-  await vcRepo.save(vcRepo.create({
-    vendorId,
-    contactId
-  }));
 }
-__name(ensureVendorCustomerForOrderContact, "ensureVendorCustomerForOrderContact");
+__name(ensureVendorCustomersForOrder, "ensureVendorCustomersForOrder");
 
 // src/lib/currency-prices.ts
 function normalizeCurrencyCode(code) {
@@ -3765,23 +3913,24 @@ function createCrudHandler(dataSource, entityMap, options) {
       if (resource === "vendor_customers" && entityMap["customer"]) {
         const scope = await resolveVendorCustomersScope(dataSource, entityMap, resolveScope);
         const repo2 = dataSource.getRepository(entity);
-        const qb = repo2.createQueryBuilder("vc").leftJoinAndSelect("vc.customer", "customer").leftJoinAndSelect("customer.user", "user").orderBy("vc.createdAt", sortOrder === "DESC" ? "DESC" : "ASC").skip(skip).take(limit);
+        const qb = repo2.createQueryBuilder("vc").leftJoinAndSelect("vc.customer", "customer").leftJoinAndSelect("customer.user", "user").leftJoinAndSelect("vc.contact", "contact").orderBy("vc.createdAt", sortOrder === "DESC" ? "DESC" : "ASC").skip(skip).take(limit);
         applyVendorScopeToQueryBuilder(qb, "vc", scope);
         if (search && typeof search === "string" && search.trim()) {
           const term = `%${search.trim()}%`;
-          qb.andWhere("(customer.name ILIKE :term OR customer.email ILIKE :term OR customer.phone ILIKE :term)", {
+          qb.andWhere("(customer.name ILIKE :term OR customer.email ILIKE :term OR customer.phone ILIKE :term OR contact.name ILIKE :term OR contact.email ILIKE :term OR contact.phone ILIKE :term)", {
             term
           });
         }
         const [rows, total2] = await qb.getManyAndCount();
         const data2 = rows.map((row) => {
           const customer = row.customer;
+          const contact = row.contact;
           return {
             ...row,
-            name: customer?.name ?? null,
-            email: customer?.email ?? null,
-            phone: customer?.phone ?? null,
-            company: customer?.company ?? null
+            name: customer?.name ?? contact?.name ?? null,
+            email: customer?.email ?? contact?.email ?? null,
+            phone: customer?.phone ?? contact?.phone ?? null,
+            company: customer?.company ?? contact?.company ?? null
           };
         });
         return json({
@@ -4115,7 +4264,11 @@ function createCrudHandler(dataSource, entityMap, options) {
         } else if (resource === "collections") {
           if (scope.type === "vendor") {
             where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
-          } else if (searchParams.get("isCatalog") !== "true") {
+          } else if (searchParams.get("isCatalog") === "true") {
+            where = mergeListWhereAnd(where, {
+              isCatalog: true
+            });
+          } else if (searchParams.get("isCatalog") === "false") {
             where = mergeListWhereAnd(where, {
               isCatalog: false
             });
@@ -4312,41 +4465,17 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 503
           });
         }
-        if (!entityMap["users"]) {
-          return json({
-            error: "Users entity not configured"
-          }, {
-            status: 503
-          });
-        }
-        let customerGroupId = null;
-        if (entityMap["user_groups"]) {
-          const userGroupRepo = dataSource.getRepository(entityMap["user_groups"]);
-          const customerGroup = await userGroupRepo.findOne({
-            where: {
-              name: "Customer",
-              deleted: false
-            }
-          });
-          if (!customerGroup) {
-            return json({
-              error: "User group 'customer' not found"
-            }, {
-              status: 500
-            });
-          }
-          customerGroupId = Number(customerGroup.id);
-        } else {
+        if (!entityMap["contacts"]) {
           return json({
-            error: "user_groups entity not configured"
+            error: "Contacts entity not configured"
           }, {
             status: 503
           });
         }
         const name = String(body.name ?? "").trim();
-        const email = String(body.email ?? "").trim();
-        const phone = String(body.phone ?? "").trim();
-        const rawPw = String(body._password ?? "").trim();
+        const email = String(body.email ?? "").trim().toLowerCase();
+        const phoneRaw = String(body.phone ?? "").trim();
+        const phone = phoneRaw || null;
         if (!name) return json({
           error: "name is required"
         }, {
@@ -4357,25 +4486,7 @@ function createCrudHandler(dataSource, entityMap, options) {
         }, {
           status: 400
         });
-        if (!phone) return json({
-          error: "phone is required"
-        }, {
-          status: 400
-        });
-        if (!rawPw) return json({
-          error: "password is required"
-        }, {
-          status: 400
-        });
-        if (rawPw.length < 6) {
-          return json({
-            error: "Password must be at least 6 characters"
-          }, {
-            status: 400
-          });
-        }
         const customerRepo = dataSource.getRepository(entityMap["customer"]);
-        const userRepo = dataSource.getRepository(entityMap["users"]);
         const dupCustEmail = await customerRepo.findOne({
           where: {
             email,
@@ -4389,49 +4500,26 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 409
           });
         }
-        const dupCustPhone = await customerRepo.findOne({
-          where: {
-            phone,
-            deleted: false
-          }
-        });
-        if (dupCustPhone) {
-          return json({
-            error: "A customer with this phone number already exists"
-          }, {
-            status: 409
+        if (phone) {
+          const dupCustPhone = await customerRepo.findOne({
+            where: {
+              phone,
+              deleted: false
+            }
           });
-        }
-        let userId;
-        const dupUser = await userRepo.findOne({
-          where: {
-            email,
-            deleted: false
+          if (dupCustPhone) {
+            return json({
+              error: "A customer with this phone number already exists"
+            }, {
+              status: 409
+            });
           }
-        });
-        if (dupUser) {
-          userId = Number(dupUser.id);
-        } else {
-          const bcrypt = await import('bcryptjs');
-          const hashedPassword = await bcrypt.hash(rawPw, 10);
-          const savedUser = await userRepo.save(userRepo.create({
-            name,
-            email,
-            phone,
-            password: hashedPassword,
-            groupId: customerGroupId,
-            adminAccess: false,
-            blocked: false
-          }));
-          userId = Number(savedUser.id);
         }
-        const savedCustomer = await ensureCustomerForUser(dataSource, entityMap["customer"], {
-          id: userId,
+        const savedCustomer = await ensureCustomerRecord(dataSource, entityMap["customer"], {
           name,
           email,
-          phone
-        }, {
-          phone
+          phone,
+          userId: null
         });
         if (!savedCustomer) {
           return json({
@@ -4440,37 +4528,37 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 409
           });
         }
-        const customerRepo2 = dataSource.getRepository(entityMap["customer"]);
-        const customerRow = await customerRepo2.findOne({
+        const contactRepo = dataSource.getRepository(entityMap["contacts"]);
+        let contact = await contactRepo.findOne({
           where: {
-            id: savedCustomer.id,
+            email,
             deleted: false
           }
-        }) ?? savedCustomer;
-        if (entityMap["contacts"]) {
-          const contactRepo = dataSource.getRepository(entityMap["contacts"]);
-          const existingContact = await contactRepo.findOne({
-            where: {
-              email,
-              deleted: false
-            }
-          });
-          if (!existingContact) {
-            await contactRepo.save(contactRepo.create({
-              name,
-              email,
-              phone: phone || null,
-              type: "customer"
-            }));
-          } else {
-            const t = existingContact.type;
-            if (t == null || t === "" || String(t).toLowerCase() !== "customer") {
-              await contactRepo.update(existingContact.id, {
-                type: "customer"
-              });
-            }
-          }
+        });
+        if (!contact) {
+          contact = await contactRepo.save(contactRepo.create({
+            name,
+            email,
+            phone: phone || null,
+            type: "customer"
+          }));
+        } else {
+          const t = contact.type;
+          const patch = {
+            name,
+            phone: phone || contact.phone || null
+          };
+          if (t == null || t === "" || String(t).toLowerCase() !== "customer") {
+            patch.type = "customer";
+          }
+          await contactRepo.update(contact.id, patch);
+          contact = {
+            ...contact,
+            ...patch,
+            id: contact.id
+          };
         }
+        const contactId = Number(contact.id);
         const scope = await resolveVendorCustomersScope(dataSource, entityMap, resolveScope);
         let vendorId = null;
         if (scope.type === "vendor") {
@@ -4486,19 +4574,25 @@ function createCrudHandler(dataSource, entityMap, options) {
             status: 400
           });
         }
-        const vcRepo = dataSource.getRepository(entity);
-        const existingLink = await vcRepo.findOne({
+        await ensureVendorCustomersForOrder(dataSource, entityMap, [
+          vendorId
+        ], contactId, {
+          name,
+          email,
+          phone
+        });
+        const customerRow = await customerRepo.findOne({
           where: {
-            customerId: savedCustomer.id
+            id: savedCustomer.id,
+            deleted: false
           }
         });
-        if (!existingLink) {
-          await vcRepo.save(vcRepo.create({
-            customerId: savedCustomer.id,
-            vendorId
-          }));
-        }
-        return json(customerRow, {
+        return json(customerRow ?? {
+          id: savedCustomer.id,
+          name,
+          email,
+          phone
+        }, {
           status: 201
         });
       }
@@ -4594,6 +4688,26 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
         }
       }
+      if (resource === "product_variants" && entityMap.products) {
+        const productIdRaw = persistBody.productId;
+        const productId = typeof productIdRaw === "number" ? productIdRaw : typeof productIdRaw === "string" && /^\d+$/.test(productIdRaw) ? parseInt(productIdRaw, 10) : NaN;
+        if (Number.isFinite(productId)) {
+          const parent = await dataSource.getRepository(entityMap.products).findOne({
+            where: {
+              id: productId
+            }
+          });
+          const parentStatus = parent?.status;
+          const parentApproval = parent?.approvalStatus;
+          const requireApproval = await getRequireProductApproval(dataSource);
+          persistBody.status = coerceVariantStatusForProduct(persistBody.status, parentStatus, {
+            approvalStatus: parentApproval,
+            requireApproval
+          });
+        } else if (!("status" in persistBody)) {
+          persistBody.status = "draft";
+        }
+      }
       if (resource === "products") {
         const scopeForProduct = await resolveScope();
         const productFlags = await getVendorCatalogCreateFlags(dataSource);
@@ -4926,6 +5040,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           }
           const nameRaw = String(body["contact.name"] ?? contact.name ?? "").trim();
           const phoneRaw = body["contact.phone"] ?? contact.phone;
+          const emailForVc = (emailRaw || String(contact.email ?? "")).trim().toLowerCase();
           const phoneToSave = phoneRaw == null || phoneRaw === "" ? null : String(phoneRaw).trim();
           if (phoneToSave && contact.phone !== phoneToSave) {
             await contactRepo.update(contact.id, {
@@ -4934,21 +5049,45 @@ function createCrudHandler(dataSource, entityMap, options) {
             contact.phone = phoneToSave;
           }
           const vendorIdForCustomer = resolveVendorIdForContactCheck(scopeCreate, persistBody);
-          const selectedExistingCustomer = Number(body.customerId);
-          if (vendorIdForCustomer != null && (!Number.isFinite(selectedExistingCustomer) || selectedExistingCustomer <= 0)) {
-            await ensureVendorCustomerForOrderContact(dataSource, entityMap, vendorIdForCustomer, contact.id, {
-              name: nameRaw || emailRaw.split("@")[0] || "Customer",
-              email: emailRaw,
+          const orderLinesForVendors = normalizeOrderLinesInput(body.orderLines);
+          const vendorIdsForVc = [];
+          if (vendorIdForCustomer != null) vendorIdsForVc.push(vendorIdForCustomer);
+          if (orderLinesForVendors?.length && entityMap.products) {
+            const productRepoForVc = dataSource.getRepository(entityMap.products);
+            for (const line of orderLinesForVendors) {
+              const pid = Number(line.productId);
+              if (!Number.isFinite(pid)) continue;
+              const product = await productRepoForVc.findOne({
+                where: {
+                  id: pid
+                }
+              });
+              const pVid = Number(product?.vendorId);
+              if (Number.isFinite(pVid) && pVid > 0) vendorIdsForVc.push(pVid);
+            }
+          }
+          if (vendorIdsForVc.length > 0 && emailForVc) {
+            await ensureVendorCustomersForOrder(dataSource, entityMap, vendorIdsForVc, contact.id, {
+              name: nameRaw || emailForVc.split("@")[0] || "Customer",
+              email: emailForVc,
               phone: phoneRaw == null || phoneRaw === "" ? null : String(phoneRaw)
             });
-          } else if (vendorIdForCustomer != null) {
-            const contactErr = await assertContactAllowedForVendorOrder(dataSource, entityMap, vendorIdForCustomer, contact.id);
-            if (contactErr) {
-              return json({
-                error: contactErr
-              }, {
-                status: 400
-              });
+          }
+          const accountCustomerId = Number(body.accountCustomerId);
+          if (entityMap.customer_contacts && Number.isFinite(accountCustomerId) && accountCustomerId > 0) {
+            const ccRepo = dataSource.getRepository(entityMap.customer_contacts);
+            const orderContactId = contact.id;
+            const existingLink = await ccRepo.findOne({
+              where: {
+                customerId: accountCustomerId,
+                contactId: orderContactId
+              }
+            });
+            if (!existingLink) {
+              await ccRepo.save(ccRepo.create({
+                customerId: accountCustomerId,
+                contactId: orderContactId
+              }));
             }
           }
           const randomPart = Math.floor(1e4 + Math.random() * 9e4);
@@ -6233,6 +6372,34 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           delete u.parentId;
         }
       }
+      if (resource === "product_variants" && entityMap.products) {
+        const currentVariant = await repo.findOne({
+          where: {
+            id: numericId
+          }
+        });
+        if (!currentVariant) return json({
+          message: "Not found"
+        }, {
+          status: 404
+        });
+        const productId = "productId" in updatePayload && updatePayload.productId != null ? Number(updatePayload.productId) : Number(currentVariant.productId);
+        if (Number.isFinite(productId)) {
+          const parent = await dataSource.getRepository(entityMap.products).findOne({
+            where: {
+              id: productId
+            }
+          });
+          const parentStatus = parent?.status;
+          const parentApproval = parent?.approvalStatus;
+          const requireApproval = await getRequireProductApproval(dataSource);
+          const nextStatus = "status" in updatePayload ? updatePayload.status : currentVariant.status;
+          updatePayload.status = coerceVariantStatusForProduct(nextStatus, parentStatus, {
+            approvalStatus: parentApproval,
+            requireApproval
+          });
+        }
+      }
       if (resource === "products") {
         const currentRow = await repo.findOne({
           where: {
@@ -6588,6 +6755,10 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           if (reloaded) updated = reloaded;
         }
         updated = hydrateProductDisplayName(updated);
+        const productStatus = String(updated.status ?? "draft");
+        if (Number.isFinite(updatedId) && updatedId > 0) {
+          await syncProductVariantsStatusWithProduct(dataSource, entityMap, updatedId, productStatus);
+        }
         if (getCms) {
           const cms = await getCms();
           await queueErpProductUpsertIfEnabled(cms, dataSource, entityMap, updated);
@@ -6696,6 +6867,14 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
           }
         }
         await repo.update(numericId, buildSoftDeletePayload(repo.metadata, deletedBy));
+        if ((resource === "forms" || resource === "vendors") && existing && typeof existing.slug === "string") {
+          const slug = String(existing.slug).trim();
+          if (slug && !slug.includes("__deleted_")) {
+            await repo.update(numericId, {
+              slug: `${slug}__deleted_${numericId}`
+            });
+          }
+        }
         return json({
           message: "Deleted successfully"
         }, {
@@ -6725,7 +6904,21 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
     }
   };
 }
-__name(createCrudByIdHandler, "createCrudByIdHandler");
+__name(createCrudByIdHandler, "createCrudByIdHandler");
+async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
+  const repo = dataSource.getRepository(contactsEntity);
+  const found = await repo.findOne({
+    where: {
+      email,
+      userId: IsNull(),
+      deleted: false
+    }
+  });
+  if (found) await repo.update(found.id, {
+    userId
+  });
+}
+__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
 var VENDOR_INVITE_METADATA_TOKEN = "inviteToken";
 var VENDOR_INVITE_METADATA_EXPIRES = "inviteExpiresAt";
 var VENDOR_INVITE_METADATA_SENT = "inviteSentAt";
@@ -7458,6 +7651,50 @@ async function findLlmAgentByScope(dataSource, entityMap, scope, options = {}) {
 }
 __name(findLlmAgentByScope, "findLlmAgentByScope");
 
+// src/lib/retire-soft-deleted-unique.ts
+async function retireSoftDeletedUniqueValue(repo, column, value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed) return;
+  const cols = new Set(repo.metadata.columns.map((c) => c.propertyName));
+  if (!cols.has(column) || !cols.has("deleted")) return;
+  const rows = await repo.find({
+    where: {
+      [column]: trimmed,
+      deleted: true
+    }
+  });
+  for (const row of rows) {
+    const id = row.id;
+    if (!Number.isFinite(id)) continue;
+    const current = String(row[column] ?? "");
+    if (current.includes("__deleted_")) continue;
+    await repo.update(id, {
+      [column]: `${trimmed}__deleted_${id}`
+    });
+  }
+}
+__name(retireSoftDeletedUniqueValue, "retireSoftDeletedUniqueValue");
+async function activeUniqueValueExists(repo, column, value, excludeId) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed) return false;
+  const cols = new Set(repo.metadata.columns.map((c) => c.propertyName));
+  if (!cols.has(column)) return false;
+  const qb = repo.createQueryBuilder("row").where(`row.${column} = :value`, {
+    value: trimmed
+  });
+  if (cols.has("deleted")) {
+    qb.andWhere("row.deleted = false");
+  }
+  if (excludeId != null && Number.isFinite(excludeId) && excludeId > 0) {
+    qb.andWhere("row.id != :excludeId", {
+      excludeId
+    });
+  }
+  const hit = await qb.getOne();
+  return !!hit;
+}
+__name(activeUniqueValueExists, "activeUniqueValueExists");
+
 // src/lib/media-folder-path.ts
 function sanitizeMediaFolderPath(input) {
   if (input == null) return "";
@@ -8851,6 +9088,17 @@ function createFormSaveHandlers(config) {
         });
         const fields = Array.isArray(body.fields) ? body.fields : [];
         const { fields: _f, ...formRow } = body;
+        const slug = typeof formRow.slug === "string" ? formRow.slug.trim() : "";
+        if (slug) {
+          if (await activeUniqueValueExists(formRepo(), "slug", slug)) {
+            return json({
+              error: "A form with this slug already exists"
+            }, {
+              status: 400
+            });
+          }
+          await retireSoftDeletedUniqueValue(formRepo(), "slug", slug);
+        }
         const form = await formRepo().save(formRepo().create(formRow));
         for (let i = 0; i < fields.length; i++) {
           const row = normalizeFieldRow(fields[i], form.id);
@@ -8874,6 +9122,14 @@ function createFormSaveHandlers(config) {
           status: 201
         });
       } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg)) {
+          return json({
+            error: "A form with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         return json({
           error: "Server Error"
         }, {
@@ -8922,6 +9178,20 @@ function createFormSaveHandlers(config) {
         ]) {
           if (body[key] !== void 0) formRow[key] = body[key];
         }
+        if (typeof formRow.slug === "string") {
+          const slug = formRow.slug.trim();
+          formRow.slug = slug;
+          if (slug) {
+            if (await activeUniqueValueExists(formRepo(), "slug", slug, formId)) {
+              return json({
+                error: "A form with this slug already exists"
+              }, {
+                status: 400
+              });
+            }
+            await retireSoftDeletedUniqueValue(formRepo(), "slug", slug);
+          }
+        }
         if (Object.keys(formRow).length > 0) await formRepo().update(formId, formRow);
         await fieldRepo().delete({
           formId
@@ -8950,6 +9220,14 @@ function createFormSaveHandlers(config) {
           status: 404
         });
       } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg)) {
+          return json({
+            error: "A form with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         return json({
           error: "Server Error"
         }, {
@@ -9531,6 +9809,7 @@ function createUsersApiHandlers(config) {
             "id",
             "name",
             "email",
+            "phone",
             "blocked",
             "createdAt",
             "updatedAt",
@@ -9560,6 +9839,11 @@ function createUsersApiHandlers(config) {
       }
       try {
         const uid = parseInt(id, 10);
+        if (!Number.isFinite(uid)) return json({
+          error: "Invalid id"
+        }, {
+          status: 400
+        });
         const existing = await userRepo().findOne({
           where: {
             id: uid,
@@ -9572,8 +9856,59 @@ function createUsersApiHandlers(config) {
           status: 404
         });
         const body = await req.json();
-        const { password: _p, ...safe } = body;
-        await userRepo().update(uid, safe);
+        const patch = {
+          updatedAt: /* @__PURE__ */ new Date()
+        };
+        if (typeof body.name === "string") patch.name = body.name.trim();
+        if (typeof body.email === "string") patch.email = body.email.trim().toLowerCase();
+        if (body.blocked !== void 0) {
+          patch.blocked = body.blocked === true || body.blocked === "true" || body.blocked === 1 || body.blocked === "1";
+        }
+        if (body.adminAccess !== void 0) {
+          patch.adminAccess = body.adminAccess === true || body.adminAccess === "true" || body.adminAccess === 1 || body.adminAccess === "1";
+        }
+        if (body.groupId !== void 0) {
+          if (body.groupId === null || body.groupId === "") {
+            patch.groupId = null;
+          } else {
+            const gid = Number(body.groupId);
+            if (!Number.isFinite(gid)) {
+              return json({
+                error: "Invalid groupId"
+              }, {
+                status: 400
+              });
+            }
+            patch.groupId = gid;
+          }
+        }
+        if (body.phone !== void 0) {
+          const phone = body.phone == null ? null : String(body.phone).trim();
+          patch.phone = phone || null;
+        }
+        if (Object.keys(patch).length <= 1) {
+          return json({
+            error: "No valid fields to update"
+          }, {
+            status: 400
+          });
+        }
+        if (typeof patch.email === "string" && patch.email !== existing.email) {
+          const emailTaken = await userRepo().findOne({
+            where: {
+              email: patch.email,
+              deleted: false
+            }
+          });
+          if (emailTaken && Number(emailTaken.id) !== uid) {
+            return json({
+              error: "Email already in use"
+            }, {
+              status: 400
+            });
+          }
+        }
+        await userRepo().update(uid, patch);
         const updated = await userRepo().findOne({
           where: {
             id: uid,
@@ -9586,6 +9921,7 @@ function createUsersApiHandlers(config) {
             "id",
             "name",
             "email",
+            "phone",
             "blocked",
             "createdAt",
             "updatedAt",
@@ -9597,7 +9933,8 @@ function createUsersApiHandlers(config) {
         }, {
           status: 404
         });
-      } catch {
+      } catch (err) {
+        console.error("[users.update]", err);
         return json({
           error: "Server Error"
         }, {
@@ -12645,6 +12982,39 @@ function slugify(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 __name(slugify, "slugify");
+async function userHasActiveVendor(em, entityMap, userId) {
+  const vendorRepo = em.getRepository(entityMap.vendors);
+  const owned = await vendorRepo.findOne({
+    where: {
+      userId,
+      deleted: false
+    }
+  });
+  if (owned) return true;
+  if (!entityMap.vendor_users) return false;
+  const link = await em.getRepository(entityMap.vendor_users).createQueryBuilder("vu").innerJoin("vendors", "v", 'v.id = vu."vendorId" AND v.deleted = false').where('vu."userId" = :userId', {
+    userId
+  }).getOne();
+  return !!link;
+}
+__name(userHasActiveVendor, "userHasActiveVendor");
+async function userHadAnyVendor(em, entityMap, userId) {
+  const vendorRepo = em.getRepository(entityMap.vendors);
+  const owned = await vendorRepo.findOne({
+    where: {
+      userId
+    }
+  });
+  if (owned) return true;
+  if (!entityMap.vendor_users) return false;
+  const link = await em.getRepository(entityMap.vendor_users).findOne({
+    where: {
+      userId
+    }
+  });
+  return !!link;
+}
+__name(userHadAnyVendor, "userHadAnyVendor");
 function vendorOnboardErrorResponse(json, err) {
   const msg = err instanceof Error ? err.message : String(err);
   console.error("[vendor-onboard]", err);
@@ -12743,14 +13113,80 @@ function createVendorOnboardHandlers(config) {
   __name(gateAdmin, "gateAdmin");
   async function resolveActiveVendorId(u) {
     const scope = resolveVendorScopeFromSessionUser(u);
-    if (scope.type === "vendor") return scope.vendorId;
-    if (scope.type === "all") {
-      const id = u.activeVendorId ?? u.vendorIds?.[0];
-      return id != null && Number.isFinite(id) ? id : null;
+    const candidates = [];
+    if (scope.type === "vendor") candidates.push(scope.vendorId);
+    if (scope.type === "all" || scope.type === "vendor") {
+      const preferred = u.activeVendorId ?? u.vendorIds?.[0];
+      if (preferred != null && Number.isFinite(preferred)) candidates.push(Number(preferred));
+      for (const id of u.vendorIds ?? []) {
+        if (Number.isFinite(id)) candidates.push(Number(id));
+      }
+    }
+    if (entityMap.vendors && candidates.length > 0) {
+      const unique = [
+        ...new Set(candidates.filter((id) => id > 0))
+      ];
+      for (const id of unique) {
+        try {
+          const row = await dataSource.getRepository(entityMap.vendors).findOne({
+            where: {
+              id,
+              deleted: false
+            }
+          });
+          if (row) return id;
+        } catch {
+        }
+      }
+    }
+    const uid = u.id != null ? Number(u.id) : NaN;
+    if (Number.isFinite(uid) && entityMap.vendors) {
+      try {
+        const owned = await dataSource.getRepository(entityMap.vendors).findOne({
+          where: {
+            userId: uid,
+            deleted: false
+          },
+          order: {
+            id: "ASC"
+          }
+        });
+        const vid = owned ? Number(owned.id) : NaN;
+        if (Number.isFinite(vid) && vid > 0) return vid;
+      } catch {
+      }
     }
     return null;
   }
   __name(resolveActiveVendorId, "resolveActiveVendorId");
+  async function gateVendorPortal() {
+    const u = await getSessionUser();
+    if (!u?.email) return json({
+      error: "Unauthorized"
+    }, {
+      status: 401
+    });
+    if (!isVendorPortalUser(u) && !isPlatformAdministrator(u)) {
+      return json({
+        error: "Forbidden"
+      }, {
+        status: 403
+      });
+    }
+    const vendorId = await resolveActiveVendorId(u);
+    if (vendorId == null) {
+      return json({
+        error: "No vendor is linked to your account."
+      }, {
+        status: 400
+      });
+    }
+    return {
+      user: u,
+      vendorId
+    };
+  }
+  __name(gateVendorPortal, "gateVendorPortal");
   async function gateVendorTeam() {
     const u = await getSessionUser();
     if (!u?.email) return json({
@@ -12804,6 +13240,40 @@ function createVendorOnboardHandlers(config) {
   }
   __name(trySendVendorOnboardEmails, "trySendVendorOnboardEmails");
   return {
+    /** GET /api/admin/vendor/profile — current user's store (server-resolved vendor id). */
+    async getProfile() {
+      const gated = await gateVendorPortal();
+      if (gated instanceof Response) return gated;
+      const { vendorId } = gated;
+      if (!entityMap.vendors) {
+        return json({
+          error: "Vendors not configured"
+        }, {
+          status: 500
+        });
+      }
+      try {
+        const row = await dataSource.getRepository(entityMap.vendors).findOne({
+          where: {
+            id: vendorId,
+            deleted: false
+          }
+        });
+        if (!row) return json({
+          error: "Vendor not found"
+        }, {
+          status: 404
+        });
+        return json(row);
+      } catch (e) {
+        console.error("[vendor.profile]", e);
+        return json({
+          error: "Failed to load vendor profile"
+        }, {
+          status: 500
+        });
+      }
+    },
     /** POST /api/admin/vendors/onboard — create vendor + owner user + vendor_users + invite */
     async onboard(req) {
       const err = await gateAdmin();
@@ -12872,6 +13342,7 @@ function createVendorOnboardHandlers(config) {
             }
           });
           if (dupVendor) throw new Error("VENDOR_SLUG_EXISTS");
+          await retireSoftDeletedUniqueValue(vendorRepo, "slug", slug);
           let ownerGroup = await groupRepo.findOne({
             where: {
               name: VENDOR_OWNER_GROUP_NAME,
@@ -12900,8 +13371,15 @@ function createVendorOnboardHandlers(config) {
               email: userEmail
             }
           });
-          if (existingUser && !existingUser.deleted) throw new Error("USER_EMAIL_EXISTS");
-          const newUser = existingUser?.deleted ? await (async () => {
+          if (existingUser && !existingUser.deleted) {
+            if (await userHasActiveVendor(em, entityMap, existingUser.id)) {
+              throw new Error("USER_EMAIL_EXISTS");
+            }
+            if (!await userHadAnyVendor(em, entityMap, existingUser.id)) {
+              throw new Error("USER_EMAIL_EXISTS");
+            }
+          }
+          const newUser = existingUser ? await (async () => {
             await userRepo.update(existingUser.id, {
               deleted: false,
               deletedAt: null,
@@ -15984,10 +16462,12 @@ var Customer = class {
     __name(this, "Customer");
   }
   id;
+  /** Set only when the customer can log in (linked `users` row). Admin/guest customers stay null. */
   userId;
   user;
   name;
   email;
+  /** Optional; multiple customers may have null (PostgreSQL UNIQUE allows multiple NULLs). */
   phone;
   createdAt;
   updatedAt;
@@ -16002,8 +16482,10 @@ _ts_decorate18([
   _ts_metadata18("design:type", Number)
 ], Customer.prototype, "id", void 0);
 _ts_decorate18([
-  Column("int"),
-  _ts_metadata18("design:type", Number)
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata18("design:type", Object)
 ], Customer.prototype, "userId", void 0);
 _ts_decorate18([
   ManyToOne(() => User, {
@@ -16026,9 +16508,10 @@ _ts_decorate18([
 ], Customer.prototype, "email", void 0);
 _ts_decorate18([
   Column("varchar", {
-    unique: true
+    unique: true,
+    nullable: true
   }),
-  _ts_metadata18("design:type", String)
+  _ts_metadata18("design:type", Object)
 ], Customer.prototype, "phone", void 0);
 _ts_decorate18([
   Column({
@@ -26612,6 +27095,14 @@ function createCmsApiHandler(config) {
         });
         return vendorHandlers.switchVendor(req);
       }
+      if (path2[0] === "admin" && path2[1] === "vendor" && path2[2] === "profile" && path2.length === 3 && m === "GET") {
+        if (!vendorHandlers) return config.json({
+          error: "Not found"
+        }, {
+          status: 404
+        });
+        return vendorHandlers.getProfile();
+      }
       if (path2[0] === "admin" && path2[1] === "vendor" && path2[2] === "roles" && vendorRolesHandlers) {
         if (path2.length === 3 && m === "GET") return vendorRolesHandlers.list();
         if (path2.length === 3 && m === "POST") return vendorRolesHandlers.create(req);
@@ -29081,13 +29572,36 @@ function createStorefrontApiHandler(config) {
         status: 400
       };
     }
+    const list = [
+      ...vendorIds
+    ];
     return {
-      vendorId: [
-        ...vendorIds
-      ][0]
+      vendorId: list[0],
+      vendorIds: list
     };
   }
   __name(resolveSingleVendorIdFromCart, "resolveSingleVendorIdFromCart");
+  async function linkOrderContactToVendors(contactId, vendorIds) {
+    try {
+      const contact = await contactRepo().findOne({
+        where: {
+          id: contactId,
+          deleted: false
+        }
+      });
+      if (!contact) return;
+      const email = String(contact.email ?? "").trim().toLowerCase();
+      if (!email) return;
+      await ensureVendorCustomersForOrder(dataSource, entityMap, vendorIds, contactId, {
+        name: String(contact.name ?? "").trim() || email.split("@")[0] || "Customer",
+        email,
+        phone: contact.phone ?? null
+      });
+    } catch (err) {
+      console.error("[storefront] vendor_customers link failed", err);
+    }
+  }
+  __name(linkOrderContactToVendors, "linkOrderContactToVendors");
   function roundMoney3(n) {
     return Math.round(n * 100) / 100;
   }
@@ -29805,7 +30319,8 @@ function createStorefrontApiHandler(config) {
     const repo = dataSource.getRepository(entityMap.product_variants);
     const rows = await repo.find({
       where: {
-        productId
+        productId,
+        status: "available"
       },
       order: {
         id: "ASC"
@@ -29838,6 +30353,52 @@ function createStorefrontApiHandler(config) {
     return result;
   }
   __name(loadProductVariantsWithPricing, "loadProductVariantsWithPricing");
+  async function loadApplicableVendorPolicies(productId, vendorId) {
+    if (!entityMap.refund_policies) return [];
+    const policyRepo = dataSource.getRepository(entityMap.refund_policies);
+    const format = /* @__PURE__ */ __name((row) => ({
+      id: Number(row.id),
+      name: String(row.name ?? "").trim(),
+      desc: row.desc != null ? String(row.desc) : null,
+      refundWindowDays: Number(row.refundWindowDays) || 0,
+      type: String(row.type ?? "percentage"),
+      value: Number(row.value) || 0
+    }), "format");
+    const linkedIds = /* @__PURE__ */ new Set();
+    if (entityMap.product_config) {
+      const configs = await dataSource.getRepository(entityMap.product_config).find({
+        where: {
+          productId
+        }
+      });
+      for (const c of configs) {
+        const id = Number(c.refundPolicyId);
+        if (Number.isFinite(id) && id > 0) linkedIds.add(id);
+      }
+    }
+    if (linkedIds.size > 0) {
+      const rows = await policyRepo.find({
+        where: {
+          id: In([
+            ...linkedIds
+          ])
+        }
+      });
+      return rows.map((r) => format(r)).filter((p) => p.name).sort((a, b) => a.id - b.id);
+    }
+    if (vendorId == null || !Number.isFinite(Number(vendorId))) return [];
+    const vendorRows = await policyRepo.find({
+      where: {
+        vendorId: Number(vendorId),
+        status: "active"
+      },
+      order: {
+        id: "ASC"
+      }
+    });
+    return vendorRows.map((r) => format(r)).filter((p) => p.name);
+  }
+  __name(loadApplicableVendorPolicies, "loadApplicableVendorPolicies");
   return {
     async handle(method, path2, req) {
       try {
@@ -29905,13 +30466,11 @@ function createStorefrontApiHandler(config) {
           const url = new URL(req.url || "", "http://localhost");
           const collectionSlug = url.searchParams.get("collection")?.trim();
           const collectionId = url.searchParams.get("collectionId");
+          const q = url.searchParams.get("q")?.trim() ?? "";
           const limit = Math.min(100, Math.max(1, parseInt(url.searchParams.get("limit") || "20", 10)));
           const offset = Math.max(0, parseInt(url.searchParams.get("offset") || "0", 10));
-          const where = {
-            status: "available",
-            deleted: false
-          };
           let collectionFilter = null;
+          let collectionIdFilter = null;
           if (collectionSlug) {
             let col = null;
             if (/^\d+$/.test(collectionSlug)) {
@@ -29938,30 +30497,59 @@ function createStorefrontApiHandler(config) {
                 collection: null
               });
             }
-            where.collectionId = col.id;
+            collectionIdFilter = Number(col.id);
             collectionFilter = {
               name: col.name,
               slug: col.slug
             };
           } else if (collectionId) {
             const cid = parseInt(collectionId, 10);
-            if (Number.isFinite(cid)) where.collectionId = cid;
+            if (Number.isFinite(cid)) collectionIdFilter = cid;
+          }
+          let items = [];
+          let total = 0;
+          if (q) {
+            const like = `%${q.replace(/[%_]/g, "\\$&")}%`;
+            const qb = productRepo().createQueryBuilder("p").where("p.status = :status", {
+              status: "available"
+            }).andWhere("p.deleted = :del", {
+              del: false
+            }).andWhere(`(p.name ILIKE :like OR p.slug ILIKE :like OR COALESCE(p.sku, '') ILIKE :like OR COALESCE(p.title, '') ILIKE :like OR COALESCE(p.metadata->>'description', '') ILIKE :like)`, {
+              like
+            }).orderBy("p.id", "ASC").take(limit).skip(offset);
+            if (collectionIdFilter != null) {
+              qb.andWhere("p.collectionId = :cid", {
+                cid: collectionIdFilter
+              });
+            }
+            [items, total] = await qb.getManyAndCount();
+          } else {
+            const where = {
+              status: "available",
+              deleted: false
+            };
+            if (collectionIdFilter != null) where.collectionId = collectionIdFilter;
+            const result = await productRepo().findAndCount({
+              where,
+              order: {
+                id: "ASC"
+              },
+              take: limit,
+              skip: offset
+            });
+            items = result[0];
+            total = result[1];
           }
-          const [items, total] = await productRepo().findAndCount({
-            where,
-            order: {
-              id: "ASC"
-            },
-            take: limit,
-            skip: offset
-          });
           const products = await Promise.all(items.map((item) => enrichProductPricing(item)));
           return json({
             products,
             total,
             ...collectionFilter && {
               collection: collectionFilter
-            }
+            },
+            ...q ? {
+              q
+            } : {}
           });
         }
         if (path2[0] === "products" && path2.length === 2 && method === "GET") {
@@ -29997,12 +30585,14 @@ function createStorefrontApiHandler(config) {
           const pricing = await resolveProductEventPricing(Number(p.id));
           const enriched = await enrichProductPricing(p, pricing);
           const variants = await loadProductVariantsWithPricing(Number(p.id), pricing);
+          const policies = await loadApplicableVendorPolicies(Number(p.id), p.vendorId != null ? Number(p.vendorId) : null);
           return json({
             ...enriched,
             attributes: attributeTags,
             ...variants.length ? {
               variants
-            } : {}
+            } : {},
+            policies
           });
         }
         if (path2[0] === "collections" && path2.length === 1 && method === "GET") {
@@ -30814,24 +31404,61 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const rawVariantId = body.variantId ?? body.variant_id;
+          const variantIdNum = rawVariantId != null && String(rawVariantId).trim() !== "" ? Number(rawVariantId) : NaN;
+          const hasVariantId = Number.isFinite(variantIdNum) && variantIdNum > 0;
+          const bodyMeta = body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata) ? body.metadata : {};
+          const optionsRaw = body.options && typeof body.options === "object" && !Array.isArray(body.options) ? body.options : bodyMeta.options && typeof bodyMeta.options === "object" && !Array.isArray(bodyMeta.options) ? bodyMeta.options : null;
+          const options = optionsRaw && Object.fromEntries(Object.entries(optionsRaw).map(([k, v]) => [
+            String(k),
+            String(v ?? "").trim()
+          ]).filter(([, v]) => v.length > 0));
+          const lineMetadata = {
+            ...bodyMeta,
+            ...hasVariantId ? {
+              variantId: variantIdNum
+            } : {},
+            ...options && Object.keys(options).length ? {
+              options
+            } : {}
+          };
+          if (typeof bodyMeta.imageUrl === "string" && bodyMeta.imageUrl.trim()) {
+            lineMetadata.imageUrl = bodyMeta.imageUrl.trim();
+          }
+          if (typeof bodyMeta.title === "string" && bodyMeta.title.trim()) {
+            lineMetadata.title = bodyMeta.title.trim();
+          }
+          const metadataPayload = Object.keys(lineMetadata).length ? lineMetadata : null;
           const { cart, setCookie, err } = await getOrCreateCart(req);
           if (err) return err;
           const cartId = cart.id;
-          const existing = await cartItemRepo().findOne({
+          const sameProductLines = await cartItemRepo().find({
             where: {
               cartId,
               productId
             }
           });
+          const existing = sameProductLines.find((row) => {
+            const m = row.metadata;
+            const existingVid = m?.variantId ?? m?.variant_id;
+            if (hasVariantId) {
+              return Number(existingVid) === variantIdNum;
+            }
+            return existingVid == null || existingVid === "";
+          });
           if (existing) {
             await cartItemRepo().update(existing.id, {
-              quantity: existing.quantity + quantity
+              quantity: existing.quantity + quantity,
+              ...metadataPayload ? {
+                metadata: metadataPayload
+              } : {}
             });
           } else {
             await cartItemRepo().save(cartItemRepo().create({
               cartId,
               productId,
-              quantity
+              quantity,
+              metadata: metadataPayload
             }));
           }
           await cartRepo().update(cartId, {
@@ -31296,6 +31923,7 @@ function createStorefrontApiHandler(config) {
               taxCode: line.taxCode
             }));
           }
+          await linkOrderContactToVendors(contactId, vendorRes.vendorIds);
           fireOrderPlacedNotification(oid);
           return json({
             orderId: oid,
@@ -31368,6 +31996,7 @@ function createStorefrontApiHandler(config) {
               taxCode: line.taxCode
             }));
           }
+          await linkOrderContactToVendors(contactId, vendorResChk.vendorIds);
           await cartItemRepo().delete({
             cartId: cart.id
           });
@@ -31614,4 +32243,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, findActiveRefundPolicyForVendor, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkEventsEnabled, checkMultiVendorEnabled, contactIsVendorCustomer, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, customerPhoneForEmail, customerPhoneForUser, daysBeforeEventStart, describeEventTierPolicy, ensureCustomerForUser, ensureCustomerRecord, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isSyntheticCustomerPhone, isZipMedia, linkUnclaimedContactToUser, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, normalizeCustomerPhone, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging };