@infuro/cms-core 1.0.71 → 1.0.72

package/dist/admin.cjs

@@ -895,7 +895,7 @@ var init_admin_config_context = __esm({
 var CMS_VERSION;
 var init_cms_version = __esm({
   "src/lib/cms-version.ts"() {
-    CMS_VERSION = "1.0.71" ;
+    CMS_VERSION = "1.0.72" ;
   }
 });
 function useCatalogCategories(enabled = true) {
@@ -24475,7 +24475,8 @@ function DetailPageHeader({ title, subtitle, backHref, backLabel = "Back", close
       size: "icon",
       className: "h-8 w-8 border border-gray-600 bg-transparent text-white hover:bg-gray-700",
       onClick: item.onClick,
-      title: item.label
+      title: item.label,
+      disabled: item.disabled
     }, /* @__PURE__ */ React.createElement(Icon2, {
       className: "h-4 w-4"
     }), /* @__PURE__ */ React.createElement("span", {
@@ -24489,7 +24490,8 @@ function DetailPageHeader({ title, subtitle, backHref, backLabel = "Back", close
       key: i,
       variant: item.variant ?? "outline",
       size: "sm",
-      onClick: item.onClick
+      onClick: item.onClick,
+      disabled: item.disabled
     }, /* @__PURE__ */ React.createElement(Icon2, {
       className: "h-4 w-4 mr-1"
     }), item.label);
@@ -37319,6 +37321,7 @@ function VendorEditPage({ vendorId }) {
   const create = isCreate6(vendorId);
   const [loading, setLoading] = React26.useState(!create);
   const [saving, setSaving] = React26.useState(false);
+  const createInFlightRef = React26.useRef(false);
   const [errors, setErrors] = React26.useState([]);
   const [name, setName] = React26.useState("");
   const [legalName, setLegalName] = React26.useState("");
@@ -37677,7 +37680,7 @@ function VendorEditPage({ vendorId }) {
     router.push(listReturnUrl);
   }, "closeInviteDialog");
   const handleCreate = /* @__PURE__ */ __name(async () => {
-    setSaving(true);
+    if (createInFlightRef.current) return;
     setErrors([]);
     const createMissing = [];
     if (!name.trim()) createMissing.push("Store name is required");
@@ -37685,14 +37688,12 @@ function VendorEditPage({ vendorId }) {
     if (!ownerEmail.trim()) createMissing.push("Owner email is required");
     if (createMissing.length) {
       setErrors(createMissing);
-      setSaving(false);
       return;
     }
     if (!termsAccepted) {
       setErrors([
         "You must confirm that the vendor has accepted the terms and conditions"
       ]);
-      setSaving(false);
       return;
     }
     const formattedOwnerPhone = formatPhoneWithCountryCode(ownerPhoneCode, ownerPhoneNum);
@@ -37703,7 +37704,6 @@ function VendorEditPage({ vendorId }) {
       setErrors([
         taxError
       ]);
-      setSaving(false);
       return;
     }
     const personErr = validatePersonKyc({
@@ -37716,25 +37716,22 @@ function VendorEditPage({ vendorId }) {
       setErrors([
         personErr
       ]);
-      setSaving(false);
       return;
     }
     if (!ownerAddressLine1.trim()) {
       setErrors([
         "Owner address line 1 is required"
       ]);
-      setSaving(false);
       return;
     }
-    const abortController = new AbortController();
-    const timeoutId = setTimeout(() => abortController.abort(), 15e3);
+    createInFlightRef.current = true;
+    setSaving(true);
     try {
       const res = await fetch("/api/admin/vendors/onboard", {
         method: "POST",
         headers: {
           "Content-Type": "application/json"
         },
-        signal: abortController.signal,
         body: JSON.stringify({
           activation: "invite",
           sendOwnerEmail: false,
@@ -37755,7 +37752,6 @@ function VendorEditPage({ vendorId }) {
           }
         })
       });
-      clearTimeout(timeoutId);
       const data = await res.json().catch(() => ({}));
       if (!res.ok) {
         setErrors([
@@ -37781,17 +37777,11 @@ function VendorEditPage({ vendorId }) {
         inviteLink
       });
     } catch (err) {
-      if (err instanceof DOMException && err.name === "AbortError") {
-        setErrors([
-          "Request timed out. Your entered data is preserved. Please click submit again."
-        ]);
-      } else {
-        setErrors([
-          err instanceof Error && err.message || "Request failed"
-        ]);
-      }
+      setErrors([
+        err instanceof Error && err.message || "Request failed"
+      ]);
     } finally {
-      clearTimeout(timeoutId);
+      createInFlightRef.current = false;
       setSaving(false);
     }
   }, "handleCreate");
@@ -37919,13 +37909,15 @@ function VendorEditPage({ vendorId }) {
       {
         label: saving ? "Creating\u2026" : "Create vendor",
         icon: LucideIcons.Save,
-        onClick: handleCreate
+        onClick: handleCreate,
+        disabled: saving
       }
     ] : [
       {
         label: saving ? "Saving\u2026" : "Save",
         icon: LucideIcons.Save,
-        onClick: handleSave
+        onClick: handleSave,
+        disabled: saving
       },
       {
         label: active ? "Deactivate" : "Activate",

package/dist/admin.d.cts

@@ -523,6 +523,7 @@ interface DetailPageHeaderMenuItem {
         className?: string;
     }>;
     variant?: "default" | "outline" | "secondary" | "destructive";
+    disabled?: boolean;
 }
 interface DetailPageHeaderProps {
     title: React.ReactNode;

package/dist/admin.d.ts

@@ -523,6 +523,7 @@ interface DetailPageHeaderMenuItem {
         className?: string;
     }>;
     variant?: "default" | "outline" | "secondary" | "destructive";
+    disabled?: boolean;
 }
 interface DetailPageHeaderProps {
     title: React.ReactNode;

package/dist/admin.js

@@ -861,7 +861,7 @@ var init_admin_config_context = __esm({
 var CMS_VERSION;
 var init_cms_version = __esm({
   "src/lib/cms-version.ts"() {
-    CMS_VERSION = "1.0.71" ;
+    CMS_VERSION = "1.0.72" ;
   }
 });
 function useCatalogCategories(enabled = true) {
@@ -24441,7 +24441,8 @@ function DetailPageHeader({ title, subtitle, backHref, backLabel = "Back", close
       size: "icon",
       className: "h-8 w-8 border border-gray-600 bg-transparent text-white hover:bg-gray-700",
       onClick: item.onClick,
-      title: item.label
+      title: item.label,
+      disabled: item.disabled
     }, /* @__PURE__ */ React.createElement(Icon2, {
       className: "h-4 w-4"
     }), /* @__PURE__ */ React.createElement("span", {
@@ -24455,7 +24456,8 @@ function DetailPageHeader({ title, subtitle, backHref, backLabel = "Back", close
       key: i,
       variant: item.variant ?? "outline",
       size: "sm",
-      onClick: item.onClick
+      onClick: item.onClick,
+      disabled: item.disabled
     }, /* @__PURE__ */ React.createElement(Icon2, {
       className: "h-4 w-4 mr-1"
     }), item.label);
@@ -37285,6 +37287,7 @@ function VendorEditPage({ vendorId }) {
   const create = isCreate6(vendorId);
   const [loading, setLoading] = useState(!create);
   const [saving, setSaving] = useState(false);
+  const createInFlightRef = useRef(false);
   const [errors, setErrors] = useState([]);
   const [name, setName] = useState("");
   const [legalName, setLegalName] = useState("");
@@ -37643,7 +37646,7 @@ function VendorEditPage({ vendorId }) {
     router.push(listReturnUrl);
   }, "closeInviteDialog");
   const handleCreate = /* @__PURE__ */ __name(async () => {
-    setSaving(true);
+    if (createInFlightRef.current) return;
     setErrors([]);
     const createMissing = [];
     if (!name.trim()) createMissing.push("Store name is required");
@@ -37651,14 +37654,12 @@ function VendorEditPage({ vendorId }) {
     if (!ownerEmail.trim()) createMissing.push("Owner email is required");
     if (createMissing.length) {
       setErrors(createMissing);
-      setSaving(false);
       return;
     }
     if (!termsAccepted) {
       setErrors([
         "You must confirm that the vendor has accepted the terms and conditions"
       ]);
-      setSaving(false);
       return;
     }
     const formattedOwnerPhone = formatPhoneWithCountryCode(ownerPhoneCode, ownerPhoneNum);
@@ -37669,7 +37670,6 @@ function VendorEditPage({ vendorId }) {
       setErrors([
         taxError
       ]);
-      setSaving(false);
       return;
     }
     const personErr = validatePersonKyc({
@@ -37682,25 +37682,22 @@ function VendorEditPage({ vendorId }) {
       setErrors([
         personErr
       ]);
-      setSaving(false);
       return;
     }
     if (!ownerAddressLine1.trim()) {
       setErrors([
         "Owner address line 1 is required"
       ]);
-      setSaving(false);
       return;
     }
-    const abortController = new AbortController();
-    const timeoutId = setTimeout(() => abortController.abort(), 15e3);
+    createInFlightRef.current = true;
+    setSaving(true);
     try {
       const res = await fetch("/api/admin/vendors/onboard", {
         method: "POST",
         headers: {
           "Content-Type": "application/json"
         },
-        signal: abortController.signal,
         body: JSON.stringify({
           activation: "invite",
           sendOwnerEmail: false,
@@ -37721,7 +37718,6 @@ function VendorEditPage({ vendorId }) {
           }
         })
       });
-      clearTimeout(timeoutId);
       const data = await res.json().catch(() => ({}));
       if (!res.ok) {
         setErrors([
@@ -37747,17 +37743,11 @@ function VendorEditPage({ vendorId }) {
         inviteLink
       });
     } catch (err) {
-      if (err instanceof DOMException && err.name === "AbortError") {
-        setErrors([
-          "Request timed out. Your entered data is preserved. Please click submit again."
-        ]);
-      } else {
-        setErrors([
-          err instanceof Error && err.message || "Request failed"
-        ]);
-      }
+      setErrors([
+        err instanceof Error && err.message || "Request failed"
+      ]);
     } finally {
-      clearTimeout(timeoutId);
+      createInFlightRef.current = false;
       setSaving(false);
     }
   }, "handleCreate");
@@ -37885,13 +37875,15 @@ function VendorEditPage({ vendorId }) {
       {
         label: saving ? "Creating\u2026" : "Create vendor",
         icon: Save,
-        onClick: handleCreate
+        onClick: handleCreate,
+        disabled: saving
       }
     ] : [
       {
         label: saving ? "Saving\u2026" : "Save",
         icon: Save,
-        onClick: handleSave
+        onClick: handleSave,
+        disabled: saving
       },
       {
         label: active ? "Deactivate" : "Activate",

package/dist/api.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkOP624LWU_cjs = require('./chunk-OP624LWU.cjs');
+var chunkSRGDHASW_cjs = require('./chunk-SRGDHASW.cjs');
 require('./chunk-TTOEY7AH.cjs');
 require('./chunk-KB7EBYPR.cjs');
 require('./chunk-KJB5LBFQ.cjs');
@@ -29,131 +29,131 @@ require('./chunk-XHPRD45G.cjs');
 
 Object.defineProperty(exports, "autoExpireOrderIfPaymentTimeExceeded", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.autoExpireOrderIfPaymentTimeExceeded; }
+  get: function () { return chunkSRGDHASW_cjs.autoExpireOrderIfPaymentTimeExceeded; }
 });
 Object.defineProperty(exports, "createAnalyticsHandlers", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createAnalyticsHandlers; }
+  get: function () { return chunkSRGDHASW_cjs.createAnalyticsHandlers; }
 });
 Object.defineProperty(exports, "createBlogBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createBlogBySlugHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createBlogBySlugHandler; }
 });
 Object.defineProperty(exports, "createChangePasswordHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createChangePasswordHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createChangePasswordHandler; }
 });
 Object.defineProperty(exports, "createCmsApiHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createCmsApiHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createCmsApiHandler; }
 });
 Object.defineProperty(exports, "createCrudByIdHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createCrudByIdHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createCrudByIdHandler; }
 });
 Object.defineProperty(exports, "createCrudHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createCrudHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createCrudHandler; }
 });
 Object.defineProperty(exports, "createDashboardStatsHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createDashboardStatsHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createDashboardStatsHandler; }
 });
 Object.defineProperty(exports, "createEcommerceAnalyticsHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createEcommerceAnalyticsHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createEcommerceAnalyticsHandler; }
 });
 Object.defineProperty(exports, "createForgotPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createForgotPasswordHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createForgotPasswordHandler; }
 });
 Object.defineProperty(exports, "createFormBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createFormBySlugHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createFormBySlugHandler; }
 });
 Object.defineProperty(exports, "createInviteAcceptHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createInviteAcceptHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createInviteAcceptHandler; }
 });
 Object.defineProperty(exports, "createJobScheduleHandlers", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createJobScheduleHandlers; }
+  get: function () { return chunkSRGDHASW_cjs.createJobScheduleHandlers; }
 });
 Object.defineProperty(exports, "createLlmAgentKnowledgeHandlers", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createLlmAgentKnowledgeHandlers; }
+  get: function () { return chunkSRGDHASW_cjs.createLlmAgentKnowledgeHandlers; }
 });
 Object.defineProperty(exports, "createMediaZipExtractHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createMediaZipExtractHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createMediaZipExtractHandler; }
 });
 Object.defineProperty(exports, "createSetPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createSetPasswordHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createSetPasswordHandler; }
 });
 Object.defineProperty(exports, "createSettingsApiHandlers", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createSettingsApiHandlers; }
+  get: function () { return chunkSRGDHASW_cjs.createSettingsApiHandlers; }
 });
 Object.defineProperty(exports, "createStorefrontApiHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createStorefrontApiHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createStorefrontApiHandler; }
 });
 Object.defineProperty(exports, "createUploadHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createUploadHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createUploadHandler; }
 });
 Object.defineProperty(exports, "createUserAuthApiRouter", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createUserAuthApiRouter; }
+  get: function () { return chunkSRGDHASW_cjs.createUserAuthApiRouter; }
 });
 Object.defineProperty(exports, "createUserAvatarHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createUserAvatarHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createUserAvatarHandler; }
 });
 Object.defineProperty(exports, "createUserProfileHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createUserProfileHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createUserProfileHandler; }
 });
 Object.defineProperty(exports, "createUsersApiHandlers", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createUsersApiHandlers; }
+  get: function () { return chunkSRGDHASW_cjs.createUsersApiHandlers; }
 });
 Object.defineProperty(exports, "createVendorDashboardHandler", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createVendorDashboardHandler; }
+  get: function () { return chunkSRGDHASW_cjs.createVendorDashboardHandler; }
 });
 Object.defineProperty(exports, "createVendorOnboardHandlers", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.createVendorOnboardHandlers; }
+  get: function () { return chunkSRGDHASW_cjs.createVendorOnboardHandlers; }
 });
 Object.defineProperty(exports, "getPublicSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.getPublicSettingsGroup; }
+  get: function () { return chunkSRGDHASW_cjs.getPublicSettingsGroup; }
 });
 Object.defineProperty(exports, "mergeGuardrailsIntoSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.mergeGuardrailsIntoSystemPrompt; }
+  get: function () { return chunkSRGDHASW_cjs.mergeGuardrailsIntoSystemPrompt; }
 });
 Object.defineProperty(exports, "parseLlmAgentValidationRules", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.parseLlmAgentValidationRules; }
+  get: function () { return chunkSRGDHASW_cjs.parseLlmAgentValidationRules; }
 });
 Object.defineProperty(exports, "simpleDecrypt", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.simpleDecrypt; }
+  get: function () { return chunkSRGDHASW_cjs.simpleDecrypt; }
 });
 Object.defineProperty(exports, "simpleEncrypt", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.simpleEncrypt; }
+  get: function () { return chunkSRGDHASW_cjs.simpleEncrypt; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstAgentRules", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.validateUserMessageAgainstAgentRules; }
+  get: function () { return chunkSRGDHASW_cjs.validateUserMessageAgainstAgentRules; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstStructuredRules", {
   enumerable: true,
-  get: function () { return chunkOP624LWU_cjs.validateUserMessageAgainstStructuredRules; }
+  get: function () { return chunkSRGDHASW_cjs.validateUserMessageAgainstStructuredRules; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,

package/dist/api.js

@@ -1,4 +1,4 @@
-export { autoExpireOrderIfPaymentTimeExceeded, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-7NQMGB2S.js';
+export { autoExpireOrderIfPaymentTimeExceeded, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-43UVXBEH.js';
 import './chunk-3LF4RYAJ.js';
 import './chunk-ECUGNV2I.js';
 import './chunk-K6JT7BKY.js';

package/dist/{chunk-7NQMGB2S.js → chunk-43UVXBEH.js}

@@ -14423,26 +14423,51 @@ async function sendVendorOnboardEmails(input, deps) {
 __name(sendVendorOnboardEmails, "sendVendorOnboardEmails");
 
 // src/lib/seed-vendor-roles.ts
-async function insertRolePermissions(exec, vendorRoleId, permissions) {
+function appendValuesRow(params, values, cols) {
+  const start = params.length;
+  values.push(`(${cols.map((_, i) => `$${start + i + 1}`).join(", ")})`);
+  params.push(...cols);
+}
+__name(appendValuesRow, "appendValuesRow");
+async function insertRolePermissions(exec, rows) {
+  if (rows.length === 0) return;
+  const values = [];
+  const params = [];
+  for (const row of rows) {
+    appendValuesRow(params, values, [
+      row.vendorRoleId,
+      row.entity,
+      row.canCreate,
+      row.canRead,
+      row.canUpdate,
+      row.canDelete
+    ]);
+  }
+  await exec.query(`
+    INSERT INTO "vendor_role_permissions"
+      ("vendorRoleId", "entity", "canCreate", "canRead", "canUpdate", "canDelete")
+    VALUES ${values.join(", ")}
+    ON CONFLICT ("vendorRoleId", "entity") DO NOTHING
+    `, params);
+}
+__name(insertRolePermissions, "insertRolePermissions");
+function permissionRowsForRole(vendorRoleId, permissions) {
+  const rows = [];
   for (const entity of VENDOR_RBAC_ENTITIES) {
     const flags = permissions[entity];
     if (!flags) continue;
-    await exec.query(`
-      INSERT INTO "vendor_role_permissions"
-        ("vendorRoleId", "entity", "canCreate", "canRead", "canUpdate", "canDelete")
-      VALUES ($1, $2, $3, $4, $5, $6)
-      ON CONFLICT ("vendorRoleId", "entity") DO NOTHING
-      `, [
+    rows.push({
       vendorRoleId,
       entity,
-      flags.canCreate,
-      flags.canRead,
-      flags.canUpdate,
-      flags.canDelete
-    ]);
+      canCreate: flags.canCreate,
+      canRead: flags.canRead,
+      canUpdate: flags.canUpdate,
+      canDelete: flags.canDelete
+    });
   }
+  return rows;
 }
-__name(insertRolePermissions, "insertRolePermissions");
+__name(permissionRowsForRole, "permissionRowsForRole");
 async function seedVendorDefaultRoles(em, vendorId) {
   const exec = em;
   const existing = await exec.query(`SELECT id, name, "isOwnerRole" FROM "vendor_roles" WHERE "vendorId" = $1 AND "deleted" = false`, [
@@ -14463,29 +14488,40 @@ async function seedVendorDefaultRoles(em, vendorId) {
       viewerRoleId: viewerRoleId2
     };
   }
-  const roleIdsByName = {};
-  let ownerRoleId = 0;
-  let viewerRoleId = 0;
+  const roleValues = [];
+  const roleParams = [];
   for (const def of DEFAULT_VENDOR_ROLE_DEFS) {
-    const inserted = await exec.query(`
-      INSERT INTO "vendor_roles"
-        ("vendorId", "name", "description", "isSystem", "isOwnerRole")
-      VALUES ($1, $2, $3, $4, $5)
-      RETURNING id
-      `, [
+    appendValuesRow(roleParams, roleValues, [
       vendorId,
       def.name,
       def.description,
       def.isSystem,
       def.isOwnerRole
     ]);
-    const roleId = Number(inserted[0]?.id);
+  }
+  const inserted = await exec.query(`
+    INSERT INTO "vendor_roles"
+      ("vendorId", "name", "description", "isSystem", "isOwnerRole")
+    VALUES ${roleValues.join(", ")}
+    RETURNING id, name, "isOwnerRole"
+    `, roleParams);
+  const roleIdsByName = {};
+  let ownerRoleId = 0;
+  let viewerRoleId = 0;
+  for (const r of inserted) {
+    const id = Number(r.id);
+    if (!id) continue;
+    roleIdsByName[r.name] = id;
+    if (r.isOwnerRole) ownerRoleId = id;
+    if (r.name === VENDOR_VIEWER_ROLE_NAME) viewerRoleId = id;
+  }
+  const permRows = [];
+  for (const def of DEFAULT_VENDOR_ROLE_DEFS) {
+    const roleId = roleIdsByName[def.name];
     if (!roleId) continue;
-    roleIdsByName[def.name] = roleId;
-    if (def.isOwnerRole) ownerRoleId = roleId;
-    if (def.name === VENDOR_VIEWER_ROLE_NAME) viewerRoleId = roleId;
-    await insertRolePermissions(exec, roleId, def.permissions);
+    permRows.push(...permissionRowsForRole(roleId, def.permissions));
   }
+  await insertRolePermissions(exec, permRows);
   return {
     roleIdsByName,
     ownerRoleId,
@@ -15345,25 +15381,25 @@ function createVendorOnboardHandlers(config) {
               vendorUserProfileId: personRow.id
             });
           }
-          if (entityMap.customer) {
-            try {
-              await ensureCustomerForUser(em, entityMap.customer, {
-                id: newUser.id,
-                name: userName,
-                email: userEmail,
-                phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
-              }, {
-                phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
-              });
-            } catch (customerErr) {
-              console.error("[vendor-onboard] ensureCustomerForUser skipped", customerErr);
-            }
-          }
           return {
             vendor,
             user: newUser
           };
         });
+        if (entityMap.customer) {
+          try {
+            await ensureCustomerForUser(dataSource, entityMap.customer, {
+              id: result.user.id,
+              name: userName,
+              email: userEmail,
+              phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
+            }, {
+              phone: trimOrNull(body.vendor?.phone) ?? ownerPhone
+            });
+          } catch (customerErr) {
+            console.error("[vendor-onboard] ensureCustomerForUser skipped", customerErr);
+          }
+        }
         let inviteLink;
         const token = readVendorInviteToken(result.vendor.metadata);
         if (token) {