@infuro/cms-core 1.0.46 → 1.0.50

package/dist/auth.d.cts

@@ -46,7 +46,7 @@ interface SessionUser {
     vendorIds?: number[];
     /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
-    /** Role for the active vendor link (`vendor_users.role`). */
+    /** @deprecated Prefer isVendorRoleOwner / vendorRoleId. Legacy owner|staff hint. */
     vendorRole?: 'owner' | 'staff' | null;
     /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
     vendorRoleId?: number | null;
@@ -140,7 +140,9 @@ type VendorScope = {
 } | {
     type: 'deny';
 };
-declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+declare const VENDOR_GROUP_NAME = "Vendor";
+/** @deprecated Use VENDOR_GROUP_NAME */
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor";
 /** User groups treated as vendor store staff (sidebar + scoped admin). */
 declare function isVendorGroupName(name: string | null | undefined): boolean;
 declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
@@ -231,8 +233,43 @@ declare function logAuthClient(message: string, data?: Record<string, unknown>):
 declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
 declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
+declare const AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
+interface GoogleAuthConfig {
+    enabled: boolean;
+    clientId: string;
+    clientSecret: string;
+}
+/** Minimal TypeORM DataSource surface needed to read `configs` settings. */
+type AuthProvidersDataSource = {
+    getRepository(entity: unknown): {
+        find(options: object): Promise<unknown[]>;
+    };
+};
+type AuthProvidersEntityMap = {
+    configs?: unknown;
+};
+type ResolveGoogleAuthConfigInput = {
+    /** Prefer loading secrets from DB (authenticated server path). */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    encryptionKey?: string;
+    /** Optional preloaded settings map (e.g. from host). */
+    settings?: Record<string, string>;
+    /** When true, skip env fallback. Default false. */
+    skipEnvFallback?: boolean;
+};
+/**
+ * Resolve Google web OAuth config for registering NextAuth GoogleProvider.
+ * Order: explicit `settings` → DB `auth_providers` group → env (`GOOGLE_*`).
+ */
+declare function resolveGoogleAuthConfig(input?: ResolveGoogleAuthConfigInput): Promise<GoogleAuthConfig | null>;
+/** Public redirect URI for Google Web OAuth (NextAuth callback). */
+declare function googleOAuthRedirectUri(baseUrl?: string): string;
+/** Whether the public `googleEnabled` flag is on (for SignInPage; secrets not required). */
+declare function isGoogleAuthPubliclyEnabled(settings: Record<string, unknown> | null | undefined): boolean;
+
 /**
- * Build NextAuth options for credentials auth. App can extend/override via extend().
+ * Build NextAuth options for credentials auth (+ optional Google OAuth). App can extend/override via extend().
  */
 
 interface NextAuthUser {
@@ -291,11 +328,75 @@ interface NextAuthOptionsConfig {
      * - `true` — always allow (dedicated storefront auth)
      * - `false` — always block
      * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
+     *
+     * For Google OAuth: customers are allowed only when this is `true`.
+     * When `true` and the Google email is new, {@link createCustomerUserFromGoogle} may create a Customer.
      */
     allowCustomerLogin?: boolean;
+    /**
+     * Static Google web OAuth config. When set and enabled, registers GoogleProvider.
+     * Prefer {@link buildNextAuthOptions} to load from Plugins settings + env.
+     */
+    google?: GoogleAuthConfig | null;
+    /**
+     * Storefront only: when Google email has no user and {@link allowCustomerLogin} is true,
+     * create a Customer-group user. Wired automatically by {@link buildNextAuthOptions} when
+     * `dataSource` + `entityMap` are provided.
+     */
+    createCustomerUserFromGoogle?: (input: {
+        email: string;
+        name: string | null;
+    }) => Promise<NextAuthUser | null>;
 }
+type BuildNextAuthOptionsConfig = NextAuthOptionsConfig & {
+    /** Load Google settings from DB / env when `google` is not passed explicitly. */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    settingsEncryptionKey?: string;
+    /** Extra input for {@link resolveGoogleAuthConfig}. */
+    googleResolve?: Omit<ResolveGoogleAuthConfigInput, 'dataSource' | 'entityMap' | 'encryptionKey'>;
+};
 declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
+/**
+ * Async builder: loads Google OAuth from Plugins `auth_providers` settings (and env fallback),
+ * then returns the same options as {@link getNextAuthOptions}.
+ */
+declare function buildNextAuthOptions(config: BuildNextAuthOptionsConfig): Promise<NextAuthOptions>;
 /** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
 declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+/** Storefront + optional Google from settings/env. */
+declare function buildStorefrontNextAuthOptions(config: Omit<BuildNextAuthOptionsConfig, 'allowCustomerLogin'>): Promise<NextAuthOptions>;
+
+type CreateGoogleCustomerDataSource = {
+    getRepository(entity: unknown): {
+        findOne(options: object): Promise<unknown | null>;
+        create(entityLike: object): unknown;
+        save(entity: unknown): Promise<unknown>;
+        metadata?: {
+            columns: Array<{
+                propertyName: string;
+            }>;
+        };
+        find?(options: object): Promise<unknown[]>;
+        update?(id: number, partial: object): Promise<unknown>;
+    };
+};
+type CreateGoogleCustomerEntityMap = {
+    users?: unknown;
+    user_groups?: unknown;
+    customer?: unknown;
+    contacts?: unknown;
+};
+type CreateGoogleCustomerInput = {
+    dataSource: CreateGoogleCustomerDataSource;
+    entityMap: CreateGoogleCustomerEntityMap;
+    email: string;
+    name?: string | null;
+};
+/**
+ * Creates an active Customer user for a verified Google email.
+ * Returns the user with `group.permissions` loaded (same shape as password login).
+ */
+declare function createCustomerUserFromGoogleOAuth(input: CreateGoogleCustomerInput): Promise<NextAuthUser | null>;
 
-export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, AUTH_PROVIDERS_SETTINGS_GROUP, type AuthHelpers, type AuthProvidersDataSource, type AuthProvidersEntityMap, type AuthorizeOtpInput, type BuildNextAuthOptionsConfig, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type CreateGoogleCustomerDataSource, type CreateGoogleCustomerEntityMap, type CreateGoogleCustomerInput, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type GoogleAuthConfig, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, type ResolveGoogleAuthConfigInput, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, buildNextAuthOptions, buildStorefrontNextAuthOptions, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, googleOAuthRedirectUri, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveGoogleAuthConfig, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };

package/dist/auth.d.ts

@@ -46,7 +46,7 @@ interface SessionUser {
     vendorIds?: number[];
     /** Active vendor for scoped CRUD (vendor staff). */
     activeVendorId?: number | null;
-    /** Role for the active vendor link (`vendor_users.role`). */
+    /** @deprecated Prefer isVendorRoleOwner / vendorRoleId. Legacy owner|staff hint. */
     vendorRole?: 'owner' | 'staff' | null;
     /** Active vendor-scoped role id (`vendor_users.vendorRoleId`). */
     vendorRoleId?: number | null;
@@ -140,7 +140,9 @@ type VendorScope = {
 } | {
     type: 'deny';
 };
-declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+declare const VENDOR_GROUP_NAME = "Vendor";
+/** @deprecated Use VENDOR_GROUP_NAME */
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor";
 /** User groups treated as vendor store staff (sidebar + scoped admin). */
 declare function isVendorGroupName(name: string | null | undefined): boolean;
 declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
@@ -231,8 +233,43 @@ declare function logAuthClient(message: string, data?: Record<string, unknown>):
 declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
 declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
+declare const AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
+interface GoogleAuthConfig {
+    enabled: boolean;
+    clientId: string;
+    clientSecret: string;
+}
+/** Minimal TypeORM DataSource surface needed to read `configs` settings. */
+type AuthProvidersDataSource = {
+    getRepository(entity: unknown): {
+        find(options: object): Promise<unknown[]>;
+    };
+};
+type AuthProvidersEntityMap = {
+    configs?: unknown;
+};
+type ResolveGoogleAuthConfigInput = {
+    /** Prefer loading secrets from DB (authenticated server path). */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    encryptionKey?: string;
+    /** Optional preloaded settings map (e.g. from host). */
+    settings?: Record<string, string>;
+    /** When true, skip env fallback. Default false. */
+    skipEnvFallback?: boolean;
+};
+/**
+ * Resolve Google web OAuth config for registering NextAuth GoogleProvider.
+ * Order: explicit `settings` → DB `auth_providers` group → env (`GOOGLE_*`).
+ */
+declare function resolveGoogleAuthConfig(input?: ResolveGoogleAuthConfigInput): Promise<GoogleAuthConfig | null>;
+/** Public redirect URI for Google Web OAuth (NextAuth callback). */
+declare function googleOAuthRedirectUri(baseUrl?: string): string;
+/** Whether the public `googleEnabled` flag is on (for SignInPage; secrets not required). */
+declare function isGoogleAuthPubliclyEnabled(settings: Record<string, unknown> | null | undefined): boolean;
+
 /**
- * Build NextAuth options for credentials auth. App can extend/override via extend().
+ * Build NextAuth options for credentials auth (+ optional Google OAuth). App can extend/override via extend().
  */
 
 interface NextAuthUser {
@@ -291,11 +328,75 @@ interface NextAuthOptionsConfig {
      * - `true` — always allow (dedicated storefront auth)
      * - `false` — always block
      * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
+     *
+     * For Google OAuth: customers are allowed only when this is `true`.
+     * When `true` and the Google email is new, {@link createCustomerUserFromGoogle} may create a Customer.
      */
     allowCustomerLogin?: boolean;
+    /**
+     * Static Google web OAuth config. When set and enabled, registers GoogleProvider.
+     * Prefer {@link buildNextAuthOptions} to load from Plugins settings + env.
+     */
+    google?: GoogleAuthConfig | null;
+    /**
+     * Storefront only: when Google email has no user and {@link allowCustomerLogin} is true,
+     * create a Customer-group user. Wired automatically by {@link buildNextAuthOptions} when
+     * `dataSource` + `entityMap` are provided.
+     */
+    createCustomerUserFromGoogle?: (input: {
+        email: string;
+        name: string | null;
+    }) => Promise<NextAuthUser | null>;
 }
+type BuildNextAuthOptionsConfig = NextAuthOptionsConfig & {
+    /** Load Google settings from DB / env when `google` is not passed explicitly. */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    settingsEncryptionKey?: string;
+    /** Extra input for {@link resolveGoogleAuthConfig}. */
+    googleResolve?: Omit<ResolveGoogleAuthConfigInput, 'dataSource' | 'entityMap' | 'encryptionKey'>;
+};
 declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
+/**
+ * Async builder: loads Google OAuth from Plugins `auth_providers` settings (and env fallback),
+ * then returns the same options as {@link getNextAuthOptions}.
+ */
+declare function buildNextAuthOptions(config: BuildNextAuthOptionsConfig): Promise<NextAuthOptions>;
 /** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
 declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+/** Storefront + optional Google from settings/env. */
+declare function buildStorefrontNextAuthOptions(config: Omit<BuildNextAuthOptionsConfig, 'allowCustomerLogin'>): Promise<NextAuthOptions>;
+
+type CreateGoogleCustomerDataSource = {
+    getRepository(entity: unknown): {
+        findOne(options: object): Promise<unknown | null>;
+        create(entityLike: object): unknown;
+        save(entity: unknown): Promise<unknown>;
+        metadata?: {
+            columns: Array<{
+                propertyName: string;
+            }>;
+        };
+        find?(options: object): Promise<unknown[]>;
+        update?(id: number, partial: object): Promise<unknown>;
+    };
+};
+type CreateGoogleCustomerEntityMap = {
+    users?: unknown;
+    user_groups?: unknown;
+    customer?: unknown;
+    contacts?: unknown;
+};
+type CreateGoogleCustomerInput = {
+    dataSource: CreateGoogleCustomerDataSource;
+    entityMap: CreateGoogleCustomerEntityMap;
+    email: string;
+    name?: string | null;
+};
+/**
+ * Creates an active Customer user for a verified Google email.
+ * Returns the user with `group.permissions` loaded (same shape as password login).
+ */
+declare function createCustomerUserFromGoogleOAuth(input: CreateGoogleCustomerInput): Promise<NextAuthUser | null>;
 
-export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, AUTH_PROVIDERS_SETTINGS_GROUP, type AuthHelpers, type AuthProvidersDataSource, type AuthProvidersEntityMap, type AuthorizeOtpInput, type BuildNextAuthOptionsConfig, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type CreateGoogleCustomerDataSource, type CreateGoogleCustomerEntityMap, type CreateGoogleCustomerInput, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type GoogleAuthConfig, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, type ResolveGoogleAuthConfigInput, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, buildNextAuthOptions, buildStorefrontNextAuthOptions, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, googleOAuthRedirectUri, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveGoogleAuthConfig, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };

package/dist/auth.js

@@ -1,4 +1,5 @@
-export { createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeSessionUserForLog } from './chunk-57O3HZPG.js';
-export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, getRequiredPermission, isOpenEndpoint, isPublicMethod, sessionHasEntityAccess } from './chunk-SF2XKMCI.js';
-export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-DN65KDIA.js';
+export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, resolveGoogleAuthConfig, seedAdministratorPermissions, summarizeSessionUserForLog } from './chunk-WRKV6MHB.js';
+export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, getRequiredPermission, isOpenEndpoint, isPublicMethod, sessionHasEntityAccess } from './chunk-RK5ETF2I.js';
+import './chunk-DBPSJYLZ.js';
+export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-JIWUVQ6B.js';
 import './chunk-SHUYVCID.js';

package/dist/chunk-2IAXTKQN.cjs

@@ -0,0 +1,19 @@
+'use strict';
+
+var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
+var React = require('react');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var React__default = /*#__PURE__*/_interopDefault(React);
+
+function ForceLightMode() {
+  return React__default.default.createElement("script", {
+    dangerouslySetInnerHTML: {
+      __html: `(function(){try{var r=document.documentElement,b=document.body;if(r){r.classList.remove('dark');r.style.colorScheme='light';}if(b){b.classList.remove('dark');b.style.colorScheme='light';}}catch(e){}})();`
+    }
+  });
+}
+chunkUSNT2KNT_cjs.__name(ForceLightMode, "ForceLightMode");
+
+exports.ForceLightMode = ForceLightMode;