@infuro/cms-core 1.0.47 → 1.0.51

package/dist/api.cjs

@@ -1,18 +1,18 @@
 'use strict';
 
-var chunkXUCKZPML_cjs = require('./chunk-XUCKZPML.cjs');
+var chunkYOW457RA_cjs = require('./chunk-YOW457RA.cjs');
 require('./chunk-HY3AXLOI.cjs');
-require('./chunk-OY2YTBMP.cjs');
-require('./chunk-LMJ7RKPF.cjs');
+require('./chunk-JN4AFHZ4.cjs');
 require('./chunk-UCKN4BBY.cjs');
 require('./chunk-7NMT3GBR.cjs');
 require('./chunk-V25RDUOU.cjs');
 require('./chunk-BXYZDMTZ.cjs');
 require('./chunk-3DZRIZOD.cjs');
 require('./chunk-OOTLNH63.cjs');
-require('./chunk-4PMK3RNA.cjs');
+require('./chunk-TJ2MIQUT.cjs');
 require('./chunk-XQ3QUHWR.cjs');
-var chunkVUQFARRT_cjs = require('./chunk-VUQFARRT.cjs');
+var chunk3EOM4V2M_cjs = require('./chunk-3EOM4V2M.cjs');
+require('./chunk-OY2YTBMP.cjs');
 require('./chunk-77NUXO6A.cjs');
 require('./chunk-D5FBNKQM.cjs');
 require('./chunk-UPLVMVRX.cjs');
@@ -22,129 +22,129 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "createAnalyticsHandlers", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createAnalyticsHandlers; }
+  get: function () { return chunkYOW457RA_cjs.createAnalyticsHandlers; }
 });
 Object.defineProperty(exports, "createBlogBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createBlogBySlugHandler; }
+  get: function () { return chunkYOW457RA_cjs.createBlogBySlugHandler; }
 });
 Object.defineProperty(exports, "createChangePasswordHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createChangePasswordHandler; }
+  get: function () { return chunkYOW457RA_cjs.createChangePasswordHandler; }
 });
 Object.defineProperty(exports, "createCmsApiHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createCmsApiHandler; }
+  get: function () { return chunkYOW457RA_cjs.createCmsApiHandler; }
 });
 Object.defineProperty(exports, "createCrudByIdHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createCrudByIdHandler; }
+  get: function () { return chunkYOW457RA_cjs.createCrudByIdHandler; }
 });
 Object.defineProperty(exports, "createCrudHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createCrudHandler; }
+  get: function () { return chunkYOW457RA_cjs.createCrudHandler; }
 });
 Object.defineProperty(exports, "createDashboardStatsHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createDashboardStatsHandler; }
+  get: function () { return chunkYOW457RA_cjs.createDashboardStatsHandler; }
 });
 Object.defineProperty(exports, "createEcommerceAnalyticsHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createEcommerceAnalyticsHandler; }
+  get: function () { return chunkYOW457RA_cjs.createEcommerceAnalyticsHandler; }
 });
 Object.defineProperty(exports, "createForgotPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createForgotPasswordHandler; }
+  get: function () { return chunkYOW457RA_cjs.createForgotPasswordHandler; }
 });
 Object.defineProperty(exports, "createFormBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createFormBySlugHandler; }
+  get: function () { return chunkYOW457RA_cjs.createFormBySlugHandler; }
 });
 Object.defineProperty(exports, "createInviteAcceptHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createInviteAcceptHandler; }
+  get: function () { return chunkYOW457RA_cjs.createInviteAcceptHandler; }
 });
 Object.defineProperty(exports, "createJobScheduleHandlers", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createJobScheduleHandlers; }
+  get: function () { return chunkYOW457RA_cjs.createJobScheduleHandlers; }
 });
 Object.defineProperty(exports, "createLlmAgentKnowledgeHandlers", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createLlmAgentKnowledgeHandlers; }
+  get: function () { return chunkYOW457RA_cjs.createLlmAgentKnowledgeHandlers; }
 });
 Object.defineProperty(exports, "createMediaZipExtractHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createMediaZipExtractHandler; }
+  get: function () { return chunkYOW457RA_cjs.createMediaZipExtractHandler; }
 });
 Object.defineProperty(exports, "createSetPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createSetPasswordHandler; }
+  get: function () { return chunkYOW457RA_cjs.createSetPasswordHandler; }
 });
 Object.defineProperty(exports, "createSettingsApiHandlers", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createSettingsApiHandlers; }
+  get: function () { return chunkYOW457RA_cjs.createSettingsApiHandlers; }
 });
 Object.defineProperty(exports, "createStorefrontApiHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createStorefrontApiHandler; }
+  get: function () { return chunkYOW457RA_cjs.createStorefrontApiHandler; }
 });
 Object.defineProperty(exports, "createUploadHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createUploadHandler; }
+  get: function () { return chunkYOW457RA_cjs.createUploadHandler; }
 });
 Object.defineProperty(exports, "createUserAuthApiRouter", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createUserAuthApiRouter; }
+  get: function () { return chunkYOW457RA_cjs.createUserAuthApiRouter; }
 });
 Object.defineProperty(exports, "createUserAvatarHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createUserAvatarHandler; }
+  get: function () { return chunkYOW457RA_cjs.createUserAvatarHandler; }
 });
 Object.defineProperty(exports, "createUserProfileHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createUserProfileHandler; }
+  get: function () { return chunkYOW457RA_cjs.createUserProfileHandler; }
 });
 Object.defineProperty(exports, "createUsersApiHandlers", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createUsersApiHandlers; }
+  get: function () { return chunkYOW457RA_cjs.createUsersApiHandlers; }
 });
 Object.defineProperty(exports, "createVendorDashboardHandler", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createVendorDashboardHandler; }
+  get: function () { return chunkYOW457RA_cjs.createVendorDashboardHandler; }
 });
 Object.defineProperty(exports, "createVendorOnboardHandlers", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.createVendorOnboardHandlers; }
+  get: function () { return chunkYOW457RA_cjs.createVendorOnboardHandlers; }
 });
 Object.defineProperty(exports, "getPublicSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.getPublicSettingsGroup; }
+  get: function () { return chunkYOW457RA_cjs.getPublicSettingsGroup; }
 });
 Object.defineProperty(exports, "mergeGuardrailsIntoSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.mergeGuardrailsIntoSystemPrompt; }
+  get: function () { return chunkYOW457RA_cjs.mergeGuardrailsIntoSystemPrompt; }
 });
 Object.defineProperty(exports, "parseLlmAgentValidationRules", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.parseLlmAgentValidationRules; }
+  get: function () { return chunkYOW457RA_cjs.parseLlmAgentValidationRules; }
 });
 Object.defineProperty(exports, "simpleDecrypt", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.simpleDecrypt; }
+  get: function () { return chunkYOW457RA_cjs.simpleDecrypt; }
 });
 Object.defineProperty(exports, "simpleEncrypt", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.simpleEncrypt; }
+  get: function () { return chunkYOW457RA_cjs.simpleEncrypt; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstAgentRules", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.validateUserMessageAgainstAgentRules; }
+  get: function () { return chunkYOW457RA_cjs.validateUserMessageAgainstAgentRules; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstStructuredRules", {
   enumerable: true,
-  get: function () { return chunkXUCKZPML_cjs.validateUserMessageAgainstStructuredRules; }
+  get: function () { return chunkYOW457RA_cjs.validateUserMessageAgainstStructuredRules; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.createCmsAuthBundle; }
+  get: function () { return chunk3EOM4V2M_cjs.createCmsAuthBundle; }
 });

package/dist/api.js

@@ -1,16 +1,16 @@
-export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-W42UZLQO.js';
+export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-NUXR7BUG.js';
 import './chunk-3K5AIEIZ.js';
-import './chunk-DBPSJYLZ.js';
-import './chunk-YXH2UUEZ.js';
+import './chunk-CTXBYO2J.js';
 import './chunk-HCIRL37O.js';
 import './chunk-JXF23MPG.js';
 import './chunk-L3525VXI.js';
 import './chunk-2KUCQVAQ.js';
 import './chunk-MQBT33IV.js';
 import './chunk-CRFV5WJK.js';
-import './chunk-2HU5R2JE.js';
+import './chunk-AYERBA7I.js';
 import './chunk-GO7PPYNU.js';
-export { createCmsAuthBundle } from './chunk-ZF2RQWXB.js';
+export { createCmsAuthBundle } from './chunk-RK5ETF2I.js';
+import './chunk-DBPSJYLZ.js';
 import './chunk-JIWUVQ6B.js';
 import './chunk-SYBOCAWB.js';
 import './chunk-JC6DLWTE.js';

package/dist/auth.cjs

@@ -1,95 +1,124 @@
 'use strict';
 
-var chunkQ3HQEM4R_cjs = require('./chunk-Q3HQEM4R.cjs');
-var chunkVUQFARRT_cjs = require('./chunk-VUQFARRT.cjs');
+var chunkYV5PK4JW_cjs = require('./chunk-YV5PK4JW.cjs');
+var chunk3EOM4V2M_cjs = require('./chunk-3EOM4V2M.cjs');
+require('./chunk-OY2YTBMP.cjs');
 var chunk77NUXO6A_cjs = require('./chunk-77NUXO6A.cjs');
 require('./chunk-USNT2KNT.cjs');
 
 
 
+Object.defineProperty(exports, "AUTH_PROVIDERS_SETTINGS_GROUP", {
+  enumerable: true,
+  get: function () { return chunkYV5PK4JW_cjs.AUTH_PROVIDERS_SETTINGS_GROUP; }
+});
+Object.defineProperty(exports, "buildNextAuthOptions", {
+  enumerable: true,
+  get: function () { return chunkYV5PK4JW_cjs.buildNextAuthOptions; }
+});
+Object.defineProperty(exports, "buildStorefrontNextAuthOptions", {
+  enumerable: true,
+  get: function () { return chunkYV5PK4JW_cjs.buildStorefrontNextAuthOptions; }
+});
 Object.defineProperty(exports, "createCmsMiddleware", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.createCmsMiddleware; }
+  get: function () { return chunkYV5PK4JW_cjs.createCmsMiddleware; }
+});
+Object.defineProperty(exports, "createCustomerUserFromGoogleOAuth", {
+  enumerable: true,
+  get: function () { return chunkYV5PK4JW_cjs.createCustomerUserFromGoogleOAuth; }
 });
 Object.defineProperty(exports, "defaultPublicApiMethods", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.defaultPublicApiMethods; }
+  get: function () { return chunkYV5PK4JW_cjs.defaultPublicApiMethods; }
 });
 Object.defineProperty(exports, "getNextAuthOptions", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.getNextAuthOptions; }
+  get: function () { return chunkYV5PK4JW_cjs.getNextAuthOptions; }
 });
 Object.defineProperty(exports, "getStorefrontNextAuthOptions", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.getStorefrontNextAuthOptions; }
+  get: function () { return chunkYV5PK4JW_cjs.getStorefrontNextAuthOptions; }
+});
+Object.defineProperty(exports, "googleOAuthRedirectUri", {
+  enumerable: true,
+  get: function () { return chunkYV5PK4JW_cjs.googleOAuthRedirectUri; }
 });
 Object.defineProperty(exports, "isAuthDebugClientEnabled", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.isAuthDebugClientEnabled; }
+  get: function () { return chunkYV5PK4JW_cjs.isAuthDebugClientEnabled; }
 });
 Object.defineProperty(exports, "isAuthDebugEnabled", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.isAuthDebugEnabled; }
+  get: function () { return chunkYV5PK4JW_cjs.isAuthDebugEnabled; }
+});
+Object.defineProperty(exports, "isGoogleAuthPubliclyEnabled", {
+  enumerable: true,
+  get: function () { return chunkYV5PK4JW_cjs.isGoogleAuthPubliclyEnabled; }
 });
 Object.defineProperty(exports, "logAuth", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.logAuth; }
+  get: function () { return chunkYV5PK4JW_cjs.logAuth; }
 });
 Object.defineProperty(exports, "logAuthClient", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.logAuthClient; }
+  get: function () { return chunkYV5PK4JW_cjs.logAuthClient; }
 });
 Object.defineProperty(exports, "nextAuthCookieDebugInfo", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.nextAuthCookieDebugInfo; }
+  get: function () { return chunkYV5PK4JW_cjs.nextAuthCookieDebugInfo; }
+});
+Object.defineProperty(exports, "resolveGoogleAuthConfig", {
+  enumerable: true,
+  get: function () { return chunkYV5PK4JW_cjs.resolveGoogleAuthConfig; }
 });
 Object.defineProperty(exports, "seedAdministratorPermissions", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.seedAdministratorPermissions; }
+  get: function () { return chunkYV5PK4JW_cjs.seedAdministratorPermissions; }
 });
 Object.defineProperty(exports, "summarizeSessionUserForLog", {
   enumerable: true,
-  get: function () { return chunkQ3HQEM4R_cjs.summarizeSessionUserForLog; }
+  get: function () { return chunkYV5PK4JW_cjs.summarizeSessionUserForLog; }
 });
 Object.defineProperty(exports, "OPEN_ENDPOINTS", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.OPEN_ENDPOINTS; }
+  get: function () { return chunk3EOM4V2M_cjs.OPEN_ENDPOINTS; }
 });
 Object.defineProperty(exports, "PERMISSION_REQUIRED_ENDPOINTS", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.PERMISSION_REQUIRED_ENDPOINTS; }
+  get: function () { return chunk3EOM4V2M_cjs.PERMISSION_REQUIRED_ENDPOINTS; }
 });
 Object.defineProperty(exports, "RBAC_ADMIN_ONLY_ENTITIES", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.RBAC_ADMIN_ONLY_ENTITIES; }
+  get: function () { return chunk3EOM4V2M_cjs.RBAC_ADMIN_ONLY_ENTITIES; }
 });
 Object.defineProperty(exports, "canManageRoles", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.canManageRoles; }
+  get: function () { return chunk3EOM4V2M_cjs.canManageRoles; }
 });
 Object.defineProperty(exports, "createAuthHelpers", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.createAuthHelpers; }
+  get: function () { return chunk3EOM4V2M_cjs.createAuthHelpers; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.createCmsAuthBundle; }
+  get: function () { return chunk3EOM4V2M_cjs.createCmsAuthBundle; }
 });
 Object.defineProperty(exports, "getRequiredPermission", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.getRequiredPermission; }
+  get: function () { return chunk3EOM4V2M_cjs.getRequiredPermission; }
 });
 Object.defineProperty(exports, "isOpenEndpoint", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.isOpenEndpoint; }
+  get: function () { return chunk3EOM4V2M_cjs.isOpenEndpoint; }
 });
 Object.defineProperty(exports, "isPublicMethod", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.isPublicMethod; }
+  get: function () { return chunk3EOM4V2M_cjs.isPublicMethod; }
 });
 Object.defineProperty(exports, "sessionHasEntityAccess", {
   enumerable: true,
-  get: function () { return chunkVUQFARRT_cjs.sessionHasEntityAccess; }
+  get: function () { return chunk3EOM4V2M_cjs.sessionHasEntityAccess; }
 });
 Object.defineProperty(exports, "ADMIN_GROUP_NAME", {
   enumerable: true,

package/dist/auth.d.cts

@@ -233,8 +233,43 @@ declare function logAuthClient(message: string, data?: Record<string, unknown>):
 declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
 declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
+declare const AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
+interface GoogleAuthConfig {
+    enabled: boolean;
+    clientId: string;
+    clientSecret: string;
+}
+/** Minimal TypeORM DataSource surface needed to read `configs` settings. */
+type AuthProvidersDataSource = {
+    getRepository(entity: unknown): {
+        find(options: object): Promise<unknown[]>;
+    };
+};
+type AuthProvidersEntityMap = {
+    configs?: unknown;
+};
+type ResolveGoogleAuthConfigInput = {
+    /** Prefer loading secrets from DB (authenticated server path). */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    encryptionKey?: string;
+    /** Optional preloaded settings map (e.g. from host). */
+    settings?: Record<string, string>;
+    /** When true, skip env fallback. Default false. */
+    skipEnvFallback?: boolean;
+};
+/**
+ * Resolve Google web OAuth config for registering NextAuth GoogleProvider.
+ * Order: explicit `settings` → DB `auth_providers` group → env (`GOOGLE_*`).
+ */
+declare function resolveGoogleAuthConfig(input?: ResolveGoogleAuthConfigInput): Promise<GoogleAuthConfig | null>;
+/** Public redirect URI for Google Web OAuth (NextAuth callback). */
+declare function googleOAuthRedirectUri(baseUrl?: string): string;
+/** Whether the public `googleEnabled` flag is on (for SignInPage; secrets not required). */
+declare function isGoogleAuthPubliclyEnabled(settings: Record<string, unknown> | null | undefined): boolean;
+
 /**
- * Build NextAuth options for credentials auth. App can extend/override via extend().
+ * Build NextAuth options for credentials auth (+ optional Google OAuth). App can extend/override via extend().
  */
 
 interface NextAuthUser {
@@ -293,11 +328,75 @@ interface NextAuthOptionsConfig {
      * - `true` — always allow (dedicated storefront auth)
      * - `false` — always block
      * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
+     *
+     * For Google OAuth: customers are allowed only when this is `true`.
+     * When `true` and the Google email is new, {@link createCustomerUserFromGoogle} may create a Customer.
      */
     allowCustomerLogin?: boolean;
+    /**
+     * Static Google web OAuth config. When set and enabled, registers GoogleProvider.
+     * Prefer {@link buildNextAuthOptions} to load from Plugins settings + env.
+     */
+    google?: GoogleAuthConfig | null;
+    /**
+     * Storefront only: when Google email has no user and {@link allowCustomerLogin} is true,
+     * create a Customer-group user. Wired automatically by {@link buildNextAuthOptions} when
+     * `dataSource` + `entityMap` are provided.
+     */
+    createCustomerUserFromGoogle?: (input: {
+        email: string;
+        name: string | null;
+    }) => Promise<NextAuthUser | null>;
 }
+type BuildNextAuthOptionsConfig = NextAuthOptionsConfig & {
+    /** Load Google settings from DB / env when `google` is not passed explicitly. */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    settingsEncryptionKey?: string;
+    /** Extra input for {@link resolveGoogleAuthConfig}. */
+    googleResolve?: Omit<ResolveGoogleAuthConfigInput, 'dataSource' | 'entityMap' | 'encryptionKey'>;
+};
 declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
+/**
+ * Async builder: loads Google OAuth from Plugins `auth_providers` settings (and env fallback),
+ * then returns the same options as {@link getNextAuthOptions}.
+ */
+declare function buildNextAuthOptions(config: BuildNextAuthOptionsConfig): Promise<NextAuthOptions>;
 /** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
 declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+/** Storefront + optional Google from settings/env. */
+declare function buildStorefrontNextAuthOptions(config: Omit<BuildNextAuthOptionsConfig, 'allowCustomerLogin'>): Promise<NextAuthOptions>;
+
+type CreateGoogleCustomerDataSource = {
+    getRepository(entity: unknown): {
+        findOne(options: object): Promise<unknown | null>;
+        create(entityLike: object): unknown;
+        save(entity: unknown): Promise<unknown>;
+        metadata?: {
+            columns: Array<{
+                propertyName: string;
+            }>;
+        };
+        find?(options: object): Promise<unknown[]>;
+        update?(id: number, partial: object): Promise<unknown>;
+    };
+};
+type CreateGoogleCustomerEntityMap = {
+    users?: unknown;
+    user_groups?: unknown;
+    customer?: unknown;
+    contacts?: unknown;
+};
+type CreateGoogleCustomerInput = {
+    dataSource: CreateGoogleCustomerDataSource;
+    entityMap: CreateGoogleCustomerEntityMap;
+    email: string;
+    name?: string | null;
+};
+/**
+ * Creates an active Customer user for a verified Google email.
+ * Returns the user with `group.permissions` loaded (same shape as password login).
+ */
+declare function createCustomerUserFromGoogleOAuth(input: CreateGoogleCustomerInput): Promise<NextAuthUser | null>;
 
-export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, AUTH_PROVIDERS_SETTINGS_GROUP, type AuthHelpers, type AuthProvidersDataSource, type AuthProvidersEntityMap, type AuthorizeOtpInput, type BuildNextAuthOptionsConfig, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type CreateGoogleCustomerDataSource, type CreateGoogleCustomerEntityMap, type CreateGoogleCustomerInput, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type GoogleAuthConfig, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, type ResolveGoogleAuthConfigInput, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, buildNextAuthOptions, buildStorefrontNextAuthOptions, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, googleOAuthRedirectUri, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveGoogleAuthConfig, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };

package/dist/auth.d.ts

@@ -233,8 +233,43 @@ declare function logAuthClient(message: string, data?: Record<string, unknown>):
 declare function summarizeSessionUserForLog(user: unknown): Record<string, unknown>;
 declare function nextAuthCookieDebugInfo(): Record<string, unknown>;
 
+declare const AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
+interface GoogleAuthConfig {
+    enabled: boolean;
+    clientId: string;
+    clientSecret: string;
+}
+/** Minimal TypeORM DataSource surface needed to read `configs` settings. */
+type AuthProvidersDataSource = {
+    getRepository(entity: unknown): {
+        find(options: object): Promise<unknown[]>;
+    };
+};
+type AuthProvidersEntityMap = {
+    configs?: unknown;
+};
+type ResolveGoogleAuthConfigInput = {
+    /** Prefer loading secrets from DB (authenticated server path). */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    encryptionKey?: string;
+    /** Optional preloaded settings map (e.g. from host). */
+    settings?: Record<string, string>;
+    /** When true, skip env fallback. Default false. */
+    skipEnvFallback?: boolean;
+};
+/**
+ * Resolve Google web OAuth config for registering NextAuth GoogleProvider.
+ * Order: explicit `settings` → DB `auth_providers` group → env (`GOOGLE_*`).
+ */
+declare function resolveGoogleAuthConfig(input?: ResolveGoogleAuthConfigInput): Promise<GoogleAuthConfig | null>;
+/** Public redirect URI for Google Web OAuth (NextAuth callback). */
+declare function googleOAuthRedirectUri(baseUrl?: string): string;
+/** Whether the public `googleEnabled` flag is on (for SignInPage; secrets not required). */
+declare function isGoogleAuthPubliclyEnabled(settings: Record<string, unknown> | null | undefined): boolean;
+
 /**
- * Build NextAuth options for credentials auth. App can extend/override via extend().
+ * Build NextAuth options for credentials auth (+ optional Google OAuth). App can extend/override via extend().
  */
 
 interface NextAuthUser {
@@ -293,11 +328,75 @@ interface NextAuthOptionsConfig {
      * - `true` — always allow (dedicated storefront auth)
      * - `false` — always block
      * - omitted — auto: allow unless `callbackUrl` targets `/admin` (storefront `/signin` works unchanged)
+     *
+     * For Google OAuth: customers are allowed only when this is `true`.
+     * When `true` and the Google email is new, {@link createCustomerUserFromGoogle} may create a Customer.
      */
     allowCustomerLogin?: boolean;
+    /**
+     * Static Google web OAuth config. When set and enabled, registers GoogleProvider.
+     * Prefer {@link buildNextAuthOptions} to load from Plugins settings + env.
+     */
+    google?: GoogleAuthConfig | null;
+    /**
+     * Storefront only: when Google email has no user and {@link allowCustomerLogin} is true,
+     * create a Customer-group user. Wired automatically by {@link buildNextAuthOptions} when
+     * `dataSource` + `entityMap` are provided.
+     */
+    createCustomerUserFromGoogle?: (input: {
+        email: string;
+        name: string | null;
+    }) => Promise<NextAuthUser | null>;
 }
+type BuildNextAuthOptionsConfig = NextAuthOptionsConfig & {
+    /** Load Google settings from DB / env when `google` is not passed explicitly. */
+    dataSource?: AuthProvidersDataSource;
+    entityMap?: AuthProvidersEntityMap;
+    settingsEncryptionKey?: string;
+    /** Extra input for {@link resolveGoogleAuthConfig}. */
+    googleResolve?: Omit<ResolveGoogleAuthConfigInput, 'dataSource' | 'entityMap' | 'encryptionKey'>;
+};
 declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
+/**
+ * Async builder: loads Google OAuth from Plugins `auth_providers` settings (and env fallback),
+ * then returns the same options as {@link getNextAuthOptions}.
+ */
+declare function buildNextAuthOptions(config: BuildNextAuthOptionsConfig): Promise<NextAuthOptions>;
 /** Storefront sign-in: allows Customer group; use with signInPage `/signin`. */
 declare function getStorefrontNextAuthOptions(config: Omit<NextAuthOptionsConfig, 'allowCustomerLogin'>): NextAuthOptions;
+/** Storefront + optional Google from settings/env. */
+declare function buildStorefrontNextAuthOptions(config: Omit<BuildNextAuthOptionsConfig, 'allowCustomerLogin'>): Promise<NextAuthOptions>;
+
+type CreateGoogleCustomerDataSource = {
+    getRepository(entity: unknown): {
+        findOne(options: object): Promise<unknown | null>;
+        create(entityLike: object): unknown;
+        save(entity: unknown): Promise<unknown>;
+        metadata?: {
+            columns: Array<{
+                propertyName: string;
+            }>;
+        };
+        find?(options: object): Promise<unknown[]>;
+        update?(id: number, partial: object): Promise<unknown>;
+    };
+};
+type CreateGoogleCustomerEntityMap = {
+    users?: unknown;
+    user_groups?: unknown;
+    customer?: unknown;
+    contacts?: unknown;
+};
+type CreateGoogleCustomerInput = {
+    dataSource: CreateGoogleCustomerDataSource;
+    entityMap: CreateGoogleCustomerEntityMap;
+    email: string;
+    name?: string | null;
+};
+/**
+ * Creates an active Customer user for a verified Google email.
+ * Returns the user with `group.permissions` loaded (same shape as password login).
+ */
+declare function createCustomerUserFromGoogleOAuth(input: CreateGoogleCustomerInput): Promise<NextAuthUser | null>;
 
-export { ADMIN_GROUP_NAME, type AuthHelpers, type AuthorizeOtpInput, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, AUTH_PROVIDERS_SETTINGS_GROUP, type AuthHelpers, type AuthProvidersDataSource, type AuthProvidersEntityMap, type AuthorizeOtpInput, type BuildNextAuthOptionsConfig, type CmsMiddlewareConfig, type CmsMiddlewareRequest, type CreateGoogleCustomerDataSource, type CreateGoogleCustomerEntityMap, type CreateGoogleCustomerInput, type EntityCrudAction, type EntityPermissionFlags, type GetSession, type GoogleAuthConfig, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, type ResolveGoogleAuthConfigInput, SUPER_ADMIN_GROUP_ID, type SessionUser, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, buildNextAuthOptions, buildStorefrontNextAuthOptions, canManageRoles, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, createAuthHelpers, createCmsAuthBundle, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, explainSessionEntityAccess, getNextAuthOptions, getPermissionableEntityKeys, getRequiredPermission, getStorefrontNextAuthOptions, googleOAuthRedirectUri, hasEntityPermission, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, isOpenEndpoint, isPlatformAdministrator, isPublicMethod, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logAuth, logAuthClient, logEntityAccessDecision, logRbac, nextAuthCookieDebugInfo, permissionRowsToRecord, resolveGoogleAuthConfig, resolveVendorScopeFromSessionUser, seedAdministratorPermissions, sessionHasEntityAccess, summarizeEntityPerms, summarizeSessionUserForLog, vendorPortalFlagsFromUser };

package/dist/auth.js

@@ -1,4 +1,5 @@
-export { createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeSessionUserForLog } from './chunk-YC4NUZCS.js';
-export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, getRequiredPermission, isOpenEndpoint, isPublicMethod, sessionHasEntityAccess } from './chunk-ZF2RQWXB.js';
+export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, resolveGoogleAuthConfig, seedAdministratorPermissions, summarizeSessionUserForLog } from './chunk-WRKV6MHB.js';
+export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, getRequiredPermission, isOpenEndpoint, isPublicMethod, sessionHasEntityAccess } from './chunk-RK5ETF2I.js';
+import './chunk-DBPSJYLZ.js';
 export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-JIWUVQ6B.js';
 import './chunk-SHUYVCID.js';