@infuro/cms-core 1.0.51 → 1.0.52

package/dist/{chunk-YV5PK4JW.cjs → chunk-BC22I7C7.cjs}

@@ -3,8 +3,8 @@
 var chunk3EOM4V2M_cjs = require('./chunk-3EOM4V2M.cjs');
 var chunkOY2YTBMP_cjs = require('./chunk-OY2YTBMP.cjs');
 var chunk77NUXO6A_cjs = require('./chunk-77NUXO6A.cjs');
+var chunk7L6KWI7S_cjs = require('./chunk-7L6KWI7S.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
-var jwt = require('next-auth/jwt');
 var _CredentialsProvider = require('next-auth/providers/credentials');
 var _GoogleProvider = require('next-auth/providers/google');
 
@@ -55,200 +55,6 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
 }
 chunkUSNT2KNT_cjs.__name(seedAdministratorPermissions, "seedAdministratorPermissions");
 
-// src/auth/auth-debug.ts
-var LOG_PREFIX = "[cms-auth]";
-function isAuthDebugEnabled() {
-  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes";
-}
-chunkUSNT2KNT_cjs.__name(isAuthDebugEnabled, "isAuthDebugEnabled");
-function isAuthDebugClientEnabled() {
-  if (typeof window === "undefined") return false;
-  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes";
-}
-chunkUSNT2KNT_cjs.__name(isAuthDebugClientEnabled, "isAuthDebugClientEnabled");
-function logAuth(message, data) {
-  if (!isAuthDebugEnabled()) return;
-  if (data) console.info(LOG_PREFIX, message, data);
-  else console.info(LOG_PREFIX, message);
-}
-chunkUSNT2KNT_cjs.__name(logAuth, "logAuth");
-function logAuthClient(message, data) {
-  if (!isAuthDebugClientEnabled()) return;
-  if (data) console.info(LOG_PREFIX, message, data);
-  else console.info(LOG_PREFIX, message);
-}
-chunkUSNT2KNT_cjs.__name(logAuthClient, "logAuthClient");
-function summarizeSessionUserForLog(user) {
-  if (!user || typeof user !== "object") return {
-    present: false
-  };
-  const u = user;
-  return {
-    present: true,
-    email: u.email ?? null,
-    id: u.id ?? null,
-    adminAccess: u.adminAccess ?? null,
-    isRBACAdmin: u.isRBACAdmin ?? null,
-    isVendorPortal: u.isVendorPortal ?? null,
-    groupName: u.groupName ?? null
-  };
-}
-chunkUSNT2KNT_cjs.__name(summarizeSessionUserForLog, "summarizeSessionUserForLog");
-function nextAuthCookieDebugInfo() {
-  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
-  const isHttps = nextAuthUrl.startsWith("https");
-  return {
-    nextAuthUrl,
-    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
-    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
-    cookieSecure: isHttps,
-    nodeEnv: process.env.NODE_ENV ?? "(unset)"
-  };
-}
-chunkUSNT2KNT_cjs.__name(nextAuthCookieDebugInfo, "nextAuthCookieDebugInfo");
-
-// src/auth/middleware.ts
-var defaultPublicApiMethods = {
-  "/api/contacts": [
-    "POST"
-  ],
-  "/api/form-submissions": [
-    "POST"
-  ],
-  "/api/blogs": [
-    "GET"
-  ],
-  "/api/forms": [
-    "GET"
-  ],
-  "/api/auth": [
-    "GET",
-    "POST"
-  ],
-  "/api/health": [
-    "GET"
-  ],
-  "/api/users/forgot-password": [
-    "POST"
-  ],
-  "/api/users/set-password": [
-    "POST"
-  ],
-  "/api/users/invite": [
-    "GET",
-    "POST"
-  ],
-  /** Public keys only (e.g. googleEnabled); secrets stay private in the settings handler. */
-  "/api/settings/auth_providers": [
-    "GET"
-  ]
-};
-function legacyGetSessionToken(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  return secure ?? regular;
-}
-chunkUSNT2KNT_cjs.__name(legacyGetSessionToken, "legacyGetSessionToken");
-function sessionCookiePresence(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
-  return {
-    hasSecureToken: Boolean(secure),
-    hasRegularToken: Boolean(regular),
-    hasChunkedToken: hasChunked,
-    resolved: Boolean(secure ?? regular)
-  };
-}
-chunkUSNT2KNT_cjs.__name(sessionCookiePresence, "sessionCookiePresence");
-function isPublicMethod(pathname, method, publicApiMethods) {
-  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
-    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;
-  }
-  return false;
-}
-chunkUSNT2KNT_cjs.__name(isPublicMethod, "isPublicMethod");
-async function hasValidSession(request, secret, legacyGetToken) {
-  if (request.req) {
-    const token = await jwt.getToken({
-      req: request.req,
-      secret
-    });
-    return token != null;
-  }
-  return Boolean(legacyGetToken(request));
-}
-chunkUSNT2KNT_cjs.__name(hasValidSession, "hasValidSession");
-function createCmsMiddleware(config = {}) {
-  const { publicAdminPaths = [
-    "/admin/signin",
-    "/admin/forgot-password",
-    "/admin/reset-password",
-    "/admin/invite"
-  ], publicApiMethods = defaultPublicApiMethods, signInPath = "/admin/signin", getSessionToken = legacyGetSessionToken, secret = process.env.NEXTAUTH_SECRET } = config;
-  return /* @__PURE__ */ chunkUSNT2KNT_cjs.__name(async function cmsMiddleware(request) {
-    const pathname = request.nextUrl.pathname;
-    const method = request.method;
-    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
-      return {
-        type: "next"
-      };
-    }
-    if (pathname.startsWith("/admin")) {
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      const cookies = sessionCookiePresence(request);
-      if (!authenticated) {
-        logAuth("middleware: admin redirect to signin (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...cookies,
-          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
-        });
-        return {
-          type: "redirect",
-          url: new URL(signInPath, request.url).toString()
-        };
-      }
-      logAuth("middleware: admin allowed", {
-        pathname,
-        method,
-        usesGetToken: Boolean(request.req),
-        ...cookies
-      });
-    }
-    if (pathname.startsWith("/api")) {
-      if (isPublicMethod(pathname, method, publicApiMethods)) {
-        return {
-          type: "next"
-        };
-      }
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      if (!authenticated) {
-        logAuth("middleware: api 401 (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...sessionCookiePresence(request)
-        });
-        return {
-          type: "json",
-          status: 401,
-          body: {
-            error: "Unauthorized"
-          }
-        };
-      }
-    }
-    return {
-      type: "next"
-    };
-  }, "cmsMiddleware");
-}
-chunkUSNT2KNT_cjs.__name(createCmsMiddleware, "createCmsMiddleware");
-
 // src/auth/auth-providers-settings.ts
 var AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
 function parseEnabled(raw) {
@@ -328,7 +134,7 @@ async function resolveGoogleAuthConfig(input = {}) {
   if (input.settings) {
     const fromExplicit = fromSettingsMap(input.settings);
     if (fromExplicit?.enabled) {
-      logAuth("resolveGoogleAuthConfig: from explicit settings", {
+      chunk7L6KWI7S_cjs.logAuth("resolveGoogleAuthConfig: from explicit settings", {
         enabled: true
       });
       return fromExplicit;
@@ -339,20 +145,20 @@ async function resolveGoogleAuthConfig(input = {}) {
       const map = await loadAuthProvidersSettingsFromDb(input.dataSource, input.entityMap, input.encryptionKey);
       const fromDb = fromSettingsMap(map);
       if (fromDb?.enabled) {
-        logAuth("resolveGoogleAuthConfig: from DB settings", {
+        chunk7L6KWI7S_cjs.logAuth("resolveGoogleAuthConfig: from DB settings", {
           enabled: true
         });
         return fromDb;
       }
       if (map.googleEnabled !== void 0 || map.googleClientId !== void 0) {
-        logAuth("resolveGoogleAuthConfig: DB present but incomplete/disabled", {
+        chunk7L6KWI7S_cjs.logAuth("resolveGoogleAuthConfig: DB present but incomplete/disabled", {
           googleEnabled: map.googleEnabled ?? null,
           hasClientId: Boolean(String(map.googleClientId ?? "").trim()),
           hasClientSecret: Boolean(String(map.googleClientSecret ?? "").trim())
         });
       }
     } catch (err) {
-      logAuth("resolveGoogleAuthConfig: DB load failed", {
+      chunk7L6KWI7S_cjs.logAuth("resolveGoogleAuthConfig: DB load failed", {
         message: err instanceof Error ? err.message : String(err)
       });
     }
@@ -360,7 +166,7 @@ async function resolveGoogleAuthConfig(input = {}) {
   if (!input.skipEnvFallback) {
     const envCfg = fromEnv();
     if (envCfg) {
-      logAuth("resolveGoogleAuthConfig: from env", {
+      chunk7L6KWI7S_cjs.logAuth("resolveGoogleAuthConfig: from env", {
         enabled: true
       });
       return envCfg;
@@ -391,7 +197,7 @@ chunkUSNT2KNT_cjs.__name(normalizeEmail, "normalizeEmail");
 async function createCustomerUserFromGoogleOAuth(input) {
   const email = normalizeEmail(input.email);
   if (!email || !input.entityMap.users || !input.entityMap.user_groups) {
-    logAuth("createCustomerUserFromGoogleOAuth skipped", {
+    chunk7L6KWI7S_cjs.logAuth("createCustomerUserFromGoogleOAuth skipped", {
       reason: "missing_email_or_entities",
       hasUsers: Boolean(input.entityMap.users),
       hasGroups: Boolean(input.entityMap.user_groups)
@@ -425,7 +231,7 @@ async function createCustomerUserFromGoogleOAuth(input) {
   });
   const groupId = customerG ? Number(customerG.id) : null;
   if (!Number.isFinite(groupId) || groupId == null) {
-    logAuth("createCustomerUserFromGoogleOAuth failed", {
+    chunk7L6KWI7S_cjs.logAuth("createCustomerUserFromGoogleOAuth failed", {
       reason: "customer_group_missing",
       email
     });
@@ -446,7 +252,7 @@ async function createCustomerUserFromGoogleOAuth(input) {
     }));
     const userId = Number(created.id);
     if (!Number.isFinite(userId)) {
-      logAuth("createCustomerUserFromGoogleOAuth failed", {
+      chunk7L6KWI7S_cjs.logAuth("createCustomerUserFromGoogleOAuth failed", {
         reason: "invalid_id",
         email
       });
@@ -481,14 +287,14 @@ async function createCustomerUserFromGoogleOAuth(input) {
       ]
     });
     if (!loaded) {
-      logAuth("createCustomerUserFromGoogleOAuth failed", {
+      chunk7L6KWI7S_cjs.logAuth("createCustomerUserFromGoogleOAuth failed", {
         reason: "reload_failed",
         email,
         userId
       });
       return null;
     }
-    logAuth("createCustomerUserFromGoogleOAuth ok", {
+    chunk7L6KWI7S_cjs.logAuth("createCustomerUserFromGoogleOAuth ok", {
       email,
       userId
     });
@@ -505,13 +311,13 @@ async function createCustomerUserFromGoogleOAuth(input) {
       ]
     });
     if (raced) {
-      logAuth("createCustomerUserFromGoogleOAuth raced_to_existing", {
+      chunk7L6KWI7S_cjs.logAuth("createCustomerUserFromGoogleOAuth raced_to_existing", {
         email,
         userId: raced.id
       });
       return raced;
     }
-    logAuth("createCustomerUserFromGoogleOAuth error", {
+    chunk7L6KWI7S_cjs.logAuth("createCustomerUserFromGoogleOAuth error", {
       email,
       message: err instanceof Error ? err.message : String(err)
     });
@@ -553,7 +359,7 @@ async function checkMultiVendorEnabledViaSettingsApi() {
   const FAIL_OPEN_DEFAULT = true;
   const base = process.env.NEXTAUTH_URL?.replace(/\/$/, "");
   if (!base) {
-    logAuth("multiVendorCheck: no NEXTAUTH_URL, defaulting", {
+    chunk7L6KWI7S_cjs.logAuth("multiVendorCheck: no NEXTAUTH_URL, defaulting", {
       multiVendorEnabled: FAIL_OPEN_DEFAULT
     });
     return FAIL_OPEN_DEFAULT;
@@ -563,7 +369,7 @@ async function checkMultiVendorEnabledViaSettingsApi() {
       cache: "no-store"
     });
     if (!res.ok) {
-      logAuth("multiVendorCheck: non-OK response, defaulting", {
+      chunk7L6KWI7S_cjs.logAuth("multiVendorCheck: non-OK response, defaulting", {
         status: res.status
       });
       return FAIL_OPEN_DEFAULT;
@@ -572,7 +378,7 @@ async function checkMultiVendorEnabledViaSettingsApi() {
     const parsed = parseBooleanSetting(data?.enabled ?? data?.value ?? data?.isEnabled ?? data?.active ?? data?.state);
     return parsed ?? FAIL_OPEN_DEFAULT;
   } catch (err) {
-    logAuth("multiVendorCheck: fetch failed, defaulting", {
+    chunk7L6KWI7S_cjs.logAuth("multiVendorCheck: fetch failed, defaulting", {
       message: err instanceof Error ? err.message : String(err)
     });
     return FAIL_OPEN_DEFAULT;
@@ -650,7 +456,7 @@ function applySessionUserToAuthUser(target, sessionUser) {
 chunkUSNT2KNT_cjs.__name(applySessionUserToAuthUser, "applySessionUserToAuthUser");
 function getNextAuthOptions(config) {
   const { getUserByEmail, comparePassword, signInPage = "/admin/signin", secret, extend, enablePasswordLogin = true, enableOtpLogin = false, authorizeOtp, allowCustomerLogin, google, createCustomerUserFromGoogle } = config;
-  logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
+  chunk7L6KWI7S_cjs.logAuth("getNextAuthOptions init", chunk7L6KWI7S_cjs.nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
     providers.push(CredentialsProvider({
@@ -669,7 +475,7 @@ function getNextAuthOptions(config) {
         const creds = credentials;
         const email = creds?.email?.trim() ?? "";
         if (!email || !creds?.password) {
-          logAuth("authorize(credentials) rejected", {
+          chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
             reason: "missing_email_or_password"
           });
           return null;
@@ -677,14 +483,14 @@ function getNextAuthOptions(config) {
         try {
           const user = await getUserByEmail(email);
           if (!user) {
-            logAuth("authorize(credentials) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
               reason: "user_not_found",
               email
             });
             return null;
           }
           if (user.blocked) {
-            logAuth("authorize(credentials) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
               reason: "blocked",
               email,
               userId: user.id
@@ -692,7 +498,7 @@ function getNextAuthOptions(config) {
             return null;
           }
           if (user.inviteStatus === "pending") {
-            logAuth("authorize(credentials) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
               reason: "invite_pending",
               email,
               userId: user.id
@@ -700,7 +506,7 @@ function getNextAuthOptions(config) {
             return null;
           }
           if (user.deleted) {
-            logAuth("authorize(credentials) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
               reason: "deleted",
               email,
               userId: user.id
@@ -708,7 +514,7 @@ function getNextAuthOptions(config) {
             return null;
           }
           if (!user.password) {
-            logAuth("authorize(credentials) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
               reason: "no_password",
               email,
               userId: user.id
@@ -717,7 +523,7 @@ function getNextAuthOptions(config) {
           }
           const valid = await comparePassword(creds.password, user.password);
           if (!valid) {
-            logAuth("authorize(credentials) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
               reason: "invalid_password",
               email,
               userId: user.id
@@ -725,7 +531,7 @@ function getNextAuthOptions(config) {
             return null;
           }
           if (isCustomerGroupUser(user) && !permitsCustomerLogin(allowCustomerLogin, creds)) {
-            logAuth("authorize(credentials) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
               reason: "customer_group",
               email,
               userId: user.id,
@@ -737,7 +543,7 @@ function getNextAuthOptions(config) {
           if (sessionUser.isVendorPortal && !sessionUser.isRBACAdmin) {
             const multiVendorEnabled = await checkMultiVendorEnabledViaSettingsApi();
             if (!multiVendorEnabled) {
-              logAuth("authorize(credentials) rejected", {
+              chunk7L6KWI7S_cjs.logAuth("authorize(credentials) rejected", {
                 reason: "multi_vendor_disabled",
                 email,
                 userId: user.id
@@ -745,11 +551,11 @@ function getNextAuthOptions(config) {
               return null;
             }
           }
-          logAuth("authorize(credentials) ok", summarizeSessionUserForLog(sessionUser));
+          chunk7L6KWI7S_cjs.logAuth("authorize(credentials) ok", chunk7L6KWI7S_cjs.summarizeSessionUserForLog(sessionUser));
           return sessionUser;
         } catch (err) {
           console.error("[cms-auth] authorize error (credentials):", err instanceof Error ? err.message : err);
-          logAuth("authorize(credentials) error", {
+          chunk7L6KWI7S_cjs.logAuth("authorize(credentials) error", {
             email,
             message: err instanceof Error ? err.message : String(err)
           });
@@ -790,7 +596,7 @@ function getNextAuthOptions(config) {
           });
           if (!user || user.blocked || user.inviteStatus === "pending" || user.deleted) return null;
           if (isCustomerGroupUser(user) && !permitsCustomerLogin(allowCustomerLogin, creds)) {
-            logAuth("authorize(otp) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("authorize(otp) rejected", {
               reason: "customer_group",
               identifier,
               callbackUrl: creds?.callbackUrl ?? null
@@ -811,7 +617,7 @@ function getNextAuthOptions(config) {
       clientSecret: google.clientSecret,
       allowDangerousEmailAccountLinking: true
     }));
-    logAuth("getNextAuthOptions: GoogleProvider registered");
+    chunk7L6KWI7S_cjs.logAuth("getNextAuthOptions: GoogleProvider registered");
   }
   const options = {
     secret: secret ?? process.env.NEXTAUTH_SECRET,
@@ -839,7 +645,7 @@ function getNextAuthOptions(config) {
         const emailRaw = typeof user?.email === "string" && user.email || (profile && typeof profile.email === "string" ? profile.email : "");
         const email = emailRaw.trim().toLowerCase();
         if (!email) {
-          logAuth("signIn(google) rejected", {
+          chunk7L6KWI7S_cjs.logAuth("signIn(google) rejected", {
             reason: "missing_email"
           });
           return false;
@@ -853,21 +659,21 @@ function getNextAuthOptions(config) {
               name: profileName
             });
             if (dbUser) {
-              logAuth("signIn(google) created customer", {
+              chunk7L6KWI7S_cjs.logAuth("signIn(google) created customer", {
                 email,
                 userId: dbUser.id
               });
             }
           }
           if (!dbUser) {
-            logAuth("signIn(google) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("signIn(google) rejected", {
               reason: "user_not_found",
               email
             });
             return false;
           }
           if (dbUser.blocked) {
-            logAuth("signIn(google) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("signIn(google) rejected", {
               reason: "blocked",
               email,
               userId: dbUser.id
@@ -875,7 +681,7 @@ function getNextAuthOptions(config) {
             return false;
           }
           if (dbUser.inviteStatus === "pending") {
-            logAuth("signIn(google) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("signIn(google) rejected", {
               reason: "invite_pending",
               email,
               userId: dbUser.id
@@ -883,7 +689,7 @@ function getNextAuthOptions(config) {
             return false;
           }
           if (dbUser.deleted) {
-            logAuth("signIn(google) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("signIn(google) rejected", {
               reason: "deleted",
               email,
               userId: dbUser.id
@@ -891,7 +697,7 @@ function getNextAuthOptions(config) {
             return false;
           }
           if (isCustomerGroupUser(dbUser) && allowCustomerLogin !== true) {
-            logAuth("signIn(google) rejected", {
+            chunk7L6KWI7S_cjs.logAuth("signIn(google) rejected", {
               reason: "customer_group",
               email,
               userId: dbUser.id
@@ -902,7 +708,7 @@ function getNextAuthOptions(config) {
           if (sessionUser.isVendorPortal && !sessionUser.isRBACAdmin) {
             const multiVendorEnabled = await checkMultiVendorEnabledViaSettingsApi();
             if (!multiVendorEnabled) {
-              logAuth("signIn(google) rejected", {
+              chunk7L6KWI7S_cjs.logAuth("signIn(google) rejected", {
                 reason: "multi_vendor_disabled",
                 email,
                 userId: dbUser.id
@@ -911,11 +717,11 @@ function getNextAuthOptions(config) {
             }
           }
           applySessionUserToAuthUser(user, sessionUser);
-          logAuth("signIn(google) ok", summarizeSessionUserForLog(sessionUser));
+          chunk7L6KWI7S_cjs.logAuth("signIn(google) ok", chunk7L6KWI7S_cjs.summarizeSessionUserForLog(sessionUser));
           return true;
         } catch (err) {
           console.error("[cms-auth] signIn error (google):", err instanceof Error ? err.message : err);
-          logAuth("signIn(google) error", {
+          chunk7L6KWI7S_cjs.logAuth("signIn(google) error", {
             email,
             message: err instanceof Error ? err.message : String(err)
           });
@@ -924,9 +730,9 @@ function getNextAuthOptions(config) {
       },
       async jwt({ token, user, trigger, session }) {
         if (user) {
-          logAuth("jwt callback: new sign-in", {
+          chunk7L6KWI7S_cjs.logAuth("jwt callback: new sign-in", {
             trigger,
-            user: summarizeSessionUserForLog(user)
+            user: chunk7L6KWI7S_cjs.summarizeSessionUserForLog(user)
           });
           const u = user;
           token.id = u.id;
@@ -946,7 +752,7 @@ function getNextAuthOptions(config) {
           token.isVendorOwner = u.isVendorOwner;
         }
         if (trigger === "update" && session && typeof session === "object") {
-          logAuth("jwt callback: session update", {
+          chunk7L6KWI7S_cjs.logAuth("jwt callback: session update", {
             trigger
           });
           const s = session;
@@ -959,10 +765,10 @@ function getNextAuthOptions(config) {
       },
       async session({ session, token }) {
         const t = token;
-        logAuth("session callback", {
+        chunk7L6KWI7S_cjs.logAuth("session callback", {
           tokenHasId: t.id != null,
           tokenEmail: typeof t.email === "string" ? t.email : null,
-          sessionUser: summarizeSessionUserForLog(session.user)
+          sessionUser: chunk7L6KWI7S_cjs.summarizeSessionUserForLog(session.user)
         });
         if (session.user) {
           if (typeof t.name === "string") session.user.name = t.name;
@@ -1032,18 +838,10 @@ chunkUSNT2KNT_cjs.__name(buildStorefrontNextAuthOptions, "buildStorefrontNextAut
 exports.AUTH_PROVIDERS_SETTINGS_GROUP = AUTH_PROVIDERS_SETTINGS_GROUP;
 exports.buildNextAuthOptions = buildNextAuthOptions;
 exports.buildStorefrontNextAuthOptions = buildStorefrontNextAuthOptions;
-exports.createCmsMiddleware = createCmsMiddleware;
 exports.createCustomerUserFromGoogleOAuth = createCustomerUserFromGoogleOAuth;
-exports.defaultPublicApiMethods = defaultPublicApiMethods;
 exports.getNextAuthOptions = getNextAuthOptions;
 exports.getStorefrontNextAuthOptions = getStorefrontNextAuthOptions;
 exports.googleOAuthRedirectUri = googleOAuthRedirectUri;
-exports.isAuthDebugClientEnabled = isAuthDebugClientEnabled;
-exports.isAuthDebugEnabled = isAuthDebugEnabled;
 exports.isGoogleAuthPubliclyEnabled = isGoogleAuthPubliclyEnabled;
-exports.logAuth = logAuth;
-exports.logAuthClient = logAuthClient;
-exports.nextAuthCookieDebugInfo = nextAuthCookieDebugInfo;
 exports.resolveGoogleAuthConfig = resolveGoogleAuthConfig;
 exports.seedAdministratorPermissions = seedAdministratorPermissions;
-exports.summarizeSessionUserForLog = summarizeSessionUserForLog;