@aura-stack/auth 0.4.0-rc.4 → 0.4.0

package/dist/index.d.ts

@@ -1,12 +1,11 @@
-import { d as AuthConfig, e as AuthInstance, f as JoseInstance } from './index-DkaLJFn8.js';
-export { C as CookieConfig, E as ErrorType, O as OAuthProvider, g as OAuthProviderConfig, h as OAuthProviderCredentials, S as Session, U as User } from './index-DkaLJFn8.js';
-export { createClient } from '@aura-stack/router';
-import './@types/router.d.js';
+import { d as AuthConfig, e as AuthInstance } from './index-CSyIJmCM.js';
+export { C as CookieConfig, E as ErrorType, f as JoseInstance, i as LogLevel, L as Logger, O as OAuthProvider, g as OAuthProviderConfig, h as OAuthProviderCredentials, S as Session, T as TrustedOrigin, U as User } from './index-CSyIJmCM.js';
 import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import './jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
 
 /**
@@ -31,9 +30,6 @@ import './@types/utility.js';
  *   }]
  * })
  */
-declare const createAuth: (authConfig: AuthConfig) => {
-    handlers: AuthInstance["handlers"];
-    jose: JoseInstance;
-};
+declare const createAuth: (authConfig: AuthConfig) => AuthInstance;
 
-export { AuthConfig, AuthInstance, JoseInstance, createAuth };
+export { AuthConfig, AuthInstance, createAuth };

package/dist/index.js

@@ -1,73 +1,115 @@
 import {
   createBuiltInOAuthProviders
-} from "./chunk-EMKJA2GJ.js";
-import "./chunk-42XB3YCW.js";
-import "./chunk-FKRDCWBF.js";
-import "./chunk-IKHPGFCW.js";
-import "./chunk-KRNOMBXQ.js";
-import "./chunk-B737EUJV.js";
-import "./chunk-HP34YGGJ.js";
-import "./chunk-E3OXBRYF.js";
-import "./chunk-6R2YZ4AC.js";
-import "./chunk-DIVDFNAP.js";
+} from "./chunk-TM5IPSNF.js";
+import "./chunk-IPKO6UQN.js";
+import "./chunk-54CZPKR4.js";
+import "./chunk-EEE7UM5T.js";
+import "./chunk-4YHJ4IEQ.js";
+import "./chunk-OVHNRULD.js";
+import "./chunk-KMMAZFSJ.js";
+import "./chunk-FW4W3REU.js";
+import "./chunk-5LZ7TOM3.js";
+import "./chunk-LDU7A2JE.js";
+import "./chunk-E6G5YCI6.js";
 import "./chunk-ITQ7352M.js";
+import {
+  signInAction
+} from "./chunk-7QF22LHP.js";
+import {
+  csrfTokenAction
+} from "./chunk-ICAZ4OVS.js";
 import {
   signOutAction
-} from "./chunk-A3N4PVAT.js";
+} from "./chunk-ALG3GIV4.js";
 import {
   callbackAction
-} from "./chunk-KSWLO5ZU.js";
-import "./chunk-GA2SMTJO.js";
-import "./chunk-IVET23KF.js";
-import {
-  csrfTokenAction
-} from "./chunk-HT4YLL7N.js";
+} from "./chunk-6MXFPFR3.js";
+import "./chunk-TZB6MUXN.js";
+import "./chunk-XGLBNXL4.js";
 import {
   sessionAction
-} from "./chunk-JVFTCTTE.js";
+} from "./chunk-PHFH2MGS.js";
+import "./chunk-XUP6KKNG.js";
+import "./chunk-ZNCZVF6U.js";
+import "./chunk-KJBAQZX2.js";
+import "./chunk-NUDITUKX.js";
+import "./chunk-4EKY7655.js";
 import {
-  signInAction
-} from "./chunk-3EUWD5BB.js";
-import "./chunk-N4SX7TZT.js";
-import "./chunk-FIPU4MLT.js";
-import "./chunk-IUYZQTJV.js";
+  createErrorHandler,
+  useSecureCookies
+} from "./chunk-QQVSRXGX.js";
 import {
   createCookieStore
-} from "./chunk-W6LG7BFW.js";
-import "./chunk-STHEPPUZ.js";
+} from "./chunk-5W4BRQYG.js";
+import "./chunk-EBAMFRB7.js";
 import {
   createJoseInstance
-} from "./chunk-TLE4PXY3.js";
-import "./chunk-N2APGLXA.js";
-import {
-  onErrorHandler,
-  useSecureCookies
-} from "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
+} from "./chunk-FRJFWTOY.js";
+import "./chunk-4MYWAOLG.js";
 import "./chunk-RRLIF4PQ.js";
-import "./chunk-ZNCZVF6U.js";
-import "./chunk-YRCB5FLE.js";
+import {
+  createLogEntry
+} from "./chunk-VNCNJKS2.js";
 
 // src/index.ts
-import "dotenv/config";
-import { createRouter, createClient } from "@aura-stack/router";
+import { createRouter } from "@aura-stack/router";
+var logLevelToSeverity = {
+  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  warn: ["warning", "error", "critical", "alert", "emergency"],
+  error: ["error", "critical", "alert", "emergency"]
+};
+var createLoggerProxy = (logger) => {
+  if (!logger) return void 0;
+  const level = logger.level;
+  const allowedSeverities = logLevelToSeverity[level] ?? [];
+  const internalLogger = {
+    level,
+    log(key, overrides) {
+      const entry = createLogEntry(key, overrides);
+      if (!allowedSeverities.includes(entry.severity)) return entry;
+      logger.log({
+        timestamp: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+        appName: entry.appName ?? "aura-auth",
+        hostname: entry.hostname ?? "aura-auth",
+        ...entry
+      });
+      return entry;
+    }
+  };
+  return internalLogger;
+};
 var createInternalConfig = (authConfig) => {
   const useSecure = authConfig?.trustedProxyHeaders ?? false;
+  const logger = authConfig?.logger;
+  const internalLogger = createLoggerProxy(logger);
   return {
     basePath: authConfig?.basePath ?? "/auth",
-    onError: onErrorHandler,
+    onError: createErrorHandler(internalLogger),
     context: {
       oauth: createBuiltInOAuthProviders(authConfig?.oauth),
-      cookies: createCookieStore(useSecure, authConfig?.cookies?.prefix, authConfig?.cookies?.overrides ?? {}),
+      cookies: createCookieStore(
+        useSecure,
+        authConfig?.cookies?.prefix,
+        authConfig?.cookies?.overrides ?? {},
+        internalLogger
+      ),
       jose: createJoseInstance(authConfig?.secret),
       secret: authConfig?.secret,
       basePath: authConfig?.basePath ?? "/auth",
-      trustedProxyHeaders: useSecure
+      trustedProxyHeaders: useSecure,
+      trustedOrigins: authConfig?.trustedOrigins,
+      logger: internalLogger
     },
     middlewares: [
       (ctx) => {
         const useSecure2 = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
-        const cookies = createCookieStore(useSecure2, authConfig?.cookies?.prefix, authConfig?.cookies?.overrides ?? {});
+        const cookies = createCookieStore(
+          useSecure2,
+          authConfig?.cookies?.prefix,
+          authConfig?.cookies?.overrides ?? {},
+          internalLogger
+        );
         ctx.context.cookies = cookies;
         return ctx;
       }
@@ -86,6 +128,5 @@ var createAuth = (authConfig) => {
   };
 };
 export {
-  createAuth,
-  createClient
+  createAuth
 };

package/dist/jose.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,30 +15,48 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/jose.ts
 var jose_exports = {};
 __export(jose_exports, {
-  createJoseInstance: () => createJoseInstance
+  createJoseInstance: () => createJoseInstance,
+  decodeJWTOptions: () => decodeJWTOptions,
+  jwtVerificationOptions: () => jwtVerificationOptions
 });
 module.exports = __toCommonJS(jose_exports);
-var import_config = require("dotenv/config");
-var import_jose = require("@aura-stack/jose");
 
-// src/secure.ts
-var import_crypto = __toESM(require("crypto"), 1);
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
 
-// src/utils.ts
-var import_router = require("@aura-stack/router");
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
 
 // src/errors.ts
 var AuthInternalError = class extends Error {
@@ -54,14 +70,8 @@ var AuthInternalError = class extends Error {
   }
 };
 
-// src/secure.ts
-var createDerivedSalt = (secret) => {
-  return import_crypto.default.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex");
-};
-
 // src/jose.ts
 var createJoseInstance = (secret) => {
-  const env = process.env;
   secret ??= env.AURA_AUTH_SECRET ?? env.AUTH_SECRET;
   if (!secret) {
     throw new AuthInternalError(
@@ -69,7 +79,22 @@ var createJoseInstance = (secret) => {
       "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
     );
   }
-  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT ?? createDerivedSalt(secret);
+  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT;
+  if (!salt) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
+    );
+  }
+  try {
+    (0, import_jose.createSecret)(salt);
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_SALT_SECRET_VALUE",
+      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
+      { cause: error }
+    );
+  }
   const { derivedKey: derivedSigningKey } = (0, import_jose.createDeriveKey)(secret, salt, "signing");
   const { derivedKey: derivedEncryptionKey } = (0, import_jose.createDeriveKey)(secret, salt, "encryption");
   const { derivedKey: derivedCsrfTokenKey } = (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
@@ -85,7 +110,19 @@ var createJoseInstance = (secret) => {
     decryptJWE
   };
 };
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+var decodeJWTOptions = {
+  jws: jwtVerificationOptions,
+  jwt: {
+    typ: "JWT"
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createJoseInstance
+  createJoseInstance,
+  decodeJWTOptions,
+  jwtVerificationOptions
 });

package/dist/jose.d.ts

@@ -1,12 +1,12 @@
 import * as _aura_stack_jose from '@aura-stack/jose';
+import { JWTVerifyOptions, DecodedJWTPayloadOptions } from '@aura-stack/jose';
 import * as _aura_stack_jose_jose from '@aura-stack/jose/jose';
 export { JWTPayload } from '@aura-stack/jose/jose';
 
 /**
  * Creates the JOSE instance used for signing and verifying tokens. It derives keys
- * for session tokens and CSRF tokens. For security and determinism, it uses the
- * `AURA_AUTH_SALT` environment variable if available; otherwise,it uses a derived
- * salt based on the provided secret.
+ * for session tokens and CSRF tokens. For security and determinism, it's required
+ * to set a salt value in `AURA_AUTH_SALT` or `AUTH_SALT` env.
  *
  * @param secret the base secret for key derivation
  * @returns jose instance with methods for encoding/decoding JWTs and signing/verifying JWSs
@@ -15,9 +15,11 @@ declare const createJoseInstance: (secret?: string) => {
     decodeJWT: (token: string) => Promise<_aura_stack_jose_jose.JWTPayload>;
     encodeJWT: (payload: _aura_stack_jose_jose.JWTPayload) => Promise<string>;
     signJWS: (payload: _aura_stack_jose_jose.JWTPayload) => Promise<string>;
-    verifyJWS: (payload: string, options?: _aura_stack_jose.JWTVerifyOptions) => Promise<_aura_stack_jose_jose.JWTPayload>;
+    verifyJWS: (payload: string, options?: JWTVerifyOptions) => Promise<_aura_stack_jose_jose.JWTPayload>;
     encryptJWE: (payload: string, options?: _aura_stack_jose.EncryptOptions) => Promise<string>;
     decryptJWE: (payload: string, options?: _aura_stack_jose.JWTDecryptOptions) => Promise<string>;
 };
+declare const jwtVerificationOptions: JWTVerifyOptions;
+declare const decodeJWTOptions: DecodedJWTPayloadOptions;
 
-export { createJoseInstance };
+export { createJoseInstance, decodeJWTOptions, jwtVerificationOptions };

package/dist/jose.js

@@ -1,10 +1,12 @@
 import {
-  createJoseInstance
-} from "./chunk-TLE4PXY3.js";
-import "./chunk-N2APGLXA.js";
-import "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
+  createJoseInstance,
+  decodeJWTOptions,
+  jwtVerificationOptions
+} from "./chunk-FRJFWTOY.js";
+import "./chunk-4MYWAOLG.js";
 import "./chunk-RRLIF4PQ.js";
 export {
-  createJoseInstance
+  createJoseInstance,
+  decodeJWTOptions,
+  jwtVerificationOptions
 };

package/dist/logger.cjs

@@ -0,0 +1,292 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/logger.ts
+var logger_exports = {};
+__export(logger_exports, {
+  createLogEntry: () => createLogEntry,
+  logMessages: () => logMessages
+});
+module.exports = __toCommonJS(logger_exports);
+var logMessages = {
+  ROUTER_INTERNAL_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "ROUTER_INTERNAL_ERROR",
+    message: "Unhandled router error while processing the request"
+  },
+  INVALID_REQUEST: {
+    facility: 10,
+    severity: "warning",
+    msgId: "INVALID_REQUEST",
+    message: "Request validation failed against the expected schema"
+  },
+  SERVER_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "SERVER_ERROR",
+    message: "Unexpected internal server error during authentication"
+  },
+  OAUTH_PROTOCOL_ERROR: {
+    facility: 10,
+    severity: "warning",
+    msgId: "OAUTH_PROTOCOL_ERROR",
+    message: "OAuth provider returned an invalid or unexpected protocol response"
+  },
+  OAUTH_AUTHORIZATION_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_AUTHORIZATION_ERROR",
+    message: "OAuth authorization request was rejected or failed"
+  },
+  INVALID_OAUTH_CONFIGURATION: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_CONFIGURATION",
+    message: "The OAuth provider configuration is invalid or incomplete"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED",
+    message: "Starting OAuth access token request to the provider"
+  },
+  INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE",
+    message: "OAuth access token endpoint returned an invalid or malformed response"
+  },
+  OAUTH_ACCESS_TOKEN_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_ERROR",
+    message: "OAuth access token endpoint returned an error response"
+  },
+  OAUTH_ACCESS_TOKEN_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_ACCESS_TOKEN_SUCCESS",
+    message: "Successfully retrieved OAuth access token from the provider"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED",
+    message: "Network or server error while requesting OAuth access token"
+  },
+  OAUTH_USERINFO_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_USERINFO_REQUEST_INITIATED",
+    message: "Starting OAuth userinfo request to the provider"
+  },
+  OAUTH_USERINFO_INVALID_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_INVALID_RESPONSE",
+    message: "OAuth userinfo endpoint returned an invalid or malformed response"
+  },
+  OAUTH_USERINFO_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_ERROR",
+    message: "OAuth userinfo endpoint returned an error response"
+  },
+  OAUTH_USERINFO_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_USERINFO_SUCCESS",
+    message: "Successfully retrieved user information from the OAuth provider"
+  },
+  OAUTH_USERINFO_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_REQUEST_FAILED",
+    message: "Network or server error while requesting user information from the OAuth provider"
+  },
+  OAUTH_CALLBACK_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "OAUTH_CALLBACK_SUCCESS",
+    message: "OAuth callback completed successfully and session was created"
+  },
+  MISMATCHING_STATE: {
+    facility: 4,
+    severity: "critical",
+    msgId: "MISMATCHING_STATE",
+    message: "OAuth response state parameter does not match the stored state value"
+  },
+  POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
+    facility: 4,
+    severity: "critical",
+    msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+    message: "Blocked redirect to untrusted or external URL (potential open redirect attack)"
+  },
+  OPEN_REDIRECT_ATTACK: {
+    facility: 4,
+    severity: "warning",
+    msgId: "OPEN_REDIRECT_ATTACK",
+    message: "Detected redirect target that does not match the trusted origin"
+  },
+  SESSION_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "SESSION_TOKEN_MISSING",
+    message: "Session cookie is missing from the request"
+  },
+  CSRF_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_TOKEN_MISSING",
+    message: "CSRF token cookie is missing from the request"
+  },
+  CSRF_HEADER_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_HEADER_MISSING",
+    message: "CSRF header is missing from the request"
+  },
+  CSRF_TOKEN_INVALID: {
+    facility: 4,
+    severity: "error",
+    msgId: "CSRF_TOKEN_INVALID",
+    message: "CSRF token verification failed or token is invalid"
+  },
+  SIGN_IN_INITIATED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_IN_INITIATED",
+    message: "Starting OAuth sign-in flow for the selected provider"
+  },
+  SIGN_OUT_ATTEMPT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_ATTEMPT",
+    message: "Received sign-out request from client"
+  },
+  SIGN_OUT_CSRF_VERIFIED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_CSRF_VERIFIED",
+    message: "CSRF token was successfully verified during sign-out"
+  },
+  SIGN_OUT_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_SUCCESS",
+    message: "User session was cleared and sign-out completed successfully"
+  },
+  SIGN_OUT_REDIRECT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_REDIRECT",
+    message: "Redirecting client after successful sign-out"
+  },
+  AUTH_SESSION_VALID: {
+    facility: 4,
+    severity: "info",
+    msgId: "AUTH_SESSION_VALID",
+    message: "Session token is valid and user session was returned"
+  },
+  AUTH_SESSION_INVALID: {
+    facility: 4,
+    severity: "notice",
+    msgId: "AUTH_SESSION_INVALID",
+    message: "Session token is missing, expired, or invalid"
+  },
+  INVALID_JWT_TOKEN: {
+    facility: 4,
+    severity: "warning",
+    msgId: "INVALID_JWT_TOKEN",
+    message: "JWT session token failed validation during sign-out"
+  },
+  CSRF_TOKEN_REQUESTED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_REQUESTED",
+    message: "Client requested a CSRF token"
+  },
+  CSRF_TOKEN_ISSUED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_ISSUED",
+    message: "Issued a new CSRF token to the client"
+  },
+  INVALID_URL: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_URL",
+    message: "Derived origin URL is invalid or malformed"
+  },
+  COOKIE_HTTPONLY_DISABLED: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HTTPONLY_DISABLED",
+    message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure."
+  },
+  COOKIE_WILDCARD_DOMAIN: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_WILDCARD_DOMAIN",
+    message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided."
+  },
+  COOKIE_SECURE_DISABLED: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SECURE_DISABLED",
+    message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser."
+  },
+  COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE",
+    message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults."
+  },
+  COOKIE_INSECURE_IN_PRODUCTION: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_INSECURE_IN_PRODUCTION",
+    message: "Cookies are being served over an insecure connection in production, which is a serious security risk."
+  },
+  COOKIE_HOST_STRATEGY_INSECURE: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HOST_STRATEGY_INSECURE",
+    message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings."
+  },
+  UNTRUSTED_ORIGIN: {
+    facility: 10,
+    severity: "error",
+    msgId: "UNTRUSTED_ORIGIN",
+    message: "The constructed origin URL is not trusted."
+  }
+};
+var createLogEntry = (key, overrides) => {
+  const message = logMessages[key];
+  return {
+    ...message,
+    ...overrides
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createLogEntry,
+  logMessages
+});

package/dist/logger.d.ts

@@ -0,0 +1,8 @@
+export { m as createLogEntry, l as logMessages } from './index-CSyIJmCM.js';
+import 'zod';
+import './schemas.js';
+import './jose.js';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
+import './@types/utility.js';

package/dist/logger.js

@@ -0,0 +1,8 @@
+import {
+  createLogEntry,
+  logMessages
+} from "./chunk-VNCNJKS2.js";
+export {
+  createLogEntry,
+  logMessages
+};