@lowdefy/api 0.0.0-experimental-20260813120102 → 0.0.0-experimental-20260814133003

package/dist/context/createApiContext.js

@@ -12,14 +12,11 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import createAuthorizeOutcome from './createAuthorizeOutcome.js';
+*/ import createAuthorize from './createAuthorize.js';
 import createReadConfigFile from './createReadConfigFile.js';
-import getAuthEnforcement from '../routes/auth/getAuthEnforcement.js';
-import getOrganizationBinding from '../routes/auth/organizations/getOrganizationBinding.js';
 import resolveLocale from './resolveLocale.js';
 function createApiContext(context) {
-    // context.user is written by resolveAuthentication (or a pre-resolved
-    // dev/e2e caller) before this runs - never assigned here.
+    context.user = context?.session?.user;
     if (context.i18n?.defaultLocale) {
         const active = resolveLocale({
             i18n: context.i18n,
@@ -32,19 +29,7 @@ function createApiContext(context) {
     } else {
         context.i18n = undefined;
     }
-    // The retained organizations state ({ policy, pinned }) - read by the
-    // _organization operator and the org-scoped admin steps; null when auth
-    // (or organizations) is not configured.
-    context.organization = getOrganizationBinding({
-        auth: context.auth ?? null
-    });
-    // The retained build-time authorization facts - the enrolment floor, the exempt
-    // enrolment page, and the unlisted-page-id default. null when auth is not
-    // configured, in which case nothing is protected and nothing is required.
-    context.authEnforcement = getAuthEnforcement({
-        auth: context.auth ?? null
-    });
-    context.authorizeOutcome = createAuthorizeOutcome(context);
+    context.authorize = createAuthorize(context);
     context.readConfigFile = createReadConfigFile(context);
 }
 export default createApiContext;

package/dist/context/createAuthorize.js

@@ -0,0 +1,45 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigError } from '@lowdefy/errors';
+function createAuthorize({ session, system = false }) {
+    // Next-auth getSession provides a session object if the user is authenticated
+    // else session will be null
+    const authenticated = !!session;
+    const roles = session?.user?.roles ?? [];
+    if (!Array.isArray(roles)) {
+        throw new ConfigError('session.user.roles must be an array of strings.', {
+            received: roles
+        });
+    }
+    function authorize(config) {
+        // A system context (scheduled, webhook, detached runs) was authorized at the
+        // transport layer, so nested endpoint calls are never gated on a user session.
+        if (system === true) return true;
+        const { auth } = config;
+        if (auth.public === true) return true;
+        if (auth.public === false) {
+            if (auth.roles) {
+                return authenticated && auth.roles.some((role)=>roles.includes(role));
+            }
+            return authenticated;
+        }
+        throw new ConfigError('auth.public must be true or false.', {
+            received: auth.public,
+            configKey: config['~k']
+        });
+    }
+    return authorize;
+}
+export default createAuthorize;

package/dist/context/createEvaluateOperators.js

@@ -14,13 +14,12 @@
   limitations under the License.
 */ import { ServerParser } from '@lowdefy/operators';
 function createEvaluateOperators(context) {
-    const { appMeta, i18n, jsMap, operators, organization, secrets, user } = context;
+    const { appMeta, i18n, jsMap, operators, secrets, user } = context;
     const operatorsParser = new ServerParser({
         i18n,
         jsMap,
         lowdefyApp: appMeta,
         operators,
-        organization,
         secrets,
         user
     });

package/dist/index.js

@@ -12,28 +12,20 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import buildEndpointResult from './response/buildEndpointResult.js';
-import callAgent from './routes/agent/callAgent.js';
+*/ import callAgent from './routes/agent/callAgent.js';
 import callEndpoint from './routes/endpoints/callEndpoint.js';
 import getEndpointConfig from './routes/endpoints/getEndpointConfig.js';
 import callRequest from './routes/request/callRequest.js';
 import createApiContext from './context/createApiContext.js';
 import createChannelRegistry from './routes/websocket/createChannelRegistry.js';
-import createSystemContext from './context/createSystemContext.js';
 import createWebSocketConnection from './routes/websocket/createWebSocketConnection.js';
-import getAuthStrategies from './routes/auth/strategies/getAuthStrategies.js';
-import getBetterAuth from './routes/auth/getBetterAuth.js';
+import createSessionCallback from './routes/auth/callbacks/createSessionCallback.js';
+import getAuthConfig from './routes/auth/getAuthConfig.js';
 import getHomeAndMenus from './routes/rootConfig/getHomeAndMenus.js';
 import getPageConfig from './routes/page/getPageConfig.js';
 import getRootConfig from './routes/rootConfig/getRootConfig.js';
 import logClientError from './routes/log/logClientError.js';
-import normalizeInjectedCaller from './context/normalizeInjectedCaller.js';
-import redactErrorResponse from './response/redactErrorResponse.js';
-import redactResponse from './response/redactResponse.js';
-import resolveAuthentication from './context/resolveAuthentication.js';
-import resolvePinnedOrganization from './routes/auth/organizations/resolvePinnedOrganization.js';
-import resolveTenantPreflight from './routes/connections/resolveTenantPreflight.js';
 import runDetachedEndpoint from './routes/endpoints/runDetachedEndpoint.js';
 import runWebhookEndpoint from './routes/endpoints/runWebhookEndpoint.js';
 import runScheduledEndpoint from './routes/endpoints/runScheduledEndpoint.js';
-export { buildEndpointResult, callAgent, callEndpoint, getEndpointConfig, callRequest, createApiContext, createChannelRegistry, createSystemContext, createWebSocketConnection, getAuthStrategies, getBetterAuth, getHomeAndMenus, getPageConfig, getRootConfig, logClientError, normalizeInjectedCaller, redactErrorResponse, redactResponse, resolveAuthentication, resolvePinnedOrganization, resolveTenantPreflight, runDetachedEndpoint, runWebhookEndpoint, runScheduledEndpoint };
+export { callAgent, callEndpoint, getEndpointConfig, callRequest, createApiContext, createChannelRegistry, createSessionCallback, createWebSocketConnection, getAuthConfig, getHomeAndMenus, getPageConfig, getRootConfig, logClientError, runDetachedEndpoint, runWebhookEndpoint, runScheduledEndpoint };

package/dist/routes/agent/prepareAgent.js

@@ -12,8 +12,7 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
-import buildEndpointResult from '../../response/buildEndpointResult.js';
+*/ import { serializer, type } from '@lowdefy/helpers';
 import getEndpointConfig from '../endpoints/getEndpointConfig.js';
 import invokeEndpoint from '../endpoints/invokeEndpoint.js';
 import getAgentConfig from './getAgentConfig.js';
@@ -81,11 +80,16 @@ async function prepareAgent(context, { agentId, agentContext, endpointDepth = 0,
                 payload,
                 endpointDepth
             });
-            return buildEndpointResult(context, {
-                error,
-                response,
-                status
-            });
+            const success = ![
+                'error',
+                'reject'
+            ].includes(status);
+            return {
+                error: serializer.serialize(error),
+                response: serializer.serialize(response),
+                status: success ? 'success' : status,
+                success
+            };
         },
         getEndpointConfig: async ({ endpointId })=>{
             return getEndpointConfig(context, {

package/dist/routes/auth/{organizations/getHookRequestHeaders.js → callbacks/addUserFieldsToSession.js}

@@ -12,13 +12,17 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ // The engine's baseURL is dynamic (resolved per request from the request
-// host), so a nested auth.api call made from inside a hook must carry the
-// firing request as its source - a headerless direct call cannot resolve a
-// base URL and BetterAuth rejects it. Database hooks receive the endpoint
-// context when the write runs inside a request lifecycle; the headers come
-// from there.
-function getHookRequestHeaders(ctx) {
-    return ctx?.headers ?? ctx?.request?.headers ?? ctx?.context?.headers;
+*/ import { get, set } from '@lowdefy/helpers';
+function addUserFieldsToSession({ session, token, authConfig, user }) {
+    if (token) {
+        Object.keys(authConfig.userFields).forEach((fieldName)=>{
+            set(session.user, fieldName, get(token, fieldName));
+        });
+    }
+    if (user) {
+        Object.keys(authConfig.userFields).forEach((fieldName)=>{
+            set(session.user, fieldName, get(user, fieldName));
+        });
+    }
 }
-export default getHookRequestHeaders;
+export default addUserFieldsToSession;

package/dist/routes/auth/callbacks/addUserFieldsToToken.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { get, set } from '@lowdefy/helpers';
+function addUserFieldsToToken({ account, authConfig, logger, profile, token, user }) {
+    const objects = {
+        account,
+        profile,
+        user
+    };
+    logger.debug('Adding userFields to user. Available provider data is:');
+    logger.debug(objects);
+    Object.entries(authConfig.userFields).forEach(([lowdefyFieldName, providerFieldName])=>{
+        const value = get(objects, providerFieldName);
+        logger.debug(`Adding provider field "${providerFieldName}" with value ${JSON.stringify(value)} as "${lowdefyFieldName}"`);
+        set(token, lowdefyFieldName, value);
+    });
+}
+export default addUserFieldsToToken;

package/dist/routes/auth/{hooks/composeAfterSlot.js → callbacks/createCallbackPlugins.js}

@@ -12,15 +12,10 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ // The composed slot for after and synthetic points - engine hooks first,
-// then the user hooks in array order, sequentially. Return values are
-// ignored; a thrown error propagates as an operational error on the
-// underlying operation.
-function composeAfterSlot({ hooks }) {
-    return async function afterSlot(data, ctx) {
-        for (const hook of hooks){
-            await hook(data, ctx);
-        }
-    };
+*/ function createCallbackPlugins({ authConfig, plugins, type }) {
+    return authConfig.callbacks.map((callbackConfig)=>({
+            fn: plugins.callbacks[callbackConfig.type],
+            properties: callbackConfig.properties
+        })).filter((callback)=>callback.fn.meta.type === type);
 }
-export default composeAfterSlot;
+export default createCallbackPlugins;

package/dist/routes/auth/callbacks/createCallbacks.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createJWTCallback from './createJWTCallback.js';
+import createRedirectCallback from './createRedirectCallback.js';
+import createSessionCallback from './createSessionCallback.js';
+import createSignInCallback from './createSignInCallback.js';
+function createCallbacks({ authConfig, logger, plugins }) {
+    const callbacks = {
+        session: createSessionCallback({
+            authConfig,
+            logger,
+            plugins
+        })
+    };
+    const jwt = createJWTCallback({
+        authConfig,
+        logger,
+        plugins
+    });
+    if (jwt) callbacks.jwt = jwt;
+    const redirect = createRedirectCallback({
+        authConfig,
+        logger,
+        plugins
+    });
+    if (redirect) callbacks.redirect = redirect;
+    const signIn = createSignInCallback({
+        authConfig,
+        plugins
+    });
+    if (signIn) callbacks.signIn = signIn;
+    return callbacks;
+}
+export default createCallbacks;

package/dist/routes/auth/callbacks/createJWTCallback.js

@@ -0,0 +1,77 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import addUserFieldsToToken from './addUserFieldsToToken.js';
+import createCallbackPlugins from './createCallbackPlugins.js';
+function createJWTCallback({ authConfig, logger, plugins }) {
+    const jwtCallbackPlugins = createCallbackPlugins({
+        authConfig,
+        plugins,
+        type: 'jwt'
+    });
+    async function jwtCallback({ token, user, account, profile, isNewUser }) {
+        if (profile) {
+            const { id, sub, name, given_name, family_name, middle_name, nickname, preferred_username, profile: profile_claim, picture, website, email, email_verified, gender, birthdate, zoneinfo, locale, phone_number, phone_number_verified, address, updated_at } = profile;
+            token = {
+                id,
+                sub,
+                name,
+                given_name,
+                family_name,
+                middle_name,
+                nickname,
+                preferred_username,
+                profile: profile_claim,
+                picture,
+                website,
+                email,
+                email_verified,
+                gender,
+                birthdate,
+                zoneinfo,
+                locale,
+                phone_number,
+                phone_number_verified,
+                address,
+                updated_at,
+                ...token
+            };
+        }
+        if (profile || user) {
+            if (authConfig.userFields) {
+                addUserFieldsToToken({
+                    authConfig,
+                    account,
+                    logger,
+                    profile,
+                    token,
+                    user
+                });
+            }
+        }
+        for (const plugin of jwtCallbackPlugins){
+            token = await plugin.fn({
+                properties: plugin.properties ?? {},
+                account,
+                isNewUser,
+                profile,
+                token,
+                user
+            });
+        }
+        return token;
+    }
+    return jwtCallback;
+}
+export default createJWTCallback;

package/dist/routes/auth/callbacks/createRedirectCallback.js

@@ -0,0 +1,41 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createCallbackPlugins from './createCallbackPlugins.js';
+function defaultRedirect({ url, baseUrl }) {
+    if (url.startsWith('/')) return `${baseUrl}${url}`;
+    else if (new URL(url).origin === baseUrl) return url;
+    return baseUrl;
+}
+function createRedirectCallback({ authConfig, plugins }) {
+    const redirectCallbackPlugins = createCallbackPlugins({
+        authConfig,
+        plugins,
+        type: 'redirect'
+    });
+    if (redirectCallbackPlugins.length === 0) return defaultRedirect;
+    if (redirectCallbackPlugins.length !== 1) {
+        throw new Error('More than one auth redirect callbacks are configured. Only one is allowed.');
+    }
+    const [plugin] = redirectCallbackPlugins;
+    function redirectCallback({ url, baseUrl }) {
+        return plugin.fn({
+            properties: plugin.properties ?? {},
+            baseUrl,
+            url
+        });
+    }
+    return redirectCallback;
+}
+export default createRedirectCallback;

package/dist/routes/auth/callbacks/createSessionCallback.js

@@ -0,0 +1,81 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import crypto from 'crypto';
+import addUserFieldsToSession from './addUserFieldsToSession.js';
+import createCallbackPlugins from './createCallbackPlugins.js';
+import validateSessionRoles from './validateSessionRoles.js';
+function createSessionCallback({ authConfig, plugins }) {
+    const sessionCallbackPlugins = createCallbackPlugins({
+        authConfig,
+        plugins,
+        type: 'session'
+    });
+    async function sessionCallback({ session, token, user }) {
+        const identifier = user ? user.id ?? user.sub ?? user.email : token.id ?? token.sub ?? token.email;
+        if (token) {
+            const { id, sub, name, given_name, family_name, middle_name, nickname, preferred_username, profile, picture, website, email, email_verified, gender, birthdate, zoneinfo, locale, phone_number, phone_number_verified, address, updated_at } = token;
+            session.user = {
+                id,
+                sub,
+                name,
+                given_name,
+                family_name,
+                middle_name,
+                nickname,
+                preferred_username,
+                profile,
+                picture,
+                website,
+                email,
+                email_verified,
+                gender,
+                birthdate,
+                zoneinfo,
+                locale,
+                phone_number,
+                phone_number_verified,
+                address,
+                updated_at,
+                ...session.user
+            };
+        }
+        if (authConfig.userFields) {
+            addUserFieldsToSession({
+                authConfig,
+                session,
+                token,
+                user
+            });
+        }
+        for (const plugin of sessionCallbackPlugins){
+            // eslint-disable-next-line no-param-reassign
+            session = await plugin.fn({
+                properties: plugin.properties ?? {},
+                session,
+                token,
+                user
+            });
+        }
+        validateSessionRoles({
+            session
+        });
+        // TODO: Should this be session.hashed_id or session.user.hashed_id
+        // Only session.user will be available using the _user operator
+        session.hashed_id = crypto.createHash('sha256').update(identifier ?? '').digest('base64');
+        return session;
+    }
+    return sessionCallback;
+}
+export default createSessionCallback;

package/dist/routes/auth/callbacks/createSignInCallback.js

@@ -0,0 +1,40 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createCallbackPlugins from './createCallbackPlugins.js';
+function createSignInCallback({ authConfig, plugins }) {
+    const signInCallbackPlugins = createCallbackPlugins({
+        authConfig,
+        plugins,
+        type: 'signIn'
+    });
+    if (signInCallbackPlugins.length === 0) return undefined;
+    async function signInCallback({ account, credentials, email, profile, user }) {
+        let allowSignIn = true;
+        for (const plugin of signInCallbackPlugins){
+            allowSignIn = await plugin.fn({
+                properties: plugin.properties ?? {},
+                account,
+                credentials,
+                email,
+                profile,
+                user
+            });
+            if (allowSignIn === false) break;
+        }
+        return allowSignIn;
+    }
+    return signInCallback;
+}
+export default createSignInCallback;

package/dist/routes/auth/callbacks/validateSessionRoles.js

@@ -0,0 +1,33 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigError } from '@lowdefy/errors';
+import { type } from '@lowdefy/helpers';
+function validateSessionRoles({ session }) {
+    const roles = session?.user?.roles;
+    if (type.isNone(roles)) return;
+    if (!Array.isArray(roles)) {
+        throw new ConfigError('session.user.roles must be an array of strings. Check auth.userFields configuration and custom session callback plugins.', {
+            received: roles
+        });
+    }
+    for (const role of roles){
+        if (!type.isString(role)) {
+            throw new ConfigError('session.user.roles must be an array of strings. Check auth.userFields configuration and custom session callback plugins.', {
+                received: roles
+            });
+        }
+    }
+}
+export default validateSessionRoles;

package/dist/routes/auth/{strategies/getAuthStrategies.js → createAdapter.js}

@@ -12,20 +12,13 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import createAuthStrategies from './createAuthStrategies.js';
-let strategies;
-// The strategy verifiers are constructed once per process at first use -
-// resolveAuthentication tries them in config order on every request that
-// resolves no session.
-function getAuthStrategies({ appMeta, authJson, logger, plugins, secrets }) {
-    if (strategies) return strategies;
-    strategies = createAuthStrategies({
-        appMeta,
-        authJson,
-        logger,
-        plugins,
-        secrets
+*/ function createAdapter({ authConfig, plugins }) {
+    const adapterConfig = authConfig.adapter;
+    if (!adapterConfig) {
+        return undefined;
+    }
+    return plugins.adapters[adapterConfig.type]({
+        properties: adapterConfig.properties
     });
-    return strategies;
 }
-export default getAuthStrategies;
+export default createAdapter;

package/dist/routes/auth/createLogger.js

@@ -0,0 +1,35 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ const authWarnings = {
+    NEXTAUTH_URL: 'NEXTAUTH_URL - Environment variable NEXTAUTH_URL is missing. Set it in your .env file. On Vercel, VERCEL_URL is used automatically.',
+    NO_SECRET: 'NO_SECRET - No `secret` configured. In development a temporary secret is generated, but production requires an explicit secret.',
+    DEBUG_ENABLED: 'DEBUG_ENABLED - NextAuth debug mode is enabled. This is meant for development only — remove it before deploying to production.',
+    EXPERIMENTAL_API: 'EXPERIMENTAL_API - An experimental NextAuth API is in use. It may change or be removed in a future version.'
+};
+function createLogger({ logger }) {
+    return {
+        // Auth.js v5 logger contract: error(error), warn(code), debug(message, metadata).
+        error: (error)=>{
+            logger.error(error);
+        },
+        warn: (code)=>{
+            logger.warn(authWarnings[code] ?? code);
+        },
+        debug: (code, metadata)=>{
+            logger.debug(metadata, code);
+        }
+    };
+}
+export default createLogger;