auramaxx 0.0.11 → 0.0.13

package/src/components/agent/CredentialAgent.tsx

@@ -47,7 +47,7 @@ type CreateCredentialStart = 'api-key-form' | 'type-picker';
 type CreatePrefill = {
   agentId?: string;
   tags?: string[];
-  type?: 'login' | 'card' | 'note' | 'plain_note' | 'hot_wallet' | 'apikey' | 'oauth2' | 'ssh' | 'gpg' | 'custom';
+  type?: 'login' | 'card' | 'sso' | 'note' | 'plain_note' | 'hot_wallet' | 'apikey' | 'oauth2' | 'ssh' | 'gpg' | 'custom';
   name?: string;
   noteContent?: string;
 };
@@ -88,6 +88,9 @@ const SEARCH_FIELD_PRIORITY = [
   'cardholder',
   'brand',
   'last4',
+  'website',
+  'provider',
+  'identifier',
   'token_endpoint',
   'scopes',
   'fingerprint',
@@ -751,6 +754,7 @@ export const CredentialAgent: React.FC<CredentialAgentProps> = ({
       all: base.length,
       login: base.filter((c) => c.type === 'login').length,
       card: base.filter((c) => c.type === 'card').length,
+      sso: base.filter((c) => c.type === 'sso').length,
       note: base.filter((c) => c.type === 'note').length,
       plain_note: base.filter((c) => c.type === 'plain_note').length,
       hot_wallet: base.filter((c) => c.type === 'hot_wallet').length,

package/src/components/agent/CredentialDetail.tsx

@@ -130,6 +130,7 @@ export const CredentialDetail: React.FC<CredentialDetailProps> = ({
   const typeLabelMap: Record<string, string> = {
     login: 'Login',
     card: 'Card',
+    sso: 'SSO Login',
     note: 'Note',
     plain_note: 'Plain Note',
     hot_wallet: 'Hot Wallet',
@@ -327,6 +328,37 @@ export const CredentialDetail: React.FC<CredentialDetailProps> = ({
           </>
         )}
 
+        {credential.type === 'sso' && (
+          <>
+            <CredentialField
+              label="Website"
+              value={credential.meta.website as string | undefined}
+              credentialId={credential.id}
+              fieldKey={CREDENTIAL_FIELD_KEYS.sso.website}
+              isSensitive={false}
+              onShowLargeType={handleShowLargeType}
+            />
+            <CredentialField
+              label="Provider"
+              value={credential.meta.provider as string | undefined}
+              credentialId={credential.id}
+              fieldKey={CREDENTIAL_FIELD_KEYS.sso.provider}
+              isSensitive={false}
+              onShowLargeType={handleShowLargeType}
+            />
+            {credential.meta.identifier && (
+              <CredentialField
+                label="Identifier"
+                value={credential.meta.identifier as string | undefined}
+                credentialId={credential.id}
+                fieldKey={CREDENTIAL_FIELD_KEYS.sso.identifier}
+                isSensitive={false}
+                onShowLargeType={handleShowLargeType}
+              />
+            )}
+          </>
+        )}
+
         {credential.type === 'note' && (
           <CredentialField
             label="Content"
@@ -423,7 +455,6 @@ export const CredentialDetail: React.FC<CredentialDetailProps> = ({
             />
           </>
         )}
-
         {credential.type === 'ssh' && (
           <>
             <CredentialField label="Fingerprint" value={credential.meta.fingerprint as string | undefined} credentialId={credential.id} fieldKey={CREDENTIAL_FIELD_KEYS.ssh.fingerprint} isSensitive={false} onShowLargeType={handleShowLargeType} />

package/src/components/agent/CredentialForm.tsx

@@ -1,7 +1,7 @@
 'use client';
 
 import React, { useState, useEffect, useCallback, useRef, useMemo } from 'react';
-import { Key, Eye, Loader2, CreditCard, FileText, RefreshCw, ArrowLeft, Wallet, Upload } from 'lucide-react';
+import { Key, Eye, Loader2, CreditCard, FileText, RefreshCw, ArrowLeft, Wallet, Upload, Apple, Facebook, Chrome } from 'lucide-react';
 import { Button, TextInput, FilterDropdown, Modal, Toggle, ItemPicker } from '@/components/design-system';
 import { api, Api } from '@/lib/api';
 import { decryptCredentialPayload } from '@/lib/agent-crypto';
@@ -36,10 +36,11 @@ interface CredentialFormProps {
   };
 }
 
-type FormType = 'login' | 'card' | 'note' | 'plain_note' | 'hot_wallet' | 'apikey' | 'oauth2' | 'ssh' | 'gpg' | 'custom';
+type FormType = 'login' | 'card' | 'sso' | 'note' | 'plain_note' | 'hot_wallet' | 'apikey' | 'oauth2' | 'ssh' | 'gpg' | 'custom';
 
 const LOGIN_FIELD_KEYS = CREDENTIAL_FIELD_KEYS.login;
 const CARD_FIELD_KEYS = CREDENTIAL_FIELD_KEYS.card;
+const SSO_FIELD_KEYS = CREDENTIAL_FIELD_KEYS.sso;
 const HOT_WALLET_FIELD_KEYS = CREDENTIAL_FIELD_KEYS.hot_wallet;
 const APIKEY_FIELD_KEYS = CREDENTIAL_FIELD_KEYS.apikey;
 const OAUTH2_FIELD_KEYS = CREDENTIAL_FIELD_KEYS.oauth2;
@@ -55,6 +56,7 @@ const TYPE_META: Record<FormType, {
   plain_note: { label: 'Plain Note', description: 'Readable note content stored without encryption', icon: FileText },
   apikey: { label: 'API Key', description: 'Simple key/value secret', icon: Key },
   login: { label: 'Login', description: 'Websites and app accounts', icon: Key },
+  sso: { label: 'SSO Login', description: 'Website + identity provider references', icon: RefreshCw },
   note: { label: 'Secure Note', description: 'Private notes and secrets', icon: FileText },
   card: { label: 'Credit Card', description: 'Payment cards and details', icon: CreditCard },
   oauth2: { label: 'OAuth2', description: 'Auto-refreshing OAuth2 tokens', icon: RefreshCw },
@@ -64,7 +66,7 @@ const TYPE_META: Record<FormType, {
 };
 
 const FEATURED_TYPE_ORDER: FormType[] = ['apikey', 'login', 'plain_note'];
-const REMAINING_TYPE_ORDER: FormType[] = ['custom', 'card', 'hot_wallet', 'note', 'oauth2', 'ssh', 'gpg'];
+const REMAINING_TYPE_ORDER: FormType[] = ['custom', 'card', 'hot_wallet', 'sso', 'note', 'oauth2', 'ssh', 'gpg'];
 const MARKDOWN_NOTE_IMPORT_ACCEPT = '.md,.markdown,text/markdown';
 
 const escapeHtml = (value: string): string => value
@@ -86,6 +88,12 @@ const BRAND_OPTIONS = [
   { value: 'other', label: 'Other' },
 ];
 
+const SSO_PROVIDER_OPTIONS = [
+  { value: 'apple', label: 'Apple', icon: <Apple size={14} /> },
+  { value: 'facebook', label: 'Facebook', icon: <Facebook size={14} /> },
+  { value: 'google', label: 'Google', icon: <Chrome size={14} /> },
+];
+
 const normalizeForRank = (value: string) => value.trim().toLowerCase();
 
 const toTimestamp = (updatedAt?: string, createdAt?: string) => {
@@ -133,6 +141,11 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
   const [billingZip, setBillingZip] = useState('');
   const [cardNotes, setCardNotes] = useState('');
 
+  // SSO fields
+  const [ssoWebsite, setSsoWebsite] = useState('');
+  const [ssoProvider, setSsoProvider] = useState('');
+  const [ssoIdentifier, setSsoIdentifier] = useState('');
+
   // Note fields
   const [noteContent, setNoteContent] = useState('');
 
@@ -280,6 +293,10 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
         setBrand((cred.meta[CARD_FIELD_KEYS.brand] as string) || 'visa');
         setCardLast4((cred.meta[CARD_FIELD_KEYS.last4] as string) || '');
         setBillingZip((cred.meta[CARD_FIELD_KEYS.billingZip] as string) || '');
+      } else if (cred.type === 'sso') {
+        setSsoWebsite((cred.meta[SSO_FIELD_KEYS.website] as string) || '');
+        setSsoProvider((cred.meta[SSO_FIELD_KEYS.provider] as string) || '');
+        setSsoIdentifier((cred.meta[SSO_FIELD_KEYS.identifier] as string) || '');
       } else if (cred.type === 'apikey') {
         setApiKeyName((cred.meta[APIKEY_FIELD_KEYS.key] as string) || '');
         setApiKeyValue((cred.meta[APIKEY_FIELD_KEYS.value] as string) || '');
@@ -565,6 +582,9 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
       setCvv('');
       setBillingZip('');
       setCardNotes('');
+      setSsoWebsite('');
+      setSsoProvider('');
+      setSsoIdentifier('');
       setNoteContent('');
       setHotWalletChain('base');
       setHotWalletAddress('');
@@ -699,6 +719,8 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
       cardholder,
       cardNumber,
       cardLast4,
+      ssoWebsite,
+      ssoProvider,
       oauth2TokenEndpoint,
       sshHostsInput,
       gpgKeyId,
@@ -712,6 +734,7 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
     if (type === 'plain_note' && !noteContent.trim()) return false;
     if (type === 'apikey' && (!apiKeyName.trim() || !apiKeyValue.trim())) return false;
     if (type === 'custom' && (!customFieldKey.trim() || !customFieldValue.trim())) return false;
+    if (type === 'sso' && (!ssoWebsite.trim() || !ssoProvider.trim())) return false;
     if (type === 'ssh' && !sshPrivateKey.trim() && !isEdit) return false;
     if (type === 'gpg' && !gpgPrivateKey.trim() && !isEdit) return false;
 
@@ -750,6 +773,8 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
     oauth2RefreshToken,
     oauth2TokenEndpoint,
     password,
+    ssoProvider,
+    ssoWebsite,
     sshHostsInput,
     sshPrivateKey,
     totpIntent,
@@ -775,6 +800,8 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
       cardNumber,
       cardBrand: brand,
       cardLast4: resolvedCardLast4,
+      ssoWebsite,
+      ssoProvider,
       oauth2TokenEndpoint,
       sshHostsInput,
       gpgKeyId,
@@ -816,6 +843,17 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
           [CARD_FIELD_KEYS.billingZip]: billingZip,
         };
         break;
+      case 'sso':
+        fields.push({ key: SSO_FIELD_KEYS.website, value: ssoWebsite.trim(), type: 'text', sensitive: false });
+        fields.push({ key: SSO_FIELD_KEYS.provider, value: ssoProvider.trim().toLowerCase(), type: 'text', sensitive: false });
+        fields.push({ key: SSO_FIELD_KEYS.identifier, value: ssoIdentifier.trim(), type: 'text', sensitive: false });
+        meta = {
+          ...meta,
+          [SSO_FIELD_KEYS.website]: ssoWebsite.trim(),
+          [SSO_FIELD_KEYS.provider]: ssoProvider.trim().toLowerCase(),
+          [SSO_FIELD_KEYS.identifier]: ssoIdentifier.trim(),
+        };
+        break;
       case 'note':
         fields.push({ key: NOTE_CONTENT_KEY, value: noteContent, type: 'text', sensitive: true });
         break;
@@ -906,15 +944,13 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
       cardholder,
       cardNumber,
       cardLast4,
+      ssoWebsite,
+      ssoProvider,
       oauth2TokenEndpoint,
       sshHostsInput,
       gpgKeyId,
       gpgUidEmail,
     });
-    if (!name.trim() && !canDeriveName) {
-      setError('Name is required');
-      return;
-    }
     if (type === 'login' && !isEdit && !password.trim()) {
       setError('Password is required for login');
       return;
@@ -935,6 +971,14 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
       setError('Primary key and value are required for custom type');
       return;
     }
+    if (type === 'sso' && !ssoWebsite.trim()) {
+      setError('Website is required for SSO login');
+      return;
+    }
+    if (type === 'sso' && !ssoProvider.trim()) {
+      setError('Provider is required for SSO login');
+      return;
+    }
     if (type === 'ssh' && !sshPrivateKey.trim() && !isEdit) {
       setError('SSH private key is required');
       return;
@@ -973,6 +1017,10 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
         }
       }
     }
+    if (!name.trim() && !canDeriveName) {
+      setError('Name is required');
+      return;
+    }
     setSaving(true);
     setError(null);
 
@@ -1325,6 +1373,45 @@ export const CredentialForm: React.FC<CredentialFormProps> = ({
               </div>
             )}
 
+            {type === 'sso' && (
+              <div className="space-y-3">
+                <TextInput
+                  label="Website"
+                  value={ssoWebsite}
+                  onChange={(e) => setSsoWebsite(e.target.value)}
+                  placeholder="https://example.com"
+                />
+                <div className="space-y-1">
+                  <label className="block font-mono text-[9px] font-bold uppercase tracking-widest text-[var(--color-text-muted,#6b7280)]">
+                    Provider
+                  </label>
+                  <div data-testid="sso-provider-select">
+                    <ItemPicker
+                      ariaLabel="SSO Provider"
+                      options={SSO_PROVIDER_OPTIONS.map((providerOption) => ({
+                        value: providerOption.value,
+                        label: providerOption.label,
+                        description: `Sign in with ${providerOption.label}`,
+                        icon: providerOption.icon,
+                      }))}
+                      value={ssoProvider}
+                      onChange={(val) => setSsoProvider(String(val))}
+                    />
+                  </div>
+                </div>
+                {showGlobalAdvanced && (
+                  <div className="space-y-3 border border-[var(--color-border,#d4d4d8)] p-3 bg-[var(--color-background-alt,#f4f4f5)]">
+                    <TextInput
+                      label="Identifier (email/phone/username)"
+                      value={ssoIdentifier}
+                      onChange={(e) => setSsoIdentifier(e.target.value)}
+                      placeholder="alice@example.com"
+                    />
+                  </div>
+                )}
+              </div>
+            )}
+
             {type === 'note' && (
               <div>
                 <div className="flex items-center justify-between mb-1.5 px-1">

package/src/components/agent/CredentialRow.tsx

@@ -1,7 +1,7 @@
 'use client';
 
 import React from 'react';
-import { Key, CreditCard, FileText, Star, RefreshCw, Terminal, ShieldCheck, Wallet } from 'lucide-react';
+import { Key, CreditCard, FileText, Star, RefreshCw, Terminal, ShieldCheck, Wallet, Globe } from 'lucide-react';
 import type { CredentialMeta } from './types';
 import { getCredentialDisplayName } from './credentialDisplayName';
 
@@ -14,6 +14,7 @@ interface CredentialRowProps {
 const typeIcons: Record<string, React.FC<{ size: number; className?: string }>> = {
   login: Key,
   card: CreditCard,
+  sso: Globe,
   note: FileText,
   hot_wallet: Wallet,
   plain_note: FileText,
@@ -29,6 +30,12 @@ function getSubtitle(credential: CredentialMeta): string {
       return credential.meta.username || credential.meta.url || '';
     case 'card':
       return credential.meta.last4 ? `\u2022\u2022\u2022\u2022 ${credential.meta.last4}` : '';
+    case 'sso': {
+      const provider = String(credential.meta.provider || '').trim();
+      const website = String(credential.meta.website || '').trim();
+      if (provider && website) return `${provider} • ${website}`;
+      return provider || website || 'SSO Login';
+    }
     case 'note':
       return 'Secure Note';
     case 'hot_wallet':

package/src/components/agent/credentialFormName.ts

@@ -1,4 +1,4 @@
-type FormType = 'login' | 'card' | 'note' | 'plain_note' | 'hot_wallet' | 'apikey' | 'oauth2' | 'ssh' | 'gpg' | 'custom';
+type FormType = 'login' | 'card' | 'sso' | 'note' | 'plain_note' | 'hot_wallet' | 'apikey' | 'oauth2' | 'ssh' | 'gpg' | 'custom';
 
 type NameInputs = {
   type: FormType;
@@ -13,6 +13,8 @@ type NameInputs = {
   cardNumber: string;
   cardBrand?: string;
   cardLast4?: string;
+  ssoWebsite?: string;
+  ssoProvider?: string;
   oauth2TokenEndpoint: string;
   sshHostsInput: string;
   gpgKeyId: string;
@@ -42,6 +44,12 @@ const deriveNoteTitleFromContent = (raw: string): string => {
   return firstNonEmptyLine.slice(0, 48);
 };
 
+const formatSsoProviderLabel = (rawProvider: string): string => {
+  const normalized = rawProvider.trim().toLowerCase();
+  if (!normalized) return '';
+  return normalized.charAt(0).toUpperCase() + normalized.slice(1);
+};
+
 export function deriveCredentialName(inputs: NameInputs): string {
   const {
     type,
@@ -55,6 +63,8 @@ export function deriveCredentialName(inputs: NameInputs): string {
     cardNumber,
     cardBrand,
     cardLast4,
+    ssoWebsite,
+    ssoProvider,
     oauth2TokenEndpoint,
     sshHostsInput,
     gpgKeyId,
@@ -64,6 +74,8 @@ export function deriveCredentialName(inputs: NameInputs): string {
   const safeCardNumber = cardNumber || '';
   const safeCardBrand = cardBrand || '';
   const safeCardLast4 = cardLast4 || '';
+  const safeSsoWebsite = ssoWebsite || '';
+  const safeSsoProvider = ssoProvider || '';
   const safeOauth2TokenEndpoint = oauth2TokenEndpoint || '';
   const safeGpgKeyId = gpgKeyId || '';
   const safeGpgUidEmail = gpgUidEmail || '';
@@ -76,6 +88,11 @@ export function deriveCredentialName(inputs: NameInputs): string {
     .split(/\n|,/)
     .map((host) => host.trim())
     .filter(Boolean);
+  const ssoProviderLabel = formatSsoProviderLabel(safeSsoProvider);
+  const ssoWebsiteValue = safeSsoWebsite.trim();
+  const ssoDisplayName = ssoProviderLabel && ssoWebsiteValue
+    ? `${ssoProviderLabel} (${ssoWebsiteValue})`
+    : ssoWebsiteValue || (ssoProviderLabel ? `${ssoProviderLabel} SSO` : 'SSO Login');
   const derivedNameByType: Partial<Record<FormType, string>> = {
     plain_note: deriveNoteTitleFromContent(noteContent),
     apikey: apiKeyName.trim(),
@@ -84,6 +101,7 @@ export function deriveCredentialName(inputs: NameInputs): string {
     hot_wallet: hotWalletChain.trim() ? `Hot Wallet (${hotWalletChain.trim().toUpperCase()})` : 'Hot Wallet',
     custom: customFieldKey.trim(),
     card: cardDisplayName,
+    sso: ssoDisplayName,
     oauth2: safeOauth2TokenEndpoint.trim() || 'OAuth2',
     ssh: trimmedHosts[0] || 'SSH Key',
     gpg: safeGpgKeyId.trim() || safeGpgUidEmail.trim() || 'GPG Key',
@@ -107,6 +125,8 @@ export function canDeriveName(inputs: Omit<NameInputs, 'name'>): boolean {
     cardholder,
     cardNumber,
     cardLast4,
+    ssoWebsite,
+    ssoProvider,
     oauth2TokenEndpoint,
     sshHostsInput,
     gpgKeyId,
@@ -121,6 +141,7 @@ export function canDeriveName(inputs: Omit<NameInputs, 'name'>): boolean {
     || (type === 'hot_wallet' && (!!hotWalletChain.trim() || true))
     || (type === 'custom' && !!customFieldKey.trim())
     || (type === 'card' && (!!cardholder?.trim() || !!cardNumber?.trim() || !!cardLast4?.trim()))
+    || (type === 'sso' && (!!ssoWebsite?.trim() || !!ssoProvider?.trim()))
     || (type === 'oauth2' && !!oauth2TokenEndpoint?.trim())
     || (type === 'ssh' && !!sshHostsInput?.trim())
     || (type === 'gpg' && (!!gpgKeyId?.trim() || !!gpgUidEmail?.trim()))

package/src/components/agent/types.ts

@@ -40,11 +40,11 @@ export interface WalletLinkMetaV1 {
   linkedAt: string;
 }
 
-export type CredentialType = 'login' | 'card' | 'note' | 'plain_note' | 'hot_wallet' | 'api' | 'apikey' | 'custom' | 'passkey' | 'oauth2' | 'ssh' | 'gpg';
+export type CredentialType = 'login' | 'card' | 'sso' | 'note' | 'plain_note' | 'hot_wallet' | 'api' | 'apikey' | 'custom' | 'passkey' | 'oauth2' | 'ssh' | 'gpg';
 export type CredentialLifecycleFilter = 'active' | 'archive' | 'recently_deleted';
 export type CredentialWithLocation = CredentialMeta & { location: CredentialLifecycleFilter };
 
-export type CategoryFilter = 'all' | 'login' | 'card' | 'note' | 'plain_note' | 'hot_wallet' | 'api' | 'apikey' | 'custom' | 'passkey' | 'oauth2' | 'ssh' | 'gpg';
+export type CategoryFilter = 'all' | 'login' | 'card' | 'sso' | 'note' | 'plain_note' | 'hot_wallet' | 'api' | 'apikey' | 'custom' | 'passkey' | 'oauth2' | 'ssh' | 'gpg';
 
 export interface AgentFilters {
   agentId: string | null;

package/src/components/design-system/Modal.tsx

@@ -109,8 +109,21 @@ export const Modal: React.FC<ModalProps> = ({
       '[tabindex]:not([tabindex="-1"])',
     ].join(',');
 
+    const isFocusableElement = (el: HTMLElement) => {
+      if (el.hasAttribute('disabled') || el.getAttribute('aria-disabled') === 'true') return false;
+      if (el.tabIndex === -1) return false;
+      if (el.closest('[inert]')) return false;
+      if (el.hasAttribute('hidden')) return false;
+      if (el instanceof HTMLInputElement && el.type === 'hidden') return false;
+
+      const computedStyle = window.getComputedStyle(el);
+      if (computedStyle.display === 'none' || computedStyle.visibility === 'hidden') return false;
+
+      return true;
+    };
+
     const getFocusable = () => Array.from(dialogEl.querySelectorAll<HTMLElement>(focusableSelector))
-      .filter((el) => !el.hasAttribute('disabled') && el.tabIndex !== -1);
+      .filter(isFocusableElement);
 
     const initialFocusable = getFocusable();
     const priorityFocus = initialFocusable.find((el) => {

package/src/hooks/useUpdateChecker.ts

@@ -63,8 +63,24 @@ export function useUpdateChecker() {
     setState((prev) => ({ ...prev, updating: true, updateError: null, updateOutput: null }));
     try {
       const res = await fetch('/api/update', { method: 'POST' });
-      const data = await res.json() as { success: boolean; output?: string; error?: string };
+      const data = await res.json() as {
+        success: boolean;
+        deferred?: boolean;
+        message?: string;
+        output?: string;
+        error?: string;
+      };
       if (data.success) {
+        if (data.deferred) {
+          setState((prev) => ({
+            ...prev,
+            updating: false,
+            updateOutput: data.output || data.message || 'Update started in background.',
+            updateError: null,
+          }));
+          return;
+        }
+
         setState((prev) => ({
           ...prev,
           updating: false,

package/src/lib/pino.ts

@@ -1,13 +1,82 @@
 /**
- * Shared Pino logger instance for the WebSocket server (port 4748)
+ * Shared logger instance for the WebSocket server (port 4748).
  *
- * Keep this logger transport-free because it runs inside Next.js
- * instrumentation/server runtime where optional vendor chunks can
- * fail to resolve during startup.
+ * This module is imported by the Next.js instrumentation runtime.
+ * A static `import pino from 'pino'` can force a vendor chunk that may
+ * not exist in stale/incremental `.next` outputs, so we resolve it at runtime
+ * and fall back to a minimal console logger when needed.
  */
 
-import pino from 'pino';
+type Level = 'debug' | 'info' | 'warn' | 'error';
 
-export const log = pino(
-  { level: process.env.LOG_LEVEL || 'debug' },
-);
+export interface LoggerLike {
+  child(bindings: Record<string, unknown>): LoggerLike;
+  debug(...args: unknown[]): void;
+  info(...args: unknown[]): void;
+  warn(...args: unknown[]): void;
+  error(...args: unknown[]): void;
+}
+
+function parseArgs(args: unknown[]): { data?: unknown; msg?: string } {
+  if (args.length === 0) return {};
+  if (typeof args[0] === 'string') {
+    return { msg: args[0] as string };
+  }
+  if (typeof args[1] === 'string') {
+    return { data: args[0], msg: args[1] as string };
+  }
+  return { data: args[0] };
+}
+
+function createConsoleLogger(bindings: Record<string, unknown> = {}): LoggerLike {
+  const emit = (level: Level, args: unknown[]) => {
+    const { data, msg } = parseArgs(args);
+    const payload = {
+      level,
+      component: 'ws',
+      ...bindings,
+      ...(data && typeof data === 'object' ? data as Record<string, unknown> : {}),
+      msg,
+      time: new Date().toISOString(),
+    };
+
+    const sink = level === 'error' ? console.error : level === 'warn' ? console.warn : console.log;
+    sink(payload);
+  };
+
+  return {
+    child(extraBindings: Record<string, unknown>) {
+      return createConsoleLogger({ ...bindings, ...extraBindings });
+    },
+    debug(...args: unknown[]) {
+      emit('debug', args);
+    },
+    info(...args: unknown[]) {
+      emit('info', args);
+    },
+    warn(...args: unknown[]) {
+      emit('warn', args);
+    },
+    error(...args: unknown[]) {
+      emit('error', args);
+    },
+  };
+}
+
+function createRuntimePinoLogger(): LoggerLike | null {
+  try {
+    const requireFn = new Function('return require')() as NodeRequire;
+    const maybeModule = requireFn('pino') as
+      | ((options?: Record<string, unknown>) => LoggerLike)
+      | { default?: (options?: Record<string, unknown>) => LoggerLike };
+    const pinoFactory =
+      typeof maybeModule === 'function' ? maybeModule : maybeModule.default;
+
+    if (!pinoFactory) return null;
+    return pinoFactory({ level: process.env.LOG_LEVEL || 'debug' });
+  } catch {
+    return null;
+  }
+}
+
+export const log: LoggerLike = createRuntimePinoLogger() ?? createConsoleLogger();

package/src/server/cli/commands/actions.ts

@@ -53,7 +53,7 @@ function showHelp(): void {
     '  --json                       JSON output',
     '',
     'Auth bootstrap options (when AURA_TOKEN is not set):',
-    '  --profile <id>               /auth fallback profile (default: strict)',
+    '  --profile <id>               /auth fallback profile (default: trust.localProfile, then dev)',
     '  --profile-version <v>        /auth fallback profile version (default: v1)',
     '  --profile-overrides <json>   Tighten-only profile override JSON',
     '',