@starci/auth 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.5.0 - 2026-11-08
+
+- Changed: `AuthError` extends `DomainError<AuthErrorCode>` of `@starci/common` (new dependency); its name, codes, constructor, `kind`, `context` and `cause` are unchanged, and it gains `params` (always empty).
+- Changed: the package's own non-array object guard is `isPlainRecord` of `@starci/common`.
+- Changed: requires `@starci/common` 1.0.1 (exact), the one copy an app installs, so `DomainError` stays one class (this version had not reached npm).
+
 ## 0.4.0 - 2026-11-04
 
 - Added: `RefreshCookieOptions.domains`: the refresh cookie's `Domain` follows the request host (its `Host` header without the port). A host equal to a listed domain, or ending in `.` and one, takes the longest that fits; any other host takes `domain`, else stays host-only, so one api signs in on localhost (host-only) and on a tunnel origin (its parent domain).

package/README.md

@@ -12,6 +12,8 @@ The sign-in of a lite StarCi app: one package, four entries.
 
 An app reaches the package only through `integrations/passport` (back end) and `modules/auth/client.ts` (front end); the lint refuses `passport*`, `jose`, `bcryptjs` and `@nestjs/jwt` in an app.
 
+The server throws one error class, `AuthError`: a `DomainError` of `@starci/common` whose `code` is a wire code, with the `kind` it travels as and a non-secret `context`.
+
 ## Back end
 
 ```ts

package/dist/server/errors.d.ts

@@ -1,7 +1,7 @@
+import { DomainError } from "@starci/common";
 import type { AuthErrorCode, AuthErrorKind } from "../contracts/index.js";
 /** The one error class of sign-in: a wire code, the kind it travels as and optional context for the log. */
-export declare class AuthError extends Error {
-    readonly code: AuthErrorCode;
+export declare class AuthError extends DomainError<AuthErrorCode> {
     readonly kind: AuthErrorKind;
     readonly context: Readonly<Record<string, unknown>>;
     constructor(code: AuthErrorCode, options?: {

package/dist/server/errors.js

@@ -1,13 +1,11 @@
+import { DomainError } from "@starci/common";
 import { AUTH_ERROR_KINDS } from "../contracts/index.js";
 /** The one error class of sign-in: a wire code, the kind it travels as and optional context for the log. */
-export class AuthError extends Error {
-    code;
+export class AuthError extends DomainError {
     kind;
     context;
     constructor(code, options = {}) {
-        super(code, options.cause === undefined ? undefined : { cause: options.cause });
-        this.name = "AuthError";
-        this.code = code;
+        super(options.cause === undefined ? { code } : { code, cause: options.cause });
         this.kind = AUTH_ERROR_KINDS[code];
         this.context = options.context ?? {};
     }

package/dist/server/flows.js

@@ -1,8 +1,9 @@
 import passport from "passport";
 import { AUTH_ERROR_CODES } from "../contracts/index.js";
 import { AuthError } from "./errors.js";
-import { isRecord, sameSitePath } from "./primitives.js";
-const isSubject = (value) => isRecord(value) && typeof value.userId === "string" && typeof value.email === "string";
+import { isPlainRecord } from "@starci/common";
+import { sameSitePath } from "./primitives.js";
+const isSubject = (value) => isPlainRecord(value) && typeof value.userId === "string" && typeof value.email === "string";
 const isHandler = (value) => typeof value === "function";
 /** The middleware passport built; passport types it as any, so it is checked once here. */
 const handlerOf = (built) => {
@@ -57,7 +58,7 @@ export class AuthFlows {
                     reject(new AuthError(AUTH_ERROR_CODES.GoogleStateInvalid));
                     return;
                 }
-                const state = isRecord(info) && isRecord(info.state) ? info.state.next : undefined;
+                const state = isPlainRecord(info) && isPlainRecord(info.state) ? info.state.next : undefined;
                 resolve({ subject: user, next: sameSitePath(state, "/") });
             };
             handlerOf(passport.authenticate("google", { session: false }, settled))(exchange.req, exchange.res, reject);

package/dist/server/primitives.d.ts

@@ -14,8 +14,6 @@ export interface SignedState {
     readonly e: number;
     readonly p?: string;
 }
-/** A record: a non-null object that is not an array. */
-export declare const isRecord: (value: unknown) => value is Readonly<Record<string, unknown>>;
 /** A same-site path (one leading slash, no line break), else the fallback path. */
 export declare const sameSitePath: (value: unknown, fallback: string) => string;
 /** Signs a state: base64url(JSON).base64url(HMAC-SHA256). */

package/dist/server/primitives.js

@@ -1,15 +1,14 @@
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { isPlainRecord } from "@starci/common";
 import { PASSWORD_BOUNDS } from "../contracts/index.js";
 /** The text of a secret input. */
 export const revealed = (secret) => (typeof secret === "string" ? secret : secret.reveal());
-/** A record: a non-null object that is not an array. */
-export const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const SAME_SITE_PATH = /^\/(?![/\\])/u;
 const LINE_BREAK = /[\r\n]/u;
 /** A same-site path (one leading slash, no line break), else the fallback path. */
 export const sameSitePath = (value, fallback) => typeof value === "string" && SAME_SITE_PATH.test(value) && !LINE_BREAK.test(value) ? value : fallback;
 const encode = (buffer) => buffer.toString("base64url");
-const isSignedState = (value) => isRecord(value) &&
+const isSignedState = (value) => isPlainRecord(value) &&
     typeof value.w === "string" &&
     typeof value.u === "string" &&
     typeof value.r === "string" &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/auth",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "The sign-in of a StarCi lite app in one package: a NestJS module (EdDSA access tokens with a multi-key JWKS, bcrypt passwords, Google OAuth with state and PKCE, rotating refresh tokens with a reuse grace window and reuse detection, a failures-only sign-in limit, the refresh cookie), the door contracts, a front-end auth client (access token in memory, one shared refresh, signed out only on 401 or 403) with React bindings, and test doubles.",
   "keywords": [
     "auth",
@@ -74,6 +74,7 @@
     "prepublishOnly": "npm test && npm run build"
   },
   "dependencies": {
+    "@starci/common": "1.0.1",
     "@nestjs/passport": "11.0.5",
     "bcryptjs": "3.0.3",
     "jose": "6.2.12",
@@ -106,6 +107,7 @@
     "@nestjs/common": "11.2.5",
     "@nestjs/core": "11.2.5",
     "@nestjs/testing": "11.2.5",
+    "@starci/common": "file:../common",
     "@types/express": "4.17.25",
     "@types/node": "22.20.4",
     "@types/passport-google-oauth20": "2.0.17",
@@ -124,5 +126,7 @@
   "publishConfig": {
     "access": "public",
     "provenance": true
-  }
+  },
+  "gitHead": "f464f759079854716389ba92feb7e4a1512a0ee3",
+  "starciSource": "d302420a970828a385f4e2325e7ed2b3e34b10e48f9d4d552326ff9fa292d945"
 }