sentri 1.1.0 → 1.1.2

package/dist/errors/AuthError.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthError.js","sourceRoot":"","sources":["../../src/errors/AuthError.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClB,IAAI,CAAgB;IAEpC,YAAY,IAAmB,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"AuthError.js","sourceRoot":"","sources":["../../src/errors/AuthError.ts"],"names":[],"mappings":"AA6BA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,YAAY,EAAE,GAAG;IACjB,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,mBAAmB,EAAE,GAAG;IACxB,SAAS,EAAE,GAAG;IACd,cAAc,EAAE,GAAG;IACnB,mBAAmB,EAAE,GAAG;IACxB,YAAY,EAAE,GAAG;IACjB,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC;;;;OAIG;IACa,IAAI,CAAS;IAE7B;;;;OAIG;IACa,UAAU,CAAS;IAEnC;;;;;;OAMG;IACH,YACE,IAAqC,EACrC,OAAe,EACf,UAAmB;QAEnB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IACjE,CAAC;CACF"}

package/dist/index.d.ts

@@ -6,10 +6,13 @@ declare global {
         }
     }
 }
-export type { AuthConfig, CookieConfig, AuthUser, ApiResponse, AuthAdapter, UserRecord, SessionRecord, CreateUserData, RouterHandlers, SignupInput, LoginInput, SignupResult, AuthResult, RefreshResult, AssignRolesResult, } from './types/auth.js';
-export type { AuthErrorCode } from './errors/AuthError.js';
+export type { AuthConfig, CookieConfig, AuthUser, ApiResponse, AuthAdapter, UserRecord, SessionRecord, CreateUserData, RouterHandlers, RegisterInput, LoginInput, RegisterResult, AuthResult, RefreshResult, AssignRolesResult, } from './types/auth.js';
+export type { SentriErrorCode } from './errors/AuthError.js';
 export type { AuthClient } from './client.js';
-export { AuthError } from './errors/AuthError.js';
+export type { ErrorHandlerOptions } from './middleware/errorHandler.js';
+export { SentriError, AUTH_ERROR_STATUS } from './errors/AuthError.js';
 export { createAuth } from './client.js';
+export { createErrorHandler } from './middleware/errorHandler.js';
+export { register } from './services/auth.js';
 export type { PermitCheck, PermitOptions } from './middleware/permit.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,QAAQ,CAAC;SACjB;KACF;CACF;AAED,YAAY,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,WAAW,EACX,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGhD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,QAAQ,CAAC;SACjB;KACF;CACF;AAED,YAAY,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACb,UAAU,EACV,cAAc,EACd,UAAU,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -1,3 +1,5 @@
-export { AuthError } from './errors/AuthError.js';
+export { SentriError, AUTH_ERROR_STATUS } from './errors/AuthError.js';
 export { createAuth } from './client.js';
+export { createErrorHandler } from './middleware/errorHandler.js';
+export { register } from './services/auth.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/libs/config.d.ts

@@ -17,14 +17,14 @@ export interface ResolvedConfig {
  * Validate configuration at startup so misconfiguration is caught immediately,
  * not at the first login attempt.
  *
- * Throws {@link AuthError} with code `CONFIGURATION_ERROR` for any of:
+ * Throws {@link SentriError} with code `CONFIGURATION_ERROR` for any of:
  * - `secret` missing or shorter than 32 characters
  * - `saltRounds` outside the range 10–31
  * - `validRoles` is empty or missing
  * - `adapter` is missing
  *
  * @param config - The raw config passed to {@link createAuth}.
- * @throws {AuthError} With code `CONFIGURATION_ERROR` on any invalid field.
+ * @throws {SentriError} With code `CONFIGURATION_ERROR` on any invalid field.
  */
 export declare function validateConfig(config: AuthConfig): void;
 /**

package/dist/libs/config.js

@@ -1,4 +1,4 @@
-import { AuthError } from '../errors/AuthError.js';
+import { SentriError } from '../errors/AuthError.js';
 const MIN_SECRET_LENGTH = 32;
 const MIN_SALT_ROUNDS = 10;
 const MAX_SALT_ROUNDS = 31;
@@ -6,31 +6,31 @@ const MAX_SALT_ROUNDS = 31;
  * Validate configuration at startup so misconfiguration is caught immediately,
  * not at the first login attempt.
  *
- * Throws {@link AuthError} with code `CONFIGURATION_ERROR` for any of:
+ * Throws {@link SentriError} with code `CONFIGURATION_ERROR` for any of:
  * - `secret` missing or shorter than 32 characters
  * - `saltRounds` outside the range 10–31
  * - `validRoles` is empty or missing
  * - `adapter` is missing
  *
  * @param config - The raw config passed to {@link createAuth}.
- * @throws {AuthError} With code `CONFIGURATION_ERROR` on any invalid field.
+ * @throws {SentriError} With code `CONFIGURATION_ERROR` on any invalid field.
  */
 export function validateConfig(config) {
     if (!config.secret || config.secret.trim().length === 0) {
-        throw new AuthError('CONFIGURATION_ERROR', 'secret must not be empty');
+        throw new SentriError('CONFIGURATION_ERROR', 'secret must not be empty');
     }
     if (config.secret.length < MIN_SECRET_LENGTH) {
-        throw new AuthError('CONFIGURATION_ERROR', `secret must be at least ${MIN_SECRET_LENGTH} characters to be cryptographically safe`);
+        throw new SentriError('CONFIGURATION_ERROR', `secret must be at least ${MIN_SECRET_LENGTH} characters to be cryptographically safe`);
     }
     const saltRounds = config.saltRounds ?? 12;
     if (!Number.isInteger(saltRounds) || saltRounds < MIN_SALT_ROUNDS || saltRounds > MAX_SALT_ROUNDS) {
-        throw new AuthError('CONFIGURATION_ERROR', `saltRounds must be an integer between ${MIN_SALT_ROUNDS} and ${MAX_SALT_ROUNDS}`);
+        throw new SentriError('CONFIGURATION_ERROR', `saltRounds must be an integer between ${MIN_SALT_ROUNDS} and ${MAX_SALT_ROUNDS}`);
     }
     if (!config.validRoles || config.validRoles.length === 0) {
-        throw new AuthError('CONFIGURATION_ERROR', 'validRoles must contain at least one role');
+        throw new SentriError('CONFIGURATION_ERROR', 'validRoles must contain at least one role');
     }
     if (!config.adapter) {
-        throw new AuthError('CONFIGURATION_ERROR', 'adapter is required');
+        throw new SentriError('CONFIGURATION_ERROR', 'adapter is required');
     }
 }
 /**

package/dist/libs/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/libs/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAkBnD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CACjB,qBAAqB,EACrB,2BAA2B,iBAAiB,0CAA0C,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,eAAe,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;QAClG,MAAM,IAAI,SAAS,CACjB,qBAAqB,EACrB,yCAAyC,eAAe,QAAQ,eAAe,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmB;IAC/C,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;QACjD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;QACvC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,SAA0B;IACpD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,GAAG,IAAI,CAAC;IAC3D,MAAM,WAAW,GAA2B;QAC1C,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,SAAS;QACZ,CAAC,EAAE,UAAU;QACb,CAAC,EAAE,WAAW;KACf,CAAC;IACF,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;AACvC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/libs/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAkBrD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC7C,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,2BAA2B,iBAAiB,0CAA0C,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,eAAe,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;QAClG,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,yCAAyC,eAAe,QAAQ,eAAe,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmB;IAC/C,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;QACjD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;QACvC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,SAA0B;IACpD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,GAAG,IAAI,CAAC;IAC3D,MAAM,WAAW,GAA2B;QAC1C,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,SAAS;QACZ,CAAC,EAAE,UAAU;QACb,CAAC,EAAE,WAAW;KACf,CAAC;IACF,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;AACvC,CAAC"}

package/dist/libs/token.d.ts

@@ -29,7 +29,7 @@ export declare function signRefreshToken(sessionId: string, config: AuthConfig):
  * @param token - Compact JWT access token string.
  * @param config - Auth configuration used to derive the secret and algorithm.
  * @returns Decoded `AuthUser` payload (id, identifier, roles).
- * @throws {AuthError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
+ * @throws {SentriError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
  */
 export declare function verifyAccessToken(token: string, config: AuthConfig): AuthUser;
 /**
@@ -38,7 +38,7 @@ export declare function verifyAccessToken(token: string, config: AuthConfig): Au
  * @param token - Compact JWT refresh token string.
  * @param config - Auth configuration used to derive the secret and algorithm.
  * @returns Object with `sessionId` matching the one passed to {@link signRefreshToken}.
- * @throws {AuthError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
+ * @throws {SentriError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
  */
 export declare function verifyRefreshToken(token: string, config: AuthConfig): {
     sessionId: string;

package/dist/libs/token.js

@@ -1,5 +1,5 @@
 import jwt, {} from 'jsonwebtoken';
-import { AuthError } from '../errors/AuthError.js';
+import { SentriError } from '../errors/AuthError.js';
 import { resolveConfig } from './config.js';
 /**
  * Derive separate HMAC secrets for access and refresh tokens from a single
@@ -31,30 +31,30 @@ function sign(payload, secret, expiresIn, algorithm) {
     return jwt.sign(payload, secret, options);
 }
 /**
- * Verify and decode a JWT, mapping jsonwebtoken errors to typed {@link AuthError}s.
+ * Verify and decode a JWT, mapping jsonwebtoken errors to typed {@link SentriError}s.
  *
  * @param token - Compact JWT string to verify.
  * @param secret - HMAC key used to sign the token.
  * @param algorithm - Expected signing algorithm.
  * @returns Decoded payload cast to `T`.
- * @throws {AuthError} With `TOKEN_EXPIRED` if the token's `exp` claim is in the past.
- * @throws {AuthError} With `TOKEN_INVALID` for any other verification failure.
+ * @throws {SentriError} With `TOKEN_EXPIRED` if the token's `exp` claim is in the past.
+ * @throws {SentriError} With `TOKEN_INVALID` for any other verification failure.
  */
 function verify(token, secret, algorithm) {
     try {
         const decoded = jwt.verify(token, secret, { algorithms: [algorithm] });
         if (typeof decoded === 'string' || decoded === null) {
-            throw new AuthError('TOKEN_INVALID', 'Token payload is not an object');
+            throw new SentriError('TOKEN_INVALID', 'Token payload is not an object');
         }
         return decoded;
     }
     catch (err) {
-        if (err instanceof AuthError)
+        if (err instanceof SentriError)
             throw err;
         if (err instanceof jwt.TokenExpiredError) {
-            throw new AuthError('TOKEN_EXPIRED', 'Token has expired');
+            throw new SentriError('TOKEN_EXPIRED', 'Token has expired');
         }
-        throw new AuthError('TOKEN_INVALID', 'Token is invalid or malformed');
+        throw new SentriError('TOKEN_INVALID', 'Token is invalid or malformed');
     }
 }
 /**
@@ -95,7 +95,7 @@ export function signRefreshToken(sessionId, config) {
  * @param token - Compact JWT access token string.
  * @param config - Auth configuration used to derive the secret and algorithm.
  * @returns Decoded `AuthUser` payload (id, identifier, roles).
- * @throws {AuthError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
+ * @throws {SentriError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
  */
 export function verifyAccessToken(token, config) {
     const resolved = resolveConfig(config);
@@ -108,7 +108,7 @@ export function verifyAccessToken(token, config) {
  * @param token - Compact JWT refresh token string.
  * @param config - Auth configuration used to derive the secret and algorithm.
  * @returns Object with `sessionId` matching the one passed to {@link signRefreshToken}.
- * @throws {AuthError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
+ * @throws {SentriError} With `TOKEN_EXPIRED` if expired, `TOKEN_INVALID` otherwise.
  */
 export function verifyRefreshToken(token, config) {
     const resolved = resolveConfig(config);

package/dist/libs/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/libs/token.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,EAAE,EAAoB,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO;QACL,MAAM,EAAE,GAAG,MAAM,SAAS;QAC1B,OAAO,EAAE,GAAG,MAAM,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CACX,OAAe,EACf,MAAc,EACd,SAA0B,EAC1B,SAAsC;IAEtC,MAAM,OAAO,GAAgB;QAC3B,SAAS,EAAE,SAAyD;QACpE,SAAS;KACV,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,MAAM,CACb,KAAa,EACb,MAAc,EACd,SAAsC;IAEtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,OAAY,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,IAAI,GAAG,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAsC,EAAE,MAAkB;IACxF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAkB;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAkB;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAW,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAkB;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAwB,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/libs/token.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,EAAE,EAAoB,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO;QACL,MAAM,EAAE,GAAG,MAAM,SAAS;QAC1B,OAAO,EAAE,GAAG,MAAM,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CACX,OAAe,EACf,MAAc,EACd,SAA0B,EAC1B,SAAsC;IAEtC,MAAM,OAAO,GAAgB;QAC3B,SAAS,EAAE,SAAyD;QACpE,SAAS;KACV,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,MAAM,CACb,KAAa,EACb,MAAc,EACd,SAAsC;IAEtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,OAAY,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW;YAAE,MAAM,GAAG,CAAC;QAC1C,IAAI,GAAG,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACzC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAsC,EAAE,MAAkB;IACxF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAkB;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAkB;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAW,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAkB;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAwB,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC3E,CAAC"}

package/dist/middleware/authorize.d.ts

@@ -3,7 +3,7 @@ import type { RequestHandler } from 'express';
  * Express middleware factory for role-based access control (RBAC).
  *
  * Passes if the authenticated user (set by `protect()`) has **at least one**
- * of the specified `allowedRoles`. Calls `next(AuthError)` with code `FORBIDDEN`
+ * of the specified `allowedRoles`. Calls `next(SentriError)` with code `FORBIDDEN`
  * if no roles match, or `UNAUTHORIZED` if `req.user` is absent.
  *
  * Must be used **after** `protect()`.

package/dist/middleware/authorize.js

@@ -1,9 +1,9 @@
-import { AuthError } from '../errors/AuthError.js';
+import { SentriError } from '../errors/AuthError.js';
 /**
  * Express middleware factory for role-based access control (RBAC).
  *
  * Passes if the authenticated user (set by `protect()`) has **at least one**
- * of the specified `allowedRoles`. Calls `next(AuthError)` with code `FORBIDDEN`
+ * of the specified `allowedRoles`. Calls `next(SentriError)` with code `FORBIDDEN`
  * if no roles match, or `UNAUTHORIZED` if `req.user` is absent.
  *
  * Must be used **after** `protect()`.
@@ -17,12 +17,12 @@ import { AuthError } from '../errors/AuthError.js';
 export function authorize(...allowedRoles) {
     return (request, _response, next) => {
         if (!request.user) {
-            return next(new AuthError('UNAUTHORIZED', 'Not authenticated'));
+            return next(new SentriError('UNAUTHORIZED', 'Not authenticated'));
         }
         const userRoles = request.user.roles;
         const hasRole = allowedRoles.some((role) => userRoles.includes(role));
         if (!hasRole) {
-            return next(new AuthError('FORBIDDEN', `Requires one of roles: ${allowedRoles.join(', ')}`));
+            return next(new SentriError('FORBIDDEN', `Requires one of roles: ${allowedRoles.join(', ')}`));
         }
         next();
     };

package/dist/middleware/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAuB,GAAG,YAAqB;IACtE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,SAAS,GAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACxD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CACT,IAAI,SAAS,CAAC,WAAW,EAAE,0BAA0B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAuB,GAAG,YAAqB;IACtE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,WAAW,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,SAAS,GAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACxD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CACT,IAAI,WAAW,CAAC,WAAW,EAAE,0BAA0B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/errorHandler.d.ts

@@ -0,0 +1,71 @@
+import type { ErrorRequestHandler } from 'express';
+/**
+ * Options for {@link createErrorHandler}.
+ */
+export interface ErrorHandlerOptions {
+    /**
+     * Called for errors that are **not** a `SentriError` instance (or subclass).
+     *
+     * Use this to log unexpected server errors before the generic 500 response
+     * is sent. The error is passed as-is and may be any unknown value.
+     *
+     * @example
+     * app.use(auth.errorHandler({
+     *   onUnhandled: (err) => logger.error('Unhandled error', { err }),
+     * }));
+     */
+    onUnhandled?: (error: unknown) => void;
+}
+/**
+ * Creates an Express error-handling middleware that formats every `SentriError`
+ * (including subclasses) into the standard sentri response envelope:
+ *
+ * ```json
+ * { "error": true, "statusCode": 401, "code": "UNAUTHORIZED", "message": "...", "data": null }
+ * ```
+ *
+ * Prefer using `auth.errorHandler()` instead of calling this directly:
+ *
+ * ```typescript
+ * app.use('/auth', auth.router());
+ * app.use('/api', apiRouter);
+ *
+ * // Must come after all route/middleware registrations
+ * app.use(auth.errorHandler());
+ * ```
+ *
+ * ---
+ *
+ * **Works with built-in sentri errors and your own subclasses**
+ *
+ * Because `instanceof SentriError` matches any subclass, you can define
+ * application-specific error types and have them automatically formatted
+ * by this handler:
+ *
+ * ```typescript
+ * import { SentriError } from 'sentri';
+ *
+ * // Extend SentriError for domain-specific failures
+ * export class NotFoundError extends SentriError {
+ *   constructor(resource: string) {
+ *     super('NOT_FOUND', `${resource} not found`, 404);
+ *   }
+ * }
+ *
+ * export class PaymentError extends SentriError {
+ *   constructor(message: string) {
+ *     super('PAYMENT_FAILED', message, 402);
+ *   }
+ * }
+ *
+ * // All of the above are caught and formatted by one handler
+ * app.use(auth.errorHandler({
+ *   onUnhandled: (err) => console.error('Unexpected error:', err),
+ * }));
+ * ```
+ *
+ * @param options - Optional configuration (see {@link ErrorHandlerOptions}).
+ * @returns An Express `ErrorRequestHandler` (4-argument middleware).
+ */
+export declare function createErrorHandler(options?: ErrorHandlerOptions): ErrorRequestHandler;
+//# sourceMappingURL=errorHandler.d.ts.map

package/dist/middleware/errorHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.d.ts","sourceRoot":"","sources":["../../src/middleware/errorHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAGnD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,mBAAmB,CAsBrF"}

package/dist/middleware/errorHandler.js

@@ -0,0 +1,74 @@
+import { SentriError } from '../errors/AuthError.js';
+/**
+ * Creates an Express error-handling middleware that formats every `SentriError`
+ * (including subclasses) into the standard sentri response envelope:
+ *
+ * ```json
+ * { "error": true, "statusCode": 401, "code": "UNAUTHORIZED", "message": "...", "data": null }
+ * ```
+ *
+ * Prefer using `auth.errorHandler()` instead of calling this directly:
+ *
+ * ```typescript
+ * app.use('/auth', auth.router());
+ * app.use('/api', apiRouter);
+ *
+ * // Must come after all route/middleware registrations
+ * app.use(auth.errorHandler());
+ * ```
+ *
+ * ---
+ *
+ * **Works with built-in sentri errors and your own subclasses**
+ *
+ * Because `instanceof SentriError` matches any subclass, you can define
+ * application-specific error types and have them automatically formatted
+ * by this handler:
+ *
+ * ```typescript
+ * import { SentriError } from 'sentri';
+ *
+ * // Extend SentriError for domain-specific failures
+ * export class NotFoundError extends SentriError {
+ *   constructor(resource: string) {
+ *     super('NOT_FOUND', `${resource} not found`, 404);
+ *   }
+ * }
+ *
+ * export class PaymentError extends SentriError {
+ *   constructor(message: string) {
+ *     super('PAYMENT_FAILED', message, 402);
+ *   }
+ * }
+ *
+ * // All of the above are caught and formatted by one handler
+ * app.use(auth.errorHandler({
+ *   onUnhandled: (err) => console.error('Unexpected error:', err),
+ * }));
+ * ```
+ *
+ * @param options - Optional configuration (see {@link ErrorHandlerOptions}).
+ * @returns An Express `ErrorRequestHandler` (4-argument middleware).
+ */
+export function createErrorHandler(options) {
+    return (err, _req, res, _next) => {
+        if (err instanceof SentriError) {
+            res.status(err.statusCode).json({
+                error: true,
+                statusCode: err.statusCode,
+                code: err.code,
+                message: err.message,
+                data: null,
+            });
+            return;
+        }
+        options?.onUnhandled?.(err);
+        res.status(500).json({
+            error: true,
+            statusCode: 500,
+            message: 'Internal server error',
+            data: null,
+        });
+    };
+}
+//# sourceMappingURL=errorHandler.js.map

package/dist/middleware/errorHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../src/middleware/errorHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAoBrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC9D,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBAC9B,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;QAE5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,uBAAuB;YAChC,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/permit.d.ts

@@ -31,7 +31,7 @@ export interface PermitOptions<TRole extends string> {
  * Express middleware factory for resource-level permission checks.
  *
  * Must be used **after** `protect()`. Evaluates a check function against the
- * current request; calls `next(AuthError)` with code `FORBIDDEN` if it returns `false`.
+ * current request; calls `next(SentriError)` with code `FORBIDDEN` if it returns `false`.
  *
  * Accepts either a bare check function or an options object with an optional
  * `roles` list whose members bypass the check entirely.

package/dist/middleware/permit.js

@@ -1,9 +1,9 @@
-import { AuthError } from '../errors/AuthError.js';
+import { SentriError } from '../errors/AuthError.js';
 /**
  * Express middleware factory for resource-level permission checks.
  *
  * Must be used **after** `protect()`. Evaluates a check function against the
- * current request; calls `next(AuthError)` with code `FORBIDDEN` if it returns `false`.
+ * current request; calls `next(SentriError)` with code `FORBIDDEN` if it returns `false`.
  *
  * Accepts either a bare check function or an options object with an optional
  * `roles` list whose members bypass the check entirely.
@@ -36,7 +36,7 @@ export function permit(optionsOrCheck) {
         : optionsOrCheck;
     return async (request, _response, next) => {
         if (!request.user) {
-            return next(new AuthError('UNAUTHORIZED', 'Not authenticated'));
+            return next(new SentriError('UNAUTHORIZED', 'Not authenticated'));
         }
         if (options.roles && options.roles.length > 0) {
             const userRoles = request.user.roles;
@@ -50,7 +50,7 @@ export function permit(optionsOrCheck) {
                 next();
             }
             else {
-                next(new AuthError('FORBIDDEN', 'You do not have permission to perform this action'));
+                next(new SentriError('FORBIDDEN', 'You do not have permission to perform this action'));
             }
         }
         catch (error) {

package/dist/middleware/permit.js.map

@@ -1 +1 @@
-{"version":3,"file":"permit.js","sourceRoot":"","sources":["../../src/middleware/permit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAgCnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,MAAM,CACpB,cAAkD;IAElD,MAAM,OAAO,GACX,OAAO,cAAc,KAAK,UAAU;QAClC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;QAC3B,CAAC,CAAC,cAAc,CAAC;IAErB,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACxD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,IAAI,aAAa;gBAAE,OAAO,IAAI,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,mDAAmD,CAAC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"permit.js","sourceRoot":"","sources":["../../src/middleware/permit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAgCrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,MAAM,CACpB,cAAkD;IAElD,MAAM,OAAO,GACX,OAAO,cAAc,KAAK,UAAU;QAClC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;QAC3B,CAAC,CAAC,cAAc,CAAC;IAErB,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,WAAW,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACxD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,IAAI,aAAa;gBAAE,OAAO,IAAI,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,mDAAmD,CAAC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/protect.d.ts

@@ -4,7 +4,7 @@ import type { AuthConfig } from '../types/auth.js';
  * Express middleware factory that enforces JWT authentication and session validity.
  *
  * Reads the `Authorization: Bearer <token>` header, verifies the access token,
- * and attaches the decoded payload to `req.user`. Calls `next(AuthError)` on
+ * and attaches the decoded payload to `req.user`. Calls `next(SentriError)` on
  * any failure so your error handler can convert it to an HTTP response.
  *
  * Since sentri 1.1.0 access tokens embed a `sessionId` claim. When this claim

package/dist/middleware/protect.js

@@ -1,10 +1,10 @@
-import { AuthError } from '../errors/AuthError.js';
+import { SentriError } from '../errors/AuthError.js';
 import { verifyAccessToken } from '../libs/token.js';
 /**
  * Express middleware factory that enforces JWT authentication and session validity.
  *
  * Reads the `Authorization: Bearer <token>` header, verifies the access token,
- * and attaches the decoded payload to `req.user`. Calls `next(AuthError)` on
+ * and attaches the decoded payload to `req.user`. Calls `next(SentriError)` on
  * any failure so your error handler can convert it to an HTTP response.
  *
  * Since sentri 1.1.0 access tokens embed a `sessionId` claim. When this claim
@@ -31,7 +31,7 @@ export function protect(config) {
     return async (request, _response, next) => {
         const authHeader = request.headers['authorization'];
         if (!authHeader?.startsWith('Bearer ')) {
-            return next(new AuthError('UNAUTHORIZED', 'Missing or malformed Authorization header'));
+            return next(new SentriError('UNAUTHORIZED', 'Missing or malformed Authorization header'));
         }
         const token = authHeader.slice(7);
         try {
@@ -41,7 +41,7 @@ export function protect(config) {
             if (payload.sessionId) {
                 const session = await config.adapter.session.findById(payload.sessionId);
                 if (!session) {
-                    return next(new AuthError('UNAUTHORIZED', 'Session has been revoked'));
+                    return next(new SentriError('UNAUTHORIZED', 'Session has been revoked'));
                 }
             }
             next();

package/dist/middleware/protect.js.map

@@ -1 +1 @@
-{"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/middleware/protect.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,IAAI,SAAS,CAAC,cAAc,EAAE,2CAA2C,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAuB,CAAC;YACvE,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAExF,oFAAoF;YACpF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACzE,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC,IAAI,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/middleware/protect.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,IAAI,WAAW,CAAC,cAAc,EAAE,2CAA2C,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAuB,CAAC;YACvE,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAExF,oFAAoF;YACpF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACzE,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC,IAAI,WAAW,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/middleware/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAA2B,MAAM,kBAAkB,CAAC;AA+E5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,SAAS,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,CAwLxF"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/middleware/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,kBAAkB,CAAC;AA4E9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,SAAS,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,CAwLxF"}

package/dist/middleware/router.js

@@ -1,7 +1,6 @@
 import { Router } from 'express';
-import { AuthError } from '../errors/AuthError.js';
-import { authErrorStatus } from '../types/auth.js';
-import { signup, login, refresh, logout, logoutAll, assignRoles } from '../services/auth.js';
+import { SentriError } from '../errors/AuthError.js';
+import { register, login, refresh, logout, logoutAll, assignRoles } from '../services/auth.js';
 import { resolveConfig, parseExpiry } from '../libs/config.js';
 import { protect } from './protect.js';
 import { authorize } from './authorize.js';
@@ -12,18 +11,17 @@ const MIN_PASSWORD_LENGTH = 8;
 const MAX_PASSWORD_LENGTH = 72;
 const MAX_IDENTIFIER_LENGTH = 255;
 function badRequest(message) {
-    return new AuthError('VALIDATION_ERROR', message);
+    return new SentriError('VALIDATION_ERROR', message);
 }
 function ok(response, statusCode, message, data) {
     response.status(statusCode).json({ error: false, statusCode, message, data });
 }
 function fail(response, error) {
-    const statusCode = authErrorStatus(error.code);
-    response.status(statusCode).json({ error: true, statusCode, message: error.message, data: null });
+    response.status(error.statusCode).json({ error: true, statusCode: error.statusCode, message: error.message, data: null });
 }
 function parseBody(body) {
     if (body === null || body === undefined || typeof body !== 'object' || Array.isArray(body)) {
-        throw new AuthError('VALIDATION_ERROR', 'Request body is missing or not a JSON object. Did you apply express.json()?');
+        throw new SentriError('VALIDATION_ERROR', 'Request body is missing or not a JSON object. Did you apply express.json()?');
     }
     return body;
 }
@@ -58,14 +56,14 @@ function clearCookie(response, config) {
 }
 /**
  * Validate the `X-Api-Key` header when `config.apiKey` is set.
- * Throws `AuthError` with code `UNAUTHORIZED` on mismatch.
+ * Throws `SentriError` with code `UNAUTHORIZED` on mismatch.
  */
 function validateApiKey(request, config) {
     if (!config.apiKey)
         return;
     const provided = request.headers['x-api-key'];
     if (typeof provided !== 'string' || provided !== config.apiKey) {
-        throw new AuthError('UNAUTHORIZED', 'Invalid or missing API key');
+        throw new SentriError('UNAUTHORIZED', 'Invalid or missing API key');
     }
 }
 /**
@@ -102,7 +100,7 @@ export function createAuthRouter(config) {
     const router = Router();
     // Resolve service functions — use custom override from config.router when provided, else fall back to the built-in service.
     const baseConfig = config;
-    const registerFn = config.router?.register ?? ((input) => signup(input, baseConfig));
+    const registerFn = config.router?.register ?? ((input) => register(input, baseConfig));
     const loginFn = config.router?.login ?? ((input) => login(input, baseConfig));
     const refreshFn = config.router?.refresh ?? ((token) => refresh(token, baseConfig));
     const logoutFn = config.router?.logout ?? ((token) => token !== undefined ? logout(token, baseConfig) : Promise.resolve());
@@ -186,7 +184,7 @@ export function createAuthRouter(config) {
         try {
             const fromCookie = readCookie(request.headers['cookie'], getCookieName(config));
             if (!fromCookie) {
-                throw new AuthError('UNAUTHORIZED', 'Refresh token cookie is missing');
+                throw new SentriError('UNAUTHORIZED', 'Refresh token cookie is missing');
             }
             const result = await refreshFn(fromCookie);
             if (!result.success) {
@@ -251,10 +249,10 @@ export function createAuthRouter(config) {
             next(error);
         }
     });
-    // Centralized error handler — converts AuthError (and unexpected errors) to the
+    // Centralized error handler — converts SentriError (and unexpected errors) to the
     // standard envelope so every endpoint produces a consistent shape on failure.
     router.use((error, _request, response, _next) => {
-        if (error instanceof AuthError) {
+        if (error instanceof SentriError) {
             fail(response, error);
         }
         else {