@koolbase/core 11.0.0 → 11.2.0

package/dist/cjs/auth-errors.d.ts

@@ -17,7 +17,13 @@ export declare class UserDisabledError extends KoolbaseAuthError {
     constructor();
 }
 export declare class WeakPasswordError extends KoolbaseAuthError {
-    constructor();
+    /**
+     * The message is optional so the server's own rule can be carried through.
+     * The SDK checks length before sending; a project may require more than
+     * that, and "must be at least 8 characters" would then be wrong as well as
+     * unhelpful.
+     */
+    constructor(message?: string);
 }
 export declare class SessionExpiredError extends KoolbaseAuthError {
     constructor();
@@ -138,6 +144,79 @@ export declare class GoogleSignInNotConfiguredError extends KoolbaseAuthError {
  * from it is what produced a signed-in user whose every request went out as
  * `Bearer undefined`, so the SDK refuses instead.
  */
+/**
+ * Sign-in refused because the account has not verified its email or phone.
+ *
+ * In a project with require_verified_contact on, this is the most common auth
+ * error there is — the user registered, did not click the link, and came back.
+ * It arrived untyped until 11.1.0, so apps showed "something went wrong" for
+ * the one case with an obvious remedy: offer to resend.
+ */
+export declare class ContactNotVerifiedError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** The project has registration turned off. Not a credential problem. */
+export declare class SignupsDisabledError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/**
+ * A verification or reset link that has expired.
+ *
+ * Distinct from TokenAlreadyUsedError because the remedy differs: expired
+ * means request another, used means it already worked and they may simply be
+ * clicking an old email.
+ */
+export declare class TokenExpiredError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** A one-shot link clicked twice. Often means it already succeeded. */
+export declare class TokenAlreadyUsedError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/**
+ * The current password given for a password change was wrong.
+ *
+ * Named for the operation rather than the code: the server calls this
+ * `invalid_password`, which reads like a rejected new password and is not.
+ */
+export declare class CurrentPasswordIncorrectError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/**
+ * An OAuth sign-in for an email that already has an account by another
+ * method. The remedy is to sign in the original way and connect the provider
+ * afterwards, which the server's message says.
+ */
+export declare class AccountExistsError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** A password attempt against an account that only has Google or Apple. */
+export declare class OAuthOnlyAccountError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** A provider the project has not enabled. */
+export declare class UnsupportedOAuthProviderError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** The call needs a signed-in user and did not have one. */
+export declare class SessionRequiredError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** The caller is authenticated but not permitted to do this. */
+export declare class InsufficientAuthorityError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/**
+ * Refused because it would remove the account's last way of signing in —
+ * unlinking the only provider, or clearing the only password.
+ */
+export declare class LastCredentialError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** Hiding account existence needs verification on; the project has it off. */
+export declare class HideRequiresVerificationError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
 export declare class MalformedSessionResponseError extends KoolbaseAuthError {
     constructor(missing: string);
 }

package/dist/cjs/auth-errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GoogleEmailRequiredError = exports.InvalidGoogleTokenError = exports.MalformedSessionResponseError = exports.GoogleSignInNotConfiguredError = exports.OAuthEmailConflictError = exports.AppleEmailRequiredError = exports.InvalidAppleTokenError = exports.AppleSignInNotConfiguredError = exports.SmsConfigMissingError = exports.PhoneAlreadyLinkedError = exports.OtpRateLimitError = exports.OtpMaxAttemptsError = exports.OtpInvalidError = exports.OtpExpiredError = exports.InvalidPhoneNumberError = exports.NetworkError = exports.VerificationResendDailyCapError = exports.VerificationResendCooldownError = exports.RateLimitError = exports.UnlockTokenInvalidError = exports.AccountLockedError = exports.TokenRevokedError = exports.SessionExpiredError = exports.WeakPasswordError = exports.UserDisabledError = exports.EmailAlreadyInUseError = exports.InvalidCredentialsError = exports.KoolbaseAuthError = void 0;
+exports.GoogleEmailRequiredError = exports.InvalidGoogleTokenError = exports.MalformedSessionResponseError = exports.HideRequiresVerificationError = exports.LastCredentialError = exports.InsufficientAuthorityError = exports.SessionRequiredError = exports.UnsupportedOAuthProviderError = exports.OAuthOnlyAccountError = exports.AccountExistsError = exports.CurrentPasswordIncorrectError = exports.TokenAlreadyUsedError = exports.TokenExpiredError = exports.SignupsDisabledError = exports.ContactNotVerifiedError = exports.GoogleSignInNotConfiguredError = exports.OAuthEmailConflictError = exports.AppleEmailRequiredError = exports.InvalidAppleTokenError = exports.AppleSignInNotConfiguredError = exports.SmsConfigMissingError = exports.PhoneAlreadyLinkedError = exports.OtpRateLimitError = exports.OtpMaxAttemptsError = exports.OtpInvalidError = exports.OtpExpiredError = exports.InvalidPhoneNumberError = exports.NetworkError = exports.VerificationResendDailyCapError = exports.VerificationResendCooldownError = exports.RateLimitError = exports.UnlockTokenInvalidError = exports.AccountLockedError = exports.TokenRevokedError = exports.SessionExpiredError = exports.WeakPasswordError = exports.UserDisabledError = exports.EmailAlreadyInUseError = exports.InvalidCredentialsError = exports.KoolbaseAuthError = void 0;
 const errors_js_1 = require("./errors.js");
 /**
  * Base error type for all Koolbase auth errors. Catchable via
@@ -41,8 +41,14 @@ class UserDisabledError extends KoolbaseAuthError {
 }
 exports.UserDisabledError = UserDisabledError;
 class WeakPasswordError extends KoolbaseAuthError {
-    constructor() {
-        super('Password must be at least 8 characters', 'weak_password');
+    /**
+     * The message is optional so the server's own rule can be carried through.
+     * The SDK checks length before sending; a project may require more than
+     * that, and "must be at least 8 characters" would then be wrong as well as
+     * unhelpful.
+     */
+    constructor(message) {
+        super(message ?? 'Password must be at least 8 characters', 'weak_password');
         this.name = 'WeakPasswordError';
         Object.setPrototypeOf(this, WeakPasswordError.prototype);
     }
@@ -271,6 +277,139 @@ exports.GoogleSignInNotConfiguredError = GoogleSignInNotConfiguredError;
  * from it is what produced a signed-in user whose every request went out as
  * `Bearer undefined`, so the SDK refuses instead.
  */
+/**
+ * Sign-in refused because the account has not verified its email or phone.
+ *
+ * In a project with require_verified_contact on, this is the most common auth
+ * error there is — the user registered, did not click the link, and came back.
+ * It arrived untyped until 11.1.0, so apps showed "something went wrong" for
+ * the one case with an obvious remedy: offer to resend.
+ */
+class ContactNotVerifiedError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'Verify your email or phone before signing in', 'contact_not_verified');
+        this.name = 'ContactNotVerifiedError';
+        Object.setPrototypeOf(this, ContactNotVerifiedError.prototype);
+    }
+}
+exports.ContactNotVerifiedError = ContactNotVerifiedError;
+/** The project has registration turned off. Not a credential problem. */
+class SignupsDisabledError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'Registration is disabled for this project', 'signups_disabled');
+        this.name = 'SignupsDisabledError';
+        Object.setPrototypeOf(this, SignupsDisabledError.prototype);
+    }
+}
+exports.SignupsDisabledError = SignupsDisabledError;
+/**
+ * A verification or reset link that has expired.
+ *
+ * Distinct from TokenAlreadyUsedError because the remedy differs: expired
+ * means request another, used means it already worked and they may simply be
+ * clicking an old email.
+ */
+class TokenExpiredError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'This link has expired — request a new one', 'token_expired');
+        this.name = 'TokenExpiredError';
+        Object.setPrototypeOf(this, TokenExpiredError.prototype);
+    }
+}
+exports.TokenExpiredError = TokenExpiredError;
+/** A one-shot link clicked twice. Often means it already succeeded. */
+class TokenAlreadyUsedError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'This link has already been used', 'token_used');
+        this.name = 'TokenAlreadyUsedError';
+        Object.setPrototypeOf(this, TokenAlreadyUsedError.prototype);
+    }
+}
+exports.TokenAlreadyUsedError = TokenAlreadyUsedError;
+/**
+ * The current password given for a password change was wrong.
+ *
+ * Named for the operation rather than the code: the server calls this
+ * `invalid_password`, which reads like a rejected new password and is not.
+ */
+class CurrentPasswordIncorrectError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'Current password is incorrect', 'invalid_password');
+        this.name = 'CurrentPasswordIncorrectError';
+        Object.setPrototypeOf(this, CurrentPasswordIncorrectError.prototype);
+    }
+}
+exports.CurrentPasswordIncorrectError = CurrentPasswordIncorrectError;
+/**
+ * An OAuth sign-in for an email that already has an account by another
+ * method. The remedy is to sign in the original way and connect the provider
+ * afterwards, which the server's message says.
+ */
+class AccountExistsError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'An account with this email already exists — sign in with your existing method first', 'account_exists');
+        this.name = 'AccountExistsError';
+        Object.setPrototypeOf(this, AccountExistsError.prototype);
+    }
+}
+exports.AccountExistsError = AccountExistsError;
+/** A password attempt against an account that only has Google or Apple. */
+class OAuthOnlyAccountError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'This account uses Google or Apple sign-in and has no password', 'oauth_only_account');
+        this.name = 'OAuthOnlyAccountError';
+        Object.setPrototypeOf(this, OAuthOnlyAccountError.prototype);
+    }
+}
+exports.OAuthOnlyAccountError = OAuthOnlyAccountError;
+/** A provider the project has not enabled. */
+class UnsupportedOAuthProviderError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'That sign-in provider is not supported', 'unsupported_oauth_provider');
+        this.name = 'UnsupportedOAuthProviderError';
+        Object.setPrototypeOf(this, UnsupportedOAuthProviderError.prototype);
+    }
+}
+exports.UnsupportedOAuthProviderError = UnsupportedOAuthProviderError;
+/** The call needs a signed-in user and did not have one. */
+class SessionRequiredError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'This action requires a signed-in user', 'session_required');
+        this.name = 'SessionRequiredError';
+        Object.setPrototypeOf(this, SessionRequiredError.prototype);
+    }
+}
+exports.SessionRequiredError = SessionRequiredError;
+/** The caller is authenticated but not permitted to do this. */
+class InsufficientAuthorityError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'You do not have permission to do that', 'insufficient_authority');
+        this.name = 'InsufficientAuthorityError';
+        Object.setPrototypeOf(this, InsufficientAuthorityError.prototype);
+    }
+}
+exports.InsufficientAuthorityError = InsufficientAuthorityError;
+/**
+ * Refused because it would remove the account's last way of signing in —
+ * unlinking the only provider, or clearing the only password.
+ */
+class LastCredentialError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'This is the account\'s only sign-in method and cannot be removed', 'last_credential');
+        this.name = 'LastCredentialError';
+        Object.setPrototypeOf(this, LastCredentialError.prototype);
+    }
+}
+exports.LastCredentialError = LastCredentialError;
+/** Hiding account existence needs verification on; the project has it off. */
+class HideRequiresVerificationError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'Hiding account existence requires verified contact to be enabled', 'hide_requires_verification');
+        this.name = 'HideRequiresVerificationError';
+        Object.setPrototypeOf(this, HideRequiresVerificationError.prototype);
+    }
+}
+exports.HideRequiresVerificationError = HideRequiresVerificationError;
 class MalformedSessionResponseError extends KoolbaseAuthError {
     constructor(missing) {
         super(`The server returned a session without ${missing}. This is a protocol error, not a credential problem.`, 'malformed_session_response');

package/dist/cjs/auth.js

@@ -797,6 +797,49 @@ class KoolbaseAuth {
                 throw new auth_errors_js_1.UnlockTokenInvalidError();
             case 'rate_limit':
                 throw new auth_errors_js_1.RateLimitError(msg || undefined);
+            // Verification state. Two codes, one situation — projectauth and the
+            // dashboard's auth package name it differently and an app should not
+            // have to know which spoke.
+            // Verification state. Two codes, one situation — projectauth and the
+            // dashboard's auth package name it differently and an app should not
+            // have to know which spoke.
+            case 'contact_not_verified':
+            case 'email_not_verified':
+                throw new auth_errors_js_1.ContactNotVerifiedError(msg || undefined);
+            // Registration
+            case 'signups_disabled':
+                throw new auth_errors_js_1.SignupsDisabledError(msg || undefined);
+            case 'weak_password':
+                // The class existed and was only ever thrown client-side for length.
+                // The server has its own rules, and a password that passes ours and
+                // fails theirs deserves the same error, not a generic one.
+                throw new auth_errors_js_1.WeakPasswordError(msg || undefined);
+            case 'account_exists':
+                throw new auth_errors_js_1.AccountExistsError(msg || undefined);
+            // Link tokens — verification and password reset
+            case 'token_expired':
+                throw new auth_errors_js_1.TokenExpiredError(msg || undefined);
+            case 'token_used':
+                throw new auth_errors_js_1.TokenAlreadyUsedError(msg || undefined);
+            case 'invalid_token':
+                throw new auth_errors_js_1.UnlockTokenInvalidError();
+            // Password change
+            case 'invalid_password':
+                throw new auth_errors_js_1.CurrentPasswordIncorrectError(msg || undefined);
+            // OAuth
+            case 'oauth_only_account':
+                throw new auth_errors_js_1.OAuthOnlyAccountError(msg || undefined);
+            case 'unsupported_oauth_provider':
+                throw new auth_errors_js_1.UnsupportedOAuthProviderError(msg || undefined);
+            // Authority
+            case 'session_required':
+                throw new auth_errors_js_1.SessionRequiredError(msg || undefined);
+            case 'insufficient_authority':
+                throw new auth_errors_js_1.InsufficientAuthorityError(msg || undefined);
+            case 'last_credential':
+                throw new auth_errors_js_1.LastCredentialError(msg || undefined);
+            case 'hide_requires_verification':
+                throw new auth_errors_js_1.HideRequiresVerificationError(msg || undefined);
             case 'resend_cooldown':
                 throw new auth_errors_js_1.VerificationResendCooldownError(body.cooldown_until ? new Date(body.cooldown_until) : null, msg || undefined);
             case 'resend_daily_cap':

package/dist/cjs/database-errors.d.ts

@@ -41,6 +41,25 @@ export declare class KoolbaseDataError extends KoolbaseError {
  *   }
  * }
  */
+/**
+ * An upsert whose filter matched more than one record.
+ *
+ * Refused rather than resolved: picking one of several would be a silent
+ * guess about which row the caller meant, and the wrong guess overwrites data
+ * nobody asked to change. Narrow the filter, or add a unique constraint over
+ * the fields you are matching on so the ambiguity cannot arise.
+ */
+export declare class KoolbaseAmbiguousMatchError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** A unique constraint already covers those fields. */
+export declare class KoolbaseConstraintExistsError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** No such unique constraint. */
+export declare class KoolbaseConstraintNotFoundError extends KoolbaseDataError {
+    constructor(message?: string);
+}
 export declare class KoolbaseConflictError extends KoolbaseDataError {
     field?: string;
     constructor(message?: string, field?: string);
@@ -51,20 +70,43 @@ export declare class KoolbaseConflictError extends KoolbaseDataError {
  * `collection_not_found`.
  */
 export declare class KoolbaseNotFoundError extends KoolbaseDataError {
-    constructor(message?: string);
+    /**
+     * The code is carried rather than fixed, because the server distinguishes
+     * what was missing — a record, a collection, a vector field — and an app
+     * reading e.code should get that answer rather than the category. Catching
+     * the class still works for anyone who only cares that something was
+     * absent.
+     */
+    constructor(message?: string, code?: string);
 }
 /**
  * Thrown when the request is rejected as invalid — the server responds with
  * 400 and code `validation_error`.
  */
 export declare class KoolbaseValidationError extends KoolbaseDataError {
-    constructor(message?: string);
+    /**
+     * Carries its code for the same reason KoolbaseNotFoundError does: a
+     * dimension the platform does not support and a vector pointed at the wrong
+     * collection are both validation failures, and an app should still be able
+     * to tell which without reading the message.
+     */
+    constructor(message?: string, code?: string);
 }
 /**
  * Thrown when the caller is authenticated but not allowed to perform the
  * operation — the server responds with 403 and code `permission_denied`
  * (typically a collection access rule rejecting the read/write).
  */
+/**
+ * Authenticated, and not permitted to do this — distinct from a rule denying
+ * access to a record. Its own class rather than folding into
+ * KoolbasePermissionError, which hardcodes permission_denied: an error
+ * reporting a code the server did not send is a small lie, and apps that
+ * branch on e.code rather than instanceof would act on it.
+ */
+export declare class KoolbaseInsufficientAuthorityError extends KoolbaseDataError {
+    constructor(message?: string);
+}
 export declare class KoolbasePermissionError extends KoolbaseDataError {
     constructor(message?: string);
 }

package/dist/cjs/database-errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KoolbaseVectorDimensionMismatchError = exports.KoolbaseRateLimitError = exports.KoolbasePermissionError = exports.KoolbaseValidationError = exports.KoolbaseNotFoundError = exports.KoolbaseConflictError = exports.KoolbaseDataError = void 0;
+exports.KoolbaseVectorDimensionMismatchError = exports.KoolbaseRateLimitError = exports.KoolbasePermissionError = exports.KoolbaseInsufficientAuthorityError = exports.KoolbaseValidationError = exports.KoolbaseNotFoundError = exports.KoolbaseConflictError = exports.KoolbaseConstraintNotFoundError = exports.KoolbaseConstraintExistsError = exports.KoolbaseAmbiguousMatchError = exports.KoolbaseDataError = void 0;
 exports.koolbaseDataError = koolbaseDataError;
 const errors_js_1 = require("./errors.js");
 /**
@@ -44,6 +44,40 @@ exports.KoolbaseDataError = KoolbaseDataError;
  *   }
  * }
  */
+/**
+ * An upsert whose filter matched more than one record.
+ *
+ * Refused rather than resolved: picking one of several would be a silent
+ * guess about which row the caller meant, and the wrong guess overwrites data
+ * nobody asked to change. Narrow the filter, or add a unique constraint over
+ * the fields you are matching on so the ambiguity cannot arise.
+ */
+class KoolbaseAmbiguousMatchError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'Upsert match resolved to more than one record', 'ambiguous_match');
+        this.name = 'KoolbaseAmbiguousMatchError';
+        Object.setPrototypeOf(this, KoolbaseAmbiguousMatchError.prototype);
+    }
+}
+exports.KoolbaseAmbiguousMatchError = KoolbaseAmbiguousMatchError;
+/** A unique constraint already covers those fields. */
+class KoolbaseConstraintExistsError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'A unique constraint already exists for these fields', 'constraint_exists');
+        this.name = 'KoolbaseConstraintExistsError';
+        Object.setPrototypeOf(this, KoolbaseConstraintExistsError.prototype);
+    }
+}
+exports.KoolbaseConstraintExistsError = KoolbaseConstraintExistsError;
+/** No such unique constraint. */
+class KoolbaseConstraintNotFoundError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'Unique constraint not found', 'constraint_not_found');
+        this.name = 'KoolbaseConstraintNotFoundError';
+        Object.setPrototypeOf(this, KoolbaseConstraintNotFoundError.prototype);
+    }
+}
+exports.KoolbaseConstraintNotFoundError = KoolbaseConstraintNotFoundError;
 class KoolbaseConflictError extends KoolbaseDataError {
     constructor(message, field) {
         super(message ?? 'Value violates a unique constraint', 'unique_violation');
@@ -59,8 +93,15 @@ exports.KoolbaseConflictError = KoolbaseConflictError;
  * `collection_not_found`.
  */
 class KoolbaseNotFoundError extends KoolbaseDataError {
-    constructor(message) {
-        super(message ?? 'The requested resource was not found', 'not_found');
+    /**
+     * The code is carried rather than fixed, because the server distinguishes
+     * what was missing — a record, a collection, a vector field — and an app
+     * reading e.code should get that answer rather than the category. Catching
+     * the class still works for anyone who only cares that something was
+     * absent.
+     */
+    constructor(message, code = 'not_found') {
+        super(message ?? 'The requested resource was not found', code);
         this.name = 'KoolbaseNotFoundError';
         Object.setPrototypeOf(this, KoolbaseNotFoundError.prototype);
     }
@@ -71,8 +112,14 @@ exports.KoolbaseNotFoundError = KoolbaseNotFoundError;
  * 400 and code `validation_error`.
  */
 class KoolbaseValidationError extends KoolbaseDataError {
-    constructor(message) {
-        super(message ?? 'The request was invalid', 'validation_error');
+    /**
+     * Carries its code for the same reason KoolbaseNotFoundError does: a
+     * dimension the platform does not support and a vector pointed at the wrong
+     * collection are both validation failures, and an app should still be able
+     * to tell which without reading the message.
+     */
+    constructor(message, code = 'validation_error') {
+        super(message ?? 'The request was invalid', code);
         this.name = 'KoolbaseValidationError';
         Object.setPrototypeOf(this, KoolbaseValidationError.prototype);
     }
@@ -83,6 +130,21 @@ exports.KoolbaseValidationError = KoolbaseValidationError;
  * operation — the server responds with 403 and code `permission_denied`
  * (typically a collection access rule rejecting the read/write).
  */
+/**
+ * Authenticated, and not permitted to do this — distinct from a rule denying
+ * access to a record. Its own class rather than folding into
+ * KoolbasePermissionError, which hardcodes permission_denied: an error
+ * reporting a code the server did not send is a small lie, and apps that
+ * branch on e.code rather than instanceof would act on it.
+ */
+class KoolbaseInsufficientAuthorityError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'You do not have the authority to perform this action', 'insufficient_authority');
+        this.name = 'KoolbaseInsufficientAuthorityError';
+        Object.setPrototypeOf(this, KoolbaseInsufficientAuthorityError.prototype);
+    }
+}
+exports.KoolbaseInsufficientAuthorityError = KoolbaseInsufficientAuthorityError;
 class KoolbasePermissionError extends KoolbaseDataError {
     constructor(message) {
         super(message ?? 'You do not have permission to perform this action', 'permission_denied');
@@ -155,12 +217,20 @@ function koolbaseDataError(status, body, fallbackMessage = 'Request failed') {
     switch (code) {
         case 'unique_violation':
             return attach(new KoolbaseConflictError(message, field));
+        case 'ambiguous_match':
+            return attach(new KoolbaseAmbiguousMatchError(message));
+        case 'constraint_exists':
+            return attach(new KoolbaseConstraintExistsError(message));
+        case 'constraint_not_found':
+            return attach(new KoolbaseConstraintNotFoundError(message));
+        case 'insufficient_authority':
+            return attach(new KoolbaseInsufficientAuthorityError(message));
         case 'not_found':
         case 'record_not_found':
         case 'collection_not_found':
         case 'vector_not_found':
         case 'vector_field_not_found':
-            return attach(new KoolbaseNotFoundError(message));
+            return attach(new KoolbaseNotFoundError(message, code));
         case 'unauthenticated':
         case 'session_expired':
         case 'invalid_token':
@@ -172,7 +242,7 @@ function koolbaseDataError(status, body, fallbackMessage = 'Request failed') {
         case 'validation_error':
         case 'vector_collection_mismatch':
         case 'unsupported_dimension':
-            return attach(new KoolbaseValidationError(message));
+            return attach(new KoolbaseValidationError(message, code));
         case 'vector_dimension_mismatch':
             return attach(new KoolbaseVectorDimensionMismatchError(message));
     }

package/dist/cjs/function-errors.d.ts

@@ -47,5 +47,24 @@ export declare class FunctionQuotaExceededError extends FunctionInvokeError {
 export declare class FunctionExecutionError extends FunctionInvokeError {
     constructor(message: string, statusCode?: number);
 }
+/**
+ * The function ran past its timeout and was killed.
+ *
+ * Its own type because the remedy is different from a function that threw:
+ * a timeout means retry, or raise the function's timeout at deploy, or move
+ * the slow part elsewhere. Without this it arrived as FunctionExecutionError
+ * — indistinguishable from an exception, which is the one thing it is not.
+ * The server already tells them apart; it logs 504 as "timeout".
+ */
+export declare class FunctionTimeoutError extends FunctionInvokeError {
+    constructor(message: string);
+}
+/**
+ * Too many invocations, too fast. Distinct from a quota being spent: this one
+ * clears by waiting.
+ */
+export declare class FunctionRateLimitError extends FunctionInvokeError {
+    constructor(message: string);
+}
 /** Builds the right error for a failed invocation. */
 export declare function functionInvokeError(status: number, message: string): KoolbaseError;

package/dist/cjs/function-errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FunctionExecutionError = exports.FunctionQuotaExceededError = exports.FunctionValidationError = exports.FunctionPermissionError = exports.FunctionNotFoundError = exports.FunctionInvokeError = void 0;
+exports.FunctionRateLimitError = exports.FunctionTimeoutError = exports.FunctionExecutionError = exports.FunctionQuotaExceededError = exports.FunctionValidationError = exports.FunctionPermissionError = exports.FunctionNotFoundError = exports.FunctionInvokeError = void 0;
 exports.functionInvokeError = functionInvokeError;
 const errors_js_1 = require("./errors.js");
 /**
@@ -81,6 +81,35 @@ class FunctionExecutionError extends FunctionInvokeError {
     }
 }
 exports.FunctionExecutionError = FunctionExecutionError;
+/**
+ * The function ran past its timeout and was killed.
+ *
+ * Its own type because the remedy is different from a function that threw:
+ * a timeout means retry, or raise the function's timeout at deploy, or move
+ * the slow part elsewhere. Without this it arrived as FunctionExecutionError
+ * — indistinguishable from an exception, which is the one thing it is not.
+ * The server already tells them apart; it logs 504 as "timeout".
+ */
+class FunctionTimeoutError extends FunctionInvokeError {
+    constructor(message) {
+        super(message, 504, 'timeout');
+        this.name = 'FunctionTimeoutError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.FunctionTimeoutError = FunctionTimeoutError;
+/**
+ * Too many invocations, too fast. Distinct from a quota being spent: this one
+ * clears by waiting.
+ */
+class FunctionRateLimitError extends FunctionInvokeError {
+    constructor(message) {
+        super(message, 429, 'rate_limit');
+        this.name = 'FunctionRateLimitError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.FunctionRateLimitError = FunctionRateLimitError;
 /** Builds the right error for a failed invocation. */
 function functionInvokeError(status, message) {
     switch (status) {
@@ -96,6 +125,11 @@ function functionInvokeError(status, message) {
             return new FunctionValidationError(message);
         case 402:
             return new FunctionQuotaExceededError(message);
+        case 429:
+            return new FunctionRateLimitError(message);
+        case 504:
+            // Before the generic 5xx branch: a timeout is not an exception.
+            return new FunctionTimeoutError(message);
     }
     if (status >= 500)
         return new FunctionExecutionError(message, status);

package/dist/cjs/storage-errors.d.ts

@@ -76,6 +76,24 @@ export declare class KoolbaseStoragePermissionError extends KoolbaseStorageError
  * 409 but means "path collides"); branch on the error type via
  * `instanceof`, not on status.
  */
+/**
+ * The presigned upload was confirmed after its window closed.
+ *
+ * An upload URL has a lifetime. A user who picks a file, gets distracted and
+ * comes back twenty minutes later hits this — so it is a retry, not a
+ * failure: presign again and send the same bytes. Worth catching rather than
+ * showing "upload failed" to someone whose file was fine.
+ */
+export declare class KoolbaseUploadExpiredError extends KoolbaseStorageError {
+    constructor(message?: string);
+}
+/**
+ * A bucket cap set below what the bucket already holds. A dashboard
+ * operation rather than an app one, mapped so it does not arrive untyped.
+ */
+export declare class KoolbaseCapBelowUsageError extends KoolbaseStorageError {
+    constructor(message?: string);
+}
 export declare class KoolbaseStorageQuotaError extends KoolbaseStorageError {
     constructor(message?: string);
 }