@koolbase/core 11.1.0 → 11.3.0

package/dist/esm/auth-errors.d.ts

@@ -217,6 +217,29 @@ export declare class LastCredentialError extends KoolbaseAuthError {
 export declare class HideRequiresVerificationError extends KoolbaseAuthError {
     constructor(message?: string);
 }
+/**
+ * The API key's scope is below what the operation requires.
+ *
+ * Scopes rank read < write < admin. Not a credential problem — the key is
+ * valid, and a different key or a dashboard session is needed. Worth its own
+ * type so an app does not tell someone to sign in again when signing in will
+ * not help.
+ */
+export declare class InsufficientScopeError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** The provider is not connected to this account. */
+export declare class IdentityNotFoundError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/**
+ * Connecting a Google or Apple identity that another account already holds.
+ * Distinct from AccountExistsError, which is about the email; this is about
+ * the provider identity itself.
+ */
+export declare class ProviderIdentityAlreadyLinkedError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
 export declare class MalformedSessionResponseError extends KoolbaseAuthError {
     constructor(missing: string);
 }

package/dist/esm/auth-errors.js

@@ -370,6 +370,41 @@ export class HideRequiresVerificationError extends KoolbaseAuthError {
         Object.setPrototypeOf(this, HideRequiresVerificationError.prototype);
     }
 }
+/**
+ * The API key's scope is below what the operation requires.
+ *
+ * Scopes rank read < write < admin. Not a credential problem — the key is
+ * valid, and a different key or a dashboard session is needed. Worth its own
+ * type so an app does not tell someone to sign in again when signing in will
+ * not help.
+ */
+export class InsufficientScopeError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? "This key's scope does not permit this operation", 'insufficient_scope');
+        this.name = 'InsufficientScopeError';
+        Object.setPrototypeOf(this, InsufficientScopeError.prototype);
+    }
+}
+/** The provider is not connected to this account. */
+export class IdentityNotFoundError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'That provider is not connected to your account', 'identity_not_found');
+        this.name = 'IdentityNotFoundError';
+        Object.setPrototypeOf(this, IdentityNotFoundError.prototype);
+    }
+}
+/**
+ * Connecting a Google or Apple identity that another account already holds.
+ * Distinct from AccountExistsError, which is about the email; this is about
+ * the provider identity itself.
+ */
+export class ProviderIdentityAlreadyLinkedError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'That provider identity is already linked to another account', 'provider_identity_already_linked');
+        this.name = 'ProviderIdentityAlreadyLinkedError';
+        Object.setPrototypeOf(this, ProviderIdentityAlreadyLinkedError.prototype);
+    }
+}
 export class MalformedSessionResponseError extends KoolbaseAuthError {
     constructor(missing) {
         super(`The server returned a session without ${missing}. This is a protocol error, not a credential problem.`, 'malformed_session_response');

package/dist/esm/auth.js

@@ -1,5 +1,5 @@
 import { RestoreResult, } from './types.js';
-import { AccountLockedError, EmailAlreadyInUseError, InvalidCredentialsError, InvalidPhoneNumberError, KoolbaseAuthError, OtpExpiredError, OtpInvalidError, OtpMaxAttemptsError, OtpRateLimitError, PhoneAlreadyLinkedError, MalformedSessionResponseError, AccountExistsError, ContactNotVerifiedError, CurrentPasswordIncorrectError, HideRequiresVerificationError, InsufficientAuthorityError, LastCredentialError, OAuthOnlyAccountError, SessionRequiredError, SignupsDisabledError, TokenAlreadyUsedError, TokenExpiredError, UnsupportedOAuthProviderError, RateLimitError, VerificationResendCooldownError, VerificationResendDailyCapError, SessionExpiredError, SmsConfigMissingError, TokenRevokedError, UnlockTokenInvalidError, UserDisabledError, WeakPasswordError, AppleEmailRequiredError, AppleSignInNotConfiguredError, InvalidAppleTokenError, OAuthEmailConflictError, GoogleEmailRequiredError, GoogleSignInNotConfiguredError, InvalidGoogleTokenError, } from './auth-errors.js';
+import { AccountLockedError, EmailAlreadyInUseError, InvalidCredentialsError, InvalidPhoneNumberError, KoolbaseAuthError, OtpExpiredError, OtpInvalidError, OtpMaxAttemptsError, OtpRateLimitError, PhoneAlreadyLinkedError, IdentityNotFoundError, InsufficientScopeError, MalformedSessionResponseError, ProviderIdentityAlreadyLinkedError, AccountExistsError, ContactNotVerifiedError, CurrentPasswordIncorrectError, HideRequiresVerificationError, InsufficientAuthorityError, LastCredentialError, OAuthOnlyAccountError, SessionRequiredError, SignupsDisabledError, TokenAlreadyUsedError, TokenExpiredError, UnsupportedOAuthProviderError, RateLimitError, VerificationResendCooldownError, VerificationResendDailyCapError, SessionExpiredError, SmsConfigMissingError, UnlockTokenInvalidError, UserDisabledError, WeakPasswordError, AppleEmailRequiredError, AppleSignInNotConfiguredError, InvalidAppleTokenError, OAuthEmailConflictError, GoogleEmailRequiredError, GoogleSignInNotConfiguredError, InvalidGoogleTokenError, } from './auth-errors.js';
 import { getPlatform } from './platform.js';
 import { DeviceMetadata } from './device-metadata.js';
 export class KoolbaseAuth {
@@ -195,9 +195,16 @@ export class KoolbaseAuth {
             return RestoreResult.Restored;
         }
         catch (e) {
-            if (e instanceof SessionExpiredError ||
-                e instanceof TokenRevokedError ||
-                e instanceof InvalidCredentialsError) {
+            // Only a refresh the server refused clears the stored session, and
+            // only because the refresh token is the last credential there is — once
+            // it is rejected there is nothing left to try.
+            //
+            // InvalidCredentialsError used to be in this list. It means "these
+            // credentials are wrong", which during a restore points at the project
+            // key or the request rather than the user's session — and deleting the
+            // refresh token on that reading signs someone out with no way back.
+            // Nothing reaches here with it today; it stays out so nothing does.
+            if (e instanceof SessionExpiredError) {
                 await this.clearSessionInternal();
                 return RestoreResult.Expired;
             }
@@ -788,8 +795,6 @@ export class KoolbaseAuth {
             case 'invalid_refresh_token':
                 // Refresh token rejected — the session is unrecoverable; re-login.
                 throw new SessionExpiredError();
-            case 'token_revoked':
-                throw new TokenRevokedError();
             case 'invalid_unlock_token':
                 throw new UnlockTokenInvalidError();
             case 'rate_limit':
@@ -828,6 +833,12 @@ export class KoolbaseAuth {
                 throw new OAuthOnlyAccountError(msg || undefined);
             case 'unsupported_oauth_provider':
                 throw new UnsupportedOAuthProviderError(msg || undefined);
+            case 'identity_not_found':
+                throw new IdentityNotFoundError(msg || undefined);
+            case 'provider_identity_already_linked':
+                throw new ProviderIdentityAlreadyLinkedError(msg || undefined);
+            case 'insufficient_scope':
+                throw new InsufficientScopeError(msg || undefined);
             // Authority
             case 'session_required':
                 throw new SessionRequiredError(msg || undefined);
@@ -860,11 +871,6 @@ export class KoolbaseAuth {
         if (msg.includes('invalid or expired unlock token')) {
             throw new UnlockTokenInvalidError();
         }
-        if (msg.includes('session revoked') ||
-            msg.includes('token revoked') ||
-            msg.includes('session has been revoked')) {
-            throw new TokenRevokedError();
-        }
         throw new KoolbaseAuthError(msg || `Request failed: ${res.status}`, code || `http_${res.status}`);
     }
     /**

package/dist/esm/database-errors.d.ts

@@ -41,6 +41,156 @@ export declare class KoolbaseDataError extends KoolbaseError {
  *   }
  * }
  */
+/**
+ * An upsert whose filter matched more than one record.
+ *
+ * Refused rather than resolved: picking one of several would be a silent
+ * guess about which row the caller meant, and the wrong guess overwrites data
+ * nobody asked to change. Narrow the filter, or add a unique constraint over
+ * the fields you are matching on so the ambiguity cannot arise.
+ */
+/**
+ * The record changed between reading it and writing it.
+ *
+ * Optimistic concurrency: a write carrying a revision is refused when the
+ * server has moved on, rather than overwriting whatever happened in between.
+ * The refusal carries the server's current record and both revisions, so
+ * resolving needs no second fetch — and cannot race one.
+ *
+ * Distinct from KoolbaseConflict, which models a queued OFFLINE write and
+ * carries a baseline as well, because a change composed hours ago needs its
+ * original context to be resolvable. Here the caller still has their data in
+ * hand.
+ *
+ * Until 11.3.0 this arrived as a generic data error and the details had to be
+ * dug out of an untyped bag — the information the server went to the trouble
+ * of attaching, unreachable in practice.
+ */
+/** A vector field with that name already exists on the collection. */
+/**
+ * A seed or import operation was refused. The code says which stage:
+ * invalid_seed_file (the file itself, with a "problems" list in details),
+ * seed_key_not_unique (the key does not identify rows uniquely),
+ * seed_needs_decision (conflicts need a choice before proceeding), or
+ * seed_conflicts_require_force (overwriting would discard the target's
+ * version of rows that changed on both sides — details carry the rows).
+ *
+ * One class with the code distinguishing them, rather than four: these are
+ * dashboard and CLI operations, and a caller handling one handles them the
+ * same way — show the reason and let a human decide.
+ */
+export declare class KoolbaseSeedError extends KoolbaseDataError {
+    constructor(message: string, code: string);
+}
+/** A project slug that another project already holds. */
+export declare class KoolbaseSlugTakenError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** An invitation that has been revoked or has expired. */
+export declare class KoolbaseInvitationInvalidError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** The project id in the request is not valid. */
+export declare class KoolbaseProjectInvalidError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** The request body could not be decoded. */
+export declare class KoolbaseInvalidBodyError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * The request asked for no change — an update with nothing to update.
+ */
+export declare class KoolbaseNoChangesError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * Something already exists, or something is in the wrong state, where the
+ * server did not say more than that.
+ *
+ * Carries whichever generic code arrived — conflict, duplicate,
+ * state_conflict — rather than four classes for codes that differ only in
+ * spelling. A caller who needs to branch finely is being underserved by the
+ * server, not by this.
+ */
+export declare class KoolbaseStateConflictError extends KoolbaseDataError {
+    constructor(message: string, code: string);
+}
+export declare class KoolbaseVectorFieldExistsError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * A backfill was asked for on a field that embeds nothing automatically.
+ * Set provider, model and source_field on the field first.
+ */
+export declare class KoolbaseFieldNotAutoEmbedError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * Embedding config is partial. Provider, model and source_field are set
+ * together or cleared together — half a configuration is refused rather than
+ * half-applied, which would embed against a model nobody chose.
+ */
+export declare class KoolbaseInvalidEmbeddingConfigError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * The project has no embedding provider configured. Embedding runs on the
+ * project's own Gemini or OpenAI key.
+ */
+export declare class KoolbaseProviderNotConfiguredError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** The configured provider's credentials were rejected by the provider. */
+export declare class KoolbaseProviderInvalidError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+export declare class KoolbaseRevisionMismatchError extends KoolbaseDataError {
+    readonly expectedRevision?: number | undefined;
+    readonly currentRevision?: number | undefined;
+    /** The record as the server holds it now. */
+    readonly current?: Record<string, unknown> | undefined;
+    constructor(message?: string, expectedRevision?: number | undefined, currentRevision?: number | undefined, 
+    /** The record as the server holds it now. */
+    current?: Record<string, unknown> | undefined);
+}
+/**
+ * The same idempotency key sent with different data.
+ *
+ * Refused rather than replayed: the two requests do not agree, so neither
+ * answer is safe. Usually a key reused by accident across two operations.
+ */
+export declare class KoolbaseIdempotencyKeyReusedError extends KoolbaseDataError {
+    /**
+     * Carries its code: the database package calls this idempotency_key_reused
+     * and fiscal calls it idempotency_conflict, and an error reporting a code
+     * the server did not send is a small lie that apps branching on e.code act
+     * on.
+     */
+    constructor(message?: string, code?: string);
+}
+/** A batch write failed for a reason the server did not classify further. */
+export declare class KoolbaseBatchFailedError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * Creating a unique constraint over data that already breaks it. details
+ * carry the offending values, so they can be shown rather than hunted for.
+ */
+export declare class KoolbaseDuplicateValuesError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+export declare class KoolbaseAmbiguousMatchError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** A unique constraint already covers those fields. */
+export declare class KoolbaseConstraintExistsError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** No such unique constraint. */
+export declare class KoolbaseConstraintNotFoundError extends KoolbaseDataError {
+    constructor(message?: string);
+}
 export declare class KoolbaseConflictError extends KoolbaseDataError {
     field?: string;
     constructor(message?: string, field?: string);
@@ -51,20 +201,43 @@ export declare class KoolbaseConflictError extends KoolbaseDataError {
  * `collection_not_found`.
  */
 export declare class KoolbaseNotFoundError extends KoolbaseDataError {
-    constructor(message?: string);
+    /**
+     * The code is carried rather than fixed, because the server distinguishes
+     * what was missing — a record, a collection, a vector field — and an app
+     * reading e.code should get that answer rather than the category. Catching
+     * the class still works for anyone who only cares that something was
+     * absent.
+     */
+    constructor(message?: string, code?: string);
 }
 /**
  * Thrown when the request is rejected as invalid — the server responds with
  * 400 and code `validation_error`.
  */
 export declare class KoolbaseValidationError extends KoolbaseDataError {
-    constructor(message?: string);
+    /**
+     * Carries its code for the same reason KoolbaseNotFoundError does: a
+     * dimension the platform does not support and a vector pointed at the wrong
+     * collection are both validation failures, and an app should still be able
+     * to tell which without reading the message.
+     */
+    constructor(message?: string, code?: string);
 }
 /**
  * Thrown when the caller is authenticated but not allowed to perform the
  * operation — the server responds with 403 and code `permission_denied`
  * (typically a collection access rule rejecting the read/write).
  */
+/**
+ * Authenticated, and not permitted to do this — distinct from a rule denying
+ * access to a record. Its own class rather than folding into
+ * KoolbasePermissionError, which hardcodes permission_denied: an error
+ * reporting a code the server did not send is a small lie, and apps that
+ * branch on e.code rather than instanceof would act on it.
+ */
+export declare class KoolbaseInsufficientAuthorityError extends KoolbaseDataError {
+    constructor(message?: string);
+}
 export declare class KoolbasePermissionError extends KoolbaseDataError {
     constructor(message?: string);
 }