@koolbase/core 11.2.0 → 11.3.0

package/dist/cjs/auth-errors.d.ts

@@ -217,6 +217,29 @@ export declare class LastCredentialError extends KoolbaseAuthError {
 export declare class HideRequiresVerificationError extends KoolbaseAuthError {
     constructor(message?: string);
 }
+/**
+ * The API key's scope is below what the operation requires.
+ *
+ * Scopes rank read < write < admin. Not a credential problem — the key is
+ * valid, and a different key or a dashboard session is needed. Worth its own
+ * type so an app does not tell someone to sign in again when signing in will
+ * not help.
+ */
+export declare class InsufficientScopeError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/** The provider is not connected to this account. */
+export declare class IdentityNotFoundError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
+/**
+ * Connecting a Google or Apple identity that another account already holds.
+ * Distinct from AccountExistsError, which is about the email; this is about
+ * the provider identity itself.
+ */
+export declare class ProviderIdentityAlreadyLinkedError extends KoolbaseAuthError {
+    constructor(message?: string);
+}
 export declare class MalformedSessionResponseError extends KoolbaseAuthError {
     constructor(missing: string);
 }

package/dist/cjs/auth-errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GoogleEmailRequiredError = exports.InvalidGoogleTokenError = exports.MalformedSessionResponseError = exports.HideRequiresVerificationError = exports.LastCredentialError = exports.InsufficientAuthorityError = exports.SessionRequiredError = exports.UnsupportedOAuthProviderError = exports.OAuthOnlyAccountError = exports.AccountExistsError = exports.CurrentPasswordIncorrectError = exports.TokenAlreadyUsedError = exports.TokenExpiredError = exports.SignupsDisabledError = exports.ContactNotVerifiedError = exports.GoogleSignInNotConfiguredError = exports.OAuthEmailConflictError = exports.AppleEmailRequiredError = exports.InvalidAppleTokenError = exports.AppleSignInNotConfiguredError = exports.SmsConfigMissingError = exports.PhoneAlreadyLinkedError = exports.OtpRateLimitError = exports.OtpMaxAttemptsError = exports.OtpInvalidError = exports.OtpExpiredError = exports.InvalidPhoneNumberError = exports.NetworkError = exports.VerificationResendDailyCapError = exports.VerificationResendCooldownError = exports.RateLimitError = exports.UnlockTokenInvalidError = exports.AccountLockedError = exports.TokenRevokedError = exports.SessionExpiredError = exports.WeakPasswordError = exports.UserDisabledError = exports.EmailAlreadyInUseError = exports.InvalidCredentialsError = exports.KoolbaseAuthError = void 0;
+exports.GoogleEmailRequiredError = exports.InvalidGoogleTokenError = exports.MalformedSessionResponseError = exports.ProviderIdentityAlreadyLinkedError = exports.IdentityNotFoundError = exports.InsufficientScopeError = exports.HideRequiresVerificationError = exports.LastCredentialError = exports.InsufficientAuthorityError = exports.SessionRequiredError = exports.UnsupportedOAuthProviderError = exports.OAuthOnlyAccountError = exports.AccountExistsError = exports.CurrentPasswordIncorrectError = exports.TokenAlreadyUsedError = exports.TokenExpiredError = exports.SignupsDisabledError = exports.ContactNotVerifiedError = exports.GoogleSignInNotConfiguredError = exports.OAuthEmailConflictError = exports.AppleEmailRequiredError = exports.InvalidAppleTokenError = exports.AppleSignInNotConfiguredError = exports.SmsConfigMissingError = exports.PhoneAlreadyLinkedError = exports.OtpRateLimitError = exports.OtpMaxAttemptsError = exports.OtpInvalidError = exports.OtpExpiredError = exports.InvalidPhoneNumberError = exports.NetworkError = exports.VerificationResendDailyCapError = exports.VerificationResendCooldownError = exports.RateLimitError = exports.UnlockTokenInvalidError = exports.AccountLockedError = exports.TokenRevokedError = exports.SessionExpiredError = exports.WeakPasswordError = exports.UserDisabledError = exports.EmailAlreadyInUseError = exports.InvalidCredentialsError = exports.KoolbaseAuthError = void 0;
 const errors_js_1 = require("./errors.js");
 /**
  * Base error type for all Koolbase auth errors. Catchable via
@@ -410,6 +410,44 @@ class HideRequiresVerificationError extends KoolbaseAuthError {
     }
 }
 exports.HideRequiresVerificationError = HideRequiresVerificationError;
+/**
+ * The API key's scope is below what the operation requires.
+ *
+ * Scopes rank read < write < admin. Not a credential problem — the key is
+ * valid, and a different key or a dashboard session is needed. Worth its own
+ * type so an app does not tell someone to sign in again when signing in will
+ * not help.
+ */
+class InsufficientScopeError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? "This key's scope does not permit this operation", 'insufficient_scope');
+        this.name = 'InsufficientScopeError';
+        Object.setPrototypeOf(this, InsufficientScopeError.prototype);
+    }
+}
+exports.InsufficientScopeError = InsufficientScopeError;
+/** The provider is not connected to this account. */
+class IdentityNotFoundError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'That provider is not connected to your account', 'identity_not_found');
+        this.name = 'IdentityNotFoundError';
+        Object.setPrototypeOf(this, IdentityNotFoundError.prototype);
+    }
+}
+exports.IdentityNotFoundError = IdentityNotFoundError;
+/**
+ * Connecting a Google or Apple identity that another account already holds.
+ * Distinct from AccountExistsError, which is about the email; this is about
+ * the provider identity itself.
+ */
+class ProviderIdentityAlreadyLinkedError extends KoolbaseAuthError {
+    constructor(message) {
+        super(message ?? 'That provider identity is already linked to another account', 'provider_identity_already_linked');
+        this.name = 'ProviderIdentityAlreadyLinkedError';
+        Object.setPrototypeOf(this, ProviderIdentityAlreadyLinkedError.prototype);
+    }
+}
+exports.ProviderIdentityAlreadyLinkedError = ProviderIdentityAlreadyLinkedError;
 class MalformedSessionResponseError extends KoolbaseAuthError {
     constructor(missing) {
         super(`The server returned a session without ${missing}. This is a protocol error, not a credential problem.`, 'malformed_session_response');

package/dist/cjs/auth.js

@@ -198,9 +198,16 @@ class KoolbaseAuth {
             return types_js_1.RestoreResult.Restored;
         }
         catch (e) {
-            if (e instanceof auth_errors_js_1.SessionExpiredError ||
-                e instanceof auth_errors_js_1.TokenRevokedError ||
-                e instanceof auth_errors_js_1.InvalidCredentialsError) {
+            // Only a refresh the server refused clears the stored session, and
+            // only because the refresh token is the last credential there is — once
+            // it is rejected there is nothing left to try.
+            //
+            // InvalidCredentialsError used to be in this list. It means "these
+            // credentials are wrong", which during a restore points at the project
+            // key or the request rather than the user's session — and deleting the
+            // refresh token on that reading signs someone out with no way back.
+            // Nothing reaches here with it today; it stays out so nothing does.
+            if (e instanceof auth_errors_js_1.SessionExpiredError) {
                 await this.clearSessionInternal();
                 return types_js_1.RestoreResult.Expired;
             }
@@ -791,8 +798,6 @@ class KoolbaseAuth {
             case 'invalid_refresh_token':
                 // Refresh token rejected — the session is unrecoverable; re-login.
                 throw new auth_errors_js_1.SessionExpiredError();
-            case 'token_revoked':
-                throw new auth_errors_js_1.TokenRevokedError();
             case 'invalid_unlock_token':
                 throw new auth_errors_js_1.UnlockTokenInvalidError();
             case 'rate_limit':
@@ -831,6 +836,12 @@ class KoolbaseAuth {
                 throw new auth_errors_js_1.OAuthOnlyAccountError(msg || undefined);
             case 'unsupported_oauth_provider':
                 throw new auth_errors_js_1.UnsupportedOAuthProviderError(msg || undefined);
+            case 'identity_not_found':
+                throw new auth_errors_js_1.IdentityNotFoundError(msg || undefined);
+            case 'provider_identity_already_linked':
+                throw new auth_errors_js_1.ProviderIdentityAlreadyLinkedError(msg || undefined);
+            case 'insufficient_scope':
+                throw new auth_errors_js_1.InsufficientScopeError(msg || undefined);
             // Authority
             case 'session_required':
                 throw new auth_errors_js_1.SessionRequiredError(msg || undefined);
@@ -863,11 +874,6 @@ class KoolbaseAuth {
         if (msg.includes('invalid or expired unlock token')) {
             throw new auth_errors_js_1.UnlockTokenInvalidError();
         }
-        if (msg.includes('session revoked') ||
-            msg.includes('token revoked') ||
-            msg.includes('session has been revoked')) {
-            throw new auth_errors_js_1.TokenRevokedError();
-        }
         throw new auth_errors_js_1.KoolbaseAuthError(msg || `Request failed: ${res.status}`, code || `http_${res.status}`);
     }
     /**

package/dist/cjs/database-errors.d.ts

@@ -49,6 +49,137 @@ export declare class KoolbaseDataError extends KoolbaseError {
  * nobody asked to change. Narrow the filter, or add a unique constraint over
  * the fields you are matching on so the ambiguity cannot arise.
  */
+/**
+ * The record changed between reading it and writing it.
+ *
+ * Optimistic concurrency: a write carrying a revision is refused when the
+ * server has moved on, rather than overwriting whatever happened in between.
+ * The refusal carries the server's current record and both revisions, so
+ * resolving needs no second fetch — and cannot race one.
+ *
+ * Distinct from KoolbaseConflict, which models a queued OFFLINE write and
+ * carries a baseline as well, because a change composed hours ago needs its
+ * original context to be resolvable. Here the caller still has their data in
+ * hand.
+ *
+ * Until 11.3.0 this arrived as a generic data error and the details had to be
+ * dug out of an untyped bag — the information the server went to the trouble
+ * of attaching, unreachable in practice.
+ */
+/** A vector field with that name already exists on the collection. */
+/**
+ * A seed or import operation was refused. The code says which stage:
+ * invalid_seed_file (the file itself, with a "problems" list in details),
+ * seed_key_not_unique (the key does not identify rows uniquely),
+ * seed_needs_decision (conflicts need a choice before proceeding), or
+ * seed_conflicts_require_force (overwriting would discard the target's
+ * version of rows that changed on both sides — details carry the rows).
+ *
+ * One class with the code distinguishing them, rather than four: these are
+ * dashboard and CLI operations, and a caller handling one handles them the
+ * same way — show the reason and let a human decide.
+ */
+export declare class KoolbaseSeedError extends KoolbaseDataError {
+    constructor(message: string, code: string);
+}
+/** A project slug that another project already holds. */
+export declare class KoolbaseSlugTakenError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** An invitation that has been revoked or has expired. */
+export declare class KoolbaseInvitationInvalidError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** The project id in the request is not valid. */
+export declare class KoolbaseProjectInvalidError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** The request body could not be decoded. */
+export declare class KoolbaseInvalidBodyError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * The request asked for no change — an update with nothing to update.
+ */
+export declare class KoolbaseNoChangesError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * Something already exists, or something is in the wrong state, where the
+ * server did not say more than that.
+ *
+ * Carries whichever generic code arrived — conflict, duplicate,
+ * state_conflict — rather than four classes for codes that differ only in
+ * spelling. A caller who needs to branch finely is being underserved by the
+ * server, not by this.
+ */
+export declare class KoolbaseStateConflictError extends KoolbaseDataError {
+    constructor(message: string, code: string);
+}
+export declare class KoolbaseVectorFieldExistsError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * A backfill was asked for on a field that embeds nothing automatically.
+ * Set provider, model and source_field on the field first.
+ */
+export declare class KoolbaseFieldNotAutoEmbedError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * Embedding config is partial. Provider, model and source_field are set
+ * together or cleared together — half a configuration is refused rather than
+ * half-applied, which would embed against a model nobody chose.
+ */
+export declare class KoolbaseInvalidEmbeddingConfigError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * The project has no embedding provider configured. Embedding runs on the
+ * project's own Gemini or OpenAI key.
+ */
+export declare class KoolbaseProviderNotConfiguredError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/** The configured provider's credentials were rejected by the provider. */
+export declare class KoolbaseProviderInvalidError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+export declare class KoolbaseRevisionMismatchError extends KoolbaseDataError {
+    readonly expectedRevision?: number | undefined;
+    readonly currentRevision?: number | undefined;
+    /** The record as the server holds it now. */
+    readonly current?: Record<string, unknown> | undefined;
+    constructor(message?: string, expectedRevision?: number | undefined, currentRevision?: number | undefined, 
+    /** The record as the server holds it now. */
+    current?: Record<string, unknown> | undefined);
+}
+/**
+ * The same idempotency key sent with different data.
+ *
+ * Refused rather than replayed: the two requests do not agree, so neither
+ * answer is safe. Usually a key reused by accident across two operations.
+ */
+export declare class KoolbaseIdempotencyKeyReusedError extends KoolbaseDataError {
+    /**
+     * Carries its code: the database package calls this idempotency_key_reused
+     * and fiscal calls it idempotency_conflict, and an error reporting a code
+     * the server did not send is a small lie that apps branching on e.code act
+     * on.
+     */
+    constructor(message?: string, code?: string);
+}
+/** A batch write failed for a reason the server did not classify further. */
+export declare class KoolbaseBatchFailedError extends KoolbaseDataError {
+    constructor(message?: string);
+}
+/**
+ * Creating a unique constraint over data that already breaks it. details
+ * carry the offending values, so they can be shown rather than hunted for.
+ */
+export declare class KoolbaseDuplicateValuesError extends KoolbaseDataError {
+    constructor(message?: string);
+}
 export declare class KoolbaseAmbiguousMatchError extends KoolbaseDataError {
     constructor(message?: string);
 }

package/dist/cjs/database-errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KoolbaseVectorDimensionMismatchError = exports.KoolbaseRateLimitError = exports.KoolbasePermissionError = exports.KoolbaseInsufficientAuthorityError = exports.KoolbaseValidationError = exports.KoolbaseNotFoundError = exports.KoolbaseConflictError = exports.KoolbaseConstraintNotFoundError = exports.KoolbaseConstraintExistsError = exports.KoolbaseAmbiguousMatchError = exports.KoolbaseDataError = void 0;
+exports.KoolbaseVectorDimensionMismatchError = exports.KoolbaseRateLimitError = exports.KoolbasePermissionError = exports.KoolbaseInsufficientAuthorityError = exports.KoolbaseValidationError = exports.KoolbaseNotFoundError = exports.KoolbaseConflictError = exports.KoolbaseConstraintNotFoundError = exports.KoolbaseConstraintExistsError = exports.KoolbaseAmbiguousMatchError = exports.KoolbaseDuplicateValuesError = exports.KoolbaseBatchFailedError = exports.KoolbaseIdempotencyKeyReusedError = exports.KoolbaseRevisionMismatchError = exports.KoolbaseProviderInvalidError = exports.KoolbaseProviderNotConfiguredError = exports.KoolbaseInvalidEmbeddingConfigError = exports.KoolbaseFieldNotAutoEmbedError = exports.KoolbaseVectorFieldExistsError = exports.KoolbaseStateConflictError = exports.KoolbaseNoChangesError = exports.KoolbaseInvalidBodyError = exports.KoolbaseProjectInvalidError = exports.KoolbaseInvitationInvalidError = exports.KoolbaseSlugTakenError = exports.KoolbaseSeedError = exports.KoolbaseDataError = void 0;
 exports.koolbaseDataError = koolbaseDataError;
 const errors_js_1 = require("./errors.js");
 /**
@@ -52,6 +52,216 @@ exports.KoolbaseDataError = KoolbaseDataError;
  * nobody asked to change. Narrow the filter, or add a unique constraint over
  * the fields you are matching on so the ambiguity cannot arise.
  */
+/**
+ * The record changed between reading it and writing it.
+ *
+ * Optimistic concurrency: a write carrying a revision is refused when the
+ * server has moved on, rather than overwriting whatever happened in between.
+ * The refusal carries the server's current record and both revisions, so
+ * resolving needs no second fetch — and cannot race one.
+ *
+ * Distinct from KoolbaseConflict, which models a queued OFFLINE write and
+ * carries a baseline as well, because a change composed hours ago needs its
+ * original context to be resolvable. Here the caller still has their data in
+ * hand.
+ *
+ * Until 11.3.0 this arrived as a generic data error and the details had to be
+ * dug out of an untyped bag — the information the server went to the trouble
+ * of attaching, unreachable in practice.
+ */
+/** A vector field with that name already exists on the collection. */
+/**
+ * A seed or import operation was refused. The code says which stage:
+ * invalid_seed_file (the file itself, with a "problems" list in details),
+ * seed_key_not_unique (the key does not identify rows uniquely),
+ * seed_needs_decision (conflicts need a choice before proceeding), or
+ * seed_conflicts_require_force (overwriting would discard the target's
+ * version of rows that changed on both sides — details carry the rows).
+ *
+ * One class with the code distinguishing them, rather than four: these are
+ * dashboard and CLI operations, and a caller handling one handles them the
+ * same way — show the reason and let a human decide.
+ */
+class KoolbaseSeedError extends KoolbaseDataError {
+    constructor(message, code) {
+        super(message, code);
+        this.name = 'KoolbaseSeedError';
+        Object.setPrototypeOf(this, KoolbaseSeedError.prototype);
+    }
+}
+exports.KoolbaseSeedError = KoolbaseSeedError;
+/** A project slug that another project already holds. */
+class KoolbaseSlugTakenError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'A project with this slug already exists', 'slug_taken');
+        this.name = 'KoolbaseSlugTakenError';
+        Object.setPrototypeOf(this, KoolbaseSlugTakenError.prototype);
+    }
+}
+exports.KoolbaseSlugTakenError = KoolbaseSlugTakenError;
+/** An invitation that has been revoked or has expired. */
+class KoolbaseInvitationInvalidError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'This invitation has been revoked or expired', 'invitation_invalid');
+        this.name = 'KoolbaseInvitationInvalidError';
+        Object.setPrototypeOf(this, KoolbaseInvitationInvalidError.prototype);
+    }
+}
+exports.KoolbaseInvitationInvalidError = KoolbaseInvitationInvalidError;
+/** The project id in the request is not valid. */
+class KoolbaseProjectInvalidError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'Invalid project id', 'project_invalid');
+        this.name = 'KoolbaseProjectInvalidError';
+        Object.setPrototypeOf(this, KoolbaseProjectInvalidError.prototype);
+    }
+}
+exports.KoolbaseProjectInvalidError = KoolbaseProjectInvalidError;
+/** The request body could not be decoded. */
+class KoolbaseInvalidBodyError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'Could not decode the request body', 'invalid_body');
+        this.name = 'KoolbaseInvalidBodyError';
+        Object.setPrototypeOf(this, KoolbaseInvalidBodyError.prototype);
+    }
+}
+exports.KoolbaseInvalidBodyError = KoolbaseInvalidBodyError;
+/**
+ * The request asked for no change — an update with nothing to update.
+ */
+class KoolbaseNoChangesError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'The request contains no changes', 'no_changes');
+        this.name = 'KoolbaseNoChangesError';
+        Object.setPrototypeOf(this, KoolbaseNoChangesError.prototype);
+    }
+}
+exports.KoolbaseNoChangesError = KoolbaseNoChangesError;
+/**
+ * Something already exists, or something is in the wrong state, where the
+ * server did not say more than that.
+ *
+ * Carries whichever generic code arrived — conflict, duplicate,
+ * state_conflict — rather than four classes for codes that differ only in
+ * spelling. A caller who needs to branch finely is being underserved by the
+ * server, not by this.
+ */
+class KoolbaseStateConflictError extends KoolbaseDataError {
+    constructor(message, code) {
+        super(message, code);
+        this.name = 'KoolbaseStateConflictError';
+        Object.setPrototypeOf(this, KoolbaseStateConflictError.prototype);
+    }
+}
+exports.KoolbaseStateConflictError = KoolbaseStateConflictError;
+class KoolbaseVectorFieldExistsError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'A vector field with that name already exists on this collection', 'vector_field_exists');
+        this.name = 'KoolbaseVectorFieldExistsError';
+        Object.setPrototypeOf(this, KoolbaseVectorFieldExistsError.prototype);
+    }
+}
+exports.KoolbaseVectorFieldExistsError = KoolbaseVectorFieldExistsError;
+/**
+ * A backfill was asked for on a field that embeds nothing automatically.
+ * Set provider, model and source_field on the field first.
+ */
+class KoolbaseFieldNotAutoEmbedError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'This vector field has no auto-embedding config; set provider, model and source_field first', 'field_not_auto_embed');
+        this.name = 'KoolbaseFieldNotAutoEmbedError';
+        Object.setPrototypeOf(this, KoolbaseFieldNotAutoEmbedError.prototype);
+    }
+}
+exports.KoolbaseFieldNotAutoEmbedError = KoolbaseFieldNotAutoEmbedError;
+/**
+ * Embedding config is partial. Provider, model and source_field are set
+ * together or cleared together — half a configuration is refused rather than
+ * half-applied, which would embed against a model nobody chose.
+ */
+class KoolbaseInvalidEmbeddingConfigError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'Embedding config requires provider, model and source_field together, or all cleared', 'invalid_embedding_config');
+        this.name = 'KoolbaseInvalidEmbeddingConfigError';
+        Object.setPrototypeOf(this, KoolbaseInvalidEmbeddingConfigError.prototype);
+    }
+}
+exports.KoolbaseInvalidEmbeddingConfigError = KoolbaseInvalidEmbeddingConfigError;
+/**
+ * The project has no embedding provider configured. Embedding runs on the
+ * project's own Gemini or OpenAI key.
+ */
+class KoolbaseProviderNotConfiguredError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'No embedding provider is configured for this project', 'provider_not_configured');
+        this.name = 'KoolbaseProviderNotConfiguredError';
+        Object.setPrototypeOf(this, KoolbaseProviderNotConfiguredError.prototype);
+    }
+}
+exports.KoolbaseProviderNotConfiguredError = KoolbaseProviderNotConfiguredError;
+/** The configured provider's credentials were rejected by the provider. */
+class KoolbaseProviderInvalidError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'The embedding provider credentials are not valid', 'provider_invalid');
+        this.name = 'KoolbaseProviderInvalidError';
+        Object.setPrototypeOf(this, KoolbaseProviderInvalidError.prototype);
+    }
+}
+exports.KoolbaseProviderInvalidError = KoolbaseProviderInvalidError;
+class KoolbaseRevisionMismatchError extends KoolbaseDataError {
+    constructor(message, expectedRevision, currentRevision, 
+    /** The record as the server holds it now. */
+    current) {
+        super(message ?? 'The record has changed since you read it', 'revision_mismatch');
+        this.expectedRevision = expectedRevision;
+        this.currentRevision = currentRevision;
+        this.current = current;
+        this.name = 'KoolbaseRevisionMismatchError';
+        Object.setPrototypeOf(this, KoolbaseRevisionMismatchError.prototype);
+    }
+}
+exports.KoolbaseRevisionMismatchError = KoolbaseRevisionMismatchError;
+/**
+ * The same idempotency key sent with different data.
+ *
+ * Refused rather than replayed: the two requests do not agree, so neither
+ * answer is safe. Usually a key reused by accident across two operations.
+ */
+class KoolbaseIdempotencyKeyReusedError extends KoolbaseDataError {
+    /**
+     * Carries its code: the database package calls this idempotency_key_reused
+     * and fiscal calls it idempotency_conflict, and an error reporting a code
+     * the server did not send is a small lie that apps branching on e.code act
+     * on.
+     */
+    constructor(message, code = 'idempotency_key_reused') {
+        super(message ?? 'Idempotency key reused with different data', code);
+        this.name = 'KoolbaseIdempotencyKeyReusedError';
+        Object.setPrototypeOf(this, KoolbaseIdempotencyKeyReusedError.prototype);
+    }
+}
+exports.KoolbaseIdempotencyKeyReusedError = KoolbaseIdempotencyKeyReusedError;
+/** A batch write failed for a reason the server did not classify further. */
+class KoolbaseBatchFailedError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'The batch write failed', 'batch_failed');
+        this.name = 'KoolbaseBatchFailedError';
+        Object.setPrototypeOf(this, KoolbaseBatchFailedError.prototype);
+    }
+}
+exports.KoolbaseBatchFailedError = KoolbaseBatchFailedError;
+/**
+ * Creating a unique constraint over data that already breaks it. details
+ * carry the offending values, so they can be shown rather than hunted for.
+ */
+class KoolbaseDuplicateValuesError extends KoolbaseDataError {
+    constructor(message) {
+        super(message ?? 'The collection has duplicate values for these fields', 'duplicate_values');
+        this.name = 'KoolbaseDuplicateValuesError';
+        Object.setPrototypeOf(this, KoolbaseDuplicateValuesError.prototype);
+    }
+}
+exports.KoolbaseDuplicateValuesError = KoolbaseDuplicateValuesError;
 class KoolbaseAmbiguousMatchError extends KoolbaseDataError {
     constructor(message) {
         super(message ?? 'Upsert match resolved to more than one record', 'ambiguous_match');
@@ -217,6 +427,55 @@ function koolbaseDataError(status, body, fallbackMessage = 'Request failed') {
     switch (code) {
         case 'unique_violation':
             return attach(new KoolbaseConflictError(message, field));
+        case 'plan_limit_reached': {
+            const d = (body?.details ?? {});
+            return new errors_js_1.KoolbasePlanLimitError(message, d.resource, d.limit, d.plan);
+        }
+        case 'invalid_seed_file':
+        case 'seed_key_not_unique':
+        case 'seed_needs_decision':
+        case 'seed_conflicts_require_force':
+            return attach(new KoolbaseSeedError(message, code));
+        case 'slug_taken':
+            return attach(new KoolbaseSlugTakenError(message));
+        case 'invitation_invalid':
+            return attach(new KoolbaseInvitationInvalidError(message));
+        case 'project_invalid':
+            return attach(new KoolbaseProjectInvalidError(message));
+        case 'invalid_body':
+            return attach(new KoolbaseInvalidBodyError(message));
+        case 'no_changes':
+            return attach(new KoolbaseNoChangesError(message));
+        case 'conflict':
+        case 'duplicate':
+        case 'state_conflict':
+            return attach(new KoolbaseStateConflictError(message, code));
+        case 'vector_field_exists':
+            return attach(new KoolbaseVectorFieldExistsError(message));
+        case 'field_not_auto_embed':
+            return attach(new KoolbaseFieldNotAutoEmbedError(message));
+        case 'invalid_embedding_config':
+            return attach(new KoolbaseInvalidEmbeddingConfigError(message));
+        case 'provider_not_configured':
+            return attach(new KoolbaseProviderNotConfiguredError(message));
+        case 'provider_invalid':
+            return attach(new KoolbaseProviderInvalidError(message));
+        case 'revision_mismatch': {
+            // The typed fields come off details, which the server attaches for
+            // exactly this. attach() still puts the whole bag on the error, so
+            // nothing is lost for a caller reading it directly.
+            const d = (body?.details ?? {});
+            return attach(new KoolbaseRevisionMismatchError(message, d.expected_revision, d.current_revision, d.record));
+        }
+        // Two codes, one situation — the database and fiscal packages name it
+        // differently and a caller should not have to know which spoke.
+        case 'idempotency_key_reused':
+        case 'idempotency_conflict':
+            return attach(new KoolbaseIdempotencyKeyReusedError(message, code));
+        case 'batch_failed':
+            return attach(new KoolbaseBatchFailedError(message));
+        case 'duplicate_values':
+            return attach(new KoolbaseDuplicateValuesError(message));
         case 'ambiguous_match':
             return attach(new KoolbaseAmbiguousMatchError(message));
         case 'constraint_exists':
@@ -232,7 +491,6 @@ function koolbaseDataError(status, body, fallbackMessage = 'Request failed') {
         case 'vector_field_not_found':
             return attach(new KoolbaseNotFoundError(message, code));
         case 'unauthenticated':
-        case 'session_expired':
         case 'invalid_token':
             return attach(new errors_js_1.KoolbaseUnauthenticatedError(message));
         case 'permission_denied':

package/dist/cjs/errors.d.ts

@@ -59,6 +59,20 @@ export declare class KoolbaseUnauthenticatedError extends KoolbaseError {
  * updates are conflict-safe and some quietly are not, which is a worse guarantee
  * than a clear refusal.
  */
+/**
+ * The project's plan does not allow this — a 402 carrying which resource, the
+ * limit, and the plan.
+ *
+ * Shared rather than per-domain: creating a collection, uploading an object
+ * and deploying a function can all hit it, and an app showing an upgrade
+ * prompt wants one type to catch.
+ */
+export declare class KoolbasePlanLimitError extends KoolbaseError {
+    readonly resource?: string | undefined;
+    readonly limit?: number | undefined;
+    readonly plan?: string | undefined;
+    constructor(message?: string, resource?: string | undefined, limit?: number | undefined, plan?: string | undefined);
+}
 export declare class KoolbaseOfflineBaselineUnavailableError extends KoolbaseError {
     constructor(message: string);
 }

package/dist/cjs/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KoolbaseOfflineBaselineUnavailableError = exports.KoolbaseUnauthenticatedError = exports.KoolbaseError = void 0;
+exports.KoolbaseOfflineBaselineUnavailableError = exports.KoolbasePlanLimitError = exports.KoolbaseUnauthenticatedError = exports.KoolbaseError = void 0;
 /**
  * The root of every error the SDK raises.
  *
@@ -75,6 +75,25 @@ exports.KoolbaseUnauthenticatedError = KoolbaseUnauthenticatedError;
  * updates are conflict-safe and some quietly are not, which is a worse guarantee
  * than a clear refusal.
  */
+/**
+ * The project's plan does not allow this — a 402 carrying which resource, the
+ * limit, and the plan.
+ *
+ * Shared rather than per-domain: creating a collection, uploading an object
+ * and deploying a function can all hit it, and an app showing an upgrade
+ * prompt wants one type to catch.
+ */
+class KoolbasePlanLimitError extends KoolbaseError {
+    constructor(message, resource, limit, plan) {
+        super(message ?? 'This exceeds your plan limit', 'plan_limit_reached');
+        this.resource = resource;
+        this.limit = limit;
+        this.plan = plan;
+        this.name = 'KoolbasePlanLimitError';
+        Object.setPrototypeOf(this, KoolbasePlanLimitError.prototype);
+    }
+}
+exports.KoolbasePlanLimitError = KoolbasePlanLimitError;
 class KoolbaseOfflineBaselineUnavailableError extends KoolbaseError {
     constructor(message) {
         super(message, 'offline_baseline_unavailable');

package/dist/cjs/storage-errors.d.ts

@@ -84,6 +84,16 @@ export declare class KoolbaseStoragePermissionError extends KoolbaseStorageError
  * failure: presign again and send the same bytes. Worth catching rather than
  * showing "upload failed" to someone whose file was fine.
  */
+/**
+ * Minting a presigned upload URL failed. The message carries the underlying
+ * reason — a misconfigured bucket, or the object store refusing.
+ *
+ * Not the user's doing, and not a retry they can fix: distinct from
+ * KoolbaseUploadExpiredError, which is a retry that will work.
+ */
+export declare class KoolbaseUploadURLFailedError extends KoolbaseStorageError {
+    constructor(message?: string);
+}
 export declare class KoolbaseUploadExpiredError extends KoolbaseStorageError {
     constructor(message?: string);
 }