@lowdefy/errors 6.1.0 → 7.1.0

package/dist/AuthorizationError.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Thrown when an authenticated caller is refused by an authorization gate - the
+// caller holds a session or a strategy credential but not the roles the
+// request, endpoint, agent, websocket or auth step requires. Maps to 403. The
+// message is written by the gate and may stay deliberately generic so it does
+// not reveal what exists. The server error handlers branch on the name before
+// the structured-log and Sentry pipeline: a caller with the wrong roles is
+// expected traffic and produces one warning line, not an error log.
+let AuthorizationError = class AuthorizationError extends Error {
+    constructor(message = 'Forbidden.', { cause } = {}){
+        super(message, {
+            cause
+        });
+        this.name = 'AuthorizationError';
+        this.isLowdefyError = true;
+    }
+};
+export default AuthorizationError;

package/dist/ConfigError.js

@@ -45,8 +45,9 @@
    * @param {string} [options.filePath] - Raw file path for pre-addKeys errors
    * @param {string|number} [options.lineNumber] - Line number for pre-addKeys errors
    * @param {string} [options.checkSlug] - The build check that triggered this error
+   * @param {string} [options.checkGroup] - A slug naming a group of checks, such as plugin-checks
    * @param {*} [options.received] - The input that caused the error
-   */ constructor(message, { cause, configKey, filePath, lineNumber, checkSlug, received } = {}){
+   */ constructor(message, { cause, configKey, filePath, lineNumber, checkSlug, checkGroup, received } = {}){
         const resolvedMessage = message ?? cause?.message;
         super(resolvedMessage, {
             cause
@@ -55,6 +56,7 @@
         this.isLowdefyError = true;
         this.configKey = configKey ?? cause?.configKey ?? null;
         this.checkSlug = checkSlug;
+        this.checkGroup = checkGroup;
         // For logger formatting
         this.received = received !== undefined ? received : cause?.received;
         // Raw file location for pre-addKeys errors (resolved by handleError/handleWarning)

package/dist/ConfigWarning.js

@@ -14,11 +14,12 @@
   limitations under the License.
 */ import ConfigError from './ConfigError.js';
 let ConfigWarning = class ConfigWarning extends ConfigError {
-    constructor(message, { cause, configKey, checkSlug, filePath, lineNumber, received, prodError } = {}){
+    constructor(message, { cause, configKey, checkSlug, checkGroup, filePath, lineNumber, received, prodError } = {}){
         super(message, {
             cause,
             configKey,
             checkSlug,
+            checkGroup,
             filePath,
             lineNumber,
             received

package/dist/ServiceError.js

@@ -28,8 +28,38 @@
     'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
     'DEPTH_ZERO_SELF_SIGNED_CERT'
 ]);
+// The HTTP status an error carries, in the places client libraries put it: most HTTP
+// clients use `statusCode`, `status` or `response.status`, AWS SDK v3 uses
+// `$metadata.httpStatusCode`, and @google-cloud and SendGrid use a numeric `code`. A
+// numeric `code` outside the HTTP range is a driver's own code (MongoDB), not a status.
+function readHttpStatus(error) {
+    if (!error || typeof error !== 'object') return undefined;
+    const numericCode = Number.isInteger(error.code) && error.code >= 100 && error.code < 600 ? error.code : undefined;
+    return error.statusCode ?? error.status ?? error.response?.status ?? error.$metadata?.httpStatusCode ?? numericCode;
+}
+// The first HTTP status down a retrying client's lastError and the cause chain.
+function findHttpStatus(error, seen = new Set()) {
+    if (!error || typeof error !== 'object' || seen.has(error)) return undefined;
+    seen.add(error);
+    return readHttpStatus(error) ?? findHttpStatus(error.lastError, seen) ?? findHttpStatus(error.cause, seen);
+}
+// 5xx is a failing service; 429 is a service throttling its callers. Both pass with
+// time, and neither is fixed by changing config.
+function isServiceStatus(statusCode) {
+    return statusCode === 429 || statusCode >= 500 && statusCode < 600;
+}
+// Retry-After from response headers, which clients expose as a plain object (the AI
+// SDK's responseHeaders, axios and SendGrid response.headers, Stripe headers) or as a
+// fetch Headers instance.
+function readRetryAfterHeader(headers) {
+    if (!headers || typeof headers !== 'object') return undefined;
+    if (typeof headers.get === 'function') {
+        return headers.get('retry-after') ?? undefined;
+    }
+    return headers['retry-after'] ?? headers['Retry-After'];
+}
 /**
- * Error class for external service failures (network, timeout, database, 5xx).
+ * Error class for external service failures (network, timeout, database, 5xx, 429).
  *
  * ServiceError represents infrastructure/service issues that are NOT caused by
  * invalid configuration. The config location is still resolved to help developers
@@ -50,26 +80,43 @@
  * // error.message = "MongoDB: Connection refused. The service may be down..."
  */ let ServiceError = class ServiceError extends Error {
     /**
-   * Checks if an error is a service error (network issues, timeouts, 5xx).
+   * Checks if an error is a service error (network issues, timeouts, 5xx, rate limits).
    * @param {Error} error - The error to check
+   * @param {Set} [seen] - Errors already checked, so a cyclic cause chain ends
    * @returns {boolean} True if this is a service error
-   */ static isServiceError(error) {
-        if (!error) return false;
+   */ static isServiceError(error, seen = new Set()) {
+        if (!error || seen.has(error)) return false;
+        seen.add(error);
+        // A client that retried and gave up (the AI SDK's RetryError) carries the
+        // failure it retried on; its own message and fields hold no status.
+        if (error.lastError) {
+            return ServiceError.isServiceError(error.lastError, seen);
+        }
         // Check error code
         if (error.code && SERVICE_ERROR_CODES.has(error.code)) {
             return true;
         }
-        // Check HTTP status codes (5xx = server error)
-        const statusCode = error.statusCode ?? error.status ?? error.response?.status;
-        if (statusCode && statusCode >= 500 && statusCode < 600) {
+        // A call cancelled because it ran out of time (AbortSignal.timeout, the AI SDK's
+        // timeout option, the server's request timeout).
+        if (error.name === 'TimeoutError') {
+            return true;
+        }
+        // AWS SDK v3 marks throttling exceptions as retryable throttling; some services
+        // answer them with 400 rather than 429.
+        if (error.$retryable?.throttling === true) {
+            return true;
+        }
+        if (isServiceStatus(readHttpStatus(error))) {
             return true;
         }
         // Check for common service error messages
         const message = error.message?.toLowerCase() ?? '';
-        if (message.includes('network') || message.includes('timeout') || message.includes('connection refused') || message.includes('dns lookup failed') || message.includes('socket hang up') || message.includes('certificate') || message.includes('unavailable')) {
+        if (message.includes('network') || message.includes('timeout') || message.includes('too many requests') || message.includes('connection refused') || message.includes('dns lookup failed') || message.includes('socket hang up') || message.includes('certificate') || message.includes('unavailable')) {
             return true;
         }
-        return false;
+        // A client error that wraps the network failure underneath it (the AI
+        // SDK's "Cannot connect to API" around a refused or timed-out fetch).
+        return ServiceError.isServiceError(error.cause, seen);
     }
     /**
    * Enhances an error message with more helpful context.
@@ -77,7 +124,7 @@
    * @returns {string} Enhanced error message
    */ static enhanceMessage(error) {
         const code = error.code;
-        const statusCode = error.statusCode ?? error.status ?? error.response?.status;
+        const statusCode = findHttpStatus(error);
         if (code === 'ECONNREFUSED') {
             return `Connection refused. The service may be down or the address may be incorrect. ${error.message ?? ''}`;
         }
@@ -90,12 +137,32 @@
         if (code === 'ECONNRESET') {
             return `Connection reset by the server. ${error.message ?? ''}`;
         }
+        if (statusCode === 429) {
+            const retryAfter = ServiceError.readRetryAfter(error);
+            const retry = retryAfter ? ` Retry after ${retryAfter}.` : '';
+            return `Rate limited by the service (429 Too Many Requests).${retry} ${error.message ?? ''}`;
+        }
         if (statusCode && statusCode >= 500) {
             return `Server returned error ${statusCode}. ${error.message ?? ''}`;
         }
         return error.message;
     }
     /**
+   * Reads the Retry-After header a throttling service sent, from the error, the
+   * failure a retrying client gave up on, or its cause chain.
+   * @param {Error} error - The error to read
+   * @param {Set} [seen] - Errors already read, so a cyclic cause chain ends
+   * @returns {string|null} The header value (seconds or an HTTP date), or null
+   */ static readRetryAfter(error, seen = new Set()) {
+        if (!error || typeof error !== 'object' || seen.has(error)) return null;
+        seen.add(error);
+        const retryAfter = readRetryAfterHeader(error.responseHeaders) ?? readRetryAfterHeader(error.response?.headers) ?? readRetryAfterHeader(error.headers) ?? readRetryAfterHeader(error.$response?.headers);
+        if (retryAfter !== undefined && retryAfter !== null) {
+            return String(retryAfter);
+        }
+        return ServiceError.readRetryAfter(error.lastError, seen) ?? ServiceError.readRetryAfter(error.cause, seen);
+    }
+    /**
    * Creates a ServiceError instance with formatted message.
    * @param {string} [message] - Error message (falls back to enhanced cause message)
    * @param {Object} [options]
@@ -104,10 +171,14 @@
    * @param {string} [options.code] - Error code (e.g., 'ECONNREFUSED')
    * @param {number} [options.statusCode] - HTTP status code if applicable
    * @param {string} [options.configKey] - Config key for location resolution
-   */ constructor(message, { cause, service, code, statusCode, configKey } = {}){
+   * @param {string} [options.hint] - A sentence telling the developer what to do about the
+   *   failure. Enumerable, so it survives serialization to the client.
+   * @param {string} [options.retryAfter] - The Retry-After a throttling service sent
+   *   (seconds or an HTTP date). Read from the cause when not given.
+   */ constructor(message, { cause, service, code, statusCode, configKey, hint, retryAfter } = {}){
         // Extract info from wrapped error if provided
         const errorCode = code ?? cause?.code;
-        const errorStatusCode = statusCode ?? cause?.statusCode ?? cause?.status ?? cause?.response?.status;
+        const errorStatusCode = statusCode ?? findHttpStatus(cause);
         // Use provided message, or enhance wrapped error's message
         const baseMessage = message ?? (cause ? ServiceError.enhanceMessage(cause) : 'Service error');
         // Message without prefix - logger uses error.name for display
@@ -121,8 +192,12 @@
         this._message = baseMessage;
         this.service = service;
         this.code = errorCode;
+        this.hint = hint ?? cause?.hint ?? null;
         this.statusCode = errorStatusCode;
-        this.configKey = configKey ?? null;
+        this.retryAfter = retryAfter ?? ServiceError.readRetryAfter(cause);
+        // Extract from the wrapped error like PluginError does, so a ServiceError
+        // wrapped around an error that already resolved its config location keeps it.
+        this.configKey = configKey ?? cause?.configKey ?? null;
     }
 };
 export default ServiceError;

package/dist/TenantIntegrityError.js

@@ -0,0 +1,35 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Thrown when a walled collection holds, or a write would leave behind, a row
+// the tenant wall cannot see: a document with no organisation, or one stamped
+// for a different organisation than the request ran for. It is a data fault, so
+// it fails one request (or is logged once at boot by the tenant preflight) and
+// never takes the app down. The fields name where to look.
+let TenantIntegrityError = class TenantIntegrityError extends Error {
+    constructor(message, { cause, collection, configKey, connectionId, organizationId, field, endpointId } = {}){
+        super(message, {
+            cause
+        });
+        this.name = 'TenantIntegrityError';
+        this.isLowdefyError = true;
+        this.collection = collection ?? null;
+        this.configKey = configKey ?? null;
+        this.connectionId = connectionId ?? null;
+        this.organizationId = organizationId ?? null;
+        this.field = field ?? null;
+        this.endpointId = endpointId ?? null;
+    }
+};
+export default TenantIntegrityError;

package/dist/TwoFactorEnrolmentRequiredError.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Thrown when an authorized caller has not enrolled a second factor and the
+// deployment sets auth.twoFactor.required. Distinct from AuthenticationError on
+// purpose: a 401 reads to the client as a dead session and bounces the user to
+// sign-in, which is the redirect loop the enrolment gate exists to avoid, so this
+// maps to 403. The server error handlers branch on the name before the
+// structured-log and Sentry pipeline - under required: true this is expected
+// traffic from every unenrolled caller, not a fault.
+let TwoFactorEnrolmentRequiredError = class TwoFactorEnrolmentRequiredError extends Error {
+    constructor(message = 'Two-factor enrolment required.', { cause } = {}){
+        super(message, {
+            cause
+        });
+        this.name = 'TwoFactorEnrolmentRequiredError';
+        this.isLowdefyError = true;
+    }
+};
+export default TwoFactorEnrolmentRequiredError;

package/dist/UserError.js

@@ -13,13 +13,16 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ let UserError = class UserError extends Error {
-    constructor(message, { blockId, cause, isReject = false, metaData, pageId } = {}){
+    constructor(message, { blockId, cause, invalidBlocks, isReject = false, metaData, pageId } = {}){
         super(message, {
             cause
         });
         this.name = 'UserError';
         this.isLowdefyError = true;
         this.blockId = blockId;
+        // The ids of the blocks a Validate action found invalid. Analytics reads them; catch
+        // actions do not (projectCaughtError leaves them out).
+        this.invalidBlocks = invalidBlocks;
         this.isReject = isReject;
         this.metaData = metaData;
         this.pageId = pageId;

package/dist/errorToDisplayString.js

@@ -16,7 +16,16 @@
     if (typeof error === 'string') return error;
     if (error?.message === undefined) return String(error);
     const name = error.name || 'Error';
-    let msg = `[${name}] ${error.message}`;
+    // Prod-gated build warnings are not fatal in dev but fail `lowdefy build`, so
+    // the name segment says so wherever the error is displayed.
+    const segments = [
+        name
+    ];
+    if (error.prodError === true) segments.push('fails in prod');
+    // The slug is what ~ignoreBuildChecks takes to silence this check.
+    if (error.checkSlug) segments.push(error.checkSlug);
+    const nameSegment = segments.join(' · ');
+    let msg = `[${nameSegment}] ${error.message}`;
     if (error.received !== undefined) {
         try {
             msg = `${msg} Received: ${JSON.stringify(error.received)}`;

package/dist/expectedErrorNames.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // Errors that are expected outcomes, never faults: a UserError (the app or its
+// user saying no on purpose) and the auth gates' refusals. A server error
+// handler that catches one answers it itself - a 400, 401 or 403 with
+// { name, message } and one warning line. They still stop the action, show
+// their message and run its catch actions, but they are never posted to
+// /api/client-error and never an app error to a journey.
+// Keyed on the class name, because plugins bundle their own @lowdefy/errors
+// copy and a server answer reaches the client as a name only.
+const expectedErrorNames = new Set([
+    'AuthenticationError',
+    'AuthorizationError',
+    'TwoFactorEnrolmentRequiredError',
+    'UserError'
+]);
+export default expectedErrorNames;

package/dist/index.js

@@ -42,9 +42,13 @@
  *    - Extends ConfigError with name override
  *    - Format: source:line\n[ConfigWarning] message
  *
- * 6. UserError - User-authored deliberate failure
- *    - Thrown: Client-side Throw action; server-side controlThrow (routine :throw) and controlReject (routine :reject)
- *    - Caught: Caller of the action/resolver; signals "the called routine deliberately failed" as distinct from a system fault
+ * 6. UserError - An expected outcome of user interaction, never a config or system fault
+ *    - Thrown: Client-side Throw and Validate actions; server-side controlThrow (routine :throw)
+ *      and controlReject (routine :reject); client auth methods when the auth server rejects
+ *      the attempt (4xx: wrong password, expired or used link, invalid code, stale OAuth query)
+ *    - Caught: Caller of the action/resolver; the message is shown to the user and catch actions
+ *      run, but it logs to the browser console only - never posted to /api/client-error, never
+ *      logged on the server at error level, never resolved to a config location
  *    - Format: [User Error] message
  *
  * 7. AuthenticationError - Unauthenticated request to a protected endpoint
@@ -52,6 +56,16 @@
  *    - Caught: Server error handlers, before structured logging and Sentry (401)
  *    - Format: [AuthenticationError] message
  *
+ * 8. TwoFactorEnrolmentRequiredError - Authorized caller with no enrolled second factor
+ *    - Thrown: The authorization gate, when auth.twoFactor.required is set and the caller is unenrolled
+ *    - Caught: Server error handlers, before structured logging and Sentry (403)
+ *    - Format: [TwoFactorEnrolmentRequiredError] message
+ *
+ * 9. AuthorizationError - Authenticated caller refused by an authorization gate (wrong roles)
+ *    - Thrown: Request, endpoint, agent, websocket and auth-step authorization gates
+ *    - Caught: Server error handlers, before structured logging and Sentry (403)
+ *    - Format: [AuthorizationError] message
+ *
  * Location Resolution Utilities:
  *   resolveConfigLocation     - Sync: configKey → {source, config} via keyMap/refMap
  *   resolveErrorLocation      - Sync: unified resolver (configKey or filePath/lineNumber)
@@ -59,16 +73,19 @@
  *   shouldSuppressBuildCheck   - Check ~ignoreBuildChecks in parent chain
  *
  * Error Field Utilities:
+ *   expectedErrorNames        - Set of error class names that are expected outcomes, not faults
  *   readErrorCodes            - {code, statusCode} from one error node's own fields
  *   lowdefyErrorNames         - Set of Lowdefy error class names
  *   lowdefyErrorTypes         - Lowdefy error class by name, for reviving and reshaping errors
  */ import ActionError from './ActionError.js';
 import AuthenticationError from './AuthenticationError.js';
+import AuthorizationError from './AuthorizationError.js';
 import BlockError from './BlockError.js';
 import BuildError from './BuildError.js';
 import ConfigError from './ConfigError.js';
 import ConfigWarning from './ConfigWarning.js';
 import errorToDisplayString from './errorToDisplayString.js';
+import expectedErrorNames from './expectedErrorNames.js';
 import LowdefyInternalError from './LowdefyInternalError.js';
 import lowdefyErrorNames from './lowdefyErrorNames.js';
 import lowdefyErrorTypes from './lowdefyErrorTypes.js';
@@ -80,6 +97,8 @@ import resolveConfigLocation from './resolveConfigLocation.js';
 import loadAndResolveErrorLocation from './loadAndResolveErrorLocation.js';
 import resolveErrorLocation from './resolveErrorLocation.js';
 import ServiceError from './ServiceError.js';
-import shouldSuppressBuildCheck, { VALID_CHECK_SLUGS } from './shouldSuppressBuildCheck.js';
+import shouldSuppressBuildCheck, { PLUGIN_CHECKS_SLUG, PLUGIN_SCHEMA_SLUG, VALID_CHECK_SLUGS } from './shouldSuppressBuildCheck.js';
+import TenantIntegrityError from './TenantIntegrityError.js';
+import TwoFactorEnrolmentRequiredError from './TwoFactorEnrolmentRequiredError.js';
 import UserError from './UserError.js';
-export { ActionError, AuthenticationError, BlockError, BuildError, ConfigError, ConfigWarning, errorToDisplayString, LowdefyInternalError, lowdefyErrorNames, lowdefyErrorTypes, OperatorError, PluginError, readErrorCodes, RequestError, resolveConfigLocation, loadAndResolveErrorLocation, resolveErrorLocation, ServiceError, shouldSuppressBuildCheck, UserError, VALID_CHECK_SLUGS };
+export { ActionError, AuthenticationError, AuthorizationError, BlockError, BuildError, ConfigError, ConfigWarning, errorToDisplayString, expectedErrorNames, LowdefyInternalError, lowdefyErrorNames, lowdefyErrorTypes, OperatorError, PluginError, PLUGIN_CHECKS_SLUG, PLUGIN_SCHEMA_SLUG, readErrorCodes, RequestError, resolveConfigLocation, loadAndResolveErrorLocation, resolveErrorLocation, ServiceError, shouldSuppressBuildCheck, TenantIntegrityError, TwoFactorEnrolmentRequiredError, UserError, VALID_CHECK_SLUGS };

package/dist/loadAndResolveErrorLocation.js

@@ -14,6 +14,16 @@
   limitations under the License.
 */ import path from 'path';
 import resolveConfigLocation from './resolveConfigLocation.js';
+async function readBuildMaps({ readConfigFile }) {
+    const [keyMap, refMap] = await Promise.all([
+        readConfigFile('keyMap.json'),
+        readConfigFile('refMap.json')
+    ]);
+    return {
+        keyMap,
+        refMap
+    };
+}
 /**
  * Resolves error config location at runtime by reading keyMap and refMap files.
  * Used by server-side error logging to trace errors back to source files.
@@ -26,16 +36,18 @@ import resolveConfigLocation from './resolveConfigLocation.js';
  * @param {Object} params.error - Error object with optional configKey/filePath properties
  * @param {Function} params.readConfigFile - Async function to read config files
  * @param {string} params.configDirectory - Absolute path to config directory
+ * @param {Function} [params.readMaps] - Async function returning { keyMap, refMap }. The dev
+ *   server passes one that adds its JIT page builds' maps; by default keyMap.json and
+ *   refMap.json are read through readConfigFile.
  * @returns {Promise<Object|null>} Location object with source and config, or null
- */ async function loadAndResolveErrorLocation({ error, readConfigFile, configDirectory }) {
+ */ async function loadAndResolveErrorLocation({ error, readConfigFile, configDirectory, readMaps = ()=>readBuildMaps({
+        readConfigFile
+    }) }) {
     if (!error) return null;
     // Path 1: configKey → keyMap/refMap lookup
     if (error.configKey) {
         try {
-            const [keyMap, refMap] = await Promise.all([
-                readConfigFile('keyMap.json'),
-                readConfigFile('refMap.json')
-            ]);
+            const { keyMap, refMap } = await readMaps();
             const location = resolveConfigLocation({
                 configKey: error.configKey,
                 keyMap,

package/dist/lowdefyErrorNames.js

@@ -27,6 +27,7 @@ const lowdefyErrorNames = new Set([
     'PluginError',
     'RequestError',
     'ServiceError',
+    'TenantIntegrityError',
     'TwoFactorEnrolmentRequiredError',
     'UserError'
 ]);

package/dist/lowdefyErrorTypes.js

@@ -13,6 +13,8 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import ActionError from './ActionError.js';
+import AuthenticationError from './AuthenticationError.js';
+import AuthorizationError from './AuthorizationError.js';
 import BlockError from './BlockError.js';
 import BuildError from './BuildError.js';
 import ConfigError from './ConfigError.js';
@@ -22,11 +24,15 @@ import OperatorError from './OperatorError.js';
 import PluginError from './PluginError.js';
 import RequestError from './RequestError.js';
 import ServiceError from './ServiceError.js';
+import TenantIntegrityError from './TenantIntegrityError.js';
+import TwoFactorEnrolmentRequiredError from './TwoFactorEnrolmentRequiredError.js';
 import UserError from './UserError.js';
 // Name to class, for rebuilding an error whose class identity is gone but whose
 // name survived - a serializer round trip, or a caught error being reshaped.
 const lowdefyErrorTypes = {
     ActionError,
+    AuthenticationError,
+    AuthorizationError,
     BlockError,
     BuildError,
     ConfigError,
@@ -36,6 +42,8 @@ const lowdefyErrorTypes = {
     PluginError,
     RequestError,
     ServiceError,
+    TenantIntegrityError,
+    TwoFactorEnrolmentRequiredError,
     UserError
 };
 export default lowdefyErrorTypes;

package/dist/shouldSuppressBuildCheck.js

@@ -23,19 +23,38 @@
     'link-refs': 'Invalid Link action page reference warnings',
     'request-refs': 'Invalid Request action reference warnings',
     'connection-refs': 'Nonexistent connection ID references',
+    'callapi-refs': 'Invalid CallAPI action endpoint reference warnings',
+    'callapi-internal-refs': 'CallAPI actions targeting InternalApi endpoints',
+    'dynamic-endpoint-refs': 'Invalid Dynamic block endpoint reference warnings',
+    'websocket-refs': 'Invalid websocket action reference warnings',
+    'callmethod-refs': 'CallMethod actions targeting blocks not defined on the page',
+    icons: 'Unresolvable icon name warnings',
     types: 'All type validation (blocks, operators, actions, requests, connections)',
-    schema: 'JSON schema validation errors'
+    schema: 'JSON schema validation errors',
+    secrets: 'Environment variable names that are not set in the build environment',
+    'plugin-schema': 'Block properties, action params and operator params that break their plugin schema'
 };
+/**
+ * Group slug for every plugin build check rule. Errors raised by plugin rules
+ * carry it as checkGroup beside the rule's own checkSlug.
+ */ export const PLUGIN_CHECKS_SLUG = 'plugin-checks';
+/**
+ * Slug of the plugin schema check. Its findings also carry PLUGIN_CHECKS_SLUG
+ * as checkGroup, so `plugin-checks` silences them with the plugin rules.
+ */ export const PLUGIN_SCHEMA_SLUG = 'plugin-schema';
 /**
  * Checks if a build check should be suppressed based on ~ignoreBuildChecks.
  * Walks up the parent chain looking for suppressions that cover this check.
  * This walk happens ONLY when an error/warning is about to be logged.
  *
- * @param {Object} error - Error/warning object with configKey and optional checkSlug
+ * A listed slug matches the error's checkSlug or its checkGroup, so
+ * `plugin-checks` silences every plugin rule.
+ *
+ * @param {Object} error - Error/warning object with configKey and optional checkSlug and checkGroup
  * @param {Object} keyMap - The keyMap from build context
  * @returns {boolean} True if the check should be suppressed
  */ function shouldSuppressBuildCheck(error, keyMap) {
-    const { configKey, checkSlug } = error;
+    const { configKey, checkSlug, checkGroup } = error;
     if (!configKey || !keyMap) return false;
     let currentKey = configKey;
     let depth = 0;
@@ -47,8 +66,9 @@
         if (ignoredChecks === true) {
             return true;
         }
-        if (Array.isArray(ignoredChecks) && checkSlug && ignoredChecks.includes(checkSlug)) {
-            return true;
+        if (Array.isArray(ignoredChecks)) {
+            if (checkSlug && ignoredChecks.includes(checkSlug)) return true;
+            if (checkGroup && ignoredChecks.includes(checkGroup)) return true;
         }
         currentKey = entry['~k_parent'];
         depth++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/errors",
-  "version": "6.1.0",
+  "version": "7.1.0",
   "license": "Apache-2.0",
   "description": "Lowdefy error classes for consistent error handling across build, server, and client",
   "homepage": "https://lowdefy.com",