Changelog — Web
Every release of the @koolbase/js SDK, newest first. Dates are when each version was published to npm.
v12.0.0
Major20 September 2026Breaking
- —Fourteen error classes now report the code the server actually sends. error.code is a public field and on these classes it carried a value the API has never emitted — EmailAlreadyInUseError said email_taken for a server that says email_in_use, and the Apple and Google classes each reported a provider-split code where the server sends one unified code. Catching by type has always worked and is unaffected: no class, constructor or export changed
- —If you compare error.code against a literal, or assert on it in tests, update those comparisons. The full old-to-new table is in the package CHANGELOG. A comparison against an old value could never have matched a real response, but it can match a mock, which is why this is a major release
New
- —Account settings: auth.getCurrentUser(), auth.updateProfile(), auth.changePassword() and auth.deleteAccount(). These existed on the server and in the Flutter SDK and not here, so a web application could not offer a settings screen at all. changePassword requires the current password — a stolen session should not be enough to lock the real owner out
- —Session management: auth.listSessions(), auth.revokeSession(id) and auth.revokeAllOtherSessions(). Three endpoints had been live on the server the whole time and no SDK exposed any of them. Each session carries its device label, IP, user agent and timestamps, with isCurrent marking this device; token hashes are never included
- —auth.auditLog(). The account's own security history for a recent-activity screen: sign-ins, failures, lockouts, password changes, verification. The server sanitizes each event against a per-type field allowlist
- —db.aggregate(). Count and total over a whole collection, with the read rule applied inside the query — not a paged query you add up in the client. And never a bare number: collections are schemaless, so every result carries its accounting, saying how many records contributed to each measure and how many were skipped. A calendar bucket requires a timezone and the types enforce it
Changed
- —x-koolbase-platform-version falls back to unknown rather than being sent empty. The browser version is read from the user agent, which recognises Chrome, Firefox, Safari and Edge — so Brave, Opera, Samsung Internet and in-app webviews reported nothing. An empty header stored against a session is indistinguishable from an SDK that never reported itself
v11.4.0
Minor20 September 2026New
- —auth.resendVerificationEmailToAddress(email) — ask for a new verification email with no session. A project requiring verified contact issues none until the account verifies and refuses login until then, so a user whose email went to spam or who waited past the 24-hour link expiry had no way back except contacting the developer
- —It returns nothing and reveals nothing: the server answers identically whether the address has an account, has none, or is already verified, because anything else would let anyone discover who has signed up. Show the same check-your-email message either way. resendVerificationEmail() is unchanged, for a signed-in user who can safely be told more
v11.3.0
Minor20 September 2026Fixed
- —Thirty error codes the API emits were not mapped, so they arrived as generic errors and an app's instanceof check silently never ran
- —Two mappings were for codes the API does not emit — session_expired and token_revoked. The server sends invalid_refresh_token; branching on the other two could never have matched
- —restoreSession no longer clears the stored session on InvalidCredentialsError. During a restore that error points at the project key, not the user's session, so deleting the refresh token signed people out with no way back
v11.2.0
Minor20 September 2026Fixed
- —A function that timed out was indistinguishable from one that threw: a 504 arrived as a generic execution failure. A timeout means retry or raise the limit; an exception means fix the code
- —upload_expired and cap_below_usage were unmapped in storage, and four database codes with them — ambiguous_match among them
- —Errors report the code the server sent rather than their category, so a collection_not_found response no longer produces an error saying not_found
v11.1.0
Minor20 September 2026Fixed
- —Fourteen error codes the API emits were not mapped, arriving as generic errors
- —WeakPasswordError carries the server's message when there is one, so a project with a stricter rule than the SDK's can say what it requires
v11.0.0
Major20 September 2026Breaking
- —register() returns a discriminated result rather than a user. Under a verified-contact policy the server issues no session, and the SDK was fabricating one from a response with no tokens — so an app believed it had signed someone in who could not make a single authenticated request. The result is now either authenticated with a session, or verification_required with none, and the type makes the difference impossible to ignore
- —A pending signup persists nothing, fires no auth-state change, and does not destroy an existing session. Signing up a second account while signed in no longer signs the first one out on a project that requires verification
v10.4.0
Minor19 September 2026New
- —auth.verifyEmail(token) — complete email verification from a token, so an app can handle its own verification link rather than sending users to a hosted page
- —auth.resendVerificationEmail() — re-send to a signed-in user, with the cooldown and daily cap reported as typed errors rather than a generic refusal
v10.3.0
Minor19 September 2026Fixed
- —Analytics events carried no user unless the app called identify() — so every event from a signed-in user was attributed to nobody, and funnels that crossed the sign-in boundary broke. Events now carry the signed-in user automatically
v10.2.0
Minor19 September 2026Added
- —Multiple tabs are coordinated. Tabs on one origin share one IndexedDB and one offline queue; two locks through the Web Locks API keep them honest. A short exclusive lock guards every read-modify-write of the offline state, so two tabs enqueueing at once cannot overwrite each other. A lease on replaying the queue is held for a whole flush including its HTTP calls, so two tabs coming online together send each queued write once rather than once each.
- —A tab that cannot take the lease skips its pass and rechecks, so a write queued during another tab's flush is not stranded. A tab that closes mid-flush releases its lock automatically. In a browser without Web Locks — none current — offline queueing refuses with an explicit error rather than risking a double send.
v10.1.0
Minor19 September 2026Fixed
- —Uploads could not work from a browser. upload() required { uri, name, type } — a React Native shape — and fetched that URI to get the bytes. A browser File has no uri, so every upload from the web failed before it reached the network, while the docs showed a file input as if it worked. file now accepts a Blob or File directly.
Added
- —storageTier() on the browser adapter — 'indexeddb', 'localstorage' or 'memory'. Storage is now chosen by trying each store rather than checking whether the API exists: Safari in private browsing exposes indexedDB and may refuse to open it, and a browser with site data blocked exposes localStorage and throws on write. A failure at any tier falls to the next, ending in memory with one console warning.
v10.0.2
Patch19 September 2026Fixed
- —A Node process that initialised the SDK never exited: the analytics flush interval and a pending realtime reconnect counted as work on Node's event loop, so a CLI, a test runner or an SSR build step hung after its last line. Both timers are now unref'd where the runtime supports it. A browser is unaffected.
v10.0.1
Patch19 September 2026Fixed
- —restoreSession() threw in Node. With no indexedDB the adapter fell through to localStorage, which does not exist on a server either, so a Next.js server render crashed with ReferenceError: localStorage is not defined. Storage now falls back to an in-memory store and a server render reports NoSession rather than failing.
- —Note what this is not: server-side authentication. This package holds one session per process, which is correct for a browser tab and wrong for a server handling many users. It renders without crashing; it is not a way to sign users in on a server.
v10.0.0
Major19 September 2026Added
- —The first release. Numbered to match @koolbase/react-native and @koolbase/core, which share one version and one core: this package is that core composed for a browser, with sixty behavioural tests run against the browser adapter before it shipped.
- —Auth — email and password, phone and OTP, session persistence across reloads, restoreSession(), onAuthStateChange, password reset, email verification. Google and Apple sign-in through their web OAuth flows.
- —Database — insert, query, update, delete, upsert, bulk delete, atomic batches, populate, and semantic / lexical / hybrid search.
- —Offline — cached reads, a durable write queue with baselines, pendingWrites(), and conflicts you resolve four ways. The same semantics as React Native, proven by the same tests.
- —Storage, realtime, functions, feature flags, remote config, version enforcement and analytics.
Not included, by design
- —Code push — a native-bundle concept; the web ships on deploy.
- —Push messaging — device tokens come from a native module. Use Web Push through a service worker and your backend.
- —The native Google and Apple sign-in libraries — the methods are here and work with a token from a web OAuth flow.