Error
└── BlursecError                (all SDK errors extend this)
    ├── BlursecValidationError  (your code called the SDK wrong)
    ├── BlursecAPIError         (the API returned a non-2xx response)
    ├── BlursecTimeoutError     (the request was aborted by timeout or caller)
    └── BlursecCircuitOpenError (the local circuit breaker is open)

import { BlursecError } from "@blursec/sdk";

try {
  await blursec.auth.rotate();
} catch (err) {
  if (err instanceof BlursecError) {
    metrics.increment("blursec.error", { kind: err.name });
  }
  throw err;
}

interface BlursecAPIError extends BlursecError {
  status: number;             // HTTP status
  statusText: string;
  code?: string;              // API error code (if returned)
  requestId?: string;         // x-request-id / x-blursec-request-id
  body: unknown;              // parsed JSON or raw text
  url: string;
  method: string;
  cause?: unknown;
}

import { BlursecAPIError } from "@blursec/sdk";

try {
  await blursec.auth.whoami();
} catch (err) {
  if (err instanceof BlursecAPIError) {
    if (err.status === 401) throw new Error("Bad Blursec API key");
    console.error(`[blursec] ${err.status} ${err.url} (request ${err.requestId})`);
  }
  throw err;
}

interface BlursecTimeoutError extends BlursecError {
  timeoutMs?: number;        // populated for SDK-initiated timeouts
  cause?: unknown;           // usually a DOMException("...", "AbortError")
}

import { BlursecTimeoutError } from "@blursec/sdk";

try {
  await blursec.auth.whoami({ /* ... */ });
} catch (err) {
  if (err instanceof BlursecTimeoutError) {
    metrics.increment("blursec.timeout", { ms: err.timeoutMs });
  }
  throw err;
}

interface BlursecCircuitOpenError extends BlursecError {
  retryAfterMs: number;      // ms until the next probe is permitted
}

{
  leaked: false,
  severity: null,
  recommendedAction: "allow",
  failedOpen: true,           // ← inspect this
  /* ...rest of CredentialRiskResult */
}

const risk = await blursec.checkCredential(email, password);

if (risk.failedOpen) {
  metrics.increment("blursec.failed_open");
  // proceed with the login — but maybe log extra context
}

if (risk.leaked) {
  return res.status(403).end();
}

try {
  const risk = await blursec.credentials.check(email, password, {
    failOpen: false,
    timeoutMs: 500,
  });
  // result is guaranteed to reflect a real API response
} catch (err) {
  // BlursecTimeoutError, BlursecAPIError (any status), or network Error
}