Error catalog

Every operational error class registered via b.frameworkError.defineClass. Each class extends FrameworkError and exposes a stable shape: { name, code, message, isFrameworkError: true }. Catch with err instanceof b.FrameworkError for the unified branch, or check err.name / the per-class isXxxError flag for fine-grained handling.

Stable contract

The class name and the per-namespace code prefix are stable across patch releases. Code suffixes after the first / are documented per primitive — operators matching on full codes should pin to a minor version.

Total classes harvested: 400. Generated 2026-08-08T16:39:14.940Z.

Async #

Class	Constructor	Flags	Code namespaces	Description
`CacheError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	CacheError is alwaysPermanent: bad opts / missing key / closed-state errors are programming bugs, not transient. Backend-level transient failures (cluster DB unavailable mid-fetch) become observability + audit signals; they don't escape as exceptions to the caller.
`CacheStatusError` cache-status.js	`(code, message)`	`alwaysPermanent`	`cache-status/*`	(no prose comment in source)
`JobsError` framework-error.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)
`LogStreamError` framework-error.js	`(code, message, permanent, statusCode)`	`withStatusCode`	none harvested	(no prose comment in source)
`QueueError` framework-error.js	`(code, message, permanent)`	`default`	`queue/*`	(no prose comment in source)
`SchedulerError` framework-error.js	`(code, message, permanent)`	`default`	`scheduler/*`	(no prose comment in source)
`WebhookDispatcherError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	WebhookDispatcherError covers the durable signed-webhook delivery store (b.webhook.dispatcher): endpoint registration, fan-out, retry/backoff, and dead-letter operations. Distinct from WebhookError (the stateless sign/verify surface) so the persistence-layer error codes stay separable.
`WebhookError` framework-error.js	`(code, message)`	`alwaysPermanent`	`webhook/*`	(no prose comment in source)
`WebhookHmacError` webhook-hmac.js	`(code, message)`	`alwaysPermanent`	`webhook-hmac/*`	(no prose comment in source)

Audit #

Class	Constructor	Flags	Code namespaces	Description
`AuditDailyReviewError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	AuditDailyReviewError covers PCI DSS 4.0 Req 10.4.1.1 daily-review misconfiguration: bad cron / lookback / severity threshold, missing notify callback under threshold-bearing posture, audit-source not queryable. Permanent — config-time errors.
`AuditSegregationError` framework-error.js	`(code, message)`	`alwaysPermanent`	`audit/*`	AuditSegregationError covers SOX §404 / SOC 2 CC1.3 actor-binding violations: bound-actor mismatch on emit, missing db-role context, trigger-installation failure when sox-404 / soc2 posture demands it. Permanent — operator-misconfig or in-flight identity mismatch.
`AuditSignError` audit-sign.js	`(code, message)`	`alwaysPermanent`	`audit-sign/*`	AuditSignError is thrown by init() for fatal boot-time conditions (conflicting on-disk key files, passphrase rejected, schema invalid). The caller — CLI or app boot — catches and translates to an exit code; lib/ never calls process.exit unilaterally.
`AuditToolsError` audit-tools.js	`(code, message)`	`alwaysPermanent`	`audit-tools/*`	(no prose comment in source)

Auth #

Class	Constructor	Flags	Code namespaces	Description
`ApiKeyError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`AuthBotChallengeError` framework-error.js	`(code, message)`	`alwaysPermanent`	`auth-bot-challenge/*`	AuthBotChallengeError — challenge / escalation refusal raised by b.authBotChallenge when the operator-supplied challengeFn is missing, returns a non-boolean verdict, or throws. Permanent.
`AuthError` framework-error.js	`(code, message)`	`alwaysPermanent`	`auth/`, `auth-aal/`, `auth-bearer/`, `auth-ciba/`, `auth-dpop/`, `auth-jwt/`, `auth-jwt-external/`, `auth-oid4vci/`, `auth-oid4vp/`, `auth-openid-federation/`, `auth-passkey/`, `auth-password/`, `auth-saml/`, `auth-sd-jwt-vc/`, `auth-step-up/`, `auth-totp/`	AuthError covers password / passkey / TOTP failures at the framework layer (lib/auth/*). Always permanent — auth failures are not transient ("retry might work"); they're "this credential doesn't match" or "this input was malformed".
`AuthJarError` auth/jar.js	`(code, message)`	`alwaysPermanent`	`auth-jar/*`	(no prose comment in source)
`LockoutError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	LockoutError is alwaysPermanent: misconfig at create() and bad keys at recordFailure/recordSuccess/check/unlock are programming bugs. The "account is currently locked" condition is NOT an error — recordFailure returns { locked: true, lockedUntil } so the caller decides the response.
`PermissionsError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`SessionDeviceBindingError` framework-error.js	`(code, message)`	`alwaysPermanent`	`session-device-binding/*`	SessionDeviceBindingError — fingerprint-drift refusal raised by b.sessionDeviceBinding when create-time opts are malformed or the boundKeyResolver returns a non-Buffer. Permanent.
`SessionError` framework-error.js	`(code, message, permanent)`	`default`	`session/*`	(no prose comment in source)

Cluster #

Class	Constructor	Flags	Code namespaces	Description
`ClusterError` framework-error.js	`(code, message, permanent)`	`default`	`FENCED_OUT/*`	(no prose comment in source)
`ClusterProviderError` framework-error.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)

Compliance #

Class	Constructor	Flags	Code namespaces	Description
`ComplianceEaaError` compliance-eaa.js	`(code, message)`	`alwaysPermanent`	`compliance-eaa/*`	(no prose comment in source)
`ComplianceError` framework-error.js	`(code, message)`	`alwaysPermanent`	`compliance/`, `compliance-ai-act/`	ComplianceError covers compliance-coordinator misuse: unknown posture name, runtime-switch refusal, assertion failures. Permanent — these are configuration errors, not transient.
`DdlChangeControlError` framework-error.js	`(code, message)`	`alwaysPermanent`	`ddl-change-control/*`	DdlChangeControlError covers SOX §404 / PCI-DSS DDL change-control violations: insufficient approvers, approval window violation, signature-mismatch on apply, duplicate approval, application of an already-applied or rejected change. Permanent.
`DoraError` framework-error.js	`(code, message)`	`alwaysPermanent`	`dora/*`	DoraError covers DORA Article 17 incident-reporting workflow errors (classification refusal, report-shape validation, ESA-template generation, audit-chain integration). Permanent — these are configuration / submission errors, not transient.
`Fda21Cfr11Error` framework-error.js	`(code, message)`	`alwaysPermanent`	`fda21cfr11/*`	Fda21Cfr11Error covers FDA 21 CFR Part 11 §11.10(e) audit-content shape + §11.50/§11.70 electronic-signature shape violations: missing printedName / dateTimeUtc / signatureMeaning / predicateRule / signed record bind, before/after pair missing on a GxP audit row, signature- algorithm allowlist drift, posture interceptor refusal. Permanent — every case is operator-supplied data shape, not transient.
`LegalHoldError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	LegalHoldError covers subject-level legal-hold registry violations: missing subjectId, malformed reason/citation, duplicate placement, release-without-placement, bad opts. Permanent — config / API shape errors, not transient.
`LegalHoldError` legal-hold.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`WormViolationError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	WormViolationError covers operator-declared WORM (write-once-read- many) trigger-installation failures and posture-asserted boot gates: declareWorm called on a non-existent table, table requires WORM under sec-17a-4 / finra-4511 / fda-21cfr11 but none declared, operator attempted to drop the WORM trigger outside a sanctioned retention.purge flow. Permanent.

Crypto #

Class	Constructor	Flags	Code namespaces	Description
`AcmeError` framework-error.js	`(code, message, permanent, statusCode)`	`withStatusCode`	none harvested	AcmeError — RFC 8555 ACME + RFC 9773 ACME Renewal Information (ARI) protocol violations raised by b.acme: bad opts at create (non-https directory URL, missing accountKey, malformed audit hook), directory-fetch failure shape, newOrder/finalize/retrieveCert HTTP-status / response-shape errors, ARI window parse failures, retrieveCert returning non-PEM bytes, renewIfDue called before retrieveCert / before ARI URL is reachable. Permanent — every case is operator-misconfig or a CA-side response shape the framework refuses to coerce. withStatusCode so HTTP-shaped failures from the CA surface as a typed status for retry classification.
`HpkeError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	HpkeError — RFC 9180 Hybrid Public-Key Encryption (lib/crypto-hpke.js). Bad opts at the call site, KEM encap/decap failures, AEAD tag failures.
`HttpSigError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	HttpSigError — RFC 9421 HTTP Message Signatures (lib/http-message- signature.js). Bad opts, missing covered components, unsupported alg.
`TlsExporterError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	TlsExporterError — RFC 9266 TLS-Exporter channel binding (lib/tls-exporter.js). Non-TLS sockets, TLS<1.3 sessions, short exporter outputs.

Framework #

Class	Constructor	Flags	Code namespaces	Description
`ArgParserError` arg-parser.js	`(code, message)`	`alwaysPermanent`	`arg-parser/*`	(no prose comment in source)
`ArgParserError` framework-error.js	`(code, message)`	`alwaysPermanent`	`arg-parser/*`	ArgParserError — b.argParser declarative CLI argument parser (lib/arg-parser.js). Bad opts at create time (unsupported flag type, duplicate flag/alias, malformed flag/command name, prototype-polluting name like __proto__/constructor/prototype), bad parse-time argv (not an array, non-string elements, unknown flag/command, missing required flag, unparseable number/boolean coercion, missing flag value). alwaysPermanent — every case is operator-shape misuse the framework will not coerce; the operator fixes the spec or the argv source.
`DaemonError` daemon.js	`(code, message)`	`alwaysPermanent`	`daemon/*`	(no prose comment in source)
`DaemonError` framework-error.js	`(code, message)`	`alwaysPermanent`	`daemon/*`	DaemonError — b.daemon (lib/daemon.js). Bad opts at start/stop, pidfile already held by a live PID, spawn failure for detached-fork mode, log-file open failure, kill() failure outside ESRCH. alwaysPermanent — every case is operator-misconfig or a host-environment condition the framework refuses to coerce; transient-shaped failures (process already exited between read and kill) are surfaced as a non-error "stopped: false, reason: stale" return.
`HandlerError` framework-error.js	`(code, message, cause)`	`withCause`	none harvested	(no prose comment in source)
`HttpClientError` framework-error.js	`(code, message, permanent, statusCode)`	`withStatusCode`	none harvested	HttpClientError — outbound httpClient streaming primitives (b.httpClient.downloadStream / b.httpClient.uploadMultipartStream). withStatusCode so HTTP-shaped failures (404, 500, 503) carry the upstream status for retry classification. Codes follow the "httpclient/<reason>" shape: hash-mismatch, dest-not-writable, missing-file, http-error, etc.
`I18nError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	I18nError is alwaysPermanent: bad locale tags, malformed translation trees, missing-key in throw mode, and bad input to formatters are programming bugs. Missing keys in default ("return-key") mode return the key without throwing — runtime hot-path semantics, not error.
`I18nMessageFormatError` i18n-messageformat.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`KeychainError` framework-error.js	`(code, message)`	`alwaysPermanent`	`keychain/*`	KeychainError — b.keychain (lib/keychain.js). Bad opts at config time, native-tool exec failure (security / secret-tool / PowerShell CredentialManager), file-fallback unseal / shape failure, oversized native-tool output. alwaysPermanent — every case is operator-misconfig or a host-environment condition the framework refuses to coerce.
`NotifyError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	NotifyError is alwaysPermanent: bad opts, unknown channels, transport contract violations are programming bugs. Per-send transient failures (the kind retry can recover) are surfaced from the underlying transport with their own shape; only after retry exhaustion does notify wrap them into NotifyError SEND_FAILED — at that point they ARE permanent.
`RouterError` framework-error.js	`(code, message)`	`alwaysPermanent`	`router/*`	RouterError covers operator-shape violations on the router primitive: invalid `allowedRedirectOrigins` opt at create time, a malformed `use()` mount (non-string / non-array prefix, a prefix not beginning with "/", a missing or non-function middleware), and cross-origin `res.redirect()` targets that are not on the allowlist. alwaysPermanent — every case is config-time programming bug or an outbound-redirect shape error that retry will not recover.
`SandboxError` framework-error.js	`(code, message)`	`alwaysPermanent`	`sandbox/*`	SandboxError covers operator-supplied transform-source isolation failures: bad opts at create() (non-string source, non-finite timeoutMs / maxBytes, allowed-list contains a non-allowlisted global), worker-thread spawn failure, timeout exceeded, peak-bytes overrun, non-allowlisted-global access, output-shape-too-large, runtime exceptions inside the transform. Permanent — every case is either operator-misconfig or a transform that the host should refuse rather than retry. Operator decides at the call site whether to surface the refusal as a 4xx or to fall back to a default value.
`SeederError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	SeederError is alwaysPermanent: load failures, bad-shape seed files, missing deps, and cycle errors are programming bugs. Per-seed runtime failures get wrapped in this class with the seed name in the message — operators see "seeders/run-failed: 0042-x.js: <cause>" not a raw driver exception.
`SelfUpdateError` framework-error.js	`(code, message)`	`alwaysPermanent`	`selfupdate/*`	SelfUpdateError — b.selfUpdate (lib/self-update.js). Bad opts at poll/verify/swap/rollback, non-2xx releases-feed response, malformed JSON, missing tag_name, signature verify mismatch, atomic-swap or rollback failure, cross-device install failure. alwaysPermanent — every case is operator-misconfig or a release-feed shape the framework refuses to coerce. Operators wrap the call in their own retry policy when polling against a flaky CDN.
`SelfUpdateError` self-update.js	`(code, message)`	`alwaysPermanent`	`selfupdate/*`	(no prose comment in source)
`SlugError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`TestingError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	TestingError is alwaysPermanent: bad inputs to test helpers (NaN clock, non-fn predicate, path-traversal tempDir prefix) and waitFor timeouts are programming bugs at test-write time.
`WatcherError` framework-error.js	`(code, message)`	`alwaysPermanent`	`watcher/*`	WatcherError — b.watcher recursive-fs.watch wrapper (lib/watcher.js). Bad opts at create (non-string root, missing root, bad ignore pattern, non-finite debounceMs, non-function hook), recursive-watch unsupported on the host platform/kernel, fs.watch start failure, pending-event queue overflow under runaway-directory pressure. alwaysPermanent — every case is config-misuse or a host-environment refusal the framework will not coerce.
`WorkerPoolError` framework-error.js	`(code, message)`	`alwaysPermanent`	`workerpool/*`	WorkerPoolError — b.workerPool (lib/worker-pool.js). Bad opts at config (size / maxQueueDepth / taskTimeoutMs out of range, non- absolute scriptPath, non-function onExit), runtime queue-full, per-task timeout, worker spawn / error / non-zero exit, malformed reply envelope, terminate-aborted tasks. alwaysPermanent — every case is operator-misconfig or worker-script bug; retry without a fix would just repeat the failure.

Guard #

Class	Constructor	Flags	Code namespaces	Description
`GuardAgentRegistryError` guard-agent-registry.js	`(code, message)`	`alwaysPermanent`	`agent-registry/*`	(no prose comment in source)
`GuardAllError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardAllError covers parity-check failures, exceptFor opt validation, and override opt validation in the b.guardAll registry. alwaysPermanent — every case is a config-time programming bug, not a transient runtime condition.
`GuardArchiveError` framework-error.js	`(code, message)`	`alwaysPermanent`	`archive/*`	GuardArchiveError covers archive-shape violations: zip-slip path traversal, symlink + hardlink escape, decompression-ratio bombs, nested-archive depth, file-count + total-size + per-entry-size caps, magic-byte / format-claim mismatch, duplicate entries, encryption- claim mismatch. alwaysPermanent.
`GuardAuthError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardAuthError covers composite auth-bundle violations: aggregates guardJwt + guardOauth + b.cookies.parseSafe + light header-smuggling detection into a single gate with `source` tagging on each issue. alwaysPermanent.
`GuardCidrError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardCidrError covers CIDR identifier violations: shape malformation, IPv4 octet overflow, IPv6 zero-group ambiguity, mask out-of-range, network-address misalignment (host bits set), reserved-range membership (RFC 1918, loopback, link-local, multicast, documentation, benchmarking, CGNAT, IPv6 ULA / link-local / multicast / documentation), IPv4-mapped IPv6 dual-stack confusion, BIDI / zero-width / control / null-byte universal refuse. alwaysPermanent.
`GuardCsvError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardCsvError covers csv-shape violations on the serialize / sanitize / validate paths. alwaysPermanent — chunk-shape errors / formula-injection attempts / schema drift are all caller-shape errors.
`GuardDomainError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardDomainError covers domain-name identifier violations: RFC 1035 length-cap overflow, RFC 952/1123 LDH-rule violations, IDN homograph / mixed-script confusables, BIDI / zero-width / control-byte injection, Punycode malformation, RFC 6761 special-use domains, IPv4-as-domain confusion (CVE-2021-22931), IPv6 bracket literals, single-label / TLD- only strings, wildcard labels, RFC 8552 underscore-label misuse, DGA high-entropy labels. alwaysPermanent.
`GuardDsnError` guard-dsn.js	`(code, message)`	`alwaysPermanent`	`guard-dsn/*`	(no prose comment in source)
`GuardEmailError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardEmailError covers email-shape violations: SMTP smuggling (bare CR/LF in body, embedded SMTP verbs), CRLF header injection, RFC 5321 /5322 local-part / domain / total-length caps, multi-@ violations, IDN homograph spoofing (mixed-script confusable codepoints), display- name vs envelope mismatch, bare IP literal addresses, comment syntax in addresses, bidi/null/control chars in headers + addresses, header- folding smuggling, BOM injection. alwaysPermanent.
`GuardEnvelopeError` guard-envelope.js	`(code, message)`	`alwaysPermanent`	`guard-envelope/*`	(no prose comment in source)
`GuardEventBusPayloadError` guard-event-bus-payload.js	`(code, message)`	`alwaysPermanent`	`event-bus-payload/*`	(no prose comment in source)
`GuardEventBusTopicError` guard-event-bus-topic.js	`(code, message)`	`alwaysPermanent`	`event-bus-topic/*`	(no prose comment in source)
`GuardFilenameError` framework-error.js	`(code, message)`	`alwaysPermanent`	`filename.extraction-absolute/`, `filename.extraction-bad-root/`, `filename.extraction-drive-prefix/`, `filename.extraction-empty/`, `filename.extraction-escape/`, `filename.extraction-leading-trailing/`, `filename.extraction-ntfs-ads/`, `filename.extraction-null-byte/`, `filename.extraction-path-max/`, `filename.extraction-realpath/`, `filename.extraction-realpath-escape/`, `filename.extraction-reserved-name/`, `filename.extraction-root-realpath/`, `filename.extraction-traversal/`, `filename.extraction-traversal-encoded/`, `filename.extraction-unc/`	GuardFilenameError covers filename-shape violations: path traversal, null-byte truncation, Windows reserved names (CON / PRN / AUX / ...), NTFS alternate data streams, leading/trailing whitespace + trailing dots (Windows strips them silently), unicode bidi/RTLO file-name spoofing, overlong UTF-8 encoding, length caps. alwaysPermanent.
`GuardGraphqlError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardGraphqlError covers GraphQL request-shape violations: query depth bombs (N² query-shape DoS), alias-bomb breadth DoS, introspection in production, batch-query DoS, persisted-query enforcement, operation-name allowlist drift, variable type confusion, oversized query / variable / total bytes, BIDI / null / control / zero-width universal refuse on the query string. alwaysPermanent.
`GuardHtmlError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardHtmlError covers html-shape violations on validate / sanitize / escape paths. alwaysPermanent — XSS attempts / dangerous-tag detections / DOM clobbering are all caller-shape errors.
`GuardHtmlWcagError` guard-html-wcag.js	`(code, message)`	`alwaysPermanent`	`guard-html-wcag/*`	(no prose comment in source)
`GuardIdempotencyKeyError` guard-idempotency-key.js	`(code, message)`	`alwaysPermanent`	`idempotency-key/*`	(no prose comment in source)
`GuardImageError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardImageError covers image-metadata violations: magic-byte vs declared-MIME mismatch (drive-by content-type confusion class), polyglot (multiple format magic bytes — PHP-in-JPEG / JS-in-PNG class), unknown magic-byte, SVG-routing-via-image bypass, oversized dimensions / frame count, oversized total bytes. alwaysPermanent.
`GuardImapCommandError` guard-imap-command.js	`(code, message)`	`alwaysPermanent`	`guard-imap-command/*`	(no prose comment in source)
`GuardJmapError` guard-jmap.js	`(code, message)`	`alwaysPermanent`	`guard-jmap/`, `urn:ietf:params:jmap:error:invalidArguments/`, `urn:ietf:params:jmap:error:limit/`, `urn:ietf:params:jmap:error:requestTooLarge/`, `urn:ietf:params:jmap:error:unknownCapability/*`	(no prose comment in source)
`GuardJsonError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardJsonError covers json-shape violations: prototype pollution (__proto__/constructor/prototype), depth + breadth + key-count bombs, duplicate keys, NaN/Infinity/comments (JSON5 extensions), bidi/null in string values, numeric precision loss, total-size cap. alwaysPermanent.
`GuardJsonpathError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardJsonpathError covers JSONPath identifier violations: filter expression (`?(...)` — RCE class in eval-based implementations), script expression, JS-source hints (`eval` / `new` / `function` / `=>` / `;`), excessive bracket nesting, recursive-descent depth bombs, oversized pattern, BIDI / null / control / zero-width universal refuse. alwaysPermanent.
`GuardJwtError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardJwtError covers JWT identifier violations: shape malformation (not 3 base64url segments), alg=none refuse (canonical CVE-class — CVE-2015-9235 jsonwebtoken alg:none / CVE-2018-0114 Cisco node-jose embedded-JWK key confusion), alg-allowlist drift, kid path-traversal (operator keyResolver path-injection class), typ confusion, oversized header / payload / signature, exp / nbf / iat sanity, missing required claims, unknown crit fields (RFC 7515 §4.1.11), BIDI / null / control / zero-width universal refuse. alwaysPermanent.
`GuardListIdError` guard-list-id.js	`(code, message)`	`alwaysPermanent`	`guard-list-id/*`	(no prose comment in source)
`GuardListUnsubscribeError` guard-list-unsubscribe.js	`(code, message)`	`alwaysPermanent`	`guard-list-unsubscribe/*`	(no prose comment in source)
`GuardMailComposeError` guard-mail-compose.js	`(code, message)`	`alwaysPermanent`	`mail-compose/*`	(no prose comment in source)
`GuardMailMoveError` guard-mail-move.js	`(code, message)`	`alwaysPermanent`	`mail-move/*`	(no prose comment in source)
`GuardMailQueryError` guard-mail-query.js	`(code, message)`	`alwaysPermanent`	`mail-query/*`	(no prose comment in source)
`GuardMailReplyError` guard-mail-reply.js	`(code, message)`	`alwaysPermanent`	`mail-reply/*`	(no prose comment in source)
`GuardMailSieveError` guard-mail-sieve.js	`(code, message)`	`alwaysPermanent`	`mail-sieve/*`	(no prose comment in source)
`GuardManageSieveCommandError` guard-managesieve-command.js	`(code, message)`	`alwaysPermanent`	`guard-managesieve-command/*`	(no prose comment in source)
`GuardMarkdownError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardMarkdownError covers markdown-shape violations: raw-HTML smuggling (including the CVE-2026-30838 whitespace-in-tag-name bypass), dangerous link / image / autolink / reference-link URL schemes (javascript: / data: text/html / vbscript: / file: / jar:), entity-encoded scheme bypass, front-matter payloads, ReDoS-prone emphasis / nesting / autolink mass, HTML-comment smuggling, code-fence language injection, depth + link count + image count + line count + size caps. alwaysPermanent.
`GuardMessageIdError` guard-message-id.js	`(code, message)`	`alwaysPermanent`	`message-id/*`	(no prose comment in source)
`GuardMimeError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardMimeError covers RFC 6838 media-type identifier violations: shape malformation (missing `/`, bad type/subtype tokens), parameter injection (multiple params, bad name/value tokens, malformed quoted- string), wildcard `/` outside Accept context, vendor / personal / unregistered tree namespaces, risky-type refuse list (executable + script-host content types), BIDI / zero-width / control / null-byte universal refuse. alwaysPermanent.
`GuardOauthError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardOauthError covers OAuth flow-shape violations: PKCE missing / non-S256 (downgrade-attack class), state missing (RFC 6749 §10.12 CSRF class), redirect_uri not in operator allowlist (exact-match per OAuth 2.1), response_type allowlist drift, scope-token shape (RFC 6749 §3.3), issuer missing on callback (RFC 9207 IdP-mix-up), authorization-code reuse (RFC 6749 §10.5), oversized parameter, BIDI / null / control / zero-width universal refuse. alwaysPermanent.
`GuardPdfError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardPdfError covers PDF-metadata violations: magic-byte missing, JavaScript action (`/JS` / `/JavaScript` — RCE class), Launch action, OpenAction trigger, embedded-file presence + count cap, encrypted PDF refuse, polyglot signal, oversized bytes / page count. alwaysPermanent.
`GuardPop3CommandError` guard-pop3-command.js	`(code, message)`	`alwaysPermanent`	`guard-pop3-command/*`	(no prose comment in source)
`GuardPostureChainError` guard-posture-chain.js	`(code, message)`	`alwaysPermanent`	`posture-chain/*`	(no prose comment in source)
`GuardRegexError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardRegexError covers regex-pattern identifier violations: nested quantifier ReDoS class (CVE-2024-21538 / CVE-2022-25929), alternation with quantifier, bounded-repeat upper-bound overflow, lookaround with internal quantifier, oversized pattern, BIDI / null / control / zero-width universal refuse. alwaysPermanent.
`GuardSagaConfigError` guard-saga-config.js	`(code, message)`	`alwaysPermanent`	`saga-config/*`	(no prose comment in source)
`GuardShellError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardShellError covers shell-arg identifier violations: POSIX + cmd.exe metacharacters, $(...) / ${...} command + parameter substitution, backtick substitution, process substitution (`<(...)` / `>(...)`), `$VAR` parameter expansion, newline injection, leading-hyphen option-flag injection (`-rf` / `--exec` class), BIDI / null / control / zero-width universal refuse. alwaysPermanent.
`GuardSmtpCommandError` guard-smtp-command.js	`(code, message)`	`alwaysPermanent`	`guard-smtp-command/*`	(no prose comment in source)
`GuardSnapshotEnvelopeError` guard-snapshot-envelope.js	`(code, message)`	`alwaysPermanent`	`snapshot-envelope/*`	(no prose comment in source)
`GuardSqlError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardSqlError covers raw-SQL refusals from the b.guardSql guard: the OS-reach floor (file / exec / FDW / extension / privilege-pivot across Postgres / SQLite / MySQL), stacked statements, comment smuggling, embedded string literals in a fragment, invalid UTF-8 (CVE-2025-1094 encoding-bypass class), time-based probes, schema recon, and the migration DDL-verb allowlist. DOT-style codes (sql.refuse / sql.stacked / sql.file-access / ...) so they don't collide with SafeSqlError's slash codes (sql/bad-shape / ...). alwaysPermanent.
`GuardStreamArgsError` guard-stream-args.js	`(code, message)`	`alwaysPermanent`	`stream-args/*`	(no prose comment in source)
`GuardSvgError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardSvgError covers svg-shape violations: dangerous tags (script / foreignObject / use cross-origin / handler), DOCTYPE entity expansion (billion laughs / XXE), animation-element attributeName targeting href, SVGZ compressed payloads, SSRF-shape href references. alwaysPermanent.
`GuardTemplateError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardTemplateError covers Server-Side Template Injection (SSTI) identifier violations: Jinja / Django / Twig / Liquid / Handlebars / AngularJS `{{...}}` + `{%...%}` shapes (CVE-2024-22195 / 26139 / 23348 class), ERB / Tornado `<%...%>`, Pug `#{...}` / `!{...}` interpolation, Mako / Velocity / Tornado `${...}`, Velocity directives (#set / #if / #foreach), BIDI / null / control / zero- width universal refuse. alwaysPermanent.
`GuardTenantIdError` guard-tenant-id.js	`(code, message)`	`alwaysPermanent`	`tenant-id/*`	(no prose comment in source)
`GuardTextError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardTextError covers free-text codepoint-threat violations on the validate / sanitize / gate paths (bidi-override / control / null / zero-width / Unicode-Tags / mixed-script-confusable). alwaysPermanent — every case is a hostile-codepoint detection or a caller-shape opt error.
`GuardTimeError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardTimeError covers RFC 3339 / ISO 8601 datetime identifier violations: shape malformation, year-window overflow (pre-epoch / far-future), naive datetime (no offset), non-UTC offset, leap-second `60` field policy, excessive fractional precision, date-only / time-only refuse, BIDI / zero-width / control / null-byte universal refuse, structural range violations (month / day-in-month / hour / minute / second). alwaysPermanent.
`GuardTraceContextError` guard-trace-context.js	`(code, message)`	`alwaysPermanent`	`trace-context/*`	(no prose comment in source)
`GuardUuidError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardUuidError covers UUID identifier violations: shape malformation (non-canonical / non-hex), RFC 9562 §4.2 unassigned version digits, non-RFC 4122 variant bits, nil UUID (§5.9) / max UUID (§5.10) sentinel leakage, urn:uuid: + Microsoft GUID braces forms outside the operator's declared formatPolicy, BIDI / zero-width / control-byte / null-byte universal refuse. alwaysPermanent.
`GuardXmlError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardXmlError covers xml-shape violations: XXE, billion-laughs entity expansion, parameter entities, external DTD subset, XInclude, schema- fetch (xsi:schemaLocation), processing instructions, CDATA, depth + element-count + attribute-count caps. alwaysPermanent.
`GuardYamlError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GuardYamlError covers yaml-shape violations: deserialization-tag injection (!!python/object / !!java.util.HashMap / custom !Class), anchor recursion (billion laughs), Norway-problem implicit booleans, leading-zero octals, duplicate keys, multi-document streams, depth + node-count + size caps. alwaysPermanent.

HttpSurface #

Class	Constructor	Flags	Code namespaces	Description
`FileUploadError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	FileUploadError is alwaysPermanent: chunk-hash mismatch / oversized chunk / oversized total file / manifest verification failure are all caller-shape errors that won't succeed on retry. Operators wrap the route handler with their own retry policy if they want client-side resumability.
`GateContractError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GateContractError covers gate-contract violations (operator-supplied gate is malformed / hook threw / runtime exceeded). alwaysPermanent because these are programming-bug-shaped, not transient.
`StaticServeError` framework-error.js	`(code, message, permanent, statusCode)`	`withStatusCode`	none harvested	StaticServeError covers the download-side surface of staticServe.create. withStatusCode: true so the framework can translate to operator-meaningful HTTP responses (403 permission_denied, 404 not_found, 412 precondition_failed, 416 range_not_satisfiable, 429 quota_exceeded, 451 retention_blocked).

Operational #

Class	Constructor	Flags	Code namespaces	Description
`AccessLockError` auth/access-lock.js	`(code, message)`	`alwaysPermanent`	`auth-access-lock/*`	(no prose comment in source)
`AdapterError` archive-adapters.js	`(code, message)`	`alwaysPermanent`	`adapter/*`	(no prose comment in source)
`AdverseDecisionError` ai-adverse-decision.js	`(code, message)`	`alwaysPermanent`	`ai-adverse/*`	(no prose comment in source)
`AedtBiasAuditError` ai-aedt-bias-audit.js	`(code, message)`	`alwaysPermanent`	`aedt/*`	(no prose comment in source)
`AgeGateError` middleware/age-gate.js	`(code, message)`	`alwaysPermanent`	`age-gate/*`	(no prose comment in source)
`AgentEnvelopeMacError` agent-envelope-mac.js	`(code, message)`	`alwaysPermanent`	`agent-envelope-mac/*`	(no prose comment in source)
`AgentEventBusError` agent-event-bus.js	`(code, message)`	`alwaysPermanent`	`agent-event-bus/*`	(no prose comment in source)
`AgentIdempotencyError` agent-idempotency.js	`(code, message)`	`alwaysPermanent`	`agent-idempotency/*`	(no prose comment in source)
`AgentOrchestratorError` agent-orchestrator.js	`(code, message)`	`alwaysPermanent`	`agent-orchestrator/*`	(no prose comment in source)
`AgentPostureChainError` agent-posture-chain.js	`(code, message)`	`alwaysPermanent`	`agent-posture-chain/*`	(no prose comment in source)
`AgentSagaError` agent-saga.js	`(code, message)`	`alwaysPermanent`	`agent-saga/*`	(no prose comment in source)
`AgentSnapshotError` agent-snapshot.js	`(code, message)`	`alwaysPermanent`	`agent-snapshot/*`	(no prose comment in source)
`AgentStreamError` agent-stream.js	`(code, message)`	`alwaysPermanent`	`agent-stream/*`	(no prose comment in source)
`AgentTenantError` agent-tenant.js	`(code, message)`	`alwaysPermanent`	`agent-tenant/*`	(no prose comment in source)
`AgentTraceError` agent-trace.js	`(code, message)`	`alwaysPermanent`	`agent-trace/*`	(no prose comment in source)
`AiCapabilityError` ai-capability.js	`(code, message)`	`alwaysPermanent`	`ai-capability/*`	(no prose comment in source)
`AiContentDetectError` ai-content-detect.js	`(code, message)`	`alwaysPermanent`	`ai-content-detect/*`	(no prose comment in source)
`AiDisclosureError` ai-disclosure.js	`(code, message)`	`alwaysPermanent`	`ai-disclosure/*`	(no prose comment in source)
`AiDpError` ai-dp.js	`(code, message)`	`alwaysPermanent`	`ai-dp/*`	(no prose comment in source)
`AiModelManifestError` ai-model-manifest.js	`(code, message)`	`alwaysPermanent`	`aibom/*`	(no prose comment in source)
`AiOutputError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	AiOutputError covers LLM output-handling violations raised by b.ai.output.sanitize / b.ai.output.redact: malformed input shape (non-string), oversized output bypass (exceeds maxBytes cap), bad maxBytes opt, unknown redaction entity. Permanent — caller-shape errors that retry will not recover. OWASP LLM05:2025 (Improper Output Handling) + LLM02:2025 (Sensitive Information Disclosure).
`AiPrefError` ai-pref.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`AiPromptError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	AiPromptError covers LLM prompt-assembly violations raised by b.ai.prompt.template: malformed segment shape (non-string system / context / user), bad maxBytes / nonceBytes opt, oversized assembled prompt. Permanent — caller-shape errors that retry will not recover. OWASP LLM01:2025 (Prompt Injection — indirect / data-plane injection from untrusted context).
`AiQuotaError` ai-quota.js	`(code, message)`	`alwaysPermanent`	`ai-quota/*`	(no prose comment in source)
`ApiEncryptError` middleware/api-encrypt.js	`(code, message, permanent, statusCode)`	`withStatusCode`	none harvested	(no prose comment in source)
`AppShutdownError` app-shutdown.js	`(code, message)`	`alwaysPermanent`	`app-shutdown/*`	(no prose comment in source)
`ArchiveError` archive.js	`(code, message)`	`alwaysPermanent`	`archive/*`	(no prose comment in source)
`ArchiveGzError` archive-gz.js	`(code, message)`	`alwaysPermanent`	`archive-gz/*`	(no prose comment in source)
`ArchiveReadError` archive-read.js	`(code, message)`	`alwaysPermanent`	`archive-read/*`	(no prose comment in source)
`ArchiveWrapError` archive-wrap.js	`(code, message)`	`alwaysPermanent`	`archive-wrap/*`	(no prose comment in source)
`Asn1Error` asn1-der.js	`(code, message)`	`alwaysPermanent`	`asn1/*`	(no prose comment in source)
`AssetlinksError` middleware/assetlinks.js	`(code, message)`	`alwaysPermanent`	`assetlinks/*`	(no prose comment in source)
`AsyncApiError` asyncapi-bindings.js	`(code, message)`	`alwaysPermanent`	`asyncapi/*`	(no prose comment in source)
`AsyncApiError` asyncapi-traits.js	`(code, message)`	`alwaysPermanent`	`asyncapi/*`	(no prose comment in source)
`AsyncApiError` asyncapi.js	`(code, message)`	`alwaysPermanent`	`asyncapi/*`	(no prose comment in source)
`AsyncApiError` middleware/asyncapi-serve.js	`(code, message)`	`alwaysPermanent`	`asyncapi/*`	(no prose comment in source)
`AtoKillSwitchError` auth/ato-kill-switch.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`BackupBundleError` backup/bundle.js	`(code, message)`	`alwaysPermanent`	`backup-bundle/*`	(no prose comment in source)
`BackupError` backup/index.js	`(code, message, permanent)`	`default`	`backup/*`	(no prose comment in source)
`Base32Error` base32.js	`(code, message)`	`alwaysPermanent`	`base32/*`	(no prose comment in source)
`BimiError` mail-bimi.js	`(code, message)`	`alwaysPermanent`	`mail-bimi/*`	Pre-existing BimiError covered DNS / record-shape failures. Kept for backwards-compatibility on the existing surface (recordShape / parseRecord / fetchPolicy). The new fetchAndVerifyMark / Tiny-PS surface uses MailBimiError so chain / policy / SVG failures route to a domain-shared class with the documented `bimi/...` codes.
`BodyParserError` middleware/body-parser.js	`(code, message, permanent, statusCode)`	`withStatusCode`	`body-parser/*`	(no prose comment in source)
`BootGatesError` boot-gates.js	`(code, message)`	`alwaysPermanent`	`boot-gates/*`	(no prose comment in source)
`BotChallengeError` framework-error.js	`(code, message)`	`alwaysPermanent`	`bot-challenge/*`	BotChallengeError — verifier-side errors raised by b.auth.botChallenge (Cloudflare Turnstile / hCaptcha / reCAPTCHA-v3 token siteverify): invalid token shape, timeout, hostname / action allowlist mismatch, provider reported success=false, malformed response body. Permanent.
`BotDiscloseError` middleware/bot-disclose.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`BotGuardError` middleware/bot-guard.js	`(code, message)`	`alwaysPermanent`	`bot-guard/*`	(no prose comment in source)
`BoundedMapError` bounded-map.js	`(code, message, permanent)`	`default`	`bounded-map/*`	(no prose comment in source)
`BreachError` breach-deadline.js	`(code, message)`	`alwaysPermanent`	`breach/`, `breach-clock/`, `breach-report/*`	(no prose comment in source)
`BreakGlassError` break-glass.js	`(code, message, permanent)`	`default`	`breakglass/*`	Errors — all 14 codes documented in the spec. `permanent: true` means caller's input is bad (config-time / call-site reject); `permanent: false` means transient (factor failed, rate-limited) — caller may retry.
`BudrError` budr.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`BundlerError` bundler.js	`(code, message)`	`alwaysPermanent`	`bundler/*`	(no prose comment in source)
`ByteQuotaError` network-byte-quota.js	`(code, message)`	`alwaysPermanent`	`byte-quota/*`	(no prose comment in source)
`CalendarError` calendar.js	`(code, message)`	`alwaysPermanent`	`calendar/*`	(no prose comment in source)
`CborError` cbor.js	`(code, message)`	`alwaysPermanent`	`cbor/*`	(no prose comment in source)
`CdnCacheControlError` cdn-cache-control.js	`(code, message)`	`alwaysPermanent`	`cdn-cache-control/*`	(no prose comment in source)
`CertError` cert.js	`(code, message, permanent)`	`default`	`cert/*`	(no prose comment in source)
`CliError` cli.js	`(code, message)`	`alwaysPermanent`	`cli/*`	(no prose comment in source)
`ClientHintsError` client-hints.js	`(code, message)`	`alwaysPermanent`	`client-hints/*`	(no prose comment in source)
`CloudEventsError` cloud-events.js	`(code, message)`	`alwaysPermanent`	`cloud-events/*`	(no prose comment in source)
`CmsCodecError` cms-codec.js	`(code, message)`	`alwaysPermanent`	`cms/*`	(no prose comment in source)
`ComposePipelineError` middleware/compose-pipeline.js	`(code, message)`	`alwaysPermanent`	`compose-pipeline/*`	(no prose comment in source)
`CompressionError` middleware/compression.js	`(code, message)`	`alwaysPermanent`	`compression/*`	(no prose comment in source)
`ConfigDriftError` config-drift.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`ConfigError` config.js	`(code, message)`	`alwaysPermanent`	`config/*`	(no prose comment in source)
`ContentCredentialsError` content-credentials.js	`(code, message)`	`alwaysPermanent`	`cac-implicit-label/*`	(no prose comment in source)
`ContentDigestError` content-digest.js	`(code, message)`	`alwaysPermanent`	`content-digest/*`	(no prose comment in source)
`CookieJarError` http-client-cookie-jar.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`CorsError` middleware/cors.js	`(code, message)`	`alwaysPermanent`	`cors/*`	(no prose comment in source)
`CoseError` cose.js	`(code, message)`	`alwaysPermanent`	`cose/*`	(no prose comment in source)
`CraReportError` cra-report.js	`(code, message)`	`alwaysPermanent`	`cra-report/*`	(no prose comment in source)
`CrdtError` crdt.js	`(code, message)`	`alwaysPermanent`	`crdt/*`	(no prose comment in source)
`CryptoFieldError` crypto-field.js	`(code, message)`	`alwaysPermanent`	`crypto-field/*`	(no prose comment in source)
`CryptoFieldRateError` crypto-field.js	`(code, message)`	`alwaysPermanent`	`crypto-field/*`	Typed refusal raised when a (actor, table, column) tuple exceeds the opt-in unseal-failure rate cap and is in cooldown. alwaysPermanent — the caller does not retry; the cooldown is a deliberate, time-bounded circuit-breaker, not a transient backend hiccup.
`CspError` csp.js	`(code, message)`	`alwaysPermanent`	`csp/*`	(no prose comment in source)
`CspNonceError` middleware/csp-nonce.js	`(code, message)`	`alwaysPermanent`	`csp-nonce/*`	(no prose comment in source)
`CsvError` csv.js	`(code, message)`	`alwaysPermanent`	`csv/*`	(no prose comment in source)
`CwtError` cwt.js	`(code, message)`	`alwaysPermanent`	`cwt/*`	(no prose comment in source)
`DailyByteQuotaError` middleware/daily-byte-quota.js	`(code, message)`	`alwaysPermanent`	`daily-byte-quota/*`	(no prose comment in source)
`DaneError` network-dane.js	`(code, message)`	`alwaysPermanent`	`dane/*`	(no prose comment in source)
`DarkPatternsError` dark-patterns.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`DataActError` data-act.js	`(code, message)`	`alwaysPermanent`	`dataact/*`	(no prose comment in source)
`DeclareRowPolicyError` db-declare-row-policy.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`DeclareViewError` db-declare-view.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`DeliverError` mail-send-deliver.js	`(code, message, permanent)`	`default`	`deliver/*`	(no prose comment in source)
`DidError` did.js	`(code, message)`	`alwaysPermanent`	`did/*`	(no prose comment in source)
`DnsError` network-dns.js	`(code, message, permanent)`	`default`	`dns/*`	(no prose comment in source)
`DnssecError` network-dnssec.js	`(code, message)`	`alwaysPermanent`	`dnssec/*`	(no prose comment in source)
`DrRunbookError` dr-runbook.js	`(code, message)`	`alwaysPermanent`	`dr-runbook/*`	(no prose comment in source)
`DsaError` framework-error.js	`(code, message)`	`alwaysPermanent`	`dsa/*`	DsaError covers b.dsa config-time misuse (EU Digital Services Act, Reg 2022/2065): malformed noticeAndAction / statementOfReasons / transparencyReport opts, an unknown notice-type / decision / redress / metric key, a statement of reasons with neither or both grounds, an out-of-order reporting period. Permanent — operator-supplied record shape.
`DsrError` dsr.js	`(code, message)`	`alwaysPermanent`	`dsr/*`	(no prose comment in source)
`DualControlError` dual-control.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`EarlyHintsError` early-hints.js	`(code, message)`	`alwaysPermanent`	`early-hints/*`	(no prose comment in source)
`EatError` eat.js	`(code, message)`	`alwaysPermanent`	`eat/*`	(no prose comment in source)
`Fapi2Error` fapi2.js	`(code, message)`	`alwaysPermanent`	`fapi-2.0/*`	(no prose comment in source)
`FdxError` fdx.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`FedcmError` fedcm.js	`(code, message)`	`alwaysPermanent`	`fedcm/*`	(no prose comment in source)
`FidoMds3Error` framework-error.js	`(code, message)`	`alwaysPermanent`	`fido-mds3/*`	FidoMds3Error — b.auth.fidoMds3 (lib/auth/fido-mds3.js). FIDO MDS3 metadata BLOB verification + AAGUID lookup violations: BLOB fetch failure (non-2xx, oversize, network), JWS shape mismatch, certificate chain validation failure against the FIDO Alliance MDS3 root, signature verification failure, payload schema violation (missing entries / nextUpdate / no), nextUpdate parse failure, AAGUID lookup against an authenticator carrying a REVOKED / USER_KEY_PHYSICAL_COMPROMISE / USER_KEY_REMOTE_COMPROMISE status report. alwaysPermanent — every case is configuration / network / signing-shape errors that retry alone won't recover.
`FileTypeError` file-type.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`FlagError` flag-cache.js	`(code, message)`	`alwaysPermanent`	`flag/*`	(no prose comment in source)
`FlagError` flag-evaluation-context.js	`(code, message)`	`alwaysPermanent`	`flag/*`	(no prose comment in source)
`FlagError` flag-providers.js	`(code, message)`	`alwaysPermanent`	`flag/*`	(no prose comment in source)
`FlagError` flag-targeting.js	`(code, message)`	`alwaysPermanent`	`flag/*`	(no prose comment in source)
`FlagError` flag.js	`(code, message)`	`alwaysPermanent`	`flag/*`	(no prose comment in source)
`FlagError` middleware/flag-context.js	`(code, message)`	`alwaysPermanent`	`flag/*`	(no prose comment in source)
`FrontierProtocolError` ai-frontier-protocol.js	`(code, message)`	`alwaysPermanent`	`frontier/*`	(no prose comment in source)
`FsmError` fsm.js	`(code, message)`	`alwaysPermanent`	`fsm/*`	(no prose comment in source)
`FuzzyError` compliance-sanctions-fuzzy.js	`(code, message)`	`alwaysPermanent`	`fuzzy/*`	(no prose comment in source)
`GdprRopaError` gdpr-ropa.js	`(code, message)`	`alwaysPermanent`	`gdpr-ropa/*`	(no prose comment in source)
`HalError` hal.js	`(code, message)`	`alwaysPermanent`	`hal/*`	(no prose comment in source)
`HealthError` middleware/health.js	`(code, message)`	`alwaysPermanent`	`health/*`	(no prose comment in source)
`HeartbeatError` network-heartbeat.js	`(code, message)`	`alwaysPermanent`	`heartbeat/*`	(no prose comment in source)
`HoneytokenError` honeytoken.js	`(code, message)`	`alwaysPermanent`	`honeytoken/*`	(no prose comment in source)
`HostAllowlistError` middleware/host-allowlist.js	`(code, message)`	`alwaysPermanent`	`host-allowlist/*`	(no prose comment in source)
`IabMspaError` iab-mspa.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`IabTcfError` iab-tcf.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`IdempotencyError` framework-error.js	`(code, message)`	`alwaysPermanent`	`idempotency/*`	IdempotencyError — b.middleware.idempotencyKey (lib/middleware/ idempotency-key.js). draft-ietf-httpapi-idempotency-key middleware violations: bad opts at create (missing store, bad ttl, bad methods list), bad idempotency key shape (non-string, too long, control chars), store-backend transport errors that exhausted retries. alwaysPermanent — every operator-facing failure is config-shape; transient store-backend failures route through audit signals so they don't escape as exceptions to the middleware caller.
`IdempotencyError` middleware/idempotency-key.js	`(code, message)`	`alwaysPermanent`	`idempotency/*`	(no prose comment in source)
`ImportmapError` importmap-integrity.js	`(code, message)`	`alwaysPermanent`	`importmap/*`	(no prose comment in source)
`InboxError` inbox.js	`(code, message)`	`alwaysPermanent`	`inbox/*`	(no prose comment in source)
`IncidentReportError` incident-report.js	`(code, message)`	`alwaysPermanent`	`incident-report/*`	(no prose comment in source)
`IniSafeError` parsers/safe-ini.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`JoseJweExperimentalError` jose-jwe-experimental.js	`(code, message)`	`alwaysPermanent`	`jose-jwe-exp/*`	(no prose comment in source)
`JsonApiError` jsonapi.js	`(code, message)`	`alwaysPermanent`	`json-api/*`	(no prose comment in source)
`JsonMergePatchError` json-merge-patch.js	`(code, message)`	`alwaysPermanent`	`json-merge-patch/*`	(no prose comment in source)
`JsonPatchError` json-patch.js	`(code, message)`	`alwaysPermanent`	`json-patch/*`	(no prose comment in source)
`JsonPathError` json-path.js	`(code, message)`	`alwaysPermanent`	`json-path/*`	(no prose comment in source)
`JsonPointerError` json-pointer.js	`(code, message)`	`alwaysPermanent`	`json-pointer/*`	(no prose comment in source)
`JsonSchemaError` json-schema.js	`(code, message)`	`alwaysPermanent`	`json-schema/*`	(no prose comment in source)
`JtdError` jtd.js	`(code, message)`	`alwaysPermanent`	`jtd/*`	(no prose comment in source)
`JwkError` jwk.js	`(code, message)`	`alwaysPermanent`	`jwk/*`	(no prose comment in source)
`LinkHeaderError` link-header.js	`(code, message)`	`alwaysPermanent`	`link-header/*`	(no prose comment in source)
`LroError` lro.js	`(code, message)`	`alwaysPermanent`	`lro/*`	(no prose comment in source)
`MdocError` mdoc.js	`(code, message)`	`alwaysPermanent`	`mdoc/*`	(no prose comment in source)
`MetricsError` metrics.js	`(code, message)`	`alwaysPermanent`	`metrics/`, `metrics-shadow/`, `metrics-snapshot/*`	(no prose comment in source)
`MoneyError` money.js	`(code, message)`	`alwaysPermanent`	`money/*`	(no prose comment in source)
`MyError` framework-error.js	`(code, message, permanent)`	`default`	none harvested	defineClass — factory for the standard FrameworkError-subclass shape every per-domain error followed by hand. Variants the factory covers:
`MyError` framework-error.js	`(code, message, permanent, statusCode)`	`withStatusCode`	none harvested	defineClass — factory for the standard FrameworkError-subclass shape every per-domain error followed by hand. Variants the factory covers: defineClass("MyError") constructor: (code, message, permanent) fields: name, permanent, isMyError
`MyError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	defineClass — factory for the standard FrameworkError-subclass shape every per-domain error followed by hand. Variants the factory covers: defineClass("MyError") constructor: (code, message, permanent) fields: name, permanent, isMyError defineClass("MyError", { withStatusCode: true }) constructor: (code, message, permanent, statusCode) fields: + statusCode (HTTP-shaped operational errors)
`MyError` framework-error.js	`(code, message, cause)`	`withCause`	none harvested	defineClass — factory for the standard FrameworkError-subclass shape every per-domain error followed by hand. Variants the factory covers: defineClass("MyError") constructor: (code, message, permanent) fields: name, permanent, isMyError defineClass("MyError", { withStatusCode: true }) constructor: (code, message, permanent, statusCode) fields: + statusCode (HTTP-shaped operational errors) defineClass("MyError", { alwaysPermanent: true }) constructor: (code, message) fields: permanent always true (auth failures, validation)
`NetworkAllowlistError` middleware/network-allowlist.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`NetworkError` network.js	`(code, message)`	`alwaysPermanent`	`ntp/`, `socket/`	(no prose comment in source)
`NetworkTlsError` network-tls.js	`(code, message, permanent)`	`default`	`network-tls/`, `tls/`	(no prose comment in source)
`Nis2ReportError` nis2-report.js	`(code, message)`	`alwaysPermanent`	`nis2-report/*`	(no prose comment in source)
`NoCacheError` middleware/no-cache.js	`(code, message)`	`alwaysPermanent`	`no-cache/*`	(no prose comment in source)
`NonceStoreError` nonce-store.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)
`NtpCheckError` ntp-check.js	`(code, message)`	`alwaysPermanent`	none harvested	Config-time misuse (a bad opts.port) throws a typed, permanent error so an operator catches the typo at boot rather than as a Promise rejection.
`NtsError` network-nts.js	`(code, message, permanent)`	`default`	`nts/*`	(no prose comment in source)
`OAuthError` auth/oauth.js	`(code, message)`	`alwaysPermanent`	`auth-oauth/*`	(no prose comment in source)
`OpenApiError` middleware/openapi-serve.js	`(code, message)`	`alwaysPermanent`	`openapi/*`	(no prose comment in source)
`OpenApiError` openapi-paths-builder.js	`(code, message)`	`alwaysPermanent`	`openapi/*`	(no prose comment in source)
`OpenApiError` openapi-schema-walk.js	`(code, message)`	`alwaysPermanent`	`openapi/*`	(no prose comment in source)
`OpenApiError` openapi-security.js	`(code, message)`	`alwaysPermanent`	`openapi/*`	(no prose comment in source)
`OpenApiError` openapi-yaml.js	`(code, message)`	`alwaysPermanent`	`openapi/*`	(no prose comment in source)
`OpenApiError` openapi.js	`(code, message)`	`alwaysPermanent`	`openapi/*`	(no prose comment in source)
`OprfError` crypto-oprf.js	`(code, message)`	`alwaysPermanent`	`oprf/*`	(no prose comment in source)
`OtelExportError` otel-export.js	`(code, message, permanent)`	`default`	`otel-export/*`	(no prose comment in source)
`OtlpExporterError` observability-otlp-exporter.js	`(code, message)`	`alwaysPermanent`	`otlp/*`	(no prose comment in source)
`OutboxError` outbox.js	`(code, message)`	`alwaysPermanent`	`outbox/*`	(no prose comment in source)
`PaginationError` pagination.js	`(code, message)`	`alwaysPermanent`	`pagination/*`	(no prose comment in source)
`PiplError` framework-error.js	`(code, message)`	`alwaysPermanent`	`pipl/*`	PiplError covers b.pipl config-time misuse (China PIPL cross-border transfer): a malformed sccFilingAssessment / securityAssessmentCertificate opts object, an unknown legalBasis / riskRating enum, an empty required array, a bad recordedAt clock, or a malformed injected audit sink. Permanent — operator configuration, not transient.
`PqcAgentError` pqc-agent.js	`(code, message)`	`alwaysPermanent`	`pqcagent/*`	(no prose comment in source)
`PqcError` pqc-software.js	`(code, message)`	`alwaysPermanent`	`pqc-software/*`	(no prose comment in source)
`PrivacyError` framework-error.js	`(code, message)`	`alwaysPermanent`	`privacy/*`	PrivacyError covers b.privacy config-time misuse: a malformed vendorReview opts object, a non-boolean clause attestation, or an unknown clause key. Permanent — operator configuration, not transient.
`PrivacyPassError` privacy-pass.js	`(code, message)`	`alwaysPermanent`	`privacy-pass/*`	(no prose comment in source)
`ProblemDetailsError` framework-error.js	`(code, message)`	`alwaysPermanent`	`problem-details/*`	ProblemDetailsError — b.problemDetails (lib/problem-details.js). RFC 9457 Problem Details for HTTP APIs builder + validator violations: bad opts at create/respond/validate, type/title/status/detail/ instance shape mismatches, reserved-field collision in extensions, prototype-pollution-shaped extension keys, bad response object at respond(), bad inbound document shape. alwaysPermanent — every case is operator-shape or wire-shape errors that retry will not recover.
`ProblemDetailsError` problem-details.js	`(code, message)`	`alwaysPermanent`	`problem-details/*`	(no prose comment in source)
`ProcessSpawnError` process-spawn.js	`(code, message)`	`alwaysPermanent`	`process-spawn/*`	(no prose comment in source)
`PromisePoolError` promise-pool.js	`(code, message)`	`alwaysPermanent`	`promise-pool/*`	(no prose comment in source)
`ProtocolDispatcherError` protocol-dispatcher.js	`(code, message, permanent, statusCode)`	`withStatusCode`	`protocol-dispatcher/*`	Default error class — operators / test fixtures that don't want to supply their own get this generic shape with the same code namespace.
`ProxyError` network-proxy.js	`(code, message, permanent)`	`default`	`proxy/*`	(no prose comment in source)
`PublicSuffixError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	PublicSuffixError — b.publicSuffix (lib/public-suffix.js). Bad domain input at lookup time (non-string, empty, overlong, control- byte-bearing, IDN-normalization failure) and missing-vendored-data at module-init are both alwaysPermanent — every case is operator- shaped (caller passed garbage) or packaging-shaped (vendored .dat missing). Codes: `public-suffix/invalid-domain`, `public-suffix/not-loaded`.
`PubsubError` pubsub-cluster.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)
`PubsubError` pubsub.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)
`RequireBoundKeyError` middleware/require-bound-key.js	`(code, message)`	`alwaysPermanent`	`require-bound-key/*`	(no prose comment in source)
`RequireContentTypeError` middleware/require-content-type.js	`(code, message)`	`alwaysPermanent`	`require-content-type/*`	(no prose comment in source)
`RequireMethodsError` middleware/require-methods.js	`(code, message)`	`alwaysPermanent`	`require-methods/*`	(no prose comment in source)
`RequireMtlsError` middleware/require-mtls.js	`(code, message)`	`alwaysPermanent`	`require-mtls/*`	(no prose comment in source)
`RequireTlsError` mail-require-tls.js	`(code, message)`	`alwaysPermanent`	`mail-require-tls/*`	(no prose comment in source)
`ResolverError` network-dns-resolver.js	`(code, message)`	`alwaysPermanent`	`resolver/*`	(no prose comment in source)
`ResourceAccessLockError` resource-access-lock.js	`(code, message)`	`alwaysPermanent`	`resource-access-lock/*`	(no prose comment in source)
`RestoreBundleError` restore-bundle.js	`(code, message)`	`alwaysPermanent`	`restore-bundle/*`	(no prose comment in source)
`RestoreRollbackError` restore-rollback.js	`(code, message)`	`alwaysPermanent`	`restore-rollback/*`	(no prose comment in source)
`RetentionError` retention.js	`(code, message)`	`alwaysPermanent`	`retention/*`	(no prose comment in source)
`SafeArchiveError` safe-archive.js	`(code, message)`	`alwaysPermanent`	`safe-archive/*`	(no prose comment in source)
`SafeDecompressError` safe-decompress.js	`(code, message)`	`alwaysPermanent`	`safe-decompress/*`	(no prose comment in source)
`SafeDnsError` safe-dns.js	`(code, message)`	`alwaysPermanent`	`safe-dns/*`	(no prose comment in source)
`SafeIcalError` safe-ical.js	`(code, message)`	`alwaysPermanent`	`safe-ical/*`	(no prose comment in source)
`SafeIcapError` safe-icap.js	`(code, message)`	`alwaysPermanent`	`safe-icap/*`	(no prose comment in source)
`SafeJsonPathError` safe-jsonpath.js	`(code, message)`	`alwaysPermanent`	none harvested	SafeJsonPathError — alwaysPermanent because every code path is a caller-shape error: bad pointer / key / expression / shape. The framework registers the class through defineClass so the unified instanceof FrameworkError check works for callers.
`SafeMimeError` safe-mime.js	`(code, message)`	`alwaysPermanent`	`safe-mime/*`	(no prose comment in source)
`SafeMountInfoError` safe-mount-info.js	`(code, message)`	`alwaysPermanent`	`safe-mount-info/*`	(no prose comment in source)
`SafePathError` safe-path.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`SafeSchemaError` safe-schema.js	`(code, message)`	`alwaysPermanent`	`safe-schema/*`	(no prose comment in source)
`SafeSieveError` safe-sieve.js	`(code, message)`	`alwaysPermanent`	`safe-sieve/*`	(no prose comment in source)
`SafeSmtpError` safe-smtp.js	`(code, message)`	`alwaysPermanent`	`safe-smtp/*`	(no prose comment in source)
`SafeVcardError` safe-vcard.js	`(code, message)`	`alwaysPermanent`	`safe-vcard/*`	(no prose comment in source)
`SanctionsError` compliance-sanctions.js	`(code, message)`	`alwaysPermanent`	`sanctions/*`	(no prose comment in source)
`SanctionsFetcherError` compliance-sanctions-fetcher.js	`(code, message)`	`alwaysPermanent`	`sanctions-fetcher/*`	(no prose comment in source)
`ScittError` scitt.js	`(code, message)`	`alwaysPermanent`	`scitt/*`	(no prose comment in source)
`SdNotifyError` sd-notify.js	`(code, message)`	`alwaysPermanent`	`sd-notify/*`	(no prose comment in source)
`SealPemFileError` vault/seal-pem-file.js	`(code, message)`	`alwaysPermanent`	`seal-pem-file/*`	(no prose comment in source)
`SecCyberError` sec-cyber.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`SecurityAssertError` security-assert.js	`(code, message)`	`alwaysPermanent`	`ASSERT_FAILED/`, `BAD_OPT/`	(no prose comment in source)
`SecurityTxtError` middleware/security-txt.js	`(code, message)`	`alwaysPermanent`	`security-txt/*`	(no prose comment in source)
`ServerTimingError` server-timing.js	`(code, message)`	`alwaysPermanent`	`server-timing/*`	(no prose comment in source)
`SpanHttpError` middleware/span-http-server.js	`(code, message)`	`alwaysPermanent`	`span-http/*`	(no prose comment in source)
`SqlBuilderError` sql.js	`(code, message)`	`alwaysPermanent`	none harvested	Mirrors the in-file error-class convention used by sibling composition modules that subclass FrameworkError directly (safe-sql.js SafeSqlError, cluster-storage.js ClusterStorageError) rather than routing through framework-error.defineClass. An integrator who would rather register it centrally adds
`SrsError` mail-srs.js	`(code, message)`	`alwaysPermanent`	`srs/*`	(no prose comment in source)
`StandardWebhooksError` standard-webhooks.js	`(code, message)`	`alwaysPermanent`	`standard-webhooks/*`	(no prose comment in source)
`StatusListError` auth/status-list.js	`(code, message)`	`alwaysPermanent`	`status-list/*`	(no prose comment in source)
`StreamThrottleError` stream-throttle.js	`(code, message)`	`alwaysPermanent`	`stream-throttle/*`	(no prose comment in source)
`TarError` archive-tar.js	`(code, message)`	`alwaysPermanent`	`archive-tar/*`	(no prose comment in source)
`Tcpa10dlcError` tcpa-10dlc.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`TenantQuotaError` tenant-quota.js	`(code, message)`	`alwaysPermanent`	`tenant-quota/*`	(no prose comment in source)
`TestHarnessError` test-harness.js	`(code, message)`	`alwaysPermanent`	`test-harness/*`	(no prose comment in source)
`TimeError` time.js	`(code, message)`	`alwaysPermanent`	`time/*`	(no prose comment in source)
`TlsRptParseError` mail-deploy.js	`(code, message)`	`alwaysPermanent`	`mail-tlsrpt/*`	(no prose comment in source)
`TlsTrustError` network-tls.js	`(code, message)`	`alwaysPermanent`	`tls/*`	TlsTrustError is a TRUST-verification failure (bad CA/PEM, fingerprint mismatch, OCSP not-good / revoked, CT violation, hostname/PKIX failure, an unreachable OCSP responder). These are ALWAYS permanent: a caller must never silently retry past a trust decision — a transient-looking OCSP-fetch failure is the operator's soft-fail policy to make explicitly, not something a retry loop should paper over. Fail closed.
`TraceLogError` middleware/trace-log-correlation.js	`(code, message)`	`alwaysPermanent`	`trace-log/*`	(no prose comment in source)
`TracePropagateError` middleware/trace-propagate.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`TracerError` observability-tracer.js	`(code, message)`	`alwaysPermanent`	`tracer/*`	(no prose comment in source)
`TracingError` tracing.js	`(code, message)`	`alwaysPermanent`	`tracing/*`	(no prose comment in source)
`TsaError` tsa.js	`(code, message)`	`alwaysPermanent`	`tsa/*`	(no prose comment in source)
`TsigError` network-tsig.js	`(code, message)`	`alwaysPermanent`	`tsig/*`	(no prose comment in source)
`TusError` middleware/tus-upload.js	`(code, message)`	`alwaysPermanent`	`tus/*`	(no prose comment in source)
`UriTemplateError` uri-template.js	`(code, message)`	`alwaysPermanent`	`uri-template/*`	(no prose comment in source)
`VaultAadError` vault-aad.js	`(code, message)`	`alwaysPermanent`	`vault-aad/*`	(no prose comment in source)
`VaultError` vault/index.js	`(code, message)`	`alwaysPermanent`	`vault/*`	VaultError — thrown by init() for fatal boot-time conditions (corrupt sealed file, schema mismatch, mode/state conflicts). The CLI / app entry point catches it and exits; lib code never calls process.exit() unilaterally.
`VaultPassphraseError` vault/passphrase-ops.js	`(code, message)`	`alwaysPermanent`	`vault-passphrase/*`	(no prose comment in source)
`VaultRotateError` vault/rotate.js	`(code, message)`	`alwaysPermanent`	`vault-rotate/*`	(no prose comment in source)
`VcError` vc.js	`(code, message)`	`alwaysPermanent`	`vc/*`	(no prose comment in source)
`VendorDataError` vendor-data.js	`(code, message)`	`alwaysPermanent`	`vendor-data/*`	(no prose comment in source)
`VexError` vex.js	`(code, message)`	`alwaysPermanent`	`vex/*`	(no prose comment in source)
`WebAppManifestError` middleware/web-app-manifest.js	`(code, message)`	`alwaysPermanent`	`manifest/*`	(no prose comment in source)
`WebPushError` web-push-vapid.js	`(code, message)`	`alwaysPermanent`	`web-push/*`	(no prose comment in source)
`WebSocketChannelsError` websocket-channels.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)
`WormError` worm.js	`(code, message)`	`alwaysPermanent`	`worm/*`	(no prose comment in source)
`WsClientError` ws-client.js	`(code, message, permanent)`	`default`	`ws-client/*`	permanent is DERIVED per-error from the code (+ status) at every construction — so err.permanent is a usable terminal/transient signal for a consumer's reconnect loop, not a blanket sentinel. Constructor: (code, message, status).
`XWingError` crypto-xwing.js	`(code, message)`	`alwaysPermanent`	`xwing/*`	(no prose comment in source)
`XmlC14nError` xml-c14n.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)

Protocol #

Class	Constructor	Flags	Code namespaces	Description
`A2aError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	A2aError covers A2A (Agent-to-Agent) protocol violations: signed- agent-card signature mismatch, expired card, unknown card id, malformed card shape, signature-algorithm allowlist drift. Permanent.
`A2aTasksError` a2a-tasks.js	`(code, message)`	`alwaysPermanent`	`a2a-tasks/*`	A2aTasksError is the per-call error class — separate from A2aError (which exists for the card-signing primitives) so operators can catch task-shape errors distinctly.
`AiInputError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	AiInputError covers prompt-injection classifier violations: malformed input shape, classifier-result-shape errors, oversized input bypass. Permanent — caller-shape errors.
`DlpError` framework-error.js	`(code, message)`	`alwaysPermanent`	`redact-dlp/*`	DlpError — outbound DLP scanner refusal raised by b.redact.installOutboundDlp's interceptors when the classifier verdict is "refuse". Permanent; the request body must be operator-corrected before re-attempt rather than retried as-is.
`GraphqlFederationError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	GraphqlFederationError covers _service.sdl trust-boundary violations: missing or malformed router-token, replay (nonce already seen), unauthorized SDL probe. Permanent.
`McpError` framework-error.js	`(code, message)`	`alwaysPermanent`	`mcp/*`	McpError covers Model Context Protocol server-side violations: unauthenticated tool/resource invocations (CVE-2026-33032 nginx-ui auth-bypass class), confused-deputy via static client IDs + dynamic client registration (CVE-2025-6514 mcp-remote OAuth RCE class), consent-cookie leakage, malformed Authorization header, tool/resource name path traversal. Permanent — protocol-shape errors.

Storage #

Class	Constructor	Flags	Code namespaces	Description
`DbError` db.js	`(code, message)`	`alwaysPermanent`	`db/*`	(no prose comment in source)
`DbFileLifecycleError` db-file-lifecycle.js	`(code, message)`	`alwaysPermanent`	`db-file-lifecycle/*`	(no prose comment in source)
`DbQueryError` framework-error.js	`(code, message, permanent)`	`default`	`db-query/*`	DbQueryError covers the local-SQLite query-builder refusal paths (residency write gates, malformed-call shapes). Refusals pass the permanent flag explicitly — a residency mismatch never becomes valid on retry, while the class stays open for transient codes later.
`DbRoleForError` middleware/db-role-for.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`DbscError` dbsc.js	`(code, message)`	`alwaysPermanent`	`dbsc/*`	(no prose comment in source)
`ExternalDbError` framework-error.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)
`ExternalDbMigrateError` external-db-migrate.js	`(code, message)`	`alwaysPermanent`	none harvested	(no prose comment in source)
`LocalDbThinError` framework-error.js	`(code, message)`	`alwaysPermanent`	`localdb-thin/*`	LocalDbThinError — b.localDb.thin lightweight node:sqlite wrapper (lib/local-db-thin.js). Bad opts at create, node:sqlite unavailable on the host Node build, integrity_check failure under recovery: "refuse", recovery-rename I/O failure, post-close handle reuse, bad SQL passed to prepare/run/query. alwaysPermanent — every case is caller-shape misuse or an irrecoverable on-disk condition.
`ObjectStoreError` framework-error.js	`(code, message, permanent, statusCode)`	`withStatusCode`	`objectstore/*`	(no prose comment in source)
`RedisError` framework-error.js	`(code, message, permanent)`	`default`	none harvested	RedisError covers transport (CONNECT/CONNECT_TIMEOUT/SOCKET/WRITE), protocol parsing (PROTOCOL/BAD_URL/BAD_OPTS), command-level (REDIS_REPLY/COMMAND_TIMEOUT), and lifecycle (CLOSED/RECONNECT_GAVE_UP). Transient by default — operators wrap calls in retry/breaker. Bad-opts and bad-URL paths surface as alwaysPermanent code names so retry sees them and skips immediately rather than hammering a misconfig.
`StorageError` framework-error.js	`(code, message, permanent)`	`default`	none harvested	(no prose comment in source)

Transport #

Class	Constructor	Flags	Code namespaces	Description
`MailAgentError` mail-agent.js	`(code, message)`	`alwaysPermanent`	`mail-agent/*`	(no prose comment in source)
`MailArfError` framework-error.js	`(code, message)`	`alwaysPermanent`	`mailarf/*`	MailArfError covers RFC 5965 Abuse Reporting Format ingest failures: missing required Feedback-Type / User-Agent fields, malformed multipart/report, message/feedback-report MIME-type mismatch, parse errors. Permanent — the report shape is operator-supplied input.
`MailAuthError` framework-error.js	`(code, message)`	`alwaysPermanent`	`arc-sign/`, `mail-auth/`	MailAuthError covers SPF / DKIM-verify / DMARC / ARC misuse: bad record shape, fetch failures, missing keys, alignment issues. Permanent — DNS-config / message-shape errors, not transient.
`MailAuthError` mail-arc-sign.js	`(code, message)`	`alwaysPermanent`	`arc-sign/`, `mail-auth/`	(no prose comment in source)
`MailBimiError` framework-error.js	`(code, message)`	`alwaysPermanent`	`bimi/*`	MailBimiError covers RFC 9091 BIMI VMC / CMC chain validation + Tiny-PS SVG profile violations: VMC fetch failures, X.509 chain validation failures, subjectAltName URI / BIMI domain mismatch, missing BIMI policy OID (1.3.6.1.5.5.7.3.31 mark verification), Tiny-PS SVG profile violations (root, version, baseProfile, scripts, external refs, viewBox, byte cap). Permanent — every case is a brand / certificate / asset shape error.
`MailBounceError` mail-bounce.js	`(code, message, permanent, statusCode)`	`withStatusCode`	`mail-bounce/*`	(no prose comment in source)
`MailCryptoError` mail-crypto-pgp.js	`(code, message)`	`alwaysPermanent`	`mail-crypto/*`	(no prose comment in source)
`MailCryptoError` mail-crypto-smime.js	`(code, message)`	`alwaysPermanent`	`mail-crypto/*`	(no prose comment in source)
`MailCryptoError` mail-crypto.js	`(code, message)`	`alwaysPermanent`	`mail-crypto/*`	Both sub-modules define `MailCryptoError` independently (each via
`MailDavError` mail-dav.js	`(code, message)`	`alwaysPermanent`	`mail-dav/*`	(no prose comment in source)
`MailDeployError` mail-deploy.js	`(code, message)`	`alwaysPermanent`	`mail-deploy/`, `mail-tlsrpt/`	(no prose comment in source)
`MailGreylistError` mail-greylist.js	`(code, message)`	`alwaysPermanent`	`mail-greylist/*`	(no prose comment in source)
`MailHeloError` mail-helo.js	`(code, message)`	`alwaysPermanent`	`mail-helo/*`	(no prose comment in source)
`MailJournalError` mail-journal.js	`(code, message)`	`alwaysPermanent`	`mail-journal/*`	(no prose comment in source)
`MailMdnError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	MailMdnError — b.mailMdn (lib/mail-mdn.js). RFC 3798 / RFC 8098 Message Disposition Notification builder + parser violations: bad opts at build/parse, malformed multipart/report shape, missing required fields (Original-Recipient / Final-Recipient / Disposition), disposition / action-mode / sending-mode token allowlist drift, auto-generation refusal when the inbound message demanded user confirmation (RFC 3798 §2.1) and the operator did not opt in. alwaysPermanent — every case is operator-shape or message-shape errors that retry will not recover.
`MailRblError` mail-rbl.js	`(code, message)`	`alwaysPermanent`	`mail-rbl/*`	(no prose comment in source)
`MailScanError` mail-scan.js	`(code, message)`	`alwaysPermanent`	`mail-scan/*`	(no prose comment in source)
`MailServerImapError` mail-server-imap.js	`(code, message)`	`alwaysPermanent`	`mail-server-imap/*`	(no prose comment in source)
`MailServerJmapError` mail-server-jmap.js	`(code, message)`	`alwaysPermanent`	`mail-server-jmap/`, `urn:ietf:params:jmap:error:/`, `urn:ietf:params:jmap:error:invalidArguments/`, `urn:ietf:params:jmap:error:invalidResultReference/`	(no prose comment in source)
`MailServerManageSieveError` mail-server-managesieve.js	`(code, message)`	`alwaysPermanent`	`mail-server-managesieve/*`	(no prose comment in source)
`MailServerMxError` mail-server-mx.js	`(code, message)`	`alwaysPermanent`	`mail-server-mx/*`	(no prose comment in source)
`MailServerPop3Error` mail-server-pop3.js	`(code, message)`	`alwaysPermanent`	`mail-server-pop3/*`	(no prose comment in source)
`MailServerRateLimitError` mail-server-rate-limit.js	`(code, message)`	`alwaysPermanent`	`mail-server-rate-limit/*`	(no prose comment in source)
`MailServerRegistryError` mail-server-registry.js	`(code, message)`	`alwaysPermanent`	`mail-server-registry/*`	(no prose comment in source)
`MailServerSubmissionError` mail-server-submission.js	`(code, message)`	`alwaysPermanent`	`mail-server-submission/*`	(no prose comment in source)
`MailServerTlsError` mail-server-tls.js	`(code, message)`	`alwaysPermanent`	`mail-server-tls/*`	(no prose comment in source)
`MailSieveError` mail-sieve.js	`(code, message)`	`alwaysPermanent`	`mail-sieve/*`	(no prose comment in source)
`MailSpamScoreError` mail-spam-score.js	`(code, message)`	`alwaysPermanent`	`mail-spam-score/*`	(no prose comment in source)
`MailStoreError` mail-store.js	`(code, message)`	`alwaysPermanent`	`mail-store/*`	(no prose comment in source)
`MailUnsubscribeError` framework-error.js	`(code, message)`	`alwaysPermanent`	`mailunsubscribe/*`	MailUnsubscribeError — b.mail.unsubscribe (lib/mail-unsubscribe.js). RFC 8058 / RFC 2369 / RFC 2919 List-* header builder violations: non-https URL in url/help/archive, non-mailto in mailto/owner, invalid list-id shape per RFC 2919 §3, control bytes / over-length header values. alwaysPermanent — every case is operator-misconfig at config-time the framework refuses to coerce.
`SmtpPolicyError` framework-error.js	`(code, message)`	`alwaysPermanent`	`smtp/*`	SmtpPolicyError covers MTA-STS / DANE / TLS-RPT misuse: bad-policy shape, fetch failures, TLSA-record format errors, missing records. Permanent — these are policy / DNS configuration errors, not transient.
`SseError` framework-error.js	`(code, message)`	`alwaysPermanent`	none harvested	SseError covers Server-Sent Events stream-shape violations: newline or CR or NUL injection in event:/id:/data: fields (CVE-2026-33128 h3, CVE-2026-29085 Hono, CVE-2026-44217 sse-channel — newline in any of the three fields enables event-spoofing, data-injection, or Last-Event-ID reconnect corruption), control-char injection in retry: numeric, oversized field caps, attempts to write after stream close. Permanent — these are caller-shape errors.

Dynamic codes

Construction sites that pass a non-literal first argument (template strings, variables) are intentionally not harvested — the catalog only records statically-resolvable code namespaces. Per-primitive wiki pages document the full code surface.

Last updated 2026-08-08T16:39:49.652Z by seeder.