@onlineapps/service-common 2.0.1 → 3.0.1

package/src/reporting/monitoringFallbackEmail.js

@@ -2,10 +2,20 @@
 
 const nodemailer = require('nodemailer');
 const runtimeCfg = require('../config');
+const { assertLogger } = require('@onlineapps/logger-contract');
 
 let transporter = null;
 let cachedConfigSignature = null;
 
+/**
+ * The lowest and highest SMTP reply code that means "try again later"
+ * (RFC 5321 §4.2.1: a 4yz reply is a transient negative completion, a 5yz reply
+ * is permanent). These are protocol constants, not configuration — the relay
+ * does not get to redefine what `421` means.
+ */
+const TRANSIENT_REPLY_MIN = 400;
+const TRANSIENT_REPLY_MAX = 499;
+
 function loadConfig() {
   return {
     host: runtimeCfg.get('infraReportSmtpHost'),
@@ -14,10 +24,36 @@ function loadConfig() {
     user: runtimeCfg.get('infraReportSmtpUser'),
     pass: runtimeCfg.get('infraReportSmtpPass'),
     from: runtimeCfg.get('infraReportFrom'),
-    to: runtimeCfg.get('infraReportTo')
+    to: runtimeCfg.get('infraReportTo'),
+    maxConnections: runtimeCfg.get('infraReportSmtpMaxConnections'),
+    maxMessages: runtimeCfg.get('infraReportSmtpMaxMessages'),
+    rateDeltaMs: runtimeCfg.get('infraReportSmtpRateDeltaMs'),
+    rateLimit: runtimeCfg.get('infraReportSmtpRateLimit'),
+    maxAttempts: runtimeCfg.get('infraReportSmtpMaxAttempts'),
+    retryDelayMs: runtimeCfg.get('infraReportSmtpRetryDelayMs')
   };
 }
 
+/**
+ * Is this refusal the relay saying "later", or "never"?
+ *
+ * Only a real reply code answers that. An error without one — a socket that
+ * died, a TLS handshake that failed — is NOT guessed to be temporary: a retry
+ * then spends the relay's auth-rate budget on something the relay never said.
+ *
+ * @param {Error} error - The error nodemailer rejected with
+ * @returns {boolean} true when the relay replied 4yz
+ */
+function isTemporaryRefusal(error) {
+  return Number.isInteger(error.responseCode)
+    && error.responseCode >= TRANSIENT_REPLY_MIN
+    && error.responseCode <= TRANSIENT_REPLY_MAX;
+}
+
+function wait(delayMs) {
+  return new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+
 function createTransportIfNeeded(config) {
   const signature = JSON.stringify(config);
   if (transporter && cachedConfigSignature === signature) {
@@ -32,6 +68,34 @@ function createTransportIfNeeded(config) {
     host: config.host,
     port: config.port,
     secure: config.secure,
+    // The relay runs `smtpd_tls_security_level = may`: it OFFERS STARTTLS and
+    // does not insist. Without this flag nodemailer does not insist either, so a
+    // relay that stops advertising STARTTLS — a downgrade, a misconfiguration,
+    // someone in the middle — gets `AUTH PLAIN <base64>` on a clear socket and
+    // the account is gone. With it, that send is refused instead.
+    //
+    // Set unconditionally. On implicit TLS (`secure: true`, port 465) the
+    // channel is already encrypted and the flag changes nothing, and there is
+    // deliberately no "only in production" branch: behaviour that depends on
+    // NODE_ENV is what `architecture-principles.md` §8 forbids, and the dev
+    // relay carries a real password too.
+    requireTLS: true,
+    // One connection shared by the whole burst, instead of one TCP+TLS+AUTH per
+    // mail. Measured 2026-09-11 (INFRA-monitoring): seven `service_down`
+    // episodes in one second opened seven connections, the relay answered
+    // `421 4.7.0 … too many connections` 18×, and 12 alerts were never
+    // delivered. The relay's own limits are 20 connections / 10 AUTH per 60 s
+    // (confirmation `alert-smtp-relay` 003 § Conditions), so the burst, not the
+    // volume, is what breaks: pooling turns N authentications into one.
+    //
+    // Every value is a declared config key with an owner default derived from
+    // those limits — see ../defaults.js. No literal here, and no
+    // environment-dependent branch (`architecture-principles.md` §8).
+    pool: true,
+    maxConnections: config.maxConnections,
+    maxMessages: config.maxMessages,
+    rateDelta: config.rateDeltaMs,
+    rateLimit: config.rateLimit,
     auth: {
       user: config.user,
       pass: config.pass
@@ -41,45 +105,116 @@ function createTransportIfNeeded(config) {
   return transporter;
 }
 
-async function sendMonitoringFailFallbackEmail(subject, text, html) {
+/**
+ * Send the monitoring fallback email.
+ *
+ * Every outcome is swallowed into the boolean return, so the injected logger is
+ * the only record of what this channel — the last one left when monitoring is
+ * down — actually did (confirmation 001, 002, 003).
+ *
+ * @param {string} subject - Mail subject
+ * @param {string} text - Plain-text body
+ * @param {string} html - HTML body
+ * @param {Object} logger - Logger with info/warn/error/debug (required)
+ * @returns {Promise<boolean>} true when the mail was handed to the SMTP server
+ */
+async function sendMonitoringFailFallbackEmail(subject, text, html, logger) {
+  const log = assertLogger(
+    'sendMonitoringFailFallbackEmail',
+    logger,
+    'the outcome of the last reporting channel is not swallowed with its boolean'
+  );
+
   const config = loadConfig();
+
+  // Fail-fast at method entry (`architecture-principles.md` §4): a bound below
+  // one is not "no retries", it is a loop that never sends. It cannot happen
+  // with the owner default, only with an explicitly configured value, so it is a
+  // deployment defect and is raised as one rather than swallowed into the
+  // boolean — the caller (`api_monitoring` alerting) records it as the reason.
+  if (!Number.isInteger(config.maxAttempts) || config.maxAttempts < 1) {
+    throw new Error(
+      '[MonitoringFallbackEmail] Invalid retry bound - ' +
+        `INFRA_REPORT_SMTP_MAX_ATTEMPTS must be an integer >= 1, got "${config.maxAttempts}". ` +
+        'Fix: set INFRA_REPORT_SMTP_MAX_ATTEMPTS in env-active/*.env, or unset it to use the owner default.'
+    );
+  }
+
   const mailer = createTransportIfNeeded(config);
 
   if (!mailer) {
-    console.warn('[MonitoringFallbackEmail] SMTP configuration missing, skipping email send');
+    // Presence only — the SMTP password must never reach a log line.
+    log.warn('[MonitoringFallbackEmail] SMTP configuration missing, skipping send', {
+      hasHost: Boolean(config.host),
+      hasPort: Boolean(config.port),
+      hasUser: Boolean(config.user),
+      hasPass: Boolean(config.pass),
+      hasFrom: Boolean(config.from),
+      hasTo: Boolean(config.to)
+    });
     return false;
   }
 
   const recipients = config.to.split(',').map(addr => addr.trim()).filter(Boolean);
   if (recipients.length === 0) {
-    console.warn('[MonitoringFallbackEmail] No recipients configured in INFRA_REPORT_TO');
+    log.warn('[MonitoringFallbackEmail] No recipients configured', { envKey: 'INFRA_REPORT_TO' });
     return false;
   }
 
-  try {
-    const result = await mailer.sendMail({
-      from: config.from,
-      to: recipients,
-      subject,
-      text,
-      html
-    });
-    console.log('[MonitoringFallbackEmail] Email sent successfully', {
-      messageId: result.messageId,
-      response: result.response,
-      accepted: result.accepted,
-      rejected: result.rejected
-    });
-    return true;
-  } catch (error) {
-    console.error('[MonitoringFallbackEmail] Failed to send email:', {
-      message: error.message,
-      code: error.code,
-      command: error.command,
-      response: error.response,
-      responseCode: error.responseCode
-    });
-    return false;
+  // A temporary refusal is re-tried HERE, by the transport, and the caller is
+  // told once — `delivery-mail-channel` 001 point 5: "retry is layered, not
+  // doubled … a refused send is the mail service's provider retry". For the
+  // alert channel this module IS the mail service, so a second retry loop in
+  // the monitoring consumer would be the doubling that entry forbids; what the
+  // consumer records (`notification_sent`) is this function's single verdict.
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      const result = await mailer.sendMail({
+        from: config.from,
+        to: recipients,
+        subject,
+        text,
+        html
+      });
+      log.info('[MonitoringFallbackEmail] Email sent', {
+        messageId: result.messageId,
+        response: result.response,
+        accepted: result.accepted,
+        rejected: result.rejected,
+        attempts: attempt
+      });
+      return true;
+    } catch (error) {
+      const retryable = isTemporaryRefusal(error) && attempt < config.maxAttempts;
+
+      if (!retryable) {
+        log.error('[MonitoringFallbackEmail] Email send failed', {
+          reason: error.message,
+          code: error.code,
+          command: error.command,
+          response: error.response,
+          responseCode: error.responseCode,
+          attempts: attempt
+        });
+        return false;
+      }
+
+      // Doubling backoff from the configured delay, which is itself the relay's
+      // tightest documented spacing (60 000 / 10 AUTH per minute = 6 s).
+      // Doubling only widens it, so the retries can never be the thing that
+      // trips the limit they exist to survive.
+      const delayMs = config.retryDelayMs * 2 ** (attempt - 1);
+      log.warn('[MonitoringFallbackEmail] Temporary SMTP refusal, retrying', {
+        reason: error.message,
+        code: error.code,
+        response: error.response,
+        responseCode: error.responseCode,
+        attempt,
+        maxAttempts: config.maxAttempts,
+        retryInMs: delayMs
+      });
+      await wait(delayMs);
+    }
   }
 }
 

package/src/runtime-config.js

@@ -12,37 +12,165 @@
 const runtimeCfg = require('./config');
 const { createRuntimeConfig } = require('@onlineapps/runtime-config');
 
+/** A bare env file name: `shared.env`, `monitoring.env`. No directory, no other suffix. */
+const ENV_FILE_PATTERN = /^[A-Za-z0-9._-]+\.env$/;
+
+/**
+ * Where an operator is told to set the key.
+ *
+ * With an owning file the sentence names it; without one it is the sentence
+ * `architecture-principles.md` §5 prescribes verbatim. The generic form is not a
+ * fallback for a missing input — it is the contract's own wording for a key
+ * whose file the call site did not name.
+ *
+ * The file is an INPUT and never a derivation. `api/config/shared-env.json` owns
+ * the platform's shared key set, but only build-time tooling reads it
+ * (`oa-sync-template shared-env`); it is absent from a service's runtime, and a
+ * library hunting for it through `__dirname`/cwd would break principle 1. So the
+ * call site names the file, and the declaration remains the authority that
+ * review checks the call site against.
+ *
+ * @param {string} [file] - bare env file name, already validated
+ * @returns {string} the location half of a `Fix:` sentence
+ */
+function whereToSet(file) {
+  return file ? `config/env-active/${file}` : 'env-active/*.env (or pass explicit config)';
+}
+
+/**
+ * Validate `options.file` at method entry — a typo must fail on the happy path
+ * too, not only the day the variable goes missing (principle 4, fail-fast).
+ *
+ * @param {object} options - caller options
+ * @returns {string|undefined} the validated file name
+ */
+function owningFileOf(options) {
+  const file = options && options.file;
+  if (file === undefined || file === null) return undefined;
+  if (typeof file !== 'string' || !ENV_FILE_PATTERN.test(file)) {
+    throw new Error(
+      '[ServiceConfig] Invalid options.file - expected a bare env file name such as '
+      + `"shared.env", got: "${file}". Fix: pass the file name alone; the helper writes `
+      + 'the config/env-active/ prefix.'
+    );
+  }
+  return file;
+}
+
 /**
  * Resolve arbitrary environment variables through runtime-config (no direct process.env access).
  * Note: Prefer module schema keys (runtimeCfg.get) over these generic helpers.
+ *
+ * The `Fix:` half of the message is composed HERE, for every caller. Until d.399
+ * it was not: the helper appended only `description`, so the sentence
+ * `architecture-principles.md` §5 requires appeared exactly where a caller had
+ * typed it into that description by hand — six call sites in
+ * `infra/api_delivery_endpoint/src/config.js`, and nowhere else. A rule that
+ * holds only where somebody remembered it is enforced by review, not by a
+ * mechanism (`automation-gates.md` §5).
+ *
+ * @param {string} name - Environment variable name
+ * @param {string} [description] - Human-readable description for error messages
+ * @param {{file?: string}} [options] - `file`: the env file that owns this key,
+ *   as a bare name (`shared.env`); the message writes the `config/env-active/`
+ *   prefix itself
+ * @returns {string} Value resolved by `@onlineapps/runtime-config`
+ * @throws {Error} If the variable is missing, or `options.file` is malformed
  */
-function requireEnv(name, description) {
+function requireEnv(name, description, options) {
+  const file = owningFileOf(options);
+  // Klíč schématu je jméno proměnné, ne interní `value`. Resolver jiné jméno
+  // klíče nezná, a co mu helper předá, to napíše do hlášky: do d.466b psal
+  // `Invalid number value for "value"`, takže z hlášky nešlo přečíst, který klíč
+  // je špatně (INFRA, kaskáda 2026-09-15). Zdejší kolej žádné jiné jméno nemá —
+  // helper dostává proměnnou, ne konfigurační klíč — a vymyslet mu jméno by
+  // znamenalo psát do hlášky fakt, který nikdo nedeklaroval.
   const cfg = createRuntimeConfig({
     defaults: {},
-    schema: { value: { env: name, required: true } },
+    schema: { [name]: { env: name, required: true } },
   });
   try {
-    return cfg.get('value');
+    return cfg.get(name);
   } catch (err) {
-    const hint = description ? ` ${description}` : '';
-    throw new Error(`[ServiceConfig] Missing environment variable - ${name} is required.${hint}`.trim());
+    // Jeden šablonový literál, ne skládání polem: statická sonda
+    // `tests/unit/error-message-contract.test.js` čte zprávu ze zdroje, a
+    // hlášku, kterou si nepřečte, hlásí jako bezkontextovou — mechanismus, který
+    // nevidí, není mechanismus (`automation-gates.md` §5).
+    const hint = description ? `${description} ` : '';
+    throw new Error(
+      `[ServiceConfig] Missing environment variable - ${name} is required. ${hint}`
+      + `Fix: set ${name} in ${whereToSet(file)}.`
+    );
   }
 }
 
 /**
- * Require a numeric environment variable (fail-fast, no default).
+ * Read a required environment variable through the resolver with a declared type.
+ *
+ * The missing-variable contract stays with `requireEnv` — all four required
+ * helpers in this file report an absent variable with the same sentence, so the
+ * operator reads one shape regardless of which type the key has. Coercion has
+ * exactly one owner, `@onlineapps/runtime-config`, and so does the message for a
+ * malformed value: a second parser here would be a second definition of what a
+ * number is (`.claude/rules/change-discipline.md` § One rail per concern).
+ *
  * @param {string} name - Environment variable name
  * @param {string} description - Human-readable description for error messages
- * @returns {number} Parsed number
- * @throws {Error} If variable is missing or not a valid number
+ * @param {'number'|'float'} type - Resolver type that owns the coercion
+ * @returns {number} Value coerced by the resolver
+ * @private
  */
-function requireNumberEnv(name, description) {
-  const raw = requireEnv(name, description);
-  const num = Number(raw);
-  if (isNaN(num)) {
-    throw new Error(`[ServiceConfig] ${name} must be a number, got: "${raw}"`);
-  }
-  return num;
+function requireTypedEnv(name, description, type, options) {
+  requireEnv(name, description, options);
+  // `file` dojde až do schématu: hlášku o vadné hodnotě skládá resolver a bez
+  // deklarace nemá odkud vzít místo, kam má operátor sáhnout. Do d.466b se
+  // `options.file` použil jen na větu o CHYBĚJÍCÍ proměnné a pro vadnou hodnotu
+  // se zahodil, ačkoli obě věty mluví o témž klíči v témž souboru.
+  const file = owningFileOf(options);
+  const cfg = createRuntimeConfig({
+    defaults: {},
+    schema: { [name]: { env: name, required: true, type, ...(file ? { file } : {}) } },
+  });
+  return cfg.get(name);
+}
+
+/**
+ * Require a WHOLE-number environment variable (fail-fast, no default).
+ *
+ * Every platform key reading through this helper is a port, a count, a budget
+ * or a millisecond/second/minute interval — a fraction there is a configuration
+ * error, not something to round. A key that is genuinely fractional (a ratio, a
+ * factor) has its own rail: {@link requireFloatEnv}.
+ *
+ * The strictness itself lives in the resolver and follows its pin: up to
+ * `@onlineapps/runtime-config` 1.0.3 a fractional value is still truncated by
+ * `parseInt`, from the d.253 release it is refused.
+ *
+ * @param {string} name - Environment variable name
+ * @param {string} description - Human-readable description for error messages
+ * @returns {number} Whole number as resolved by `@onlineapps/runtime-config`
+ * @throws {Error} If the variable is missing, or its value is not a whole number
+ */
+function requireNumberEnv(name, description, options) {
+  return requireTypedEnv(name, description, 'number', options);
+}
+
+/**
+ * Require a FRACTIONAL environment variable (fail-fast, no default).
+ *
+ * For keys whose value is a ratio or a factor rather than a count — e.g. a
+ * completion ratio in `0.0-1.0`. Using {@link requireNumberEnv} for such a key
+ * loses the fraction (and, once the whole-number resolver is pinned, stops the
+ * boot), so the choice between the two rails is a property of the key and
+ * belongs at the call site.
+ *
+ * @param {string} name - Environment variable name
+ * @param {string} description - Human-readable description for error messages
+ * @returns {number} Fractional number as resolved by `@onlineapps/runtime-config`
+ * @throws {Error} If the variable is missing, or its value is not a number
+ */
+function requireFloatEnv(name, description, options) {
+  return requireTypedEnv(name, description, 'float', options);
 }
 
 /**
@@ -53,10 +181,13 @@ function requireNumberEnv(name, description) {
  * @returns {boolean} Parsed boolean
  * @throws {Error} If variable is missing or not "true"/"false"
  */
-function requireBoolEnv(name, description) {
-  const raw = requireEnv(name, description);
+function requireBoolEnv(name, description, options) {
+  const raw = requireEnv(name, description, options);
   if (raw !== 'true' && raw !== 'false') {
-    throw new Error(`[ServiceConfig] ${name} must be "true" or "false", got: "${raw}"`);
+    throw new Error(
+      `[ServiceConfig] ${name} must be "true" or "false" - got: "${raw}". `
+      + `Fix: set ${name} to the literal true or false in ${whereToSet(owningFileOf(options))}.`
+    );
   }
   return raw === 'true';
 }
@@ -71,9 +202,9 @@ function requireBoolEnv(name, description) {
 function optionalEnv(name, defaultValue) {
   const cfg = createRuntimeConfig({
     defaults: {},
-    schema: { value: { env: name, default: defaultValue } },
+    schema: { [name]: { env: name, default: defaultValue } },
   });
-  return cfg.get('value');
+  return cfg.get(name);
 }
 
 /**
@@ -85,9 +216,9 @@ function optionalEnv(name, defaultValue) {
 function optionalNumberEnv(name, defaultValue) {
   const cfg = createRuntimeConfig({
     defaults: {},
-    schema: { value: { env: name, default: defaultValue, type: 'number' } },
+    schema: { [name]: { env: name, default: defaultValue, type: 'number' } },
   });
-  return cfg.get('value');
+  return cfg.get(name);
 }
 
 /**
@@ -104,17 +235,6 @@ function getCriticalConfig() {
   };
 }
 
-/**
- * Get critical infrastructure configuration with fallbacks
- *
- * Strict mode: This function is kept for compatibility but DOES NOT provide fallbacks.
- * Topology is FAIL-FAST (no defaults).
- * @returns {Object} Critical infrastructure config with fallbacks
- */
-function getCriticalConfigWithFallbacks() {
-  return getCriticalConfig();
-}
-
 /**
  * Get infrastructure health configuration with defaults
  * @returns {Object} Infrastructure health config
@@ -126,7 +246,6 @@ function getInfrastructureHealthConfig() {
     waitMaxTime: runtimeCfg.get('infrastructureHealthWaitMaxTimeMs'),
     waitCheckInterval: runtimeCfg.get('infrastructureHealthWaitCheckIntervalMs'),
     healthCheckTimeout: runtimeCfg.get('infrastructureHealthTimeoutMs'),
-    redisKeyTTL: runtimeCfg.get('infrastructureHealthRedisTtlSeconds'),
     cleanupInterval: runtimeCfg.get('infrastructureHealthCleanupIntervalMs'),
     queueWaitMaxTime: runtimeCfg.get('infrastructureHealthQueueWaitMaxTimeMs'),
     queueWaitCheckInterval: runtimeCfg.get('infrastructureHealthQueueWaitCheckIntervalMs'),
@@ -136,11 +255,11 @@ function getInfrastructureHealthConfig() {
 module.exports = {
   requireEnv,
   requireNumberEnv,
+  requireFloatEnv,
   requireBoolEnv,
   optionalEnv,
   optionalNumberEnv,
   getCriticalConfig,
-  getCriticalConfigWithFallbacks,
   getInfrastructureHealthConfig
 };
 

package/src/errors/BusinessError.js

@@ -1,118 +0,0 @@
-'use strict';
-
-// See: docs/biz/70-contracts/error-handling.md
-const ERROR_TYPES = {
-  TRANSIENT: 'TRANSIENT',
-  BUSINESS: 'BUSINESS',
-  FATAL: 'FATAL',
-  VALIDATION: 'VALIDATION',
-  TIMEOUT: 'TIMEOUT',
-  RATE_LIMIT: 'RATE_LIMIT',
-  UNKNOWN: 'UNKNOWN'
-};
-
-class BusinessError extends Error {
-  constructor(message, { statusCode = 500, errorCode = 'INTERNAL_ERROR', type = 'BUSINESS', details = [], operation = null, service = null } = {}) {
-    super(message);
-    this.name = this.constructor.name;
-    this.statusCode = statusCode;
-    this.errorCode = errorCode;
-    this.type = type;
-    this.details = Array.isArray(details) ? details : [details];
-    this.operation = operation || null;
-    this.service = service || process.env.SERVICE_NAME || null;
-  }
-
-  toJSON() {
-    return {
-      code: this.errorCode,
-      message: this.message,
-      statusCode: this.statusCode,
-      details: this.details.length > 0 ? this.details : undefined,
-      service: this.service || undefined,
-      operation: this.operation || undefined
-    };
-  }
-}
-
-class NotFoundError extends BusinessError {
-  constructor(message, options = {}) {
-    super(message, {
-      statusCode: 404,
-      errorCode: options.errorCode || 'RESOURCE_NOT_FOUND',
-      type: ERROR_TYPES.BUSINESS,
-      ...options
-    });
-  }
-}
-
-class ValidationError extends BusinessError {
-  constructor(message, options = {}) {
-    super(message, {
-      statusCode: 400,
-      errorCode: options.errorCode || 'VALIDATION_FAILED',
-      type: ERROR_TYPES.VALIDATION,
-      ...options
-    });
-  }
-}
-
-class ConflictError extends BusinessError {
-  constructor(message, options = {}) {
-    super(message, {
-      statusCode: 409,
-      errorCode: options.errorCode || 'DUPLICATE_RESOURCE',
-      type: ERROR_TYPES.BUSINESS,
-      ...options
-    });
-  }
-}
-
-class BusinessRuleError extends BusinessError {
-  constructor(message, options = {}) {
-    super(message, {
-      statusCode: 422,
-      errorCode: options.errorCode || 'BUSINESS_RULE_VIOLATED',
-      type: ERROR_TYPES.VALIDATION,
-      ...options
-    });
-  }
-}
-
-class AuthorizationError extends BusinessError {
-  constructor(message, options = {}) {
-    super(message, {
-      statusCode: 403,
-      errorCode: options.errorCode || 'FORBIDDEN',
-      type: ERROR_TYPES.BUSINESS,
-      ...options
-    });
-  }
-}
-
-class ServiceUnavailableError extends BusinessError {
-  constructor(message, options = {}) {
-    super(message, {
-      statusCode: 503,
-      errorCode: options.errorCode || 'SERVICE_UNAVAILABLE',
-      type: ERROR_TYPES.TRANSIENT,
-      ...options
-    });
-  }
-}
-
-function isBusinessError(error) {
-  return error instanceof BusinessError;
-}
-
-module.exports = {
-  BusinessError,
-  NotFoundError,
-  ValidationError,
-  ConflictError,
-  BusinessRuleError,
-  AuthorizationError,
-  ServiceUnavailableError,
-  isBusinessError,
-  ERROR_TYPES
-};