@sema-agent/sdk 23.1.0 → 25.0.0

package/dist/errors.js

@@ -37,6 +37,7 @@ function extraOf(body) {
 export class APIError extends Error {
     status;
     errorCode;
+    name = "APIError";
     /**
      * 🔴 **错误体上 `error` / `errorCode` 之外的全部键,原样**(K-09 销账,SDK 11.1.0)。`{}` = 这条体上
      * 没有附加键(**不是** `undefined`:「没有附加材料」只该有一种读法)。
@@ -52,7 +53,7 @@ export class APIError extends Error {
      *
      * ⚠️ 既有的具名位({@link retriable}、`retryAfterMs`、各子类的结构化字段)是**先于本格存在**的镜像,
      * 值来自同一张体 —— 它们不因本格而改变,新键也不再因此长出第 N 个属性。例外只由票面裁定开出,开了也仍同在本格:
-     * 现有一例 = K-19 `ParkedResumeStartupError.startupCause`(wire 键 `cause`;跨仓请托 [8537] / 认领 [8539] 点名要一个具型的读位;23.0.0 起是引擎五词闭集
+     * 现有一例 = K-19 `ParkedResumeStartupError.startupCause`(wire 键 `cause`;跨仓请托 [8537] / 认领 [8539] 点名要一个具型的读位;23.0.0 起是引擎的成因闭集(core 7.52.0 起六词)
      * `ResumeStartupCause`;值仍原样在 `extra.cause`)。
      * ⚠️ **未清洗**:`message` 是给人看/进日志的那一半,过 `scrub()`;本格是给机器分支的那一半,原样透传
      * (是 server 契约里的机读键,不是自由文本)。要把它打进日志的调用方自己负责清洗。
@@ -83,6 +84,11 @@ export class APIError extends Error {
      *  🔴 **server ≥7.124.0:这一码的体多两只版本键** `writerVersion` / `readerVersion`(每个铸点同律 —— core 原码镜像与 server 自铸的两只读法记号拒都带;形见
      *  {@link CheckpointUnsupportedVersionExtra},值经 {@link extra} 到达)。「停驻行的格式比本引擎新」只有这一个来源:`writerVersion` 比 `readerVersion` 新 ⇒ 回到那一版(或更新的一版)去决,不是在本引擎上重试。
      *
+     *  🔴 **server ≥7.132.0 一只写点、一条律**:三类续跑拒(server 重放存量体前的拒、准入策略折叠 `resume_blocked_by_policy`、引擎拒的续跑)上 `retriable: true` 在场 ⇔ **有一张待批卡仍在等、
+     *  run 行留 `suspended`**(server `resumeRefusalWithCard` 一处追加,排在体尾)。由此两处订正:① `resume_blocked_by_policy` 自 7.132.0 起**同带** `retriable: true`(卡同样仍 pending;此前不带);
+     *  ② **终态 run 的 `POST /v1/runs/:id/steer` 在铸唤醒卡之前拒的路径不带它**(没有卡)—— `checkpoint.unsupported_version` 的 allow 读法 / 模式词读法两臂在那条路径上此前自述 `true`,是错的。
+     *  同批:引擎拒的续跑体多三只判别位 `blockedBy` / `field` / `reason`(加性,见 {@link ResumeRefusalExtra});体键序变(`taskId` 移到 `errorCode` 之后、`retriable` 在体尾,键集不变)。
+     *
      *  🔴 `undefined` means "the server did not say", NOT "not retriable" — it is a CONDITIONAL field server-side
      *  (absent ⇒ key omitted), so reading its absence as an explicit `false` over-reads the wire.
      *
@@ -94,7 +100,6 @@ export class APIError extends Error {
         super(message);
         this.status = status;
         this.errorCode = errorCode;
-        this.name = new.target.name;
     }
 }
 /** `auth.*` 前缀族 + 401 状态兜底 —— fail-closed auth(缺/错 SERVICE_AUTH_TOKEN、非属主、
@@ -108,6 +113,7 @@ export class APIError extends Error {
  *  🔴 [2400] CB-3(SDK 4.2.0):状态兜底**只剩 401**。无码 503 已改归 {@link ServiceStateError} —— 那条臂
  *  上真正可达的是中间层的无码 503(「上游暂时不可用」),把它铸成本类等于把「稍后重试」说成「你没权限」。 */
 export class AuthError extends APIError {
+    name = "AuthError";
 }
 // ── 附录 A 判据三:稳定前缀族的兜底 typed 面(SDK 1.1.0 × server 3.0.0 起 11 族;server 7.106.0 契约现行 14 族)────────
 // 服务端契约原文(ASSISTANT-WIRE-CONTRACT 附录 A 判据三,server 7.106.0):「前缀族(`auth.` / `request.` /
@@ -195,17 +201,18 @@ export class AuthError extends APIError {
  *  (体里同时还有别的毛病而先撞上的是那一个时,`message` 说那个毛病、`field` 照带)。要「去掉这只键重发」的调用方按**码 + `err.extra.field`** 判,**别解析句子**
  *  (三口的句子在 7.119.0 收成逐字同一句,≤7.118.x 各说各的)。体里没有这只键的坏体**没有** `field`。本类不为它开具名属性(同上:开形一格)。 */
 export class BadRequestError extends APIError {
+    name = "BadRequestError";
 }
 /** [2420] `attachment.*` 族(上传面拒收):`attachment.too_large`(413)携 {@link maxBytes},
  *  `attachment.mime_not_allowed`(415)携 {@link allowed}——两键是用户能改正的唯一量(压到多大/换什么类型)。 */
 export class AttachmentRejectedError extends APIError {
     maxBytes;
     allowed;
+    name = "AttachmentRejectedError";
     constructor(status, errorCode, message, maxBytes, allowed) {
         super(status, errorCode, message);
         this.maxBytes = maxBytes;
         this.allowed = allowed;
-        this.name = "AttachmentRejectedError";
     }
 }
 /** `not_found.*` 前缀族 —— 资源不存在。⚠️ 也包含**属主门**:server 对非属主一律回 404 同码同文
@@ -229,12 +236,14 @@ export class AttachmentRejectedError extends APIError {
  *  反枚举不变式),永远走不到这两个码 —— 所以它们泄漏的全部信息是「**你自己**这条 run 的状态」,
  *  而那本来就是 `runs.get(taskId)` 直答的东西。 */
 export class NotFoundError extends APIError {
+    name = "NotFoundError";
 }
 /** `limit.*` 前缀族 —— 配额 / 限流 / 保留窗(429 限流与成本配额、416 续读点过保留窗)。
  *  `retryAfterMs` 来自 `Retry-After` 头(由 transport 喂入)。
  *  ⚠️ 429 那两个成员码({@link RateLimitedError} 起)走更具体的子类,见下。 */
 export class LimitExceededError extends APIError {
     retryAfterMs;
+    name = "LimitExceededError";
     constructor(status, errorCode, message, retryAfterMs) {
         super(status, errorCode, message);
         this.retryAfterMs = retryAfterMs;
@@ -253,6 +262,7 @@ export class LimitExceededError extends APIError {
  *  `capability.snapshot_store_required`(history blob GET)· `capability.policy_purge_required`(同步整族,嵌入方形)。**唯一登记例外**:`a2aServe` 的两条路由不可用时答 404(反指纹)。
  *  ⚠️ **按状态码判「没权限 / 不存在 / 不可用」的分支要改按 `errorCode`**:403 可能是「不在名单」也可能(≤7.115.x)是名单空;404 可能是「真不存在」也可能(≤7.115.x)是「这台没挂这一族」。 */
 export class CapabilityUnavailableError extends APIError {
+    name = "CapabilityUnavailableError";
 }
 /** `feature.*` 前缀族 —— **面存在,但开关是关的**(501;`feature.metrics_disabled` 是 404)。
  *  处置:提示管理员打开对应开关(`RESOURCE_SUSPEND` / 三个 LIVE HITL 开关 / `STREAM_APPROVAL_ENABLED` /
@@ -263,6 +273,7 @@ export class CapabilityUnavailableError extends APIError {
  *  server ≥7.116.0 新增两员(都是 501,开旋钮即可):`feature.memory_consolidation_disabled`(记忆整理两口,`MEMORY_CONSOLIDATION_DRIVER` 关或出厂缺省派生关 ——
  *  没配便宜模型;此前 404)· `feature.config_catalog_disabled`(`CONFIG_CATALOG_ENABLED=false` 时 `GET /v1/config/catalog`;此前 404)。 */
 export class FeatureDisabledError extends APIError {
+    name = "FeatureDisabledError";
 }
 /** `internal.*` 前缀族 —— 服务端自己出错(500 / 502)。细节不上 wire。
  *  部分成员**明确可重试**(`internal.cancel_not_terminalized` = 重试 cancel;
@@ -272,6 +283,7 @@ export class FeatureDisabledError extends APIError {
  *  (会话规则店读不出)**不在本族**(不以 `internal.` 开头)⇒ 落带码的 {@link APIError},同样不自动重试;按 `.errorCode` 分支,
  *  `error` 是引擎 / 店的原句(给运维看,不含盘上路径)。 */
 export class InternalServerError extends APIError {
+    name = "InternalServerError";
 }
 /** `state.*` 前缀族 —— 服务端**当前状态**不接受这个请求(503)。开集,下面是本包逐码注过的成员(附录 A 为准;server ≥7.119.0 新增 `state.scenario_assignment_unknown`):
  *   · `state.model_roster_pending`(roster 还没拉到)/ `state.no_sandbox_base`(没有可用的 sandbox-base)
@@ -316,6 +328,7 @@ export class InternalServerError extends APIError {
  *  {@link import("./types.js").CenterWiringCapability.failMode} / `leaseHealth`。 */
 export class ServiceStateError extends APIError {
     retryAfterMs;
+    name = "ServiceStateError";
     /**
      * 等待提示(**毫秒**,单位与 {@link LimitExceededError.retryAfterMs} 同口径)。缺席 = server 这一支
      * **没给**窗(如 `state.sse_connection_cap` 那些「换通道」成员),不是「可以立刻重打」。
@@ -347,6 +360,7 @@ export class ServiceStateError extends APIError {
 export class WorkspaceFileTooLargeError extends APIError {
     sizeBytes;
     limit;
+    name = "WorkspaceFileTooLargeError";
     constructor(status, errorCode, message, sizeBytes, limit) {
         super(status, errorCode, message);
         this.sizeBytes = sizeBytes;
@@ -370,6 +384,7 @@ export class WorkspaceFileTooLargeError extends APIError {
  *  codeless 503 arm to {@link ServiceStateError}; the status tariff now falls back to AuthError for 401 ONLY.) */
 export class DrainingError extends APIError {
     retryAfterMs;
+    name = "DrainingError";
     constructor(status, errorCode, message, retryAfterMs) {
         super(status, errorCode, message);
         this.retryAfterMs = retryAfterMs;
@@ -393,6 +408,7 @@ export class DrainingError extends APIError {
 export class RateLimitedError extends LimitExceededError {
     usedMicroUsd;
     limitMicroUsd;
+    name = "RateLimitedError";
     constructor(status, errorCode, message, retryAfterMs, 
     /** `limit.cost_quota_exceeded` only —— 本窗口已花费(micro-USD)。缺席 = 服务端没给/给了坏值。 */
     usedMicroUsd, 
@@ -411,6 +427,7 @@ export class RateLimitedError extends LimitExceededError {
  *  usage window=引擎部署级 token 治理窗(design/166,`USAGE_WINDOWS`)。两类同为 429 但处置来源不同。 */
 export class QuotaExhaustedError extends RateLimitedError {
     detail;
+    name = "QuotaExhaustedError";
     constructor(status, errorCode, message, retryAfterMs, detail) {
         super(status, errorCode, message, retryAfterMs);
         this.detail = detail;
@@ -424,6 +441,7 @@ export class QuotaExhaustedError extends RateLimitedError {
  *  `errorCode`,不再是 429——按 run 终态处置。 */
 export class UsageWindowExhaustedError extends RateLimitedError {
     retryAfterSec;
+    name = "UsageWindowExhaustedError";
     constructor(status, errorCode, message, retryAfterMs, 
     /** 响应体的 retryAfterSec(秒,上取整;与 Retry-After 头同源)。缺席=服务端没给。 */
     retryAfterSec) {
@@ -442,6 +460,7 @@ export class UsageWindowExhaustedError extends RateLimitedError {
  *  {@link APIError}),全文理由见 `classifyApiError` 里本臂的注。 */
 export class MemoryAdmissionError extends APIError {
     retryAfterSec;
+    name = "MemoryAdmissionError";
     constructor(status, errorCode, message, 
     /** 仅 transient 形(admission_required)可能在场;terminal 形恒缺席(等待提示在终局拒上是方向性谎言)。 */
     retryAfterSec) {
@@ -456,6 +475,7 @@ export class MemoryAdmissionError extends APIError {
  *  `allowlist`, or omit `scenario` entirely to run on the assigned default. */
 export class ScenarioNotAllowedError extends APIError {
     allowlist;
+    name = "ScenarioNotAllowedError";
     constructor(status, errorCode, message, 
     /** The principal's allowed scenario names (may be empty on an older service / defensive drop). */
     allowlist) {
@@ -465,6 +485,7 @@ export class ScenarioNotAllowedError extends APIError {
 }
 /** errorCode `budget.precall` / `budget.exceeded` — per-task or per-principal cost ceiling. NOT retryable. */
 export class BudgetExceededError extends APIError {
+    name = "BudgetExceededError";
 }
 /** 409 — session already has an active run, or an idempotency conflict / session CAS conflict.
  *
@@ -500,6 +521,7 @@ export class ConflictError extends APIError {
     activeTaskId;
     activeTaskStatus;
     pendingGate;
+    name = "ConflictError";
     constructor(status, errorCode, message, activeTaskId, 
     /** [2255]① server ≥3.21:conflict.session_active_run 携带的真出路材料(ADDITIVE / tolerate-absent)。
      *  running ⇒ steer/cancel 两条路;suspended/needs_review ⇒ pendingGate.decidePath 是那一个正确的
@@ -555,6 +577,7 @@ export class ConflictError extends APIError {
  */
 export class DeviceError extends ConflictError {
     currentRev;
+    name = "DeviceError";
     constructor(status, errorCode, message, 
     /** `device.rebind_rev_conflict` 的当前 rev(顶层键)—— 壳一跳重定位:直接拿它重发换绑。
      *  其余码上缺席(**守卫式**:非有限数丢弃 ⇒ 缺席,绝不把垃圾当前态)。 */
@@ -574,6 +597,7 @@ export class DeviceError extends ConflictError {
  *  NEVER auto-overwrite (a silent clobber is exactly the data loss the classifier exists to prevent). */
 export class SyncConflictError extends ConflictError {
     relation;
+    name = "SyncConflictError";
     constructor(status, errorCode, message, 
     /** The §7 `fork`/`stale` relation with the exclusive entry sets (untyped at the JSON boundary). */
     relation) {
@@ -581,12 +605,19 @@ export class SyncConflictError extends ConflictError {
         this.relation = relation;
     }
 }
-/** design/80 D-1 — the checkpoint you tried to decide is already TERMINAL (someone else resolved it, it was
- *  GC'd past its abandonment-TTL, or its SLA deadline fired a resolve-deny). DISTINCT from a binding mismatch
- *  and from session-CAS 409. Client action: this pending is gone → REFETCH the inbox; do not retry the decide. */
+/** 409 `approval_stale` — **one code, two causes**, told apart by the body:
+ *  - **with {@link ApprovalStaleError.terminal}** = the checkpoint you tried to decide is already TERMINAL (someone else resolved it, it was
+ *    GC'd past its abandonment-TTL, or its SLA deadline fired a resolve-deny). That pending is gone → REFETCH the inbox; do not retry the decide.
+ *  - **no `terminal` and {@link ApprovalStaleError.currentPending} present** = the binding you echoed is STALE (the `boundCallId` no longer matches the row
+ *    that is pending now — the card was superseded between your read and your decide). The pending row is still alive: use `currentPending` to
+ *    re-point (one hop) and decide again; no full inbox re-pull needed.
+ *  - Neither key = the server could not name a current pending (no pending, a non-tool gate, or the row read failed): REFETCH.
+ *  Only a wrong `boundInputHash` (with the right `boundCallId`) is NOT this error: it lands in core's bare 409 `approval_binding_mismatch`
+ *  ({@link ApprovalBindingMismatchError}). DISTINCT from the session-CAS 409. */
 export class ApprovalStaleError extends APIError {
     terminal;
     currentPending;
+    name = "ApprovalStaleError";
     constructor(status, errorCode, message, terminal, 
     /** S-02(server ≥7.52)—— 本会话**当前** pending 的三件 D-1 坐标(additive 指路键):壳拿它一跳
      *  重定位再 decide,免整队重拉。缺席=无 pending/非工具门/行读失败(server F 类留痕臂)或老 server。
@@ -633,6 +664,7 @@ function staleCurrentPending(v) {
  *  对着 ≤7.123.x 的 server,那一席仍借本码到达:{@link field} 按闭集读,不认识的词读作缺席,原值在 `err.extra.field`。`retriable: true` 形不变(卡仍 pending、run 行重新 park)。 */
 export class ApprovalBindingMismatchError extends APIError {
     field;
+    name = "ApprovalBindingMismatchError";
     constructor(status, errorCode, message, field) {
         super(status, errorCode, message);
         this.field = field;
@@ -643,6 +675,7 @@ export class ApprovalBindingMismatchError extends APIError {
  *  do NOT treat as ApprovalStaleError. Client action: REFETCH the PendingCheckpoint + re-present, then decide
  *  again (retryable). */
 export class ApprovalConcurrentlyReopenedError extends APIError {
+    name = "ApprovalConcurrentlyReopenedError";
 }
 /** `steering.*` 族的基类(SDK 1.1.0 —— 从**逐码枚举**改成**前缀分派**,与 `stop.*` / `decide.*` 同形)。
  *
@@ -655,16 +688,19 @@ export class ApprovalConcurrentlyReopenedError extends APIError {
  *  这是有意的 —— 「409」是传输层的巧合,「steer 目标有歧义」才是消费端要分支的东西;按 [clean-cut] 硬切,
  *  不留双继承之类的兼容层。整族一把接:`catch (e instanceof SteeringError)`。 */
 export class SteeringError extends APIError {
+    name = "SteeringError";
 }
 /** design/80 D-A — you steered a run that is NOT running (it is durable-`suspended`, terminal, or unknown).
  *  Steer is at-most-once and NOT queued. Client action: surface "task isn't running"; if suspended, the path
  *  forward is the approval decide, not a steer. */
 export class SteeringNotRunningError extends SteeringError {
+    name = "SteeringNotRunningError";
 }
 /** design/80 D-A — the steer text carried a control-plane escape (e.g. `</system-reminder>`) and core rejected
  *  it (runtask.ts:489). Client action: it's an injection attempt or a malformed steer — surface it; don't retry
  *  verbatim. (The BFF also fences steer text defensively; this is core's authoritative reject.) */
 export class SteeringInvalidContentError extends SteeringError {
+    name = "SteeringInvalidContentError";
 }
 /** `steering.ambiguous_target`(子代 steer/resume 面,server `http/routes/runs.ts`)/
  *  `steering.ambiguous_label`(workflow agent steer 面,`http/routes/workflows.ts`)—— **这一个 run 里有
@@ -672,12 +708,14 @@ export class SteeringInvalidContentError extends SteeringError {
  *  Client action:两个码同一个处置 —— **换一个唯一的定位方式**(子代面用 `parentToolCallId`;workflow 面
  *  用更具体的 label/句柄),原样重试永远同一个结果。`.errorCode` 区分是哪条轴上歧义。 */
 export class SteeringAmbiguousTargetError extends SteeringError {
+    name = "SteeringAmbiguousTargetError";
 }
 /** `steering.still_running` —— 你对一个**还在飞**的子代调了 `resume`(revive 只在 settle 之后合法;
  *  也可能是上一次 resume 还没落地)。409。
  *  Client action:要么改调 steer(给在跑的它递话),要么等它 settle 再 resume。**与
  *  {@link SteeringNotRunningError} 正好互为反面**,两个码塌在一起会让 UI 说反话。 */
 export class SteeringStillRunningError extends SteeringError {
+    name = "SteeringStillRunningError";
 }
 /** `steering.queue_full`(server ≥7.3.0 / core 5.14.0 #147)—— 这条 run **确实**挂着,但它 checkpoint 上
  *  已 park 的转向队列**满了**。队列是有界且 **fail-loud** 的:引擎绝不驱逐一条已被接受的指令来腾位子
@@ -686,6 +724,7 @@ export class SteeringStillRunningError extends SteeringError {
  *  只是现在放不下。让它 resume 把已 park 的投递掉(或减少并发转向)之后再发。两个码塌在一起会让 UI
  *  说反话(同 `still_running` 的先例),所以它有自己的类而不是落基类。 */
 export class SteeringQueueFullError extends SteeringError {
+    name = "SteeringQueueFullError";
 }
 /** `steering.ledger_unavailable`(server ≥7.110.0,S-928;子代 steer 路由自 server ≥7.111.0 / S-966 起同样可达)—— server 在回 `200 applied`
  *  (interrupt{text}:`202 queued-immediate`;子代 steer:`200 applied`)**之前**
@@ -695,6 +734,7 @@ export class SteeringQueueFullError extends SteeringError {
  *  照用,server 侧零受理、零注入 ⇒ 不会重复)。不是改内容(invalid_content / blocked_by_hook)、不是换 key(duplicate_input_id)、
  *  不是等 resume(queue_full)。处置分岔 ⇒ 自己的类(判据二),`.errorCode` 保留。 */
 export class SteeringLedgerUnavailableError extends SteeringError {
+    name = "SteeringLedgerUnavailableError";
 }
 /** `steering.duplicate_input_id`(parked 腿 server ≥7.3.0 / core 5.14.0 #147;live 腿 server ≥7.23.0 /
  *  core 5.35.0 #257 起同样可达)—— 你带的 `Idempotency-Key` 已经
@@ -710,6 +750,7 @@ export class SteeringLedgerUnavailableError extends SteeringError {
  *  句子是引擎的(7.118.0 改过一次),别按 `message` 匹配。 */
 export class SteeringDuplicateInputIdError extends SteeringError {
     differs;
+    name = "SteeringDuplicateInputIdError";
     constructor(status, errorCode, message, 
     /** 体 `detail.differs`:{@link STEER_REPLAY_FACETS} 的非空子集(引擎的序)。整体成形或整体缺席 —— 不是数组 / 空 / 含集外词 ⇒ undefined
      *  (原值仍在 {@link APIError.extra};与 server 自己的读口同判:读不出就不铸)。 */
@@ -732,7 +773,11 @@ export const STEER_REPLAY_FACETS = Object.freeze(["text", "trusted", "priority",
  *     ⚠️ 这一条**必须**是拒:`reason` 自 1.284.0 起在直连门的 HMAC 签名载荷里(ASSISTANT-WIRE-CONTRACT §6.2),
  *     服务端截过的字节与签名方签的字节必然不同 ⇒ MAC 恒不匹配,截断只会把可诊断的 413 变成费解的 401。
  *  Client action:缩短该字段后重发(重试原文没有意义);两个上限都是 server 侧常量,别在客户端猜。 */
+/** ⚠️ 同一类也接 `413 request.payload_too_large`(`request.*` 族里唯一的分岔,处置同样是「缩短后重发」)—— server ≥7.132.0:TiDB / MySQL 协议部署上**提交体**超库的单行墙 / 包墙
+ *  (`min(8 MiB, 库的单行上限 − 64 KiB)`,按体的 JSON 字节判)也落这一码,体带 `wallSource`(墙从哪来,见 {@link PayloadWallRefusalExtra});写续跑输入那一笔被库以「一行装不下」拒的答复同码
+ *  (活流腿是终帧 `done`,`result.errorCode` 同码)。此前受理、写库那一刻 500。出路:缩小内联图 / 附件,或运维抬库的单行上限。 */
 export class PayloadTooLargeError extends APIError {
+    name = "PayloadTooLargeError";
 }
 /** [1833] G13 — `runs.taskStop` 的 409 冲突家族(server `src/http/routes/runs.ts` 的 stop 路由,`errorCode`
  *  判别;design/158 A9 域拆分后已不在 `src/http/server.ts`):
@@ -741,6 +786,7 @@ export class PayloadTooLargeError extends APIError {
  *  恢复赢了)/ `stop.park_arbiter_unreachable`(仲裁店不可达,真相未知——core 1.397 三分)。
  *  开集:未来新 `stop.*` 码同样落到本类(`errorCode` 原样携带),消费方 switch 要留 default。 */
 export class TaskStopConflictError extends ConflictError {
+    name = "TaskStopConflictError";
 }
 /** 409 `interrupt.*` 族(core #504 / server ≥7.52 `POST /v1/runs/:id/interrupt`)—— 前缀开集,与 `stop.*`
  *  同形。两个现役码,处置相反所以**都别盲重试**,按 `.errorCode` 分支:
@@ -750,27 +796,32 @@ export class TaskStopConflictError extends ConflictError {
  *     那两条腿返回结果不返回流)⇒ 要 run 级停用 `POST /v1/runs/:id/cancel`;证得出他副本时文案会指路重发。
  *  终态/刚落定臂复用 `steering.not_running`(→ {@link SteeringNotRunningError}),不在本族。 */
 export class InterruptConflictError extends ConflictError {
+    name = "InterruptConflictError";
 }
 /** design/80 D-G (direct-connect door, service [84]) — the signed principal JWT (`X-Approval-Principal-Token`)
  *  failed to verify against the worker's projected pubkey anchor (bad sig / exp / iss / aud / alg-not-pinned).
  *  401. Client action: re-sign a fresh short-TTL JWT; persistent ⇒ BFF signing key/anchor misaligned. FORWARD-
  *  DRAFT: wire codes are service-locked; the BFF signer + live path land at M2. */
 export class PrincipalUnverifiedError extends APIError {
+    name = "PrincipalUnverifiedError";
 }
 /** design/80 D-G — the JWT verified but its `cnf.bnd` ≠ SHA256(checkpointToken): the identity assertion was
  *  minted for a DIFFERENT decision and lifted onto this one (token-lift). A SAFETY signal. 401. Client action:
  *  NEVER retry verbatim; re-mint the JWT bound to THIS checkpointToken. */
 export class PrincipalUnboundError extends APIError {
+    name = "PrincipalUnboundError";
 }
 /** ASSISTANT-WIRE-CONTRACT §4b（service main 6cd0164）— 你对一个 human/policy_ask 门调了 resume（CONTINUE）。
  *  409 errorCode `gate_not_resumable`。一个 "continue" 绝不能绕过人审。SEMANTIC（错门）, NOT session-CAS ConflictError。
  *  Client action: 这条路是 /decide（approve/deny）, 不是 resume —— 改走人审 UI。 */
 export class GateNotResumableError extends APIError {
+    name = "GateNotResumableError";
 }
 /** ASSISTANT-WIRE-CONTRACT §4c（service main 6cd0164）— 你对一个非 plan_review 门调了 plan_review。
  *  409 errorCode `gate_not_plan_review`。一个 plan 决策绝不能解 tool 审批 / resource_limit。SEMANTIC（错门）, NOT ConflictError。
  *  Client action: 按 gateKind 选对的决策端点（/decide 或 /resume）, 重取 inbox。 */
 export class GateNotPlanReviewError extends APIError {
+    name = "GateNotPlanReviewError";
 }
 /** [2400] CB-2(SDK 4.2.0)—— 语义错门守卫的**第三个**成员(与上面两兄弟同形):你对一个**不是工具审批门**
  *  的挂起调了 `/v1/approvals/:sessionId/decide`。409 errorCode `gate_not_tool_approval`
@@ -781,6 +832,7 @@ export class GateNotPlanReviewError extends APIError {
  *  🔴 与 session-CAS `ConflictError` 刻意不同类:两者都是 409,但这一条说的是「你敲错门了」,处置是**换端点**,
  *  不是「重读再试」。 */
 export class GateNotToolApprovalError extends APIError {
+    name = "GateNotToolApprovalError";
 }
 // ── design/172 流内审批协议回决端点(#151 车4;POST /v1/tasks/:taskId/asks/:askId/decision)────────────
 // 🔴 已发布:server 7.3.0 上线该端点,SDK 6.7.0 同窗发这四个类。四则响应(§3.2)在 wire 上是**四个不同的处置**,所以是四个类,
@@ -795,6 +847,7 @@ export class AskDecidedError extends ConflictError {
     firstDecision;
     decidedAtMs;
     actor;
+    name = "AskDecidedError";
     constructor(status, errorCode, message, 
     /** 首决:被接受的那个决议。 */
     firstDecision, 
@@ -813,6 +866,7 @@ export class AskDecidedError extends ConflictError {
  *  条款排除了它(一次同意不得被复用到另一次未经确认的征询)。
  *  Client action:换一个 key 重发(**不是**换 askId)。 */
 export class AskIdempotencyConflictError extends ConflictError {
+    name = "AskIdempotencyConflictError";
 }
 /** 410 `gone.ask_parked` / `gone.ask` —— 窗已关闭,这张卡的结局**已经铸定**,流内回决面对它已不存在。
  *
@@ -846,6 +900,7 @@ export class AskGoneError extends APIError {
     gateBoundCallId;
     gateBoundInputHash;
     endingCause;
+    name = "AskGoneError";
     constructor(status, errorCode, message, 
     /** `PARKED` | `DENIED` | `VOID`(`gone.ask` 腿携带;`gone.ask_parked` 腿恒 PARKED,可缺席)。具名闭集型 {@link AskGoneState}
      *  ({@link toApiError} 只会产出三词之一,越界值在 mapper 里就被丢弃)。 */
@@ -895,6 +950,36 @@ export const ASK_ROW_ENDING_CAUSES = Object.freeze([
     "crashed_before_park",
     "shutdown_before_park",
 ]);
+/** 契约包(`@sema-agent/settings-schema/hooks`)分类器的码:`HOOKS_REJECTION_CODES` 六词 ∪ `HOOKS_DROPPED_PIECE_CODES` 五词(镜像;门钉对钉版 server 依赖的契约包运行期常量)。 */
+export const SETTINGS_HOOKS_PIECE_CODES = Object.freeze([
+    "guard-outside-hooks", "hooks-is-matcher", "guard-under-unknown-event", "guard-event-not-array", "guard-matcher-invalid", "guard-entry-invalid",
+    "hooks-not-object", "unknown-event", "event-not-array", "matcher-invalid", "entry-invalid",
+]);
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+// server ≥7.133.0 —— 受理面拒体的机读位(additive;句子与码不变,**不要解析句子**)
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+/**
+ * `400 request.invalid_json` 的 `reason` 闭集(server ≥7.133.0;体 `{ error, errorCode, reason }`,值经 `err.extra.reason` 到达):请求体不是这一口要的 JSON ——
+ * `not_json`(体不是合法 JSON)/ `not_object`(体是合法 JSON 但不是对象,而这一口要对象;如 `compact` 口)。**读开集**(未知词按「请求体形不对」处置)。
+ * 🔴 **BREAKING(wire 码,server 7.133.0)**:坏 JSON 体恒答 `400 request.invalid_json`。此前同一件事在多数口答 `request.rejected`(状态兜底粗码)、`notify` / `wake` / 权限规则三口答 `request.body_shape`,
+ * 一批口读体超限折 400 —— 按那几个码识别「坏 JSON」的代码要改读 `errorCode === "request.invalid_json"` + `reason`(零别名、零开关)。≤7.132.x 的 server 仍是旧码:**本包的读法恒是按 wire 上的 `errorCode` 分,不按版本猜**。
+ */
+export const INVALID_JSON_REASONS = Object.freeze(["not_json", "not_object"]);
+/**
+ * `400 request.field_conflict` 的 `detail.kind` 闭集(server ≥7.133.0,**十四词**):一份请求体**自己跟自己矛盾**(两个键不能同带)是哪一类约束。同一个约束的几个拒点同一个词。体 `detail`:
+ * `{ kind, fields[], count?, cap? }` —— `fields` = 被点名的请求体坐标(主语在前,至少一个;动态下标用 `agents[1].skills` 形),`count` / `cap` 只在「折叠上限」那一类带(合起来的量与帽)。句子与码不变;老 server 只有一句英文。
+ * 每类的坐标闭集:`cascade_verify`(`verify` / `cascade` / `sandboxImageProfile` / `resumeAt` / `suggestNextPrompts`)· `image_profile`(`capabilitiesNeeded` / `sandboxImageProfile`)·
+ * `resume_anchor`(`resumeAtMode` / `resumeAt`)· `system_prompt_fold`(`appendSystemPrompt` / `settings.outputStyle`)· `file_history_restore`(`fileHistory` / `restoreFiles` / `rewindFilesTo` / `rewindFiles`)·
+ * `skills_disabled`(`disableSkills` / `skills` / `agents[i].skills`)· `existing_session`(`requireExistingSession` / `sessionId`)· `scratchpad_root`(`cwd` / `scratchpadDir`)· `ask_answer`(`decision` / `answer`)·
+ * `policy_person_ask`(`decision` / `decidedBy`)· `plan_edit`(`decision` / `editedPlan`)· `plan_mode_after`(`decision` / `permissionModeAfter`)· `bound_call_door`(`boundCallId`)· `remember_decision`(`remember` / `decision`)。
+ * 壳按 `detail.kind` 分支、按 `detail.fields` 高亮冲突的两处输入;**读开集**(未知 kind 按「请求体自相矛盾」处置)。
+ */
+export const FIELD_CONFLICT_KINDS = Object.freeze([
+    "cascade_verify", "image_profile", "resume_anchor", "system_prompt_fold", "file_history_restore", "skills_disabled", "existing_session",
+    "scratchpad_root", "ask_answer", "policy_person_ask", "plan_edit", "plan_mode_after", "bound_call_door", "remember_decision",
+]);
+/** server 自铸的两个条目问题词(闭集,其余 `reason` 是引擎的词原样):`not_in_roster`(受理告知 `warnings[]` 的词)· `home_unresolvable`(设置规则 422 的词)。 */
+export const SERVER_ENTRY_PROBLEM_REASONS = Object.freeze(["not_in_roster", "home_unresolvable"]);
 /** `DENIED` 态的唯一合法结局成因(server 全仓 `DENIED` 只有一个写点)—— {@link ASK_ROW_ENDING_CAUSES} 的首员。导出是因为消费端要拿它做
  *  「路由失败 vs 人拒」的判别与文案分支 —— 手抄一份字符串正是这条界线被抹掉的常见方式。server ≥7.124.0 起它住在 410 体的 `cause` 键上(此前 `deniedReason`)。 */
 export const DENY_REASON_ROUTING_FAILURE = "routing_failure_fail_closed";
@@ -912,6 +997,7 @@ export const RULE_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespac
 export class AskParkingError extends APIError {
     retryAfterMs;
     retryAfterSec;
+    name = "AskParkingError";
     constructor(status, errorCode, message, 
     /** `Retry-After` 头解析出的毫秒(transport 统一喂入)。 */
     retryAfterMs, 
@@ -924,6 +1010,7 @@ export class AskParkingError extends APIError {
 }
 /** design/80 D-G — the direct-connect door requires the HMAC envelope (`X-Approval-Mac`) and it was absent. */
 export class ApprovalMacRequiredError extends APIError {
+    name = "ApprovalMacRequiredError";
 }
 /** design/80 D-G — the HMAC envelope failed verification (wrong key/kid, or a tampered [token,callId,hash,
  *  decision] tuple). 401. Client action: re-sign with the active HMAC kid; persistent ⇒ key rotation skew.
@@ -934,6 +1021,7 @@ export class ApprovalMacRequiredError extends APIError {
  *  删除、零双读、混版两向皆 401)对**本包的调用方**零动作 —— 除非它自己就是那个签名器,那时它按 server 的
  *  契约 §6 改形。**没有直连门的部署完全不受影响**。 */
 export class ApprovalMacInvalidError extends APIError {
+    name = "ApprovalMacInvalidError";
 }
 /** `resume_outcome_invalid` — a plan_review / dry-run-review outcome was REJECTED BY CONTENT SANITIZE
  *  (`editedPlan`/`reason` carried a forbidden tag), or — on the tool-approval gate — one cell of the decision body is not valid:
@@ -947,6 +1035,7 @@ export class ApprovalMacInvalidError extends APIError {
  *  precisely so a UI routes to the right recovery (fix the text and re-submit) instead of the action-binding
  *  flow. Collapsing the two back into one type in the SDK would undo that split. Usually `retriable`. */
 export class ResumeOutcomeInvalidError extends APIError {
+    name = "ResumeOutcomeInvalidError";
 }
 /** `resume_blocked_by_policy` — an admission policy CHANGED between suspend and resume, and the resume is no
  *  longer admissible. Not a race: retrying as-is stays blocked until the policy or the request changes.
@@ -959,6 +1048,7 @@ export class ResumeOutcomeInvalidError extends APIError {
  *  原因:引擎 7.41 去首尾空白(`"Bash "` 曾是一条有效的拒),7.42 逐字读 —— 不判就是升级后那条拒无声消失。本类按 `errorCode` 判别,三条来路用 `blockedBy` 区分。 */
 export class ResumeBlockedByPolicyError extends APIError {
     blockedBy;
+    name = "ResumeBlockedByPolicyError";
     constructor(status, errorCode, message, 
     /**
      * **哪一道检查拒的**:被折叠的那只拒绝**直接**出去时会带的 `errorCode`。server ≥7.104.0(S-607)起 wire 上**恒在**:带码的原拒绝 ⇒
@@ -989,6 +1079,7 @@ export class ResumeBlockedByPolicyError extends APIError {
  *  session_not_found。前缀开集:core 未来新码至少落到本类(`.errorCode` 判别),不塌匿名 409。
  *  ⚠️ 与下划线形的 resume_outcome_invalid / resume_blocked_by_policy 是**两族**(那两个在上面,先判)。 */
 export class SubagentResumeConflictError extends ConflictError {
+    name = "SubagentResumeConflictError";
 }
 /** A-075.10 —— resume 族的**时间性拒绝**二码(前码 server ≥7.47.0、后码 ≥7.51.0;亲读 `http/server.ts` 拒绝体铸点):
  *  `resume.usage_window_exhausted`(#449 G1,core 5.60.1:该行账本键上的部署治理窗满了;「什么都没消费、
@@ -1002,6 +1093,7 @@ export class SubagentResumeConflictError extends ConflictError {
 export class ResumeRetryLaterError extends SubagentResumeConflictError {
     retryAfterMs;
     retryAfterSec;
+    name = "ResumeRetryLaterError";
     constructor(status, errorCode, message, 
     /** `Retry-After` 头解析出的毫秒(transport 喂入;该腿 server 今天不发头 ⇒ 通常缺席)。 */
     retryAfterMs, 
@@ -1017,10 +1109,12 @@ export class ResumeRetryLaterError extends SubagentResumeConflictError {
  *  ⚠️ [2400] CB-2 起 `wake.` 是**前缀开集**:未来的 `wake.*` 新码至少落到 {@link ConflictError}
  *  (`.errorCode` 原样携带),不再塌成匿名 409。 */
 export class WakeGatePendingError extends ConflictError {
+    name = "WakeGatePendingError";
 }
 /** 409 `compact.not_running` / `detach.not_running` —— replica-local live-verb 族:run 已终态,或活在
  *  另一副本(手动 compact/detach 只对本副本的活流有效)。`.errorCode` 判别是哪个 verb。 */
 export class RunNotLiveError extends ConflictError {
+    name = "RunNotLiveError";
 }
 /** Base of the `decide.*` family — catch this to handle the whole decide door in one place.
  *  Codes that fall on THIS class rather than a subclass need a human: `row_unrevivable` (damaged row),
@@ -1040,6 +1134,7 @@ export class DecideError extends APIError {
     taskId;
     rollback;
     runId;
+    name = "DecideError";
     constructor(status, errorCode, message, taskId, 
     /** revive legs only — the claim-rollback disposition the server reported. */
     rollback, 
@@ -1064,6 +1159,7 @@ export class DecideError extends APIError {
  *  different occupant. The re-fetch then usually shows the card GONE (a 7.104.0 session delete retires its parked children's cards) —
  *  nothing is left to decide; this form mostly meets cards left behind by a session deleted before 7.104.0. */
 export class DecideParkMovedError extends DecideError {
+    name = "DecideParkMovedError";
 }
 /** `decide.parked_answer_required` / `decide.parked_remember_unsupported` — this park shape does not accept
  *  the decide you sent (an AskUserQuestion approve without `body.answer` — server 5.12.0/core 5.7.0 RB-459;
@@ -1072,18 +1168,22 @@ export class DecideParkMovedError extends DecideError {
  *  `decide.parked_answer_unsupported` / `..._question_unsupported` are retired: the answer HAS a hookpoint
  *  now and a parked question CAN be approved (with an answer). */
 export class DecideUnsupportedError extends DecideError {
+    name = "DecideUnsupportedError";
 }
 /**
- * Why a parked resume could not start its approved action — the engine's closed set `RESUME_STARTUP_CAUSES` (core 7.51.0), word for word and in
+ * Why a parked resume could not start its approved action — the engine's closed set `RESUME_STARTUP_CAUSES` (core 7.51.0; six words since core 7.52.0), word for word and in
  * order. Server ≥ 7.129.0 relays it as the 422 `parked_resume.startup_failed` body's `cause`, screened against this set (a word the engine did
  * not say, or one outside the set ⇒ the key is absent). What each word tells the caller to do:
  *  · `environment` — the leg's infrastructure failed (workspace restore, an abort); the decision is untouched — retrying replays it;
  *  · `session_gone` — the resumed agent's transcript session is missing;
+ *  · `transcript_corrupt` — (core 7.52.0 #1796, server ≥ 7.132.0) the resumed agent's transcript is there but damaged: no header its store wrote, a leaf
+ *    or parent entry missing from the log, or a lost tail the checkpoint was cut inside. The row reopens as for `session_gone` (a system retry, the
+ *    decision is untouched); only the receipt now says which. Servers ≤ 7.131.x answered `session_gone` / no cause for these;
  *  · `tool_unavailable` — the approved tool is not available to the resumed leg (gone, or replaced by a different contract) — this approval cannot run, decide afresh;
  *  · `configuration` — the deployment's configuration refuses the resumed leg; a retry under the same configuration fails the same way;
  *  · `decision_rejected` — the decision does not fit the checkpoint (another gate's answer, an input the constraints refuse) — correct it and resubmit.
  */
-export const RESUME_STARTUP_CAUSES = Object.freeze(["environment", "session_gone", "tool_unavailable", "configuration", "decision_rejected"]);
+export const RESUME_STARTUP_CAUSES = Object.freeze(["environment", "session_gone", "transcript_corrupt", "tool_unavailable", "configuration", "decision_rejected"]);
 const isResumeStartupCause = (v) => typeof v === "string" && RESUME_STARTUP_CAUSES.includes(v);
 /** `parked_resume.startup_failed` (422 — core code PASSTHROUGH, server 5.12.0/RB-459): the decide was
  *  accepted and the revive attempted, but the resume failed during startup — the child's session is gone,
@@ -1103,6 +1203,7 @@ const isResumeStartupCause = (v) => typeof v === "string" && RESUME_STARTUP_CAUS
  *  indistinguishable on the wire (the prose `message` is the engine's text — never branch on it). See {@link startupCause}. */
 export class ParkedResumeStartupError extends DecideError {
     startupCause;
+    name = "ParkedResumeStartupError";
     constructor(status, errorCode, message, taskId, rollback, runId, 
     /**
      * K-19 — the machine-readable CAUSE WORD of this startup failure (client-core [8537] CC-225; server S-818 relays it
@@ -1128,6 +1229,7 @@ export class ParkedResumeStartupError extends DecideError {
 }
 /** `decide.store_unreachable` — the durable agent store is unreachable. Transient: retry the same decide. */
 export class DecideStoreUnreachableError extends DecideError {
+    name = "DecideStoreUnreachableError";
 }
 /** `decide.workflow_host_unknown` / `decide.workflow_host_not_parked` (409, server >=7.69.0 / S-185) — the
  *  pending belongs to a **workflow child** that parked on an approval gate, and the deployment could not hand
@@ -1153,6 +1255,7 @@ export class DecideStoreUnreachableError extends DecideError {
  *  (Grouped by what the caller must do — the same axis as {@link DecideParkMovedError} — rather than by status;
  *  both are 409 but neither is the "the park moved, refetch the list" doctrine.) */
 export class DecideWorkflowHostError extends DecideError {
+    name = "DecideWorkflowHostError";
 }
 /** `decide.workflow_parks_unreadable` (409, server >=7.75.0 / S-252) — the pending belongs to a **workflow
  *  child**, and (the 7.75.0–7.117.x reading; a server ≥7.118.0 narrows the triggers — see the 7.118.0 paragraph at the end)
@@ -1220,6 +1323,7 @@ export class DecideWorkflowHostError extends DecideError {
  */
 export class DecideWorkflowParksUnreadableError extends DecideError {
     readableHolderRunId;
+    name = "DecideWorkflowParksUnreadableError";
     constructor(status, errorCode, message, taskId, rollback, runId, 
     /** server ≥7.118.0, the "record cannot be read" cause only: the readable record that holds this card at the highest generation
      *  (the body's top-level `readableHolderRunId`; absent when there is none or a tie — never `null`). Where the work can be carried
@@ -1240,6 +1344,7 @@ export class DecideWorkflowParksUnreadableError extends DecideError {
  *  fork look like a single holder and the decision goes to the branch whose pointer exists (server 7.118.0 known boundary). */
 export class DecideWorkflowParkForkedError extends DecideError {
     runIds;
+    name = "DecideWorkflowParkForkedError";
     constructor(status, errorCode, message, taskId, rollback, runId, 
     /** The resumed runs that all hold this card (the body's `runIds`, ≥2 on the wire). Whole-or-nothing: absent when the body does
      *  not carry an array of non-empty strings (the raw value stays on {@link APIError.extra}). */
@@ -1508,7 +1613,7 @@ function classifyApiError(status, body, retryAfterMs) {
     // RB-459(server 5.12.0):core 码 422 原样透传——非 decide. 前缀但同一决定面,处置=重查 pending 再决。
     if (errorCode === "parked_resume.startup_failed") {
         return new ParkedResumeStartupError(status, errorCode, msg, typeof b.taskId === "string" ? b.taskId : undefined, typeof b.rollback === "string" ? b.rollback : undefined, typeof b.runId === "string" ? b.runId : undefined, 
-        // K-19 / 23.0.0:wire 键 `cause` 是引擎五词闭集(server ≥7.129.0 按引擎 `RESUME_STARTUP_CAUSES` 筛过才发);成员原样读进 `startupCause`,
+        // K-19 / 23.0.0:wire 键 `cause` 是引擎的成因闭集(core 7.52.0 起六词;server ≥7.129.0 按引擎 `RESUME_STARTUP_CAUSES` 筛过才发);成员原样读进 `startupCause`,
         // 缺席 / 非串 / 集外 ⇒ undefined(不补默认、不改写;原值仍在 `err.extra.cause`)。
         isResumeStartupCause(b.cause) ? b.cause : undefined);
     }
@@ -1722,26 +1827,30 @@ function classifyApiError(status, body, retryAfterMs) {
  *  failed. `message` is secret-scrubbed (a registry/proxy may echo an Authorization header into an error body). */
 export class ControlError extends Error {
     status;
+    name = "ControlError";
     constructor(status, message) {
         super(message);
         this.status = status;
-        this.name = new.target.name;
     }
 }
 /** 401 — missing/invalid registry Bearer (SEMA_REGISTRY_TOKEN). Fail-closed. */
 export class ControlAuthError extends ControlError {
+    name = "ControlAuthError";
 }
 /** 403 — authenticated but the token's role is below what the write needs (editor / publisher per domain).
  *  Client action: surface "needs a higher role"; do NOT retry with the same token. */
 export class ControlForbiddenError extends ControlError {
+    name = "ControlForbiddenError";
 }
 /** 404 — unknown domain / unknown change id / unknown worker. */
 export class ControlNotFoundError extends ControlError {
+    name = "ControlNotFoundError";
 }
 /** 400 — zod validation failed. `issues` carries the flat `{ path, message }[]` (batch prefixes path with
  *  `[changeIndex, domain, …]`). Client action: fix the offending field; this is deterministic, do NOT retry. */
 export class ControlValidationError extends ControlError {
     issues;
+    name = "ControlValidationError";
     constructor(status, message, issues) {
         super(status, message);
         this.issues = issues;
@@ -1753,6 +1862,7 @@ export class ControlValidationError extends ControlError {
  *  K-17: every 409 EXCEPT the scope-gone one — that is {@link ControlScopeGoneError}, deliberately not this class. */
 export class ControlConflictError extends ControlError {
     currentVersion;
+    name = "ControlConflictError";
     constructor(status, message, currentVersion) {
         super(status, message);
         this.currentVersion = currentVersion;
@@ -1767,6 +1877,7 @@ export class ControlConflictError extends ControlError {
  *  reviewed. Client action: stop, keep the intent, have a person confirm the scope is still the one to write. Still a
  *  {@link ControlError} (`status` 409, scrubbed `message`), so a family-wide catch keeps matching. */
 export class ControlScopeGoneError extends ControlError {
+    name = "ControlScopeGoneError";
 }
 /** Map a control-plane HTTP status + parsed body to the right typed error. Body envelope is `{ error, issues?,
  *  message?, currentVersion?, errorCode? }`. 🔴 message is scrubbed (Bearer / presigned) before surfacing.