Errors

Every failure StashJS reports is a typed error with a stable .code. Consumers branch on the code, never on the message text -- messages are free to improve between patches; codes are frozen. All classes extend StashError, so err instanceof StashError separates a stash verdict from an unrelated bug.

One rule binds every message: it never contains a ref, a meta value, or a filesystem path (the CWE-209 / CWE-532 exposure classes). A ref is a capability, and an error that echoes a capability into a log file has leaked it. Messages describe the failure class; the caller already holds the identifiers it passed in.