Errors

All error classes are exported from the main entry. Evaluation-phase errors follow the onError option; KerberosValidationError always throws.

Class	Thrown when
KerberosValidationError	Malformed method arguments or request shapes (always propagates — a programming error, not a deny).
KerberosCacheError	A transient cache.get failure persists after the cacheRetry attempts.
KerberosCodecError	A cached policy/tuple document is corrupt or fails to deserialize (for policies it is logged and counts as a miss; for ReBAC tuple documents it throws — see Dynamic tuples).
KerberosExprError	A { $expr } string uses a construct outside the safe allowlist, exceeds codec limits, or fails to parse.
KerberosRelationsError	The built-in ReBAC resolver hits maxDepth, a throwing caveat, or invalid relation data.