# `RequestSeal.Custody.Error`
[🔗](https://github.com/baselabs/request_seal/blob/v0.5.2/lib/request_seal/custody/error.ex#L1)

Bounded custody failures. No exception, reference, key, socket path, peer text,
or input bytes are retained. Only `:deadline_exceeded` and
`:custodian_unavailable` are retryable; callers decide whether replay is safe.

Reasons:

* `:invalid_handle`, `:invalid_options`: malformed capability, options, or
  SSH agent socket path.
* `:unsupported_algorithm`, `:unsupported_operation`, `:unsupported_format`:
  explicitly unimplemented selection; no fallback.
* `:invalid_key`, `:key_mismatch`: invalid material or incompatible binding.
* `:invalid_data`, `:invalid_signature`, `:limit`: invalid or excessive bytes.
* `:invalid_signing_output`: signing returned malformed or excessive output bytes.
* `:decryption_failed`: RSA-OAEP key unwrapping failed; no private diagnostics.
* `:no_public_key`: symmetric custody has no public export.
* `:key_not_found`: the selected key was released, removed, or is unavailable.
* `:deadline_exceeded`: the absolute operation deadline expired.
* `:custodian_unavailable`: connection absent, refused, or closed.
* `:custodian_rejected`: provider refusal or returned signature fails verification.
* `:custodian_protocol`: malformed or excessive agent protocol response.
* `:custodian_failure`: callback crash, unexpected response, or unmapped failure.

# `reason`

```elixir
@type reason() ::
  :limit
  | :decryption_failed
  | :custodian_failure
  | :custodian_protocol
  | :custodian_rejected
  | :custodian_unavailable
  | :deadline_exceeded
  | :key_not_found
  | :no_public_key
  | :invalid_signing_output
  | :unsupported_format
  | :invalid_signature
  | :invalid_data
  | :key_mismatch
  | :invalid_key
  | :unsupported_operation
  | :unsupported_algorithm
  | :invalid_options
  | :invalid_handle
```

# `t`

```elixir
@type t() :: %RequestSeal.Custody.Error{reason: reason(), retryable: boolean()}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*