feat(errors): add DomainError foundation

[jyecusch]

Closes SUGA-1976.

Adds @sugabots/errors, which core, the HTTP contracts and any later interface build on. Every expected failure is its own DomainError class with an internal message, a userMessage, isRetryable, an optional retryAfter, and a severity. PublicError is the part of it that may leave the system. asHttpError now nests it in API failures as error.

UserText is the one kind of text for people. userText is how it's written; it takes literals, numbers, fixed sets of words and DisplayNames, and refuses any other string. API failures now take message: UserText, so a route can't send an exception's or a service's text. The 404 for an unknown route no longer echoes the URL. UserMessage in core is now UserText under its old name, until every error is a DomainError. The remaining vouch is UserText.unchecked for better-auth's refusals in the SDK.

Code that has moved is checked by the Effect language service rules raised to errors in tsconfig.base.json, and by the GritQL rules in lint/. bun run lint fails if the two allowlists differ. Today they list only server/src/http/errors.ts; SUGA-1977 adds the model providers first.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	sugabots-website	c594897	Oct 08 2026, 11:44 PM