klock-errors
klock error reference
service, the CLI and device agent, the library and
outh — with what it means, why ithappens and what to do. The catalog in
src/klock/errors.ts is the single source oftruth; this page is generated from it, and a test fails when the code emits a code that
is not here.
{ "error": "<code>", "message": "…" }, with the HTTPstatus below. Some carry more:
needs and unlock (capability_missing,step_up_required), reason (session_revoked), sessions (session_limit). A 401to a klock session also carries
WWW-Authenticate: Klock error="<code>".Error whosemessage starts with the code:
device_not_found: no device dev_….(
JwsError bad-signature, KlockFileError mode); each maps to an entry here,listed as Local codes.
explainKlockError(err) from ts-prorm-orm/klock does themapping for you, and also recognises the v1 messages that never had a code.
What to do (<code>).CLI for the commands named below.
What now? A decision chart
By HTTP status
Codes by category
Sessions and sign-in
already_bound
That session is bound to another device key; rotate that key, or revoke the session and issue another1.
prorm klock rotate.2.
prorm sessions revoke <id>) and bind the new key.api/security/controllers/klock.ts).already_rotated.already_rotated
This session has already been rotatedrotationId.1.
prorm klock sync to pick up the rotated key.api/security/controllers/klock.ts).assumed_identity
An assumed identity cannot open or change klock sessions.1.
api/basic/routes/security.js).check_in_required
sync needed (past the check-in deadline)checkInBy deadline: offline, only public and local:use capabilities are honoured until the device syncs. The CLI treats this code as a refresh signal, and a service gate (db serve v2, a host agent) raises it for gated operations past a service grant’s checkInBy; the API itself does not send it (online, it checks the session live and lets the grant expire).1.
prorm klock sync.2.
prorm login.src/cli/core/cloud.ts), device agent / klock core (src/klock/agent/session.ts), device agent / klock core (src/klock/providers/db.ts).grant_expired.confirm_code_mismatch
The confirm code does not match the one the terminal printed1.
prorm login yourself and compare the code on both screens.api/security/controllers/klock.ts).confirm_code_required
Opening a session from the console needs the state and confirm code 'prorm login' printed1.
prorm login and open the link it prints.api/security/controllers/klock.ts).confirm_code_mismatch.console_only
Open a klock session from the console ('prorm login'), not with a CLI token1.
prorm login and approve it in the browser.api/security/controllers/klock.ts).fresh_signin_required
Releasing a lockdown needs a fresh sign-in1.
prorm login), then prorm lockdown release within 15 minutes.api/basic/routes/lockdown.js).lockdown, step_up_required.idle_timeout
idle_timeoutreason: idle; sessionIsLive returns this code over RPC; locally the agent reports sync needed.1.
prorm klock sync; if the server has already revoked it, prorm login.api/security/controllers/klock.ts), device agent / klock core (src/klock/agent/session.ts).session_revoked.kind_unsupported
A service session is opened over a database or a local transfer job: resource {kind: "database" | "transfer-job", id}kind: "service" session was asked for without a resource, or over a kind of resource no service session stands for (a store). Service sessions are bound to one passwordless database session or one local transfer job.1.
prorm klock upgrade on the holder.2.
resource: {kind: "database", id, role, scope} or {kind: "transfer-job", id}.api/security/controllers/klock.ts).klock_unusable
Your klock session cannot be used ({reason}). Run 'prorm login' again.1.
prorm klock sync if the reason says a sync is needed.2.
prorm login.3.
--token or set PRORM_TOKEN.src/cli/core/cloud.ts).grant_expired, klock_tampered, check_in_required.lockdown
This account is locked down. Use account recovery, or wait for it to end.prorm lockdown (or the console’s Danger zone) on this account: every session was revoked, devices were suspended, and for 15 minutes every request of the account is refused — including from a session signed in after the lockdown. The body’s lockdownUntil says when the window ends.1.
lockdownUntil, sign in again, and run prorm lockdown release (it needs your authenticator code).2.
#/recover) gives a one-hour session that gets through the lockdown and can release it.3.
prorm devices reinstate <id>.api/middleware/accessRules.js), API (api/basic/routes/lockdown.js), klock service (api/klock/contract.ts).access_denied, fresh_signin_required.login_v2_required
This API no longer issues legacy CLI tokens at sign-in. Update the CLI and run 'prorm login' (klock v2).CAPABILITY_E3=1) the login flow (POST /security/sessions/cli and the v1 relay POST /security/cli-logins) stops minting v1 bearer tokens. Tokens already issued keep working until they expire. An explicit personal token (purpose: "token", 30 days at most) is still issued for --token / PRORM_TOKEN.1.
prorm login, which opens a klock v2 session.2.
--token or PRORM_TOKEN.api/basic/routes/security.js).mfa_not_enrolled
This account has no second factor to step up with1.
prorm security mfa enable, then prorm step-up.api/security/controllers/klock.ts).mfa_required
Admin accounts need a TOTP second factor. Enrol one, then try again.CAPABILITY_E3=1) every admin account must have a confirmed TOTP second factor, and the admin routes refuse an admin without one. The body carries enrol.setup and enrol.confirm, the enrolment routes, which stay open to the admin.1.
prorm security mfa enable (or the console security page), which calls POST /security/mfa/setup then POST /security/mfa/confirm.2.
prorm step-up --totp <code> before admin writes.api/auth.js).mfa_not_enrolled, step_up_required.not_bound
This session is not bound to a device key: use its v1 credential, or bind it (prorm klock upgrade)1.
prorm klock upgrade on the holder.2.
--klock-v2, which enrols the agent.api/security/routes/passwordless.js), API (api/basic/controllers/transfers.ts).device_signature_required.not_this_session
Only the session itself may do this1.
api/security/controllers/klock.ts).not_yours
That grant is not yours to hand over1.
prorm login again.api/basic/routes/security.js).password_browser_only
A password step-up is for the browser; use a TOTP code1.
prorm step-up --totp <code>, or prorm step-up --browser.api/security/controllers/klock.ts).recovery_failed
That recovery link or its details are not valid1.
2.
api/basic/routes/recovery.js).access_denied, too_many_attempts.rotation_proof_invalid
The new key's proof was refused: {reason}1.
prorm klock rotate; if it persists, prorm login to enrol afresh.api/security/controllers/klock.ts).service_session_scope
A service session is used only for what it stands for (its database session or transfer job), and to check in or rotate1.
prorm login on a machine the owner uses.2.
api/security/controllers/klock.ts).wrong_subject.session_expired
session_expiredexpiresAt / maxDuration. On the wire the API answers session_revoked with reason: expired; this code is what sessionIsLive returns to the klock service over RPC, and what the CLI also accepts.1.
prorm login.api/security/controllers/klock.ts), device agent / klock core (src/klock/agent/session.ts).session_revoked.session_frozen
This klock session is frozen1.
prorm step-up, then prorm sessions unfreeze <id>.2.
prorm login.api/security/controllers/klock.ts).step_up_required.session_limit
You have {count} {kind} sessions, the most allowed. Revoke one first.refuse. The body lists the live sessions.1.
prorm sessions.2.
prorm sessions revoke <id>.3.
api/security/controllers/klock.ts).session_required
The device holds no klock session1.
prorm login.api/klock/lib/credentials.ts), API (api/security/controllers/klockCredentials.ts).session_revoked.session_revoked
This klock session has ended ({reason}). Sign in again.reason: expired), idled out (reason: idle), does not exist (unknown), is not device-bound, or its account is gone. The CLI drops the local session when it sees this. As 409 it means the session you tried to revoke is already revoked.1.
prorm login.2.
prorm sessions and prorm security audit.api/security/controllers/klock.ts), klock service (api/klock/contract.ts), MCP Worker (workers/mcp/src/auth.ts).session_expired, idle_timeout, device_revoked.session_unknown
session_unknownsessionIsLive (API ← klock service RPC) found no session for the id. Over HTTP the API answers session_revoked with reason: unknown.1.
prorm login.api/security/controllers/klock.ts).session_revoked.step_up_failed
That code is not right1.
prorm step-up again with a fresh code.api/security/controllers/klock.ts).too_many_attempts, step_up_required.subject_unavailable
That passwordless session is revoked or expired1.
prorm passwordless issue) or create a new job, then bind that.api/security/controllers/klock.ts).team_not_active
That team is not one you are an active member of1.
prorm teams list; accept the invitation or pick another team.api/security/controllers/klock.ts), library (src/capabilities.ts).CapabilityResolutionError:team_not_active.team_not_found.team_not_found
You are not an active member of that team1.
prorm teams list.api/security/controllers/klock.ts).unknown_team.token_expired
That MCP client token has expired1.
prorm mcp clients create --name "<client>" --caps … --days <n>.api/security/controllers/mcpForward.ts).token_invalid.token_invalid
That MCP client token is not valid/security/mcp/* routes take only a delegated MCP client token (Authorization: Bearer prorm_dt_…), and this one is unknown, malformed, not a delegated token, or its account no longer exists.1.
prorm mcp clients create --name "<client>" --caps …, and put it in the client’s config.2.
prorm_dt_ prefix.api/security/controllers/mcpForward.ts).token_revoked, token_expired.token_revoked
That MCP client token was revokedprorm mcp clients revoke, from the console, by a lockdown, or when the local prorm mcp that created it stopped.1.
prorm mcp clients create, or restart prorm mcp.api/security/controllers/mcpForward.ts).token_invalid.too_many_attempts
Too many step-up attempts. Try again in a few minutes.1.
prorm step-up with a fresh code.api/security/controllers/klock.ts).totp_required
This account has a second factor: step up with a TOTP code1.
prorm step-up --totp <code>.api/security/controllers/klock.ts).wrong_subject
That service session stands for something else1.
prorm klock show).2.
prorm klock upgrade, or open an agent session for the job.api/security/controllers/klock.ts), API (api/basic/controllers/transfers.ts).service_session_scope, not_bound.Capabilities and step-up
access_check_unavailable
Access rules could not be checked right now. Try again shortly.1.
Retry-After seconds.2.
api/middleware/accessRules.js).access_denied.access_denied
access_deniedaccess.denied).1.
prorm access list and prorm access test.2.
#/recover): it skips account rules for an hour.3.
api/middleware/accessRules.js).would_lock_you_out, lockdown, recovery_failed.admin_not_delegable
Admin capabilities are never delegatedadmin:* capability was asked for on an MCP client token. Admin work needs a Klock session with a fresh step-up; no bearer ever holds it.1.
admin:* capability from --caps.api/security/controllers/mcpForward.ts).not_delegable.capabilities_unavailable
Could not resolve capabilities right nowGET /me/capabilities could not resolve the principal’s capabilities (a database hiccup).1.
api/basic/routes/me.js), MCP Worker (workers/mcp/src/auth.ts).capability_missing
This session cannot do thatneeds) this session’s ceiling, your team role, or the API key does not have. The body’s unlock says what would give it: login, upgrade, team-role, step-up or none.1.
unlock: login — sign in: prorm login.2.
unlock: upgrade — the plan does not include it: prorm billing plans.3.
unlock: team-role — ask a team owner or admin for a role that allows it.4.
unlock: none — an API key or narrowed session cannot do it; use a full session.api/middleware/capabilities.js), API (api/basic/routes/provision.js), API (api/basic/routes/transfers.js).step_up_required, unauthenticated.capability_required
A {provider} credential needs {caps}klock:sync for a person’s device, passwordless:use for a database host’s service session. It is re-resolved from live facts at issue. The same code covers a device kind that cannot hold the provider.1.
prorm login).2.
prorm klock upgrade).api/klock/lib/credentials.ts), API (api/security/controllers/klockCredentials.ts).provider_unavailable.confirmation_required
confirmation required: call again with confirm "{confirm}"1.
confirm: "<token>".2.
api/security/controllers/mcpForward.ts).invalid_profile
Invalid behaviour profilehttps://prod-orm.io/schemas/klock-profile.v1.json) or its extends does not resolve, the preset is unknown, the mode is not report or enforce, or the scope is not account, team, device, session or service.1.
prorm behaviour test --file profile.json.2.
prorm behaviour presets lists the presets a profile can extend (extends: "preset:<name>").api/controllers/behaviour.ts).invalid_rule
That rule is not validproblems lists each problem.1.
problems lists; prorm access add --help shows each dimension’s value.2.
prorm lockdown release, not by removing its rule.api/controllers/accessRules.ts).would_lock_you_out.not_delegable
These capabilities cannot be given to an MCP clientdelegated session mask: never other members’ devices or sessions, team-wide rules or profiles, or the right to create further MCP clients.1.
notDelegable from --caps.2.
api/security/controllers/mcpForward.ts).admin_not_delegable, unknown_capability.provider_unavailable
The {provider} provider is not available on the {plan} plan1.
prorm billing), or use the team whose plan includes it.2.
api/klock/lib/credentials.ts), API (api/security/controllers/klockCredentials.ts).capability_required.resource_in_other_team
That {kind} is already shared with another team. A resource belongs to at most one team: detach it there first.code field (with the message in error).1.
api/controllers/ownership.ts).step_up_required
This needs a fresh step-up: prorm step-upWWW-Authenticate: Klock error="step_up_required"; bearer sessions get 403.1.
prorm step-up (or prorm step-up --totp <code>), then the command again. On a terminal the CLI offers this itself.api/middleware/capabilities.js), API (api/auth.js), API (api/security/controllers/klock.ts).step_up_failed, capability_missing, mfa_not_enrolled.tool_not_found
Unknown tool1.
tools/list) and call one of those.2.
prorm mcp clients create --caps ….api/security/controllers/mcpForward.ts).capability_missing.transfer_quota_exceeded
the file-transfer quota is reached1.
Retry-After).2.
prorm klock inbox).3.
prorm billing plans.api/klock/routes/transfers.ts).transfer_too_large, rate_limited.transfer_recipient_refused
no device you may send files to has that name or idfiles:team, or it is suspended, revoked or has no certificate. All of these get the same answer, so the route does not reveal which device ids exist.files:team (roles owner, admin, operator) in a team you both belong to.1.
prorm devices list shows your own devices and their ids.2.
files:team.3.
support: with --reason.api/klock/lib/transfer-policy.ts).capability_missing.transfer_too_large
the transfer is over the per-transfer limit1.
prorm klock cp runs.2.
prorm billing plans.api/klock/routes/transfers.ts).transfer_quota_exceeded.unauthenticated
Sign in to do that1.
prorm login.api/middleware/capabilities.js), MCP Worker (workers/mcp/src/auth.ts).unknown_capability
Unknown capability ids1.
unknown against prorm whoami or the capabilities guide.2.
ns:* (for example resource:*) for a whole namespace.api/security/controllers/mcpForward.ts).not_delegable.unknown_kind
unknown session kind {kind}1.
src/capabilities.ts).CapabilityResolutionError:unknown_kind.unknown_team
Unknown team1.
prorm teams list, or pass no team to act for yourself.api/basic/routes/provision.js), API (api/basic/routes/transfers.js), API (api/team/routes/teams.js).team_not_found.would_lock_you_out
would_lock_you_outreasons say which allowlist or block it is; the CLI runs the same guard locally first.1.
prorm access test shows how a request is judged).2.
force: true (prorm access … --force): that needs a fresh step-up and a verified email address, which is how recovery reaches you.api/controllers/accessRules.ts), API (api/middleware/accessRules.js), device agent / klock core (src/klock/policy/access-rules.ts).access_denied, step_up_required.Grants
grant_expired
The grant has expired; refresh itexp. Grants are short; the session behind them usually is not. The CLI syncs for a new grant and retries once automatically.1.
prorm klock sync (online).2.
prorm login.api/security/controllers/klock.ts), device agent / klock core (src/klock/jws.ts), device agent / klock core (src/klock/agent/session.ts), outh (Go) (outh/internal/klockv2/grant.go), MCP Worker (workers/mcp/src/auth.ts).JwsError:expired.session_revoked, check_in_required.grant_invalid
The grant was refused: {reason}grant_invalid.1.
prorm klock sync.2.
prorm login.api/security/controllers/klock.ts), API (api/basic/routes/security.js), klock service (api/klock/lib/trust.ts), device agent / klock core (src/klock/agent/session.ts), MCP Worker (workers/mcp/src/auth.ts).grant_expired, klock_tampered, jws_bad_signature.grant_not_yet_valid
the grant is not valid yetnbf is ahead of this machine’s clock, beyond the allowed skew.1.
src/klock/jws.ts), outh (Go) (outh/internal/klockv2/grant.go).JwsError:not-yet-valid.clock_skew.grant_wrong_audience
the grant is not for {audience}aud does not include the verifier (api, klock, a database gate).1.
prorm login.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/grant.go).JwsError:wrong-audience.grant_wrong_device
the grant is bound to another device keydeviceKeyThumbprint is not this device’s key: the klock was copied from another machine, or the key was rotated without a new grant.1.
prorm klock sync; if that fails, prorm login to enrol this device.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/grant.go).JwsError:wrong-device.device_key_mismatch.grant_wrong_issuer
the grant is from {iss}, not {issuer}iss is not the API this klock is for — for example a staging grant against production.1.
PRORM_API_URL / the profile, then prorm login against the right API.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/grant.go).JwsError:wrong-issuer.Devices and enrolment
bad_pop
the proof of possession does not verify1.
prorm login; if it persists, upgrade the CLI.api/klock/lib/enrolment.ts), API (api/security/controllers/klock.ts).cert_invalid
the device certificate does not verify: {reason}certify_failed.1.
api/klock/lib/trust.ts).certify_failed
the API did not certify the device: {reason}1.
prorm login in a moment.api/klock/lib/enrolment.ts).cert_invalid.credential_not_active
the credential is {status}; request a new one1.
prorm klock certs request.api/klock/lib/credentials.ts).credential_not_found
no such credential on this device1.
prorm klock certs list.api/klock/lib/credentials.ts).device_key_enrolled
this device key is already enrolled1.
prorm klock sync to use the existing enrolment.api/klock/lib/enrolment.ts).device_key_in_use
this device key is enrolled to someone else1.
prorm logout, then prorm login.api/klock/lib/enrolment.ts).device_key_invalid
the {what} is not a 32-byte base64url key1.
prorm login.src/klock/agent/devicekey.ts).DeviceKeyError:bad-key.device_key_mismatch
The grant is for another device key; enrol this device again1.
prorm login to enrol this device again.api/security/controllers/klock.ts), klock service (api/klock/lib/device-auth.ts).HttpSigError:wrong-key.grant_wrong_device, klock_tampered.device_key_missing
the {what} is missingkeyStore: file).1.
prorm login.src/klock/agent/devicekey.ts), device agent / klock core (src/klock/agent/index.ts).DeviceKeyError:missing.device_key_revoked
this device key was revoked; generate a new one1.
prorm logout, then prorm login.api/klock/lib/enrolment.ts).device_mismatch
deviceId is not the signing devicedeviceId that is not the device whose key signed it (over RPC: the session is bound to another device).1.
prorm login if it was copied from elsewhere.api/klock/routes/sync.ts), API (api/security/controllers/klock.ts).device_key_mismatch.device_not_found
device_not_found: no device {id}1.
prorm devices list.api/klock/internal.ts).device_pending
the device is pending1.
prorm devices pair <code>, or in the console.api/klock/lib/device-auth.ts).device_revoked
the device is revoked1.
prorm login.2.
prorm devices list and prorm security audit from another device.api/klock/lib/device-auth.ts), MCP Worker (workers/mcp/src/auth.ts).session_revoked, device_key_revoked.device_suspended
the device is suspended/v2/credentials/*) do not, so a suspended device gets no certificate or principal.1.
prorm devices show <id>.api/klock/lib/device-auth.ts), klock service (api/klock/routes/credentials.ts).invalid_state
invalid_state: a {status} device cannot be suspended1.
prorm devices show <id>.api/klock/internal.ts).kerberos_realm_missing
The team has no Kerberos realm; create it first1.
kerberos:manage (owner, admin or security) creates the realm: POST /teams/:teamId/kerberos.2.
api/klock/providers/kerberos.ts).keychain_write_failed
could not write keychain entry {entry}1.
security unlock-keychain) and retry.2.
keyStore: file (the key then sits in the 0600 file).src/klock/agent/devicekey.ts).DeviceKeyError:store-failed.klock_service_unavailable
The klock service could not register the device: {reason}1.
prorm login in a moment; check https://status.prod-orm.io.api/security/controllers/klock.ts).pairing_expired
that pairing code has expired; start pairing again on the new device1.
prorm login --pair, and approve the new code.api/klock/internal.ts), API (api/controllers/devices.ts).pairing_not_found.pairing_kind_mismatch
The new device asked for a {kind} session, not {asked}--kind device (a trusted, lasting device) and the new device asked for interactive, or the reverse. The code is spent.1.
prorm devices pair --kind device\|interactive) and approve with the same --kind.api/controllers/devices.ts).pairing_used.pairing_not_found
no pairing has that code1.
KXQ7-M2PD).2.
prorm login --pair.api/klock/internal.ts), klock service (api/klock/routes/pair.ts), API (api/controllers/devices.ts).pairing_expired, pairing_used.pairing_used
that pairing code has already been approved1.
prorm login --pair.2.
prorm devices list.api/klock/internal.ts), API (api/controllers/devices.ts).pairing_not_found.provider_unknown
no credential provider {provider}/v2/credentials/<provider> for a provider the klock service (or the API) does not have. The providers are tls and kerberos.1.
prorm klock certs request for a TLS certificate.2.
api/klock/lib/credentials.ts), API (api/security/controllers/klockCredentials.ts).reason_required
Say why: a reason is required (it is kept in the audit log, and the owner is told)1.
--reason "…" (the CLI) or fill in the reason (the console).api/controllers/devices.ts).seal_binding_invalid
The seal binding was refused: {reason}1.
prorm login; if it persists, upgrade the CLI.api/security/controllers/klock.ts), klock service (api/klock/lib/enrolment.ts), klock service (api/klock/lib/trust.ts).ticket_expired
the enrolment ticket has expired1.
prorm login.api/klock/lib/enrolment.ts), klock service (api/klock/lib/trust.ts).ticket_invalid
The enrolment ticket does not verify: {reason}1.
prorm login.api/security/controllers/klock.ts), klock service (api/klock/lib/enrolment.ts), klock service (api/klock/lib/trust.ts).ticket_expired, ticket_used.ticket_used
this enrolment ticket has been used1.
prorm login.api/klock/lib/enrolment.ts).tls_delivery_invalid
the delivery carries no certificatetls credential delivery (from the credentials route or sync) had no certificate in it.1.
prorm klock sync, or prorm klock certs request.src/klock/providers/tls.ts).tls_key_invalid
the certificate is not for this device’s TLS key1.
prorm klock certs request.src/klock/providers/tls.ts).tls_not_enrolled
this klock has no enrolled device1.
prorm login (or prorm klock init on a host).src/klock/providers/tls.ts).tls_store_failed
the keychain refused the TLS key1.
src/klock/providers/tls.ts).transfer_expired
the transfer has expired1.
prorm klock cp.api/klock/routes/transfers.ts).transfer_not_found.transfer_not_found
no such transferprorm klock cp yet.prorm klock accept on the sending device.1.
prorm klock inbox on the receiving device for the ids waiting there.2.
prorm klock inbox --sent lists what it sent.api/klock/routes/transfers.ts).transfer_expired.transfer_sender_revoked
the sending device is no longer trusted; the transfer was cancelled1.
2.
prorm devices list and your security events.api/klock/routes/transfers.ts).device_revoked, device_suspended.unknown_device
no device is enrolled with this keybad_signature, so enrolment cannot be probed.1.
prorm login.api/klock/lib/device-auth.ts).device_revoked, bad_signature.Sync
command_invalid
the command does not verify: {reason}1.
api/klock/lib/trust.ts).feed_invalid
the revocation feed does not verify: {reason}1.
api/klock/lib/trust.ts), MCP Worker (workers/mcp/src/auth.ts).sync_bad_envelope
the sync answer does not verify: {reason}syncSeq, or there is no verified keyset to check it with.1.
prorm klock sync again; if it persists, prorm login.src/klock/agent/sync.ts), device agent / klock core (src/klock/agent/index.ts).SyncError:bad-envelope.sync_bad_grant
the synced grant does not verify: {reason}1.
prorm login.src/klock/agent/sync.ts).SyncError:bad-grant.sync_http
klock sync answered {status} ({code})1.
src/klock/agent/sync.ts).SyncError:http.sync_network
klock sync failed: {reason}1.
prorm klock sync. Until checkInBy, the session keeps working offline.src/klock/agent/sync.ts).SyncError:network.sync_no_device
the klock has no device to sync1.
prorm login, or upgrade a v1 file with prorm klock upgrade.src/klock/agent/sync.ts), device agent / klock core (src/klock/agent/index.ts).SyncError:no-device.sync_nonce_mismatch
the sync answer is not for this request (replayed?)echoNonce is not the nonce this request sent — an old answer replayed.1.
prorm klock sync again on a trusted network.src/klock/agent/sync.ts).SyncError:nonce-mismatch.sync_response_rollback
the sync answer's syncSeq {seq} is lower than {seen} (rollback)klock.sync-rollback.1.
prorm klock sync again on a trusted network.2.
src/klock/agent/sync.ts).SyncError:rollback.sync_rollback.sync_rollback
syncSeq {seq} is behind what this device has acknowledged ({ack})syncSeq is lower than one it already acknowledged: its klock was restored from a backup or copied from an older snapshot.1.
prorm login.api/klock/routes/sync.ts).sync_seq_ahead, sync_response_rollback.sync_seq_ahead
syncSeq {seq} is ahead of anything issued ({issued})syncSeq is higher than any the service issued — the klock was edited, or belongs to another deployment.1.
prorm login.api/klock/routes/sync.ts).Signatures and cryptography
bad_digest
Content-Digest does not match the body1.
api/klock/lib/device-auth.ts).HttpSigError:bad-digest.signature_invalid.bad_nonce
bad_nonceDeviceGuard Durable Object was asked to claim a nonce that is not 16–64 base64url characters. It is internal to the API.1.
api/sockets/device-guard.ts).bad_signature
the signature does not verify against an enrolled device key1.
prorm klock sync; if it fails, prorm login to enrol again.api/klock/lib/device-auth.ts).HttpSigError:bad-signature.signature_invalid, device_key_mismatch.canonical_json_invalid
non-integer number {n}1.
2.
src/klock/canonical.ts), outh (Go) (outh/internal/canon/canon.go).CanonicalJsonError.clock_skew
The request was signed too far from the server's timecreated is more than 60 seconds from the server’s clock. The answer carries Klock-Server-Time; the CLI adopts that offset and retries once automatically, so you see this only when the retry fails too.1.
sudo sntp -sS time.apple.com (macOS) or timedatectl set-ntp true (Linux).2.
api/security/controllers/klock.ts), klock service (api/klock/lib/device-auth.ts), MCP Worker (workers/mcp/src/auth.ts).HttpSigError:clock-skew.signature_expired, rpc_clock_skew.csr_attestation_invalid
csrAttestation is not the device key's signature over the CSR keyklock/csr/v1). It is checked against the enrolled device key by klock, and again by the API against the session’s key. Here it did not verify: a different device key, a different CSR key, or a tampered request.1.
prorm klock certs request again from the device itself.2.
prorm klock verify: the device key may not be this klock’s.api/klock/providers/tls.ts), API (api/security/controllers/klockCredentials.ts).device_key_mismatch.csr_invalid
csr is one PEM CERTIFICATE REQUEST1.
prorm klock certs request.2.
docs/guides/klock.md.api/klock/providers/tls.ts), API (api/security/controllers/klockCredentials.ts).csr_key_type, csr_subject_mismatch.csr_key_type
the TLS key must be P-256 ECDSA1.
prorm klock certs request.api/klock/providers/tls.ts), API (api/security/controllers/klockCredentials.ts).csr_invalid.csr_subject_mismatch
the CSR does not name this deviceCN=device/<deviceId> with exactly one URI name urn:prorm:device:<deviceId>, for the key the device attested. This CSR names another device, carries other names (DNS, IP, email, extra subject fields), or is for a different key than spki.1.
prorm klock certs request.api/security/controllers/klockCredentials.ts).csr_invalid, csr_attestation_invalid.jws_bad_alg
alg must be EdDSA, not {alg}EdDSA) signatures only; anything else is refused before any key is looked up.1.
prorm login, prorm klock sync).src/klock/jws.ts), outh (Go) (outh/internal/klockv2/jws.go).JwsError:bad-alg.jws_bad_header
unexpected header member {name}kid, or has members beyond alg, kid and typ.1.
prorm klock sync.2.
prorm login.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/jws.go).JwsError:bad-header.jws_bad_payload
not a klock v2 grant: {why}1.
prorm klock sync; if it persists, prorm login.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/grant.go).JwsError:bad-payload.jws_bad_signature
the signature does not verify1.
prorm klock sync.2.
prorm login.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/jws.go).JwsError:bad-signature.klock_tampered, grant_invalid.jws_bad_typ
typ must be {expected}, not {typ}typ (grant, device certificate, sync envelope, ticket, command); one kind was presented where another is required.1.
prorm klock sync for a fresh one.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/jws.go).JwsError:bad-typ.jws_malformed
a compact JWS has three parts1.
prorm klock sync to fetch a fresh copy.2.
prorm login.src/klock/jws.ts), outh (Go) (outh/internal/klockv2/jws.go).JwsError:malformed.grant_invalid.jws_unknown_kid
no key for kid {kid}1.
prorm klock sync online to refresh the keyset.2.
src/klock/jws.ts), outh (Go) (outh/internal/klockv2/jws.go).JwsError:unknown-kid.keyset_invalid, no_keyset.keytab_invalid
keytab: {reason}1.
prorm klock sync to receive the current keytab.2.
prorm klock kerberos rotate for a new key.src/klock/providers/kerberos.ts), outh (Go) (outh/internal/klockv2/keytab.go), klock service (api/klock/providers/kerberos.ts).KeytabError:keytab_invalid.seal_auth_failed, seal_invalid.nonce_replayed
That signed request was already used1.
2.
prorm sessions and revoke anything unknown.api/security/controllers/klock.ts).nonce_reused, rpc_replay.nonce_reused
this request has been seen beforenonce_replayed: a sync or channel request reused a nonce.1.
prorm klock sync again.api/klock/routes/sync.ts), klock service (api/klock/worker.ts).nonce_replayed.seal_auth_failed
AES-GCM: authentication failed1.
prorm klock sync so the server seals the secret to this device again.2.
src/klock/crypto.ts), outh (Go) (outh/internal/klockv2/seal.go).seal_invalid
malformed sealed box{"v":1,"epk","n","ct"} box, has extra members, or names a low-order X25519 key.1.
prorm klock sync to receive the credential again.src/klock/seal.ts), outh (Go) (outh/internal/klockv2/seal.go).seal_auth_failed.signature_expired
the signature has expiredexpires). The request was held too long before it arrived, or the clock is off.1.
2.
api/klock/lib/device-auth.ts).HttpSigError:expired.clock_skew.signature_incomplete
the signature must cover {component}@method, @authority, @path, @query, content-digest, authorization, klock-client, and idempotency-key / x-prorm-team when present).1.
api/klock/lib/device-auth.ts).HttpSigError:missing-component.signature_invalid.signature_invalid
The request signature was refused: {reason}Authorization: Klock request: a component is missing, the digest does not match the body, the key is not the grant’s device key, or the signature does not verify. The klock service reports the same failures with finer codes (bad_signature, bad_digest, signature_malformed, …).1.
prorm klock sync.2.
Authorization header.3.
prorm login.api/security/controllers/klock.ts), MCP Worker (workers/mcp/src/auth.ts).bad_signature, clock_skew, device_key_mismatch.signature_malformed
the signature keyid is not a device thumbprintSignature-Input / Signature headers do not parse, carry unexpected parameters, or lack the klock-v2 tag.1.
npm i -g ts-prorm-orm@latest); an old or third-party signer produced it.api/klock/lib/device-auth.ts).HttpSigError:malformed, HttpSigError:bad-params, HttpSigError:bad-tag.signature_invalid.transfer_chunk_corrupt
the chunk on the relay is not the one the sender stored1.
prorm klock refuse <id>) and ask the sender to send it again.2.
api/klock/lib/transfer-store.ts).transfer_key_invalid
wrappedKey is not a sealed 32-byte keyklock-seal-v1: a 32-byte ephemeral key, a 12-byte nonce and a 48-byte ciphertext). The relay cannot open it, but it refuses one that has the wrong shape.1.
prorm klock cp.api/klock/routes/transfers.ts).transfer_manifest_sig_invalid, seal_invalid.transfer_manifest_sig_invalid
the manifest signature does not verifyklock-manifest+jws over the transfer id and the manifest exactly as offered). The signature did not verify, was by another key, or covered another list or transfer. It is recorded as a tamper event.1.
prorm klock cp; if it happens again, run prorm klock verify.api/klock/routes/transfers.ts).transfer_key_invalid.unsigned
the request is not klock-signed: {reason}Authorization: Klock <grant> or Klock device=<thumbprint>.1.
2.
prorm login.api/klock/lib/device-auth.ts).signature_malformed.The .klock file
klock_coordinates_missing
the .klock does not say which {missing}; pass --{flags}databaseId, sessionId or role, for example because outh wrote it or rewrote a prorm file.1.
--database --session --role), or $OUTH_DATABASE / $OUTH_SESSION_ID.2.
prorm passwordless issue / prorm roles grant.src/cli/basic/commands/passwordless.ts), library (src/store-key.ts).klock_format_invalid
{path}: {reason}src/klock/klock-file.schema.json.1.
prorm klock show <path> to see what is wrong.2.
prorm passwordless issue, prorm login for a device session).src/klock/format.ts), device agent / klock core (src/klock/agent/store.ts), library (src/klock-io.ts), outh (Go) (outh/internal/klock/format.go).KlockStoreError:format, KlockFileError:format, KlockFormatError.klock_version_unsupported.klock_io_failed
cannot read {path}: {reason}1.
2.
security unlock-keychain) and try again.src/klock/agent/store.ts).KlockStoreError:io.klock_mode_insecure
{path} is mode {mode}; it must be 0600.klock holds a secret (v1) or names a device key (v2), so every reader refuses a file anyone but the owner can read.1.
chmod 600 <path>.2.
prorm passwordless revoke <session>, or prorm devices revoke <id> for a device) and re-issue.src/klock/agent/store.ts), library (src/klock-io.ts), outh (Go) (outh/internal/klock/klock.go).KlockStoreError:mode, KlockFileError:mode.klock_not_found
No .klock at {path}.--klock, then $OUTH_KLOCK, then ./.klock (for a profile klock, ~/.prorm/klock/<profile>.klock)../.klock.$OUTH_KLOCK points at an old location.1.
--klock, then $OUTH_KLOCK, then ./.klock.2.
prorm passwordless issue --database <id> --read (a cloud session) or prorm db init (a local database).3.
prorm login.src/klock/agent/store.ts), library (src/klock-io.ts), outh (Go) (outh/internal/klock/klock.go).KlockStoreError:not-found, KlockFileError:missing.klock_path_invalid.klock_overwrite_refused
{path} holds a klock of kind {kind} (a device identity); write this one elsewhere with --klock <file>passwordless issue, roles grant or db init would have overwritten a version 2 device identity or a klock sealed with an integrity tag.1.
--klock with another path.src/cli/basic/commands/passwordless.ts).klock_path_invalid
a profile name is letters, digits, '.', '_' and '-': {name}- was given where a file must be read, ~ has no home directory to expand to, or a profile name has characters outside [A-Za-z0-9._-].1.
--klock <file>.2.
., _ and -.3.
$HOME when running in a container or service account without one.src/klock/path.ts), outh (Go) (outh/internal/klock/path.go).klock_not_found.klock_read_only
refusing to write a version {version} klock1.
--klock <file>.src/klock/format.ts), device agent / klock core (src/klock/agent/store.ts), outh (Go) (outh/internal/klock/write.go).KlockStoreError:read-only.klock_secret_length
a local klock secret is 32 bytes; this one is {length}writeKlock was handed a secret that is not exactly 32 bytes.$OUTH_SESSION_SECRET was not the secret the issue response returned.1.
prorm passwordless issue) or re-run prorm db init for a 32-byte secret.2.
outh, set $OUTH_SESSION_SECRET to the exact secret, or unset it so outh keeps its own.src/local-klock.ts), library (src/store-key.ts), library (src/transfer/transfer-klock.ts), CLI (src/cli/basic/commands/passwordless.ts), outh (Go) (outh/internal/klock/klock.go).klock_secret_missing
{path} holds no secretsecret field is empty or missing. A version 2 service klock issued without a v1-compatible secret signs with its device key, which some readers do not do yet.1.
2.
src/local-klock.ts), library (src/store-key.ts), library (src/transfer/transfer-klock.ts), device agent / klock core (src/klock/format.ts), outh (Go) (outh/internal/klock/klock.go).klock_secret_length.klock_secret_ref_unresolved
{path}: the database password is not in the file (urlSecretRef {ref})urlSecretRef (env:NAME or keychain:<service>/<account>), and neither the environment, the .env beside the klock, nor this machine's keychain has it..env.1.
.env that prorm db init wrote beside the klock.2.
src/klock-io.ts).KlockFileError:secret-ref.klock_tampered
the klock integrity tag does not match (the file was edited)klock sync is tried, and the finding klock.tamper-detected is reported at the next sync.api URL).1.
prorm klock sync; the server re-issues the grant if the session and device key are still valid.2.
prorm login.3.
prorm devices list for devices you do not recognise and revoke them.src/klock/agent/store.ts), device agent / klock core (src/klock/agent/devicekey.ts), device agent / klock core (src/klock/agent/index.ts).DeviceKeyError:mismatch.grant_invalid, device_key_mismatch.klock_version_unsupported
{path} is version {version}; this build understands versions 1 and 2version is newer than this build understands, or missing. prorm klock show still shows a newer file, read-only.1.
npm i -g ts-prorm-orm@latest.2.
src/klock-io.ts), outh (Go) (outh/internal/klock/klock.go).KlockFileError:version.klock_read_only.klock_wrong_kind
{path} is a klock of kind {kind}, not a database session1.
--klock (or StoreKey.fromKlock) at the database session’s own .klock.2.
LocalKlockGate / prorm db serve, use the file prorm db init wrote. A cloud .klock belongs to StoreKey.src/klock-io.ts), library (src/local-klock.ts), library (src/store-key.ts), CLI (src/cli/basic/commands/passwordless.ts).KlockFileError:kind.The local gate
gate_auth_refused
present a valid klock token: Authorization: Klock <token>reason says why (missing, not valid, expired, not yet valid, already used).1.
LocalKlock.token()).2.
src/local-klock.ts).GateRefusedError:auth.gate_token_expired, gate_token_replayed, gate_token_invalid.gate_query_failed
the query failed; the gate logged why1.
prorm db serve) for the engine’s message.2.
exposeErrors: true to get the message in the response.src/local-klock.ts).gate_scope_refused
refused: this gate does not permit writesscope (ops or tables), or which tables it touches cannot be told.1.
scope in the gate’s klock and restart prorm db serve.src/local-klock.ts), library (src/local-klock-scope.ts).GateRefusedError:scope.gate_token_expired
refused: the token expired1.
src/local-klock.ts).gate_token_invalid
refused: the token is not valid1.
prorm db init writes both).src/local-klock.ts).gate_token_missing
refused: no tokenAuthorization: Klock <token>.1.
Authorization: Klock <token> from LocalKlock.token().src/local-klock.ts).gate_token_not_yet_valid
refused: the token is for a window not yet started1.
src/local-klock.ts).gate_token_replayed
refused: the token has already been used1.
src/local-klock.ts).Configuration and keys
authority_unavailable
The certificate authority could not signKERBEROS_AUTHORITY_URL/KERBEROS_AUTHORITY_TOKEN), or the authority answered with something the API refused to bind (a certificate for another key or subject).1.
2.
/healthz and the API’s KERBEROS_AUTHORITY_* settings.api/klock/providers/tls.ts), klock service (api/klock/lib/credentials.ts), API (api/security/controllers/klockCredentials.ts).crypto_unavailable
klock: no cryptography available (neither node:crypto nor WebCrypto)node:crypto nor WebCrypto with Ed25519 and X25519.1.
src/klock/crypto.ts).keyset_invalid
the API's keyset does not verify: {reason}1.
prorm klock sync later; upgrade the CLI if the roots were rotated.src/klock/keys.ts), klock service (api/klock/lib/trust.ts), MCP Worker (workers/mcp/src/auth.ts).KeysetError.keyset_rollback.keyset_rollback
keyset seq {seq} is older than {minSeq} (rollback)seq is lower than one already verified: an old keyset replayed, which could re-admit a retired key.1.
src/klock/keys.ts), klock service (api/klock/lib/trust.ts).klock_key_unpublished
the keyset does not publish klock key {kid}1.
KLOCK_SERVICE_KID, or fix the kid.api/klock/lib/trust.ts).klock_roots_invalid
PRORM_KLOCK_ROOTS must be a JSON array of {kid, x} Ed25519 roots{kid, x} keys. It is ignored in production builds.1.
PRORM_KLOCK_ROOTS.src/klock/keys.ts), outh (Go) (outh/internal/klockv2/roots.go).klock_unconfigured
KLOCK_RPC_PUB is not configured: ApiInternal refuses every callKLOCK_RPC_PUB, API_RPC_PUB, a klock seed) is missing or malformed, so every RPC call is refused.1.
api/controllers/klockGrants.ts), klock service (api/klock/env.ts).klock_v2_unavailable
klock v2 is not available: cannot {what}KLOCK_GRANT_KEY is not set, no verified keyset is published, or the keyset does not certify the key. Legacy bearers and API keys keep working.1.
prorm login --legacy), or retry later.2.
KLOCK_GRANT_KEY and publish a keyset (see docs/runbooks/credential-rotation.md).api/controllers/klockGrants.ts), API (api/security/controllers/klock.ts).no_keyset, klock_unconfigured.mcp_unavailable
The MCP tool registry on this API is out of datets-prorm-orm), or the key that confirmations and forwarded calls are signed with is not configured.1.
ts-prorm-orm whose mcp/registry has needs, and set JWT_SECRET.2.
prorm mcp and ordinary CLI commands keep working.api/security/controllers/mcpForward.ts).no_keyset
No klock keyset is published1.
api/basic/routes/security.js), klock service (api/klock/routes/public.ts), klock service (api/klock/lib/trust.ts), MCP Worker (workers/mcp/src/auth.ts).klock_v2_unavailable.secrets_key_missing
Passwordless access needs SECRETS_KEY to be configured1.
SECRETS_KEY on the API.api/security/routes/passwordless.js), API (api/basic/routes/security.js).tls_unavailable
WebCrypto is not available here1.
src/klock/providers/tls.ts).Protocol and RPC
api_unavailable
the revocation feed is unavailable1.
api/klock/routes/public.ts), klock service (api/klock/lib/enrolment.ts).bad_arguments
Missing argument: {name}1.
inputSchema requires.api/security/controllers/mcpForward.ts).bad_intent
The signed body is not one JSON-RPC tools/call/internal/mcp/forward must be exactly one JSON-RPC tools/call. The body was not JSON, was a batch, or was another method.1.
tools/call per request. A client that batches should call tools one at a time.api/security/controllers/mcpForward.ts).intent_mismatch.bad_request
the body is not an object1.
api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).body_too_large
the body is over {limit} bytes1.
api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).intent_mismatch
The relayed tool call is not the one the device signed1.
api/security/controllers/mcpForward.ts).bad_intent, signature_invalid.internal
klock could not complete the request1.
api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).method_not_allowed
use {allow}1.
api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).not_found
no such route1.
prorm sessions, prorm devices list.api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).not_implemented
pairing is not available yet (S2)1.
api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).policy_unavailable
the access rules could not be readgrantError: "policy_unavailable" and no grant.1.
2.
3.
API service binding and that the API’s KLOCK_RPC_PUB matches klock’s KLOCK_RPC_KEY.api/klock/lib/policy.ts), klock service (api/klock/routes/sync.ts), klock service (api/klock/routes/enrol.ts).access_denied, api_unavailable, klock_unconfigured.rate_limited
too many syncsRetry-After says when to try again.1.
Retry-After seconds, then retry.api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).rpc_args_mismatch
the arguments are not the ones signedErrors whose message starts with the code (rpc_args_mismatch: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/controllers/klockGrants.ts).rpc_bad_signature
the call signature does not verify: {reason}Errors whose message starts with the code (rpc_bad_signature: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/controllers/klockGrants.ts).rpc_clock_skew
the call was signed too far from nowiat is outside the allowed window: the two Workers’ clocks disagree or the call was delayed. RPC errors cross the service binding as Errors whose message starts with the code (rpc_clock_skew: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/controllers/klockGrants.ts).rpc_malformed
the call has no usable nonceErrors whose message starts with the code (rpc_malformed: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/controllers/klockGrants.ts).rpc_replay
the call nonce has been usedErrors whose message starts with the code (rpc_replay: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/security/controllers/klock.ts).rpc_unsigned
the call is not signedErrors whose message starts with the code (rpc_unsigned: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/controllers/klockGrants.ts).rpc_wrong_audience
the call is not for {aud}Errors whose message starts with the code (rpc_wrong_audience: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/controllers/klockGrants.ts).rpc_wrong_caller
the call is not signed by {keyid}Errors whose message starts with the code (rpc_wrong_caller: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts).rpc_wrong_method
the signature is for another methodErrors whose message starts with the code (rpc_wrong_method: …); users never see them directly, only as a failed request that depended on the call.1.
API_RPC_KEY/API_RPC_PUB and KLOCK_RPC_PUB are the matching pair on both Workers, and that both are deployed from the same release.api/klock/lib/rpc.ts), API (api/controllers/klockGrants.ts).transfer_chunk_exists
the chunk is already stored; a chunk cannot be replaced1.
prorm klock cp.api/klock/routes/transfers.ts).transfer_chunk_invalid
the chunk is not one this transfer has1.
prorm klock cp.api/klock/routes/transfers.ts).transfer_chunk_exists.transfer_chunk_missing
the chunk is no longer on the relay1.
prorm klock cp.api/klock/lib/transfer-store.ts), klock service (api/klock/routes/transfers.ts).transfer_expired.transfer_incomplete
some chunks have not been uploaded1.
prorm klock cp (an interrupted upload is not resumed).api/klock/routes/transfers.ts).transfer_manifest_invalid
the manifest is not acceptable: {reason}prorm klock accept: relative plain names (no absolute path, drive letter, .., . or empty segment, no control characters, each segment at most 255 bytes), no duplicates, sizes and SHA-256s well formed, at most 10000 files, and totalBytes, chunks and chunkSize that agree with the list.1.
2.
prorm klock cp itself sent this, report it: the client checks the same rules first.api/klock/routes/transfers.ts).upgrade_required
GET /v2/channel is a WebSocket/v2/channel is a WebSocket endpoint.1.
prorm klock agent does).api/klock/routes/router.ts), klock service (api/klock/lib/http.ts), API (api/sockets/device-guard.ts), API (api/security/controllers/klock.ts).v1 passwordless grants
device_signature_required
This session is bound to a device key: sign the request with it (klock v2)v2, so its v1 secret no longer opens it. Whoever still holds the old secret — an old copy of the file, outh before the upgrade — is refused.1.
2.
v1+v2 instead of v2.api/security/routes/passwordless.js).not_bound.v1_beyond_session
The grant exceeds the session: {what}1.
api/security/routes/passwordless.js).v1_client_cert_required
This session presents a client certificate; none arrived.--auth tls session was used without its certificate, or with someone else’s.1.
.klock with its tls block through StoreKey, which presents it on the mutually-authenticated endpoint.api/security/routes/passwordless.js).v1_credential_malformed
A credential is <body>.<signature><body>.<signature> in base64url, or its body is not a grant, names no role, or permits nothing.1.
StoreKey, or a current outh.api/security/controllers/passwordless.ts), device agent / klock core (src/klock/v1.ts), outh (Go) (outh/internal/grant/grant.go).v1_grant_not_canonical
The body carries more than the grant it decodes toouth that HTML-escaped <, > and & in table names.1.
StoreKey, or a current outh.api/security/controllers/passwordless.ts), device agent / klock core (src/klock/v1.ts), outh (Go) (outh/internal/grant/grant.go).v1_kerberos_refused
This session presents a Kerberos ticket; send it as Authorization: Negotiate <token>.--auth kerberos session was used without its ticket, with someone else’s, or the file has no kerberos block.1.
.klock with its kerberos block through StoreKey.2.
outh spnego, issue with --auth kerberos.api/security/routes/passwordless.js), library (src/store-key.ts).v1_kerberos_unavailable
The Kerberos authority could not check the ticket: {reason}1.
KERBEROS_AUTHORITY_TOKEN.api/security/routes/passwordless.js).v1_query_invalid
A query is one of select, insert, update or deleteselect\|insert\|update\|delete) naming its table, not SQL.1.
{ op, table, … }; see prorm passwordless query --help.api/security/routes/passwordless.js), CLI (src/cli/basic/commands/passwordless.ts).v1_role_gone
The role this session was granted no longer existsroles grant session was deleted.1.
prorm roles grant.api/security/routes/passwordless.js).v1_role_mismatch
The grant is for a different role than the sessionrole or entId in the file was changed, or overridden with --role / --ent-id.1.
api/security/routes/passwordless.js).v1_session_unusable
That session cannot be usedexpiresAt. The API deliberately does not say which.1.
prorm passwordless issue --database <id> --read.api/security/routes/passwordless.js).v1_signature_mismatch
The signature does not match this session1.
.klock that belongs to that sessionId, or re-issue.api/security/controllers/passwordless.ts), device agent / klock core (src/klock/v1.ts), outh (Go) (outh/internal/grant/grant.go).v1_unknown
Unknown session1.
prorm passwordless list and the database id.api/security/routes/passwordless.js).v1_window_expired
The grant expired about {age} seconds ago1.
api/security/controllers/passwordless.ts), device agent / klock core (src/klock/v1.ts), outh (Go) (outh/internal/grant/grant.go).v1_window_not_started
The grant is for a window that has not started1.
api/security/controllers/passwordless.ts), device agent / klock core (src/klock/v1.ts), outh (Go) (outh/internal/grant/grant.go).v1_wrong_database
That session is for a different database:id in the path is not the session’s database. A .klock written before databaseId was recorded sends the uuid when the holder is not signed in, which an API without the uuid/id fix refuses.1.
databaseId).2.
--database <id> or $OUTH_DATABASE; for StoreKey, databaseId.api/security/routes/passwordless.js).Modified at 2026-10-04 00:40:16