Type Alias: ConnectionErrorCause

ConnectionErrorCause = "fifo-unsafe" | "in-flight-orphan" | "tls-verify" | "tls-handshake" | "framing-fatal"

Stable cause codes for MllpConnectionError.

These codes are a public API, they appear in error inspection by callers, log pipelines, and monitoring dashboards. Renaming or removing a member is a breaking change.

• 'fifo-unsafe', A queued send was rejected during reconnect because FIFO ordering cannot be safely resumed across sessions.
• 'in-flight-orphan', An in-flight send (already write-flushed, ACK timer started) was rejected during reconnect in FIFO mode because the at-most-once delivery contract cannot be preserved across a socket drop (healthcare medication/orders semantics).
• 'tls-verify', The TLS handshake failed certificate verification (untrusted chain, expired/not-yet-valid cert, hostname mismatch, revocation, …). See isTlsVerificationErrorCode for the exact underlying error codes. Classified permanent by isTransientConnectionError, never auto-reconnect-looped into a misconfigured or MITM'd endpoint.
• 'tls-handshake', A TLS-protocol-shaped handshake failure observed before 'secureConnect': ERR_SSL_* codes, EPROTO, or an OpenSSL alert-bearing error (protocol version mismatch, no shared cipher, a required mutual-TLS client certificate rejected by the server, …). See isTlsProtocolError for the boundary. Pure TCP-level failures (ECONNREFUSED, ETIMEDOUT, …) on a TLS-configured connection carry no connectionCause, the same shape as plaintext.

Scope note: the 'tls-verify'/'tls-handshake' values are attached on the client's initial connect() path. Failures on the auto-reconnect path surface as raw socket errors, their transient/permanent classification still applies, but they do not (yet) carry a connectionCause.

Example

if (err instanceof MllpConnectionError && err.connectionCause === 'in-flight-orphan') {
  // Treat as at-most-once: do NOT auto-retry; bubble up to caller for
  // application-level dedupe / replay decisions.
}