type-safe errors