A request refused at the thread DO's identity boundary: the DO's name carries
no tenant, or the request's authenticated tenant is not the one the name
carries. Surfaced as 403 — this boundary is internal (a DO namespace is not
client-reachable and the Worker 404s a foreign threadId before forwarding),
so there is no existence oracle to protect here and a distinct status keeps a
routing bug from reading as a generic 500.
Extends DoStatusError because that is how a status opts in: this class is what
doErrorResponse recognizes, not the shape of its fields.
A request refused at the thread DO's identity boundary: the DO's name carries no tenant, or the request's authenticated tenant is not the one the name carries. Surfaced as 403 — this boundary is internal (a DO namespace is not client-reachable and the Worker 404s a foreign threadId before forwarding), so there is no existence oracle to protect here and a distinct status keeps a routing bug from reading as a generic 500.
Extends DoStatusError because that is how a status opts in: this class is what doErrorResponse recognizes, not the shape of its fields.