@peac/kernel 0.11.0 → 0.11.2

package/dist/index.cjs

@@ -301,10 +301,16 @@ var ERROR_CODES = {
   E_KEY_NOT_FOUND: "E_KEY_NOT_FOUND",
   // Verifier error codes
   E_VERIFY_EXTENSION_TOO_LARGE: "E_VERIFY_EXTENSION_TOO_LARGE",
+  E_VERIFY_INSECURE_SCHEME_BLOCKED: "E_VERIFY_INSECURE_SCHEME_BLOCKED",
   E_VERIFY_INVALID_TRANSPORT: "E_VERIFY_INVALID_TRANSPORT",
+  E_VERIFY_ISSUER_CONFIG_INVALID: "E_VERIFY_ISSUER_CONFIG_INVALID",
+  E_VERIFY_ISSUER_CONFIG_MISSING: "E_VERIFY_ISSUER_CONFIG_MISSING",
+  E_VERIFY_ISSUER_MISMATCH: "E_VERIFY_ISSUER_MISMATCH",
   E_VERIFY_ISSUER_NOT_ALLOWED: "E_VERIFY_ISSUER_NOT_ALLOWED",
+  E_VERIFY_JWKS_INVALID: "E_VERIFY_JWKS_INVALID",
   E_VERIFY_JWKS_TOO_LARGE: "E_VERIFY_JWKS_TOO_LARGE",
   E_VERIFY_JWKS_TOO_MANY_KEYS: "E_VERIFY_JWKS_TOO_MANY_KEYS",
+  E_VERIFY_JWKS_URI_INVALID: "E_VERIFY_JWKS_URI_INVALID",
   E_VERIFY_KEY_FETCH_BLOCKED: "E_VERIFY_KEY_FETCH_BLOCKED",
   E_VERIFY_KEY_FETCH_FAILED: "E_VERIFY_KEY_FETCH_FAILED",
   E_VERIFY_KEY_FETCH_TIMEOUT: "E_VERIFY_KEY_FETCH_TIMEOUT",
@@ -334,7 +340,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Chain Too Deep",
     description: "Attribution chain exceeds maximum allowed depth (8)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_CIRCULAR_CHAIN: {
@@ -342,7 +349,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Circular Chain",
     description: "Circular reference detected in attribution chain",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_EXPIRED: {
@@ -350,7 +358,8 @@ var ERRORS = {
     http_status: 401,
     title: "Attribution Expired",
     description: "Attribution attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_HASH_INVALID: {
@@ -358,7 +367,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Hash Invalid",
     description: "Content hash structure is invalid (wrong algorithm, encoding, or value length)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_FORMAT: {
@@ -366,7 +376,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Format",
     description: "Attribution attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_REF: {
@@ -374,7 +385,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Reference",
     description: "Receipt reference format is invalid (must be jti:{id}, URL, or URN)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_WEIGHT: {
@@ -382,7 +394,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Weight",
     description: "Attribution weight is out of valid range (must be 0.0-1.0)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_MISSING_SOURCES: {
@@ -390,7 +403,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Missing Sources",
     description: "Attribution attestation has empty sources array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_NOT_YET_VALID: {
@@ -398,7 +412,8 @@ var ERRORS = {
     http_status: 401,
     title: "Attribution Not Yet Valid",
     description: "Attribution attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_RESOLUTION_FAILED: {
@@ -406,7 +421,8 @@ var ERRORS = {
     http_status: 502,
     title: "Attribution Resolution Failed",
     description: "Failed to resolve receipt reference in attribution chain",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_RESOLUTION_TIMEOUT: {
@@ -414,7 +430,8 @@ var ERRORS = {
     http_status: 504,
     title: "Attribution Resolution Timeout",
     description: "Timeout while resolving receipt reference in attribution chain",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_SIZE_EXCEEDED: {
@@ -422,7 +439,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Size Exceeded",
     description: "Attribution attestation exceeds maximum size (64KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_TOO_MANY_SOURCES: {
@@ -430,7 +448,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Too Many Sources",
     description: "Attribution has too many sources (maximum 100)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_UNKNOWN_USAGE: {
@@ -438,7 +457,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Unknown Usage",
     description: "Attribution usage type is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   // Bundle error codes
@@ -447,7 +467,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Duplicate Receipt",
     description: "Bundle contains multiple receipts with the same ID",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_HASH_MISMATCH: {
@@ -455,7 +476,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Hash Mismatch",
     description: "File hash does not match value declared in manifest.json",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_INVALID_FORMAT: {
@@ -463,7 +485,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Invalid Format",
     description: "Bundle archive structure is invalid (not a valid ZIP or missing required files)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_KEY_MISSING: {
@@ -471,7 +494,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Key Missing",
     description: "Required signing key not found in bundle (offline verification mode)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MANIFEST_INVALID: {
@@ -479,7 +503,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Manifest Invalid",
     description: "manifest.json does not conform to schema or contains invalid values",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MANIFEST_MISSING: {
@@ -487,7 +512,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Manifest Missing",
     description: "manifest.json not found at bundle archive root",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MISSING_KEYS: {
@@ -495,7 +521,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Missing Keys",
     description: "No verification keys provided in bundle JWKS",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MISSING_RECEIPTS: {
@@ -503,7 +530,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Missing Receipts",
     description: "No receipts provided when creating bundle",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_PATH_TRAVERSAL: {
@@ -511,7 +539,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Path Traversal",
     description: "Bundle contains path traversal attack (zip-slip vulnerability)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_POLICY_HASH_MISMATCH: {
@@ -519,7 +548,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Policy Hash Mismatch",
     description: "Policy snapshot hash does not match policy used to evaluate receipts",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_RECEIPTS_UNORDERED: {
@@ -527,7 +557,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Receipts Unordered",
     description: "receipts.ndjson is not in deterministic order (issued_at, receipt_id, receipt_hash)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_RECEIPT_INVALID: {
@@ -535,7 +566,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Receipt Invalid",
     description: "Receipt JWS in bundle is malformed or missing required claims",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_SIGNATURE_INVALID: {
@@ -543,7 +575,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Signature Invalid",
     description: "bundle.sig JWS verification failed over manifest hash",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_SIZE_EXCEEDED: {
@@ -551,7 +584,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Size Exceeded",
     description: "Bundle exceeds size limits (entry count, entry size, or total size)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_TIME_RANGE_INVALID: {
@@ -559,7 +593,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Time Range Invalid",
     description: "Receipt issued_at is outside the bundle declared time_range",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   // Control error codes
@@ -568,7 +603,8 @@ var ERRORS = {
     http_status: 403,
     title: "Control Decision Denied",
     description: "Control engine denied authorization",
-    retriable: false,
+    retryable: false,
+    next_action: "contact_issuer",
     category: "control"
   },
   E_CONTROL_REVIEW_REQUIRED: {
@@ -576,7 +612,8 @@ var ERRORS = {
     http_status: 202,
     title: "Review Required",
     description: "Control engine requires manual review",
-    retriable: true,
+    retryable: true,
+    next_action: "contact_issuer",
     category: "control"
   },
   // Dispute error codes
@@ -585,7 +622,8 @@ var ERRORS = {
     http_status: 409,
     title: "Dispute Duplicate",
     description: "A dispute with this ID already exists",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_EXPIRED: {
@@ -593,7 +631,8 @@ var ERRORS = {
     http_status: 401,
     title: "Dispute Expired",
     description: "Dispute attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_FORMAT: {
@@ -601,7 +640,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Format",
     description: "Dispute attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_GROUNDS: {
@@ -609,7 +649,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Grounds",
     description: "Dispute grounds code is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_ID: {
@@ -617,7 +658,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid ID",
     description: "Dispute ID is not a valid ULID format (26 uppercase alphanumeric characters)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_STATE: {
@@ -625,7 +667,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid State",
     description: "Dispute state is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TARGET_TYPE: {
@@ -633,7 +676,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Target Type",
     description: "Dispute target type is not recognized (must be receipt, attribution, identity, or policy)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TRANSITION: {
@@ -641,7 +685,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Transition",
     description: "Invalid state transition for dispute lifecycle",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TYPE: {
@@ -649,7 +694,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Type",
     description: "Dispute type is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_MISSING_RESOLUTION: {
@@ -657,7 +703,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Missing Resolution",
     description: "Resolution is required for terminal states (resolved, rejected, final)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_NOT_YET_VALID: {
@@ -665,7 +712,8 @@ var ERRORS = {
     http_status: 401,
     title: "Dispute Not Yet Valid",
     description: "Dispute attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "dispute"
   },
   E_DISPUTE_OTHER_REQUIRES_DESCRIPTION: {
@@ -673,7 +721,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Other Requires Description",
     description: "Dispute type 'other' requires description of at least 50 characters",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_RESOLUTION_NOT_ALLOWED: {
@@ -681,7 +730,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Resolution Not Allowed",
     description: "Resolution is only valid for terminal states",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_TARGET_NOT_FOUND: {
@@ -689,7 +739,8 @@ var ERRORS = {
     http_status: 404,
     title: "Dispute Target Not Found",
     description: "The target receipt, attribution, or identity being disputed was not found",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "dispute"
   },
   // Identity error codes
@@ -698,7 +749,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Binding Future",
     description: "Identity binding signed_at timestamp is in the future",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_BINDING_MISMATCH: {
@@ -706,7 +758,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Binding Mismatch",
     description: "Identity binding does not match the request being verified",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_BINDING_STALE: {
@@ -714,7 +767,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Binding Stale",
     description: "Identity binding is too old and requires fresh binding",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_DIRECTORY_UNAVAILABLE: {
@@ -722,7 +776,8 @@ var ERRORS = {
     http_status: 503,
     title: "Identity Directory Unavailable",
     description: "Failed to fetch agent key directory",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_EXPIRED: {
@@ -730,7 +785,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Expired",
     description: "Agent identity attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_INVALID_FORMAT: {
@@ -738,7 +794,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Invalid Format",
     description: "Agent identity attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_KEY_EXPIRED: {
@@ -746,7 +803,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Expired",
     description: "Agent signing key has expired per directory metadata",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_KEY_REVOKED: {
@@ -754,7 +812,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Revoked",
     description: "Agent signing key has been explicitly revoked",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_KEY_UNKNOWN: {
@@ -762,7 +821,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Unknown",
     description: "Key ID not found in agent key directory",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_MISSING: {
@@ -770,7 +830,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Missing",
     description: "No agent identity attestation provided in request",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_NOT_YET_VALID: {
@@ -778,7 +839,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Not Yet Valid",
     description: "Agent identity attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_PROOF_UNSUPPORTED: {
@@ -786,7 +848,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Proof Unsupported",
     description: "Agent identity proof method is not supported",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_SIG_INVALID: {
@@ -794,7 +857,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Signature Invalid",
     description: "Agent identity proof signature verification failed",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   // Infrastructure error codes
@@ -803,7 +867,8 @@ var ERRORS = {
     http_status: 503,
     title: "Circuit Breaker Open",
     description: "Service temporarily unavailable due to circuit breaker",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_INTERNAL: {
@@ -811,7 +876,8 @@ var ERRORS = {
     http_status: 500,
     title: "Internal Error",
     description: "An unexpected internal error occurred during verification",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_JWKS_FETCH_FAILED: {
@@ -819,7 +885,8 @@ var ERRORS = {
     http_status: 503,
     title: "JWKS Fetch Failed",
     description: "Failed to fetch public keys from JWKS endpoint",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_RATE_LIMITED: {
@@ -827,7 +894,8 @@ var ERRORS = {
     http_status: 429,
     title: "Rate Limited",
     description: "Too many requests, please retry later",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   // Interaction error codes
@@ -836,7 +904,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Digest",
     description: "Digest structure is invalid (wrong value format or missing bytes)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_DIGEST_ALG: {
@@ -844,7 +913,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Digest Algorithm",
     description: "Digest algorithm is not in the canonical set (sha-256, sha-256:trunc-64k, sha-256:trunc-1m)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_EXTENSION_KEY: {
@@ -852,7 +922,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Extension Key",
     description: "Extension key does not match required format (reverse-DNS/name[@version])",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_FORMAT: {
@@ -860,7 +931,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Format",
     description: "Interaction evidence does not conform to InteractionEvidenceV01 schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_KIND_FORMAT: {
@@ -868,7 +940,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Kind Format",
     description: "Interaction kind does not match required format (lowercase, 2-128 chars, starts with letter)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_TIMING: {
@@ -876,7 +949,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Timing",
     description: "Timing constraint violated (completed_at < started_at or invalid datetime format)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_KIND_RESERVED: {
@@ -884,7 +958,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Kind Reserved",
     description: "Interaction kind uses reserved prefix (peac.*, org.peacprotocol.*) but is not in the well-known registry",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_ERROR_DETAIL: {
@@ -892,7 +967,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Error Detail",
     description: "error_code or extensions required when result.status is error",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_EXECUTOR: {
@@ -900,7 +976,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Executor",
     description: "Interaction evidence is missing required executor or executor.platform field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_ID: {
@@ -908,7 +985,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing ID",
     description: "Interaction evidence is missing required interaction_id field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_KIND: {
@@ -916,7 +994,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Kind",
     description: "Interaction evidence is missing required kind field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_RESULT: {
@@ -924,7 +1003,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Result",
     description: "result.status is required when output is present",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_STARTED_AT: {
@@ -932,7 +1012,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Started At",
     description: "Interaction evidence is missing required started_at field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_TARGET: {
@@ -940,7 +1021,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Target",
     description: "Kind prefix requires matching target field (tool.* needs tool, http.*/fs.* need resource)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   // Ucp error codes
@@ -949,7 +1031,8 @@ var ERRORS = {
     http_status: 500,
     title: "UCP Evidence Serialization Failed",
     description: "Failed to serialize UCP evidence to YAML format",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_ALGORITHM_MISMATCH: {
@@ -957,7 +1040,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Algorithm Mismatch",
     description: "Key type is not EC as required for ECDSA signatures",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_CURVE_MISMATCH: {
@@ -965,7 +1049,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Curve Mismatch",
     description: "Key curve does not match signature algorithm (ES256=P-256, ES384=P-384, ES512=P-521)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_NOT_FOUND: {
@@ -973,7 +1058,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Not Found",
     description: "Key ID from signature not found in business UCP profile",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "ucp"
   },
   E_UCP_ORDER_INVALID: {
@@ -981,7 +1067,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Invalid",
     description: "UCP order object does not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_ID: {
@@ -989,7 +1076,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing ID",
     description: "UCP order is missing required id field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_LINE_ITEMS: {
@@ -997,7 +1085,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing Line Items",
     description: "UCP order is missing required line_items array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_TOTALS: {
@@ -1005,7 +1094,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing Totals",
     description: "UCP order is missing required totals array or total entry",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_EMPTY: {
@@ -1013,7 +1103,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Empty",
     description: "Webhook request body is empty",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_NOT_JSON: {
@@ -1021,7 +1112,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Not JSON",
     description: "Webhook request body is not valid JSON",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_TOO_LARGE: {
@@ -1029,7 +1121,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Too Large",
     description: "Webhook request body exceeds maximum allowed size",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PROFILE_FETCH_FAILED: {
@@ -1037,7 +1130,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile Fetch Failed",
     description: "Failed to fetch business UCP profile from /.well-known/ucp",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "ucp"
   },
   E_UCP_PROFILE_INVALID: {
@@ -1045,7 +1139,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile Invalid",
     description: "Business UCP profile does not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PROFILE_NO_SIGNING_KEYS: {
@@ -1053,7 +1148,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile No Signing Keys",
     description: "Business UCP profile has empty or missing signing_keys array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_ALGORITHM_UNSUPPORTED: {
@@ -1061,7 +1157,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Algorithm Unsupported",
     description: "Signature algorithm is not ES256, ES384, or ES512",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_B64_INVALID: {
@@ -1069,7 +1166,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature b64 Invalid",
     description: "b64=false requires 'b64' in 'crit' array per RFC 7797",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_INVALID: {
@@ -1077,7 +1175,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Signature Invalid",
     description: "Webhook signature verification failed against payload",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_MALFORMED: {
@@ -1085,7 +1184,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Malformed",
     description: "Request-Signature header is not a valid detached JWS (RFC 7797)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_MISSING: {
@@ -1093,7 +1193,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Missing",
     description: "Request-Signature header is missing from UCP webhook request",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_VERIFICATION_FAILED: {
@@ -1101,7 +1202,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Verification Failed",
     description: "All verification attempts failed (raw and JCS canonicalized)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   // Validation error codes
@@ -1110,7 +1212,8 @@ var ERRORS = {
     http_status: 400,
     title: "Kernel Constraint Violation",
     description: "Receipt claims exceed a kernel constraint (max keys, max depth, max string length, max evidence bytes, or similar structural limit)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_EVIDENCE_NOT_JSON: {
@@ -1118,7 +1221,8 @@ var ERRORS = {
     http_status: 400,
     title: "Evidence Not JSON-Safe",
     description: "Evidence contains non-JSON-safe values (NaN, Infinity, undefined, BigInt, Date, Map, Set, functions, symbols, class instances, or cycles)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_EXPIRED: {
@@ -1126,7 +1230,8 @@ var ERRORS = {
     http_status: 400,
     title: "Receipt Expired",
     description: "Receipt has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_AMOUNT: {
@@ -1134,7 +1239,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Amount",
     description: "Payment amount is invalid or out of allowed range",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_AUDIENCE: {
@@ -1142,7 +1248,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Audience",
     description: "Receipt audience claim does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_CURRENCY: {
@@ -1150,7 +1257,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Currency",
     description: "Currency code is not a valid ISO 4217 code",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_FORMAT: {
@@ -1158,7 +1266,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Format",
     description: "Receipt does not conform to JWS format",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_ISSUER: {
@@ -1166,7 +1275,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Issuer",
     description: "Receipt issuer claim is invalid or untrusted",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_RAIL: {
@@ -1174,7 +1284,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Payment Rail",
     description: "Payment rail identifier is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_RECEIPT_ID: {
@@ -1182,7 +1293,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Receipt ID",
     description: "Receipt ID (rid) does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_SUBJECT: {
@@ -1190,7 +1302,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Subject",
     description: "Receipt subject claim does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_MISSING_EXP: {
@@ -1198,7 +1311,8 @@ var ERRORS = {
     http_status: 400,
     title: "Missing Expiration",
     description: "Receipt is missing required exp claim",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_MISSING_REQUIRED_CLAIM: {
@@ -1206,7 +1320,8 @@ var ERRORS = {
     http_status: 400,
     title: "Missing Required Claim",
     description: "Receipt is missing a required JWT claim",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_NOT_YET_VALID: {
@@ -1214,7 +1329,8 @@ var ERRORS = {
     http_status: 400,
     title: "Not Yet Valid",
     description: "Receipt nbf (not before) time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "validation"
   },
   E_PARSE_ATTESTATION_INVALID: {
@@ -1222,7 +1338,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attestation Receipt Invalid",
     description: "Receipt classified as attestation but fails attestation schema validation",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_PARSE_COMMERCE_INVALID: {
@@ -1230,7 +1347,8 @@ var ERRORS = {
     http_status: 400,
     title: "Commerce Receipt Invalid",
     description: "Receipt has commerce fields (amt/cur/payment) but fails commerce schema validation",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_PARSE_INVALID_INPUT: {
@@ -1238,7 +1356,8 @@ var ERRORS = {
     http_status: 400,
     title: "Parse Invalid Input",
     description: "Input to receipt parser is not a non-null object",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   // Verification error codes
@@ -1247,7 +1366,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Signature",
     description: "Receipt signature verification failed",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verification"
   },
   E_KEY_NOT_FOUND: {
@@ -1255,7 +1375,8 @@ var ERRORS = {
     http_status: 400,
     title: "Key Not Found",
     description: "Public key with specified kid not found in JWKS",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_key",
     category: "verification"
   },
   // Verifier error codes
@@ -1264,7 +1385,17 @@ var ERRORS = {
     http_status: 400,
     title: "Extension Too Large",
     description: "Receipt extension data exceeds maximum size limit (64 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_INSECURE_SCHEME_BLOCKED: {
+    code: "E_VERIFY_INSECURE_SCHEME_BLOCKED",
+    http_status: 403,
+    title: "Insecure Scheme Blocked",
+    description: "Non-HTTPS URL encountered during issuer discovery (issuer URL or jwks_uri)",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_INVALID_TRANSPORT: {
@@ -1272,7 +1403,35 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Transport",
     description: "Multiple PEAC-Receipt or PEAC-Receipt-Pointer headers detected (ambiguous transport)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_ISSUER_CONFIG_INVALID: {
+    code: "E_VERIFY_ISSUER_CONFIG_INVALID",
+    http_status: 502,
+    title: "Issuer Config Invalid",
+    description: "peac-issuer.json is not valid JSON or does not conform to issuer config schema",
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_ISSUER_CONFIG_MISSING: {
+    code: "E_VERIFY_ISSUER_CONFIG_MISSING",
+    http_status: 502,
+    title: "Issuer Config Missing",
+    description: "peac-issuer.json not found or not fetchable at issuer origin",
+    retryable: true,
+    next_action: "retry_after_delay",
+    category: "verifier"
+  },
+  E_VERIFY_ISSUER_MISMATCH: {
+    code: "E_VERIFY_ISSUER_MISMATCH",
+    http_status: 403,
+    title: "Issuer Mismatch",
+    description: "issuer field in peac-issuer.json does not match the expected issuer origin",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_ISSUER_NOT_ALLOWED: {
@@ -1280,7 +1439,17 @@ var ERRORS = {
     http_status: 403,
     title: "Issuer Not Allowed",
     description: "Receipt issuer is not in the verifier policy allowlist",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_JWKS_INVALID: {
+    code: "E_VERIFY_JWKS_INVALID",
+    http_status: 502,
+    title: "JWKS Invalid",
+    description: "JWKS response is not valid JSON or missing required keys array",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_TOO_LARGE: {
@@ -1288,7 +1457,8 @@ var ERRORS = {
     http_status: 400,
     title: "JWKS Too Large",
     description: "JWKS response exceeds maximum size limit (64 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_TOO_MANY_KEYS: {
@@ -1296,7 +1466,17 @@ var ERRORS = {
     http_status: 400,
     title: "JWKS Too Many Keys",
     description: "JWKS contains more than maximum allowed keys (20)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_JWKS_URI_INVALID: {
+    code: "E_VERIFY_JWKS_URI_INVALID",
+    http_status: 502,
+    title: "JWKS URI Invalid",
+    description: "jwks_uri in peac-issuer.json is not a valid HTTPS URL",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_BLOCKED: {
@@ -1304,7 +1484,8 @@ var ERRORS = {
     http_status: 403,
     title: "Key Fetch Blocked",
     description: "JWKS discovery blocked by SSRF protection (private IP, non-HTTPS, or blocked redirect)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_FAILED: {
@@ -1312,7 +1493,8 @@ var ERRORS = {
     http_status: 502,
     title: "Key Fetch Failed",
     description: "Network error while fetching JWKS from issuer",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_TIMEOUT: {
@@ -1320,7 +1502,8 @@ var ERRORS = {
     http_status: 504,
     title: "Key Fetch Timeout",
     description: "JWKS discovery timed out (5 second limit)",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_MALFORMED_RECEIPT: {
@@ -1328,7 +1511,8 @@ var ERRORS = {
     http_status: 400,
     title: "Malformed Receipt",
     description: "Cannot parse receipt as JWS Compact Serialization",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_DIGEST_MISMATCH: {
@@ -1336,7 +1520,8 @@ var ERRORS = {
     http_status: 400,
     title: "Pointer Digest Mismatch",
     description: "Fetched receipt SHA-256 digest does not match pointer declaration",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_BLOCKED: {
@@ -1344,7 +1529,8 @@ var ERRORS = {
     http_status: 403,
     title: "Pointer Fetch Blocked",
     description: "Pointer URL fetch blocked by SSRF protection (private IP, non-HTTPS, or blocked redirect)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_FAILED: {
@@ -1352,7 +1538,8 @@ var ERRORS = {
     http_status: 502,
     title: "Pointer Fetch Failed",
     description: "Network error while fetching receipt from pointer URL",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_TIMEOUT: {
@@ -1360,7 +1547,8 @@ var ERRORS = {
     http_status: 504,
     title: "Pointer Fetch Timeout",
     description: "Pointer URL fetch timed out (5 second limit)",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_TOO_LARGE: {
@@ -1368,7 +1556,8 @@ var ERRORS = {
     http_status: 413,
     title: "Pointer Fetch Too Large",
     description: "Pointer URL response exceeds maximum size limit (256 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POLICY_VIOLATION: {
@@ -1376,7 +1565,8 @@ var ERRORS = {
     http_status: 403,
     title: "Policy Violation",
     description: "Receipt violates verifier trust policy",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_RECEIPT_TOO_LARGE: {
@@ -1384,7 +1574,8 @@ var ERRORS = {
     http_status: 413,
     title: "Receipt Too Large",
     description: "Receipt exceeds maximum size limit (256 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_SCHEMA_INVALID: {
@@ -1392,7 +1583,8 @@ var ERRORS = {
     http_status: 400,
     title: "Schema Invalid",
     description: "Receipt claims do not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   // Workflow error codes
@@ -1401,7 +1593,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow Context",
     description: "Workflow context does not conform to WorkflowContextSchema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_CYCLE_DETECTED: {
@@ -1409,7 +1602,8 @@ var ERRORS = {
     http_status: 400,
     title: "Workflow Cycle Detected",
     description: "Workflow DAG contains a cycle (not acyclic)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_DAG_INVALID: {
@@ -1417,7 +1611,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow DAG",
     description: "Workflow DAG semantics violated (self-parent, duplicate parents, or cycle detected)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_ID_INVALID: {
@@ -1425,7 +1620,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow ID",
     description: "Workflow ID does not match required format (wf_{ulid|uuid})",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_LIMIT_EXCEEDED: {
@@ -1433,7 +1629,8 @@ var ERRORS = {
     http_status: 400,
     title: "Workflow Limit Exceeded",
     description: "Workflow exceeds defined limits (parent count, ID length, etc.)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_PARENT_NOT_FOUND: {
@@ -1441,7 +1638,8 @@ var ERRORS = {
     http_status: 400,
     title: "Parent Step Not Found",
     description: "Referenced parent step ID does not exist in the workflow",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_STEP_ID_INVALID: {
@@ -1449,7 +1647,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Step ID",
     description: "Step ID does not match required format (step_{ulid|uuid})",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_SUMMARY_INVALID: {
@@ -1457,15 +1656,16 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow Summary",
     description: "Workflow summary attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   }
 };
 function getError(code) {
   return ERRORS[code];
 }
-function isRetriable(code) {
-  return ERRORS[code]?.retriable ?? false;
+function isRetryable(code) {
+  return ERRORS[code]?.retryable ?? false;
 }
 var BUNDLE_ERRORS = {
   DUPLICATE_RECEIPT: "E_BUNDLE_DUPLICATE_RECEIPT",
@@ -1653,6 +1853,10 @@ function needsPurposeVary(purposeEnforced) {
   return purposeEnforced;
 }
 
+// src/carrier.ts
+var PEAC_RECEIPT_HEADER = "PEAC-Receipt";
+var PEAC_RECEIPT_URL_HEADER = "PEAC-Receipt-URL";
+
 exports.AGENT_PROTOCOLS = AGENT_PROTOCOLS;
 exports.ALGORITHMS = ALGORITHMS;
 exports.BUNDLE_ERRORS = BUNDLE_ERRORS;
@@ -1670,6 +1874,8 @@ exports.ISSUER_CONFIG = ISSUER_CONFIG;
 exports.JWKS = JWKS;
 exports.LIMITS = LIMITS;
 exports.PAYMENT_RAILS = PAYMENT_RAILS;
+exports.PEAC_RECEIPT_HEADER = PEAC_RECEIPT_HEADER;
+exports.PEAC_RECEIPT_URL_HEADER = PEAC_RECEIPT_URL_HEADER;
 exports.POLICY = POLICY;
 exports.PRIVATE_IP_RANGES = PRIVATE_IP_RANGES;
 exports.RECEIPT = RECEIPT;
@@ -1691,7 +1897,7 @@ exports.findTransportMethod = findTransportMethod;
 exports.formatHash = formatHash;
 exports.getError = getError;
 exports.getPeacVaryHeaders = getPeacVaryHeaders;
-exports.isRetriable = isRetriable;
+exports.isRetryable = isRetryable;
 exports.isValidHash = isValidHash;
 exports.needsPurposeVary = needsPurposeVary;
 exports.parseHash = parseHash;