@peac/kernel 0.11.0 → 0.11.2

package/dist/index.mjs

@@ -299,10 +299,16 @@ var ERROR_CODES = {
   E_KEY_NOT_FOUND: "E_KEY_NOT_FOUND",
   // Verifier error codes
   E_VERIFY_EXTENSION_TOO_LARGE: "E_VERIFY_EXTENSION_TOO_LARGE",
+  E_VERIFY_INSECURE_SCHEME_BLOCKED: "E_VERIFY_INSECURE_SCHEME_BLOCKED",
   E_VERIFY_INVALID_TRANSPORT: "E_VERIFY_INVALID_TRANSPORT",
+  E_VERIFY_ISSUER_CONFIG_INVALID: "E_VERIFY_ISSUER_CONFIG_INVALID",
+  E_VERIFY_ISSUER_CONFIG_MISSING: "E_VERIFY_ISSUER_CONFIG_MISSING",
+  E_VERIFY_ISSUER_MISMATCH: "E_VERIFY_ISSUER_MISMATCH",
   E_VERIFY_ISSUER_NOT_ALLOWED: "E_VERIFY_ISSUER_NOT_ALLOWED",
+  E_VERIFY_JWKS_INVALID: "E_VERIFY_JWKS_INVALID",
   E_VERIFY_JWKS_TOO_LARGE: "E_VERIFY_JWKS_TOO_LARGE",
   E_VERIFY_JWKS_TOO_MANY_KEYS: "E_VERIFY_JWKS_TOO_MANY_KEYS",
+  E_VERIFY_JWKS_URI_INVALID: "E_VERIFY_JWKS_URI_INVALID",
   E_VERIFY_KEY_FETCH_BLOCKED: "E_VERIFY_KEY_FETCH_BLOCKED",
   E_VERIFY_KEY_FETCH_FAILED: "E_VERIFY_KEY_FETCH_FAILED",
   E_VERIFY_KEY_FETCH_TIMEOUT: "E_VERIFY_KEY_FETCH_TIMEOUT",
@@ -332,7 +338,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Chain Too Deep",
     description: "Attribution chain exceeds maximum allowed depth (8)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_CIRCULAR_CHAIN: {
@@ -340,7 +347,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Circular Chain",
     description: "Circular reference detected in attribution chain",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_EXPIRED: {
@@ -348,7 +356,8 @@ var ERRORS = {
     http_status: 401,
     title: "Attribution Expired",
     description: "Attribution attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_HASH_INVALID: {
@@ -356,7 +365,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Hash Invalid",
     description: "Content hash structure is invalid (wrong algorithm, encoding, or value length)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_FORMAT: {
@@ -364,7 +374,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Format",
     description: "Attribution attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_REF: {
@@ -372,7 +383,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Reference",
     description: "Receipt reference format is invalid (must be jti:{id}, URL, or URN)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_WEIGHT: {
@@ -380,7 +392,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Weight",
     description: "Attribution weight is out of valid range (must be 0.0-1.0)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_MISSING_SOURCES: {
@@ -388,7 +401,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Missing Sources",
     description: "Attribution attestation has empty sources array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_NOT_YET_VALID: {
@@ -396,7 +410,8 @@ var ERRORS = {
     http_status: 401,
     title: "Attribution Not Yet Valid",
     description: "Attribution attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_RESOLUTION_FAILED: {
@@ -404,7 +419,8 @@ var ERRORS = {
     http_status: 502,
     title: "Attribution Resolution Failed",
     description: "Failed to resolve receipt reference in attribution chain",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_RESOLUTION_TIMEOUT: {
@@ -412,7 +428,8 @@ var ERRORS = {
     http_status: 504,
     title: "Attribution Resolution Timeout",
     description: "Timeout while resolving receipt reference in attribution chain",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_SIZE_EXCEEDED: {
@@ -420,7 +437,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Size Exceeded",
     description: "Attribution attestation exceeds maximum size (64KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_TOO_MANY_SOURCES: {
@@ -428,7 +446,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Too Many Sources",
     description: "Attribution has too many sources (maximum 100)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_UNKNOWN_USAGE: {
@@ -436,7 +455,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Unknown Usage",
     description: "Attribution usage type is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   // Bundle error codes
@@ -445,7 +465,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Duplicate Receipt",
     description: "Bundle contains multiple receipts with the same ID",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_HASH_MISMATCH: {
@@ -453,7 +474,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Hash Mismatch",
     description: "File hash does not match value declared in manifest.json",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_INVALID_FORMAT: {
@@ -461,7 +483,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Invalid Format",
     description: "Bundle archive structure is invalid (not a valid ZIP or missing required files)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_KEY_MISSING: {
@@ -469,7 +492,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Key Missing",
     description: "Required signing key not found in bundle (offline verification mode)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MANIFEST_INVALID: {
@@ -477,7 +501,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Manifest Invalid",
     description: "manifest.json does not conform to schema or contains invalid values",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MANIFEST_MISSING: {
@@ -485,7 +510,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Manifest Missing",
     description: "manifest.json not found at bundle archive root",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MISSING_KEYS: {
@@ -493,7 +519,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Missing Keys",
     description: "No verification keys provided in bundle JWKS",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MISSING_RECEIPTS: {
@@ -501,7 +528,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Missing Receipts",
     description: "No receipts provided when creating bundle",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_PATH_TRAVERSAL: {
@@ -509,7 +537,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Path Traversal",
     description: "Bundle contains path traversal attack (zip-slip vulnerability)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_POLICY_HASH_MISMATCH: {
@@ -517,7 +546,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Policy Hash Mismatch",
     description: "Policy snapshot hash does not match policy used to evaluate receipts",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_RECEIPTS_UNORDERED: {
@@ -525,7 +555,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Receipts Unordered",
     description: "receipts.ndjson is not in deterministic order (issued_at, receipt_id, receipt_hash)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_RECEIPT_INVALID: {
@@ -533,7 +564,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Receipt Invalid",
     description: "Receipt JWS in bundle is malformed or missing required claims",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_SIGNATURE_INVALID: {
@@ -541,7 +573,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Signature Invalid",
     description: "bundle.sig JWS verification failed over manifest hash",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_SIZE_EXCEEDED: {
@@ -549,7 +582,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Size Exceeded",
     description: "Bundle exceeds size limits (entry count, entry size, or total size)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_TIME_RANGE_INVALID: {
@@ -557,7 +591,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Time Range Invalid",
     description: "Receipt issued_at is outside the bundle declared time_range",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   // Control error codes
@@ -566,7 +601,8 @@ var ERRORS = {
     http_status: 403,
     title: "Control Decision Denied",
     description: "Control engine denied authorization",
-    retriable: false,
+    retryable: false,
+    next_action: "contact_issuer",
     category: "control"
   },
   E_CONTROL_REVIEW_REQUIRED: {
@@ -574,7 +610,8 @@ var ERRORS = {
     http_status: 202,
     title: "Review Required",
     description: "Control engine requires manual review",
-    retriable: true,
+    retryable: true,
+    next_action: "contact_issuer",
     category: "control"
   },
   // Dispute error codes
@@ -583,7 +620,8 @@ var ERRORS = {
     http_status: 409,
     title: "Dispute Duplicate",
     description: "A dispute with this ID already exists",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_EXPIRED: {
@@ -591,7 +629,8 @@ var ERRORS = {
     http_status: 401,
     title: "Dispute Expired",
     description: "Dispute attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_FORMAT: {
@@ -599,7 +638,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Format",
     description: "Dispute attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_GROUNDS: {
@@ -607,7 +647,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Grounds",
     description: "Dispute grounds code is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_ID: {
@@ -615,7 +656,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid ID",
     description: "Dispute ID is not a valid ULID format (26 uppercase alphanumeric characters)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_STATE: {
@@ -623,7 +665,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid State",
     description: "Dispute state is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TARGET_TYPE: {
@@ -631,7 +674,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Target Type",
     description: "Dispute target type is not recognized (must be receipt, attribution, identity, or policy)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TRANSITION: {
@@ -639,7 +683,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Transition",
     description: "Invalid state transition for dispute lifecycle",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TYPE: {
@@ -647,7 +692,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Type",
     description: "Dispute type is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_MISSING_RESOLUTION: {
@@ -655,7 +701,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Missing Resolution",
     description: "Resolution is required for terminal states (resolved, rejected, final)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_NOT_YET_VALID: {
@@ -663,7 +710,8 @@ var ERRORS = {
     http_status: 401,
     title: "Dispute Not Yet Valid",
     description: "Dispute attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "dispute"
   },
   E_DISPUTE_OTHER_REQUIRES_DESCRIPTION: {
@@ -671,7 +719,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Other Requires Description",
     description: "Dispute type 'other' requires description of at least 50 characters",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_RESOLUTION_NOT_ALLOWED: {
@@ -679,7 +728,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Resolution Not Allowed",
     description: "Resolution is only valid for terminal states",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_TARGET_NOT_FOUND: {
@@ -687,7 +737,8 @@ var ERRORS = {
     http_status: 404,
     title: "Dispute Target Not Found",
     description: "The target receipt, attribution, or identity being disputed was not found",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "dispute"
   },
   // Identity error codes
@@ -696,7 +747,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Binding Future",
     description: "Identity binding signed_at timestamp is in the future",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_BINDING_MISMATCH: {
@@ -704,7 +756,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Binding Mismatch",
     description: "Identity binding does not match the request being verified",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_BINDING_STALE: {
@@ -712,7 +765,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Binding Stale",
     description: "Identity binding is too old and requires fresh binding",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_DIRECTORY_UNAVAILABLE: {
@@ -720,7 +774,8 @@ var ERRORS = {
     http_status: 503,
     title: "Identity Directory Unavailable",
     description: "Failed to fetch agent key directory",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_EXPIRED: {
@@ -728,7 +783,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Expired",
     description: "Agent identity attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_INVALID_FORMAT: {
@@ -736,7 +792,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Invalid Format",
     description: "Agent identity attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_KEY_EXPIRED: {
@@ -744,7 +801,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Expired",
     description: "Agent signing key has expired per directory metadata",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_KEY_REVOKED: {
@@ -752,7 +810,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Revoked",
     description: "Agent signing key has been explicitly revoked",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_KEY_UNKNOWN: {
@@ -760,7 +819,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Unknown",
     description: "Key ID not found in agent key directory",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_MISSING: {
@@ -768,7 +828,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Missing",
     description: "No agent identity attestation provided in request",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_NOT_YET_VALID: {
@@ -776,7 +837,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Not Yet Valid",
     description: "Agent identity attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_PROOF_UNSUPPORTED: {
@@ -784,7 +846,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Proof Unsupported",
     description: "Agent identity proof method is not supported",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_SIG_INVALID: {
@@ -792,7 +855,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Signature Invalid",
     description: "Agent identity proof signature verification failed",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   // Infrastructure error codes
@@ -801,7 +865,8 @@ var ERRORS = {
     http_status: 503,
     title: "Circuit Breaker Open",
     description: "Service temporarily unavailable due to circuit breaker",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_INTERNAL: {
@@ -809,7 +874,8 @@ var ERRORS = {
     http_status: 500,
     title: "Internal Error",
     description: "An unexpected internal error occurred during verification",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_JWKS_FETCH_FAILED: {
@@ -817,7 +883,8 @@ var ERRORS = {
     http_status: 503,
     title: "JWKS Fetch Failed",
     description: "Failed to fetch public keys from JWKS endpoint",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_RATE_LIMITED: {
@@ -825,7 +892,8 @@ var ERRORS = {
     http_status: 429,
     title: "Rate Limited",
     description: "Too many requests, please retry later",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   // Interaction error codes
@@ -834,7 +902,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Digest",
     description: "Digest structure is invalid (wrong value format or missing bytes)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_DIGEST_ALG: {
@@ -842,7 +911,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Digest Algorithm",
     description: "Digest algorithm is not in the canonical set (sha-256, sha-256:trunc-64k, sha-256:trunc-1m)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_EXTENSION_KEY: {
@@ -850,7 +920,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Extension Key",
     description: "Extension key does not match required format (reverse-DNS/name[@version])",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_FORMAT: {
@@ -858,7 +929,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Format",
     description: "Interaction evidence does not conform to InteractionEvidenceV01 schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_KIND_FORMAT: {
@@ -866,7 +938,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Kind Format",
     description: "Interaction kind does not match required format (lowercase, 2-128 chars, starts with letter)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_TIMING: {
@@ -874,7 +947,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Timing",
     description: "Timing constraint violated (completed_at < started_at or invalid datetime format)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_KIND_RESERVED: {
@@ -882,7 +956,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Kind Reserved",
     description: "Interaction kind uses reserved prefix (peac.*, org.peacprotocol.*) but is not in the well-known registry",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_ERROR_DETAIL: {
@@ -890,7 +965,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Error Detail",
     description: "error_code or extensions required when result.status is error",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_EXECUTOR: {
@@ -898,7 +974,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Executor",
     description: "Interaction evidence is missing required executor or executor.platform field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_ID: {
@@ -906,7 +983,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing ID",
     description: "Interaction evidence is missing required interaction_id field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_KIND: {
@@ -914,7 +992,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Kind",
     description: "Interaction evidence is missing required kind field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_RESULT: {
@@ -922,7 +1001,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Result",
     description: "result.status is required when output is present",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_STARTED_AT: {
@@ -930,7 +1010,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Started At",
     description: "Interaction evidence is missing required started_at field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_TARGET: {
@@ -938,7 +1019,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Target",
     description: "Kind prefix requires matching target field (tool.* needs tool, http.*/fs.* need resource)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   // Ucp error codes
@@ -947,7 +1029,8 @@ var ERRORS = {
     http_status: 500,
     title: "UCP Evidence Serialization Failed",
     description: "Failed to serialize UCP evidence to YAML format",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_ALGORITHM_MISMATCH: {
@@ -955,7 +1038,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Algorithm Mismatch",
     description: "Key type is not EC as required for ECDSA signatures",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_CURVE_MISMATCH: {
@@ -963,7 +1047,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Curve Mismatch",
     description: "Key curve does not match signature algorithm (ES256=P-256, ES384=P-384, ES512=P-521)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_NOT_FOUND: {
@@ -971,7 +1056,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Not Found",
     description: "Key ID from signature not found in business UCP profile",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "ucp"
   },
   E_UCP_ORDER_INVALID: {
@@ -979,7 +1065,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Invalid",
     description: "UCP order object does not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_ID: {
@@ -987,7 +1074,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing ID",
     description: "UCP order is missing required id field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_LINE_ITEMS: {
@@ -995,7 +1083,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing Line Items",
     description: "UCP order is missing required line_items array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_TOTALS: {
@@ -1003,7 +1092,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing Totals",
     description: "UCP order is missing required totals array or total entry",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_EMPTY: {
@@ -1011,7 +1101,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Empty",
     description: "Webhook request body is empty",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_NOT_JSON: {
@@ -1019,7 +1110,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Not JSON",
     description: "Webhook request body is not valid JSON",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_TOO_LARGE: {
@@ -1027,7 +1119,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Too Large",
     description: "Webhook request body exceeds maximum allowed size",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PROFILE_FETCH_FAILED: {
@@ -1035,7 +1128,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile Fetch Failed",
     description: "Failed to fetch business UCP profile from /.well-known/ucp",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "ucp"
   },
   E_UCP_PROFILE_INVALID: {
@@ -1043,7 +1137,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile Invalid",
     description: "Business UCP profile does not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PROFILE_NO_SIGNING_KEYS: {
@@ -1051,7 +1146,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile No Signing Keys",
     description: "Business UCP profile has empty or missing signing_keys array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_ALGORITHM_UNSUPPORTED: {
@@ -1059,7 +1155,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Algorithm Unsupported",
     description: "Signature algorithm is not ES256, ES384, or ES512",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_B64_INVALID: {
@@ -1067,7 +1164,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature b64 Invalid",
     description: "b64=false requires 'b64' in 'crit' array per RFC 7797",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_INVALID: {
@@ -1075,7 +1173,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Signature Invalid",
     description: "Webhook signature verification failed against payload",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_MALFORMED: {
@@ -1083,7 +1182,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Malformed",
     description: "Request-Signature header is not a valid detached JWS (RFC 7797)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_MISSING: {
@@ -1091,7 +1191,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Missing",
     description: "Request-Signature header is missing from UCP webhook request",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_VERIFICATION_FAILED: {
@@ -1099,7 +1200,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Verification Failed",
     description: "All verification attempts failed (raw and JCS canonicalized)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   // Validation error codes
@@ -1108,7 +1210,8 @@ var ERRORS = {
     http_status: 400,
     title: "Kernel Constraint Violation",
     description: "Receipt claims exceed a kernel constraint (max keys, max depth, max string length, max evidence bytes, or similar structural limit)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_EVIDENCE_NOT_JSON: {
@@ -1116,7 +1219,8 @@ var ERRORS = {
     http_status: 400,
     title: "Evidence Not JSON-Safe",
     description: "Evidence contains non-JSON-safe values (NaN, Infinity, undefined, BigInt, Date, Map, Set, functions, symbols, class instances, or cycles)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_EXPIRED: {
@@ -1124,7 +1228,8 @@ var ERRORS = {
     http_status: 400,
     title: "Receipt Expired",
     description: "Receipt has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_AMOUNT: {
@@ -1132,7 +1237,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Amount",
     description: "Payment amount is invalid or out of allowed range",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_AUDIENCE: {
@@ -1140,7 +1246,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Audience",
     description: "Receipt audience claim does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_CURRENCY: {
@@ -1148,7 +1255,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Currency",
     description: "Currency code is not a valid ISO 4217 code",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_FORMAT: {
@@ -1156,7 +1264,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Format",
     description: "Receipt does not conform to JWS format",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_ISSUER: {
@@ -1164,7 +1273,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Issuer",
     description: "Receipt issuer claim is invalid or untrusted",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_RAIL: {
@@ -1172,7 +1282,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Payment Rail",
     description: "Payment rail identifier is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_RECEIPT_ID: {
@@ -1180,7 +1291,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Receipt ID",
     description: "Receipt ID (rid) does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_SUBJECT: {
@@ -1188,7 +1300,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Subject",
     description: "Receipt subject claim does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_MISSING_EXP: {
@@ -1196,7 +1309,8 @@ var ERRORS = {
     http_status: 400,
     title: "Missing Expiration",
     description: "Receipt is missing required exp claim",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_MISSING_REQUIRED_CLAIM: {
@@ -1204,7 +1318,8 @@ var ERRORS = {
     http_status: 400,
     title: "Missing Required Claim",
     description: "Receipt is missing a required JWT claim",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_NOT_YET_VALID: {
@@ -1212,7 +1327,8 @@ var ERRORS = {
     http_status: 400,
     title: "Not Yet Valid",
     description: "Receipt nbf (not before) time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "validation"
   },
   E_PARSE_ATTESTATION_INVALID: {
@@ -1220,7 +1336,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attestation Receipt Invalid",
     description: "Receipt classified as attestation but fails attestation schema validation",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_PARSE_COMMERCE_INVALID: {
@@ -1228,7 +1345,8 @@ var ERRORS = {
     http_status: 400,
     title: "Commerce Receipt Invalid",
     description: "Receipt has commerce fields (amt/cur/payment) but fails commerce schema validation",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_PARSE_INVALID_INPUT: {
@@ -1236,7 +1354,8 @@ var ERRORS = {
     http_status: 400,
     title: "Parse Invalid Input",
     description: "Input to receipt parser is not a non-null object",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   // Verification error codes
@@ -1245,7 +1364,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Signature",
     description: "Receipt signature verification failed",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verification"
   },
   E_KEY_NOT_FOUND: {
@@ -1253,7 +1373,8 @@ var ERRORS = {
     http_status: 400,
     title: "Key Not Found",
     description: "Public key with specified kid not found in JWKS",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_key",
     category: "verification"
   },
   // Verifier error codes
@@ -1262,7 +1383,17 @@ var ERRORS = {
     http_status: 400,
     title: "Extension Too Large",
     description: "Receipt extension data exceeds maximum size limit (64 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_INSECURE_SCHEME_BLOCKED: {
+    code: "E_VERIFY_INSECURE_SCHEME_BLOCKED",
+    http_status: 403,
+    title: "Insecure Scheme Blocked",
+    description: "Non-HTTPS URL encountered during issuer discovery (issuer URL or jwks_uri)",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_INVALID_TRANSPORT: {
@@ -1270,7 +1401,35 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Transport",
     description: "Multiple PEAC-Receipt or PEAC-Receipt-Pointer headers detected (ambiguous transport)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_ISSUER_CONFIG_INVALID: {
+    code: "E_VERIFY_ISSUER_CONFIG_INVALID",
+    http_status: 502,
+    title: "Issuer Config Invalid",
+    description: "peac-issuer.json is not valid JSON or does not conform to issuer config schema",
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_ISSUER_CONFIG_MISSING: {
+    code: "E_VERIFY_ISSUER_CONFIG_MISSING",
+    http_status: 502,
+    title: "Issuer Config Missing",
+    description: "peac-issuer.json not found or not fetchable at issuer origin",
+    retryable: true,
+    next_action: "retry_after_delay",
+    category: "verifier"
+  },
+  E_VERIFY_ISSUER_MISMATCH: {
+    code: "E_VERIFY_ISSUER_MISMATCH",
+    http_status: 403,
+    title: "Issuer Mismatch",
+    description: "issuer field in peac-issuer.json does not match the expected issuer origin",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_ISSUER_NOT_ALLOWED: {
@@ -1278,7 +1437,17 @@ var ERRORS = {
     http_status: 403,
     title: "Issuer Not Allowed",
     description: "Receipt issuer is not in the verifier policy allowlist",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_JWKS_INVALID: {
+    code: "E_VERIFY_JWKS_INVALID",
+    http_status: 502,
+    title: "JWKS Invalid",
+    description: "JWKS response is not valid JSON or missing required keys array",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_TOO_LARGE: {
@@ -1286,7 +1455,8 @@ var ERRORS = {
     http_status: 400,
     title: "JWKS Too Large",
     description: "JWKS response exceeds maximum size limit (64 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_TOO_MANY_KEYS: {
@@ -1294,7 +1464,17 @@ var ERRORS = {
     http_status: 400,
     title: "JWKS Too Many Keys",
     description: "JWKS contains more than maximum allowed keys (20)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
+    category: "verifier"
+  },
+  E_VERIFY_JWKS_URI_INVALID: {
+    code: "E_VERIFY_JWKS_URI_INVALID",
+    http_status: 502,
+    title: "JWKS URI Invalid",
+    description: "jwks_uri in peac-issuer.json is not a valid HTTPS URL",
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_BLOCKED: {
@@ -1302,7 +1482,8 @@ var ERRORS = {
     http_status: 403,
     title: "Key Fetch Blocked",
     description: "JWKS discovery blocked by SSRF protection (private IP, non-HTTPS, or blocked redirect)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_FAILED: {
@@ -1310,7 +1491,8 @@ var ERRORS = {
     http_status: 502,
     title: "Key Fetch Failed",
     description: "Network error while fetching JWKS from issuer",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_TIMEOUT: {
@@ -1318,7 +1500,8 @@ var ERRORS = {
     http_status: 504,
     title: "Key Fetch Timeout",
     description: "JWKS discovery timed out (5 second limit)",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_MALFORMED_RECEIPT: {
@@ -1326,7 +1509,8 @@ var ERRORS = {
     http_status: 400,
     title: "Malformed Receipt",
     description: "Cannot parse receipt as JWS Compact Serialization",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_DIGEST_MISMATCH: {
@@ -1334,7 +1518,8 @@ var ERRORS = {
     http_status: 400,
     title: "Pointer Digest Mismatch",
     description: "Fetched receipt SHA-256 digest does not match pointer declaration",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_BLOCKED: {
@@ -1342,7 +1527,8 @@ var ERRORS = {
     http_status: 403,
     title: "Pointer Fetch Blocked",
     description: "Pointer URL fetch blocked by SSRF protection (private IP, non-HTTPS, or blocked redirect)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_FAILED: {
@@ -1350,7 +1536,8 @@ var ERRORS = {
     http_status: 502,
     title: "Pointer Fetch Failed",
     description: "Network error while fetching receipt from pointer URL",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_TIMEOUT: {
@@ -1358,7 +1545,8 @@ var ERRORS = {
     http_status: 504,
     title: "Pointer Fetch Timeout",
     description: "Pointer URL fetch timed out (5 second limit)",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_TOO_LARGE: {
@@ -1366,7 +1554,8 @@ var ERRORS = {
     http_status: 413,
     title: "Pointer Fetch Too Large",
     description: "Pointer URL response exceeds maximum size limit (256 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POLICY_VIOLATION: {
@@ -1374,7 +1563,8 @@ var ERRORS = {
     http_status: 403,
     title: "Policy Violation",
     description: "Receipt violates verifier trust policy",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_RECEIPT_TOO_LARGE: {
@@ -1382,7 +1572,8 @@ var ERRORS = {
     http_status: 413,
     title: "Receipt Too Large",
     description: "Receipt exceeds maximum size limit (256 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_SCHEMA_INVALID: {
@@ -1390,7 +1581,8 @@ var ERRORS = {
     http_status: 400,
     title: "Schema Invalid",
     description: "Receipt claims do not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   // Workflow error codes
@@ -1399,7 +1591,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow Context",
     description: "Workflow context does not conform to WorkflowContextSchema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_CYCLE_DETECTED: {
@@ -1407,7 +1600,8 @@ var ERRORS = {
     http_status: 400,
     title: "Workflow Cycle Detected",
     description: "Workflow DAG contains a cycle (not acyclic)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_DAG_INVALID: {
@@ -1415,7 +1609,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow DAG",
     description: "Workflow DAG semantics violated (self-parent, duplicate parents, or cycle detected)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_ID_INVALID: {
@@ -1423,7 +1618,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow ID",
     description: "Workflow ID does not match required format (wf_{ulid|uuid})",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_LIMIT_EXCEEDED: {
@@ -1431,7 +1627,8 @@ var ERRORS = {
     http_status: 400,
     title: "Workflow Limit Exceeded",
     description: "Workflow exceeds defined limits (parent count, ID length, etc.)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_PARENT_NOT_FOUND: {
@@ -1439,7 +1636,8 @@ var ERRORS = {
     http_status: 400,
     title: "Parent Step Not Found",
     description: "Referenced parent step ID does not exist in the workflow",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_STEP_ID_INVALID: {
@@ -1447,7 +1645,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Step ID",
     description: "Step ID does not match required format (step_{ulid|uuid})",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_SUMMARY_INVALID: {
@@ -1455,15 +1654,16 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow Summary",
     description: "Workflow summary attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   }
 };
 function getError(code) {
   return ERRORS[code];
 }
-function isRetriable(code) {
-  return ERRORS[code]?.retriable ?? false;
+function isRetryable(code) {
+  return ERRORS[code]?.retryable ?? false;
 }
 var BUNDLE_ERRORS = {
   DUPLICATE_RECEIPT: "E_BUNDLE_DUPLICATE_RECEIPT",
@@ -1651,6 +1851,10 @@ function needsPurposeVary(purposeEnforced) {
   return purposeEnforced;
 }
 
-export { AGENT_PROTOCOLS, ALGORITHMS, BUNDLE_ERRORS, BUNDLE_VERSION, CONSTANTS, CONTROL_ENGINES, DISCOVERY, DISPUTE_ERRORS, ERRORS, ERROR_CATEGORIES, ERROR_CODES, HASH, HEADERS, ISSUER_CONFIG, JWKS, LIMITS, PAYMENT_RAILS, POLICY, PRIVATE_IP_RANGES, RECEIPT, REGISTRIES, TRANSPORT_METHODS, VARY_HEADERS, VERIFICATION_MODES, VERIFICATION_REPORT_VERSION, VERIFIER_LIMITS, VERIFIER_NETWORK, VERIFIER_POLICY_VERSION, WIRE_TYPE, WIRE_VERSION, applyPurposeVary, findAgentProtocol, findControlEngine, findPaymentRail, findTransportMethod, formatHash, getError, getPeacVaryHeaders, isRetriable, isValidHash, needsPurposeVary, parseHash };
+// src/carrier.ts
+var PEAC_RECEIPT_HEADER = "PEAC-Receipt";
+var PEAC_RECEIPT_URL_HEADER = "PEAC-Receipt-URL";
+
+export { AGENT_PROTOCOLS, ALGORITHMS, BUNDLE_ERRORS, BUNDLE_VERSION, CONSTANTS, CONTROL_ENGINES, DISCOVERY, DISPUTE_ERRORS, ERRORS, ERROR_CATEGORIES, ERROR_CODES, HASH, HEADERS, ISSUER_CONFIG, JWKS, LIMITS, PAYMENT_RAILS, PEAC_RECEIPT_HEADER, PEAC_RECEIPT_URL_HEADER, POLICY, PRIVATE_IP_RANGES, RECEIPT, REGISTRIES, TRANSPORT_METHODS, VARY_HEADERS, VERIFICATION_MODES, VERIFICATION_REPORT_VERSION, VERIFIER_LIMITS, VERIFIER_NETWORK, VERIFIER_POLICY_VERSION, WIRE_TYPE, WIRE_VERSION, applyPurposeVary, findAgentProtocol, findControlEngine, findPaymentRail, findTransportMethod, formatHash, getError, getPeacVaryHeaders, isRetryable, isValidHash, needsPurposeVary, parseHash };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map