@peac/kernel 0.11.1 → 0.11.3

package/dist/index.mjs

@@ -55,7 +55,8 @@ var DISCOVERY = {
 };
 var JWKS = {
   rotationDays: 90,
-  overlapDays: 7,
+  /** Normative minimum overlap period (DD-148, v0.11.3+) */
+  overlapDays: 30,
   emergencyRevocationHours: 24
 };
 var RECEIPT = {
@@ -235,6 +236,7 @@ var ERROR_CODES = {
   E_IDENTITY_NOT_YET_VALID: "E_IDENTITY_NOT_YET_VALID",
   E_IDENTITY_PROOF_UNSUPPORTED: "E_IDENTITY_PROOF_UNSUPPORTED",
   E_IDENTITY_SIG_INVALID: "E_IDENTITY_SIG_INVALID",
+  E_MVIS_INCOMPLETE: "E_MVIS_INCOMPLETE",
   // Infrastructure error codes
   E_CIRCUIT_BREAKER_OPEN: "E_CIRCUIT_BREAKER_OPEN",
   E_INTERNAL: "E_INTERNAL",
@@ -297,6 +299,8 @@ var ERROR_CODES = {
   // Verification error codes
   E_INVALID_SIGNATURE: "E_INVALID_SIGNATURE",
   E_KEY_NOT_FOUND: "E_KEY_NOT_FOUND",
+  E_KID_REUSE_DETECTED: "E_KID_REUSE_DETECTED",
+  E_REVOKED_KEY_USED: "E_REVOKED_KEY_USED",
   // Verifier error codes
   E_VERIFY_EXTENSION_TOO_LARGE: "E_VERIFY_EXTENSION_TOO_LARGE",
   E_VERIFY_INSECURE_SCHEME_BLOCKED: "E_VERIFY_INSECURE_SCHEME_BLOCKED",
@@ -338,7 +342,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Chain Too Deep",
     description: "Attribution chain exceeds maximum allowed depth (8)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_CIRCULAR_CHAIN: {
@@ -346,7 +351,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Circular Chain",
     description: "Circular reference detected in attribution chain",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_EXPIRED: {
@@ -354,7 +360,8 @@ var ERRORS = {
     http_status: 401,
     title: "Attribution Expired",
     description: "Attribution attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_HASH_INVALID: {
@@ -362,7 +369,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Hash Invalid",
     description: "Content hash structure is invalid (wrong algorithm, encoding, or value length)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_FORMAT: {
@@ -370,7 +378,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Format",
     description: "Attribution attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_REF: {
@@ -378,7 +387,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Reference",
     description: "Receipt reference format is invalid (must be jti:{id}, URL, or URN)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_INVALID_WEIGHT: {
@@ -386,7 +396,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Invalid Weight",
     description: "Attribution weight is out of valid range (must be 0.0-1.0)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_MISSING_SOURCES: {
@@ -394,7 +405,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Missing Sources",
     description: "Attribution attestation has empty sources array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_NOT_YET_VALID: {
@@ -402,7 +414,8 @@ var ERRORS = {
     http_status: 401,
     title: "Attribution Not Yet Valid",
     description: "Attribution attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_RESOLUTION_FAILED: {
@@ -410,7 +423,8 @@ var ERRORS = {
     http_status: 502,
     title: "Attribution Resolution Failed",
     description: "Failed to resolve receipt reference in attribution chain",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_RESOLUTION_TIMEOUT: {
@@ -418,7 +432,8 @@ var ERRORS = {
     http_status: 504,
     title: "Attribution Resolution Timeout",
     description: "Timeout while resolving receipt reference in attribution chain",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "attribution"
   },
   E_ATTRIBUTION_SIZE_EXCEEDED: {
@@ -426,7 +441,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Size Exceeded",
     description: "Attribution attestation exceeds maximum size (64KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_TOO_MANY_SOURCES: {
@@ -434,7 +450,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Too Many Sources",
     description: "Attribution has too many sources (maximum 100)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   E_ATTRIBUTION_UNKNOWN_USAGE: {
@@ -442,7 +459,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attribution Unknown Usage",
     description: "Attribution usage type is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "attribution"
   },
   // Bundle error codes
@@ -451,7 +469,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Duplicate Receipt",
     description: "Bundle contains multiple receipts with the same ID",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_HASH_MISMATCH: {
@@ -459,7 +478,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Hash Mismatch",
     description: "File hash does not match value declared in manifest.json",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_INVALID_FORMAT: {
@@ -467,7 +487,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Invalid Format",
     description: "Bundle archive structure is invalid (not a valid ZIP or missing required files)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_KEY_MISSING: {
@@ -475,7 +496,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Key Missing",
     description: "Required signing key not found in bundle (offline verification mode)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MANIFEST_INVALID: {
@@ -483,7 +505,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Manifest Invalid",
     description: "manifest.json does not conform to schema or contains invalid values",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MANIFEST_MISSING: {
@@ -491,7 +514,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Manifest Missing",
     description: "manifest.json not found at bundle archive root",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MISSING_KEYS: {
@@ -499,7 +523,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Missing Keys",
     description: "No verification keys provided in bundle JWKS",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_MISSING_RECEIPTS: {
@@ -507,7 +532,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Missing Receipts",
     description: "No receipts provided when creating bundle",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_PATH_TRAVERSAL: {
@@ -515,7 +541,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Path Traversal",
     description: "Bundle contains path traversal attack (zip-slip vulnerability)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_POLICY_HASH_MISMATCH: {
@@ -523,7 +550,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Policy Hash Mismatch",
     description: "Policy snapshot hash does not match policy used to evaluate receipts",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_RECEIPTS_UNORDERED: {
@@ -531,7 +559,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Receipts Unordered",
     description: "receipts.ndjson is not in deterministic order (issued_at, receipt_id, receipt_hash)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_RECEIPT_INVALID: {
@@ -539,7 +568,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Receipt Invalid",
     description: "Receipt JWS in bundle is malformed or missing required claims",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_SIGNATURE_INVALID: {
@@ -547,7 +577,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Signature Invalid",
     description: "bundle.sig JWS verification failed over manifest hash",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_SIZE_EXCEEDED: {
@@ -555,7 +586,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Size Exceeded",
     description: "Bundle exceeds size limits (entry count, entry size, or total size)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   E_BUNDLE_TIME_RANGE_INVALID: {
@@ -563,7 +595,8 @@ var ERRORS = {
     http_status: 400,
     title: "Bundle Time Range Invalid",
     description: "Receipt issued_at is outside the bundle declared time_range",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "bundle"
   },
   // Control error codes
@@ -572,7 +605,8 @@ var ERRORS = {
     http_status: 403,
     title: "Control Decision Denied",
     description: "Control engine denied authorization",
-    retriable: false,
+    retryable: false,
+    next_action: "contact_issuer",
     category: "control"
   },
   E_CONTROL_REVIEW_REQUIRED: {
@@ -580,7 +614,8 @@ var ERRORS = {
     http_status: 202,
     title: "Review Required",
     description: "Control engine requires manual review",
-    retriable: true,
+    retryable: true,
+    next_action: "contact_issuer",
     category: "control"
   },
   // Dispute error codes
@@ -589,7 +624,8 @@ var ERRORS = {
     http_status: 409,
     title: "Dispute Duplicate",
     description: "A dispute with this ID already exists",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_EXPIRED: {
@@ -597,7 +633,8 @@ var ERRORS = {
     http_status: 401,
     title: "Dispute Expired",
     description: "Dispute attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_FORMAT: {
@@ -605,7 +642,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Format",
     description: "Dispute attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_GROUNDS: {
@@ -613,7 +651,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Grounds",
     description: "Dispute grounds code is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_ID: {
@@ -621,7 +660,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid ID",
     description: "Dispute ID is not a valid ULID format (26 uppercase alphanumeric characters)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_STATE: {
@@ -629,7 +669,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid State",
     description: "Dispute state is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TARGET_TYPE: {
@@ -637,7 +678,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Target Type",
     description: "Dispute target type is not recognized (must be receipt, attribution, identity, or policy)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TRANSITION: {
@@ -645,7 +687,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Transition",
     description: "Invalid state transition for dispute lifecycle",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_INVALID_TYPE: {
@@ -653,7 +696,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Invalid Type",
     description: "Dispute type is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_MISSING_RESOLUTION: {
@@ -661,7 +705,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Missing Resolution",
     description: "Resolution is required for terminal states (resolved, rejected, final)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_NOT_YET_VALID: {
@@ -669,7 +714,8 @@ var ERRORS = {
     http_status: 401,
     title: "Dispute Not Yet Valid",
     description: "Dispute attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "dispute"
   },
   E_DISPUTE_OTHER_REQUIRES_DESCRIPTION: {
@@ -677,7 +723,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Other Requires Description",
     description: "Dispute type 'other' requires description of at least 50 characters",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_RESOLUTION_NOT_ALLOWED: {
@@ -685,7 +732,8 @@ var ERRORS = {
     http_status: 400,
     title: "Dispute Resolution Not Allowed",
     description: "Resolution is only valid for terminal states",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "dispute"
   },
   E_DISPUTE_TARGET_NOT_FOUND: {
@@ -693,7 +741,8 @@ var ERRORS = {
     http_status: 404,
     title: "Dispute Target Not Found",
     description: "The target receipt, attribution, or identity being disputed was not found",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "dispute"
   },
   // Identity error codes
@@ -702,7 +751,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Binding Future",
     description: "Identity binding signed_at timestamp is in the future",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_BINDING_MISMATCH: {
@@ -710,7 +760,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Binding Mismatch",
     description: "Identity binding does not match the request being verified",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_BINDING_STALE: {
@@ -718,7 +769,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Binding Stale",
     description: "Identity binding is too old and requires fresh binding",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_DIRECTORY_UNAVAILABLE: {
@@ -726,7 +778,8 @@ var ERRORS = {
     http_status: 503,
     title: "Identity Directory Unavailable",
     description: "Failed to fetch agent key directory",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_EXPIRED: {
@@ -734,7 +787,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Expired",
     description: "Agent identity attestation has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_INVALID_FORMAT: {
@@ -742,7 +796,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Invalid Format",
     description: "Agent identity attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_KEY_EXPIRED: {
@@ -750,7 +805,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Expired",
     description: "Agent signing key has expired per directory metadata",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_KEY_REVOKED: {
@@ -758,7 +814,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Revoked",
     description: "Agent signing key has been explicitly revoked",
-    retriable: false,
+    retryable: false,
+    next_action: "refresh_attestation",
     category: "identity"
   },
   E_IDENTITY_KEY_UNKNOWN: {
@@ -766,7 +823,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Key Unknown",
     description: "Key ID not found in agent key directory",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_MISSING: {
@@ -774,7 +832,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Missing",
     description: "No agent identity attestation provided in request",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_NOT_YET_VALID: {
@@ -782,7 +841,8 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Not Yet Valid",
     description: "Agent identity attestation issued_at time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "identity"
   },
   E_IDENTITY_PROOF_UNSUPPORTED: {
@@ -790,7 +850,8 @@ var ERRORS = {
     http_status: 400,
     title: "Identity Proof Unsupported",
     description: "Agent identity proof method is not supported",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   E_IDENTITY_SIG_INVALID: {
@@ -798,7 +859,17 @@ var ERRORS = {
     http_status: 401,
     title: "Identity Signature Invalid",
     description: "Agent identity proof signature verification failed",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
+    category: "identity"
+  },
+  E_MVIS_INCOMPLETE: {
+    code: "E_MVIS_INCOMPLETE",
+    http_status: 400,
+    title: "MVIS Incomplete",
+    description: "Identity receipt missing one or more Minimum Viable Identity Set required fields (issuer, subject, key_binding, time_bounds, replay_protection)",
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "identity"
   },
   // Infrastructure error codes
@@ -807,7 +878,8 @@ var ERRORS = {
     http_status: 503,
     title: "Circuit Breaker Open",
     description: "Service temporarily unavailable due to circuit breaker",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_INTERNAL: {
@@ -815,7 +887,8 @@ var ERRORS = {
     http_status: 500,
     title: "Internal Error",
     description: "An unexpected internal error occurred during verification",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_JWKS_FETCH_FAILED: {
@@ -823,7 +896,8 @@ var ERRORS = {
     http_status: 503,
     title: "JWKS Fetch Failed",
     description: "Failed to fetch public keys from JWKS endpoint",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   E_RATE_LIMITED: {
@@ -831,7 +905,8 @@ var ERRORS = {
     http_status: 429,
     title: "Rate Limited",
     description: "Too many requests, please retry later",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "infrastructure"
   },
   // Interaction error codes
@@ -840,7 +915,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Digest",
     description: "Digest structure is invalid (wrong value format or missing bytes)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_DIGEST_ALG: {
@@ -848,7 +924,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Digest Algorithm",
     description: "Digest algorithm is not in the canonical set (sha-256, sha-256:trunc-64k, sha-256:trunc-1m)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_EXTENSION_KEY: {
@@ -856,7 +933,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Extension Key",
     description: "Extension key does not match required format (reverse-DNS/name[@version])",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_FORMAT: {
@@ -864,7 +942,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Format",
     description: "Interaction evidence does not conform to InteractionEvidenceV01 schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_KIND_FORMAT: {
@@ -872,7 +951,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Kind Format",
     description: "Interaction kind does not match required format (lowercase, 2-128 chars, starts with letter)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_INVALID_TIMING: {
@@ -880,7 +960,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Invalid Timing",
     description: "Timing constraint violated (completed_at < started_at or invalid datetime format)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_KIND_RESERVED: {
@@ -888,7 +969,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Kind Reserved",
     description: "Interaction kind uses reserved prefix (peac.*, org.peacprotocol.*) but is not in the well-known registry",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_ERROR_DETAIL: {
@@ -896,7 +978,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Error Detail",
     description: "error_code or extensions required when result.status is error",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_EXECUTOR: {
@@ -904,7 +987,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Executor",
     description: "Interaction evidence is missing required executor or executor.platform field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_ID: {
@@ -912,7 +996,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing ID",
     description: "Interaction evidence is missing required interaction_id field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_KIND: {
@@ -920,7 +1005,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Kind",
     description: "Interaction evidence is missing required kind field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_RESULT: {
@@ -928,7 +1014,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Result",
     description: "result.status is required when output is present",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_STARTED_AT: {
@@ -936,7 +1023,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Started At",
     description: "Interaction evidence is missing required started_at field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   E_INTERACTION_MISSING_TARGET: {
@@ -944,7 +1032,8 @@ var ERRORS = {
     http_status: 400,
     title: "Interaction Missing Target",
     description: "Kind prefix requires matching target field (tool.* needs tool, http.*/fs.* need resource)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "interaction"
   },
   // Ucp error codes
@@ -953,7 +1042,8 @@ var ERRORS = {
     http_status: 500,
     title: "UCP Evidence Serialization Failed",
     description: "Failed to serialize UCP evidence to YAML format",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_ALGORITHM_MISMATCH: {
@@ -961,7 +1051,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Algorithm Mismatch",
     description: "Key type is not EC as required for ECDSA signatures",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_CURVE_MISMATCH: {
@@ -969,7 +1060,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Curve Mismatch",
     description: "Key curve does not match signature algorithm (ES256=P-256, ES384=P-384, ES512=P-521)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_KEY_NOT_FOUND: {
@@ -977,7 +1069,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Key Not Found",
     description: "Key ID from signature not found in business UCP profile",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "ucp"
   },
   E_UCP_ORDER_INVALID: {
@@ -985,7 +1078,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Invalid",
     description: "UCP order object does not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_ID: {
@@ -993,7 +1087,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing ID",
     description: "UCP order is missing required id field",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_LINE_ITEMS: {
@@ -1001,7 +1096,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing Line Items",
     description: "UCP order is missing required line_items array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_ORDER_MISSING_TOTALS: {
@@ -1009,7 +1105,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Order Missing Totals",
     description: "UCP order is missing required totals array or total entry",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_EMPTY: {
@@ -1017,7 +1114,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Empty",
     description: "Webhook request body is empty",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_NOT_JSON: {
@@ -1025,7 +1123,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Not JSON",
     description: "Webhook request body is not valid JSON",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PAYLOAD_TOO_LARGE: {
@@ -1033,7 +1132,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Payload Too Large",
     description: "Webhook request body exceeds maximum allowed size",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PROFILE_FETCH_FAILED: {
@@ -1041,7 +1141,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile Fetch Failed",
     description: "Failed to fetch business UCP profile from /.well-known/ucp",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "ucp"
   },
   E_UCP_PROFILE_INVALID: {
@@ -1049,7 +1150,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile Invalid",
     description: "Business UCP profile does not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_PROFILE_NO_SIGNING_KEYS: {
@@ -1057,7 +1159,8 @@ var ERRORS = {
     http_status: 502,
     title: "UCP Profile No Signing Keys",
     description: "Business UCP profile has empty or missing signing_keys array",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_ALGORITHM_UNSUPPORTED: {
@@ -1065,7 +1168,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Algorithm Unsupported",
     description: "Signature algorithm is not ES256, ES384, or ES512",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_B64_INVALID: {
@@ -1073,7 +1177,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature b64 Invalid",
     description: "b64=false requires 'b64' in 'crit' array per RFC 7797",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_INVALID: {
@@ -1081,7 +1186,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Signature Invalid",
     description: "Webhook signature verification failed against payload",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_MALFORMED: {
@@ -1089,7 +1195,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Malformed",
     description: "Request-Signature header is not a valid detached JWS (RFC 7797)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_SIGNATURE_MISSING: {
@@ -1097,7 +1204,8 @@ var ERRORS = {
     http_status: 400,
     title: "UCP Signature Missing",
     description: "Request-Signature header is missing from UCP webhook request",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   E_UCP_VERIFICATION_FAILED: {
@@ -1105,7 +1213,8 @@ var ERRORS = {
     http_status: 401,
     title: "UCP Verification Failed",
     description: "All verification attempts failed (raw and JCS canonicalized)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "ucp"
   },
   // Validation error codes
@@ -1114,7 +1223,8 @@ var ERRORS = {
     http_status: 400,
     title: "Kernel Constraint Violation",
     description: "Receipt claims exceed a kernel constraint (max keys, max depth, max string length, max evidence bytes, or similar structural limit)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_EVIDENCE_NOT_JSON: {
@@ -1122,7 +1232,8 @@ var ERRORS = {
     http_status: 400,
     title: "Evidence Not JSON-Safe",
     description: "Evidence contains non-JSON-safe values (NaN, Infinity, undefined, BigInt, Date, Map, Set, functions, symbols, class instances, or cycles)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_EXPIRED: {
@@ -1130,7 +1241,8 @@ var ERRORS = {
     http_status: 400,
     title: "Receipt Expired",
     description: "Receipt has exceeded its expiration time",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_AMOUNT: {
@@ -1138,7 +1250,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Amount",
     description: "Payment amount is invalid or out of allowed range",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_AUDIENCE: {
@@ -1146,7 +1259,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Audience",
     description: "Receipt audience claim does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_CURRENCY: {
@@ -1154,7 +1268,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Currency",
     description: "Currency code is not a valid ISO 4217 code",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_FORMAT: {
@@ -1162,7 +1277,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Format",
     description: "Receipt does not conform to JWS format",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_ISSUER: {
@@ -1170,7 +1286,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Issuer",
     description: "Receipt issuer claim is invalid or untrusted",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_RAIL: {
@@ -1178,7 +1295,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Payment Rail",
     description: "Payment rail identifier is not recognized",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_RECEIPT_ID: {
@@ -1186,7 +1304,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Receipt ID",
     description: "Receipt ID (rid) does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_INVALID_SUBJECT: {
@@ -1194,7 +1313,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Subject",
     description: "Receipt subject claim does not match expected value",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_MISSING_EXP: {
@@ -1202,7 +1322,8 @@ var ERRORS = {
     http_status: 400,
     title: "Missing Expiration",
     description: "Receipt is missing required exp claim",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_MISSING_REQUIRED_CLAIM: {
@@ -1210,7 +1331,8 @@ var ERRORS = {
     http_status: 400,
     title: "Missing Required Claim",
     description: "Receipt is missing a required JWT claim",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_NOT_YET_VALID: {
@@ -1218,7 +1340,8 @@ var ERRORS = {
     http_status: 400,
     title: "Not Yet Valid",
     description: "Receipt nbf (not before) time is in the future",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "validation"
   },
   E_PARSE_ATTESTATION_INVALID: {
@@ -1226,7 +1349,8 @@ var ERRORS = {
     http_status: 400,
     title: "Attestation Receipt Invalid",
     description: "Receipt classified as attestation but fails attestation schema validation",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_PARSE_COMMERCE_INVALID: {
@@ -1234,7 +1358,8 @@ var ERRORS = {
     http_status: 400,
     title: "Commerce Receipt Invalid",
     description: "Receipt has commerce fields (amt/cur/payment) but fails commerce schema validation",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   E_PARSE_INVALID_INPUT: {
@@ -1242,7 +1367,8 @@ var ERRORS = {
     http_status: 400,
     title: "Parse Invalid Input",
     description: "Input to receipt parser is not a non-null object",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "validation"
   },
   // Verification error codes
@@ -1251,7 +1377,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Signature",
     description: "Receipt signature verification failed",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verification"
   },
   E_KEY_NOT_FOUND: {
@@ -1259,7 +1386,26 @@ var ERRORS = {
     http_status: 400,
     title: "Key Not Found",
     description: "Public key with specified kid not found in JWKS",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_key",
+    category: "verification"
+  },
+  E_KID_REUSE_DETECTED: {
+    code: "E_KID_REUSE_DETECTED",
+    http_status: 400,
+    title: "Kid Reuse Detected",
+    description: "Same kid value used with different key material within the retention window",
+    retryable: false,
+    next_action: "abort",
+    category: "verification"
+  },
+  E_REVOKED_KEY_USED: {
+    code: "E_REVOKED_KEY_USED",
+    http_status: 400,
+    title: "Revoked Key Used",
+    description: "Receipt signed with a key listed in the issuer revoked_keys set",
+    retryable: false,
+    next_action: "retry_with_different_key",
     category: "verification"
   },
   // Verifier error codes
@@ -1268,7 +1414,8 @@ var ERRORS = {
     http_status: 400,
     title: "Extension Too Large",
     description: "Receipt extension data exceeds maximum size limit (64 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_INSECURE_SCHEME_BLOCKED: {
@@ -1276,7 +1423,8 @@ var ERRORS = {
     http_status: 403,
     title: "Insecure Scheme Blocked",
     description: "Non-HTTPS URL encountered during issuer discovery (issuer URL or jwks_uri)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_INVALID_TRANSPORT: {
@@ -1284,7 +1432,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Transport",
     description: "Multiple PEAC-Receipt or PEAC-Receipt-Pointer headers detected (ambiguous transport)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_ISSUER_CONFIG_INVALID: {
@@ -1292,7 +1441,8 @@ var ERRORS = {
     http_status: 502,
     title: "Issuer Config Invalid",
     description: "peac-issuer.json is not valid JSON or does not conform to issuer config schema",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_ISSUER_CONFIG_MISSING: {
@@ -1300,7 +1450,8 @@ var ERRORS = {
     http_status: 502,
     title: "Issuer Config Missing",
     description: "peac-issuer.json not found or not fetchable at issuer origin",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_ISSUER_MISMATCH: {
@@ -1308,7 +1459,8 @@ var ERRORS = {
     http_status: 403,
     title: "Issuer Mismatch",
     description: "issuer field in peac-issuer.json does not match the expected issuer origin",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_ISSUER_NOT_ALLOWED: {
@@ -1316,7 +1468,8 @@ var ERRORS = {
     http_status: 403,
     title: "Issuer Not Allowed",
     description: "Receipt issuer is not in the verifier policy allowlist",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_INVALID: {
@@ -1324,7 +1477,8 @@ var ERRORS = {
     http_status: 502,
     title: "JWKS Invalid",
     description: "JWKS response is not valid JSON or missing required keys array",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_TOO_LARGE: {
@@ -1332,7 +1486,8 @@ var ERRORS = {
     http_status: 400,
     title: "JWKS Too Large",
     description: "JWKS response exceeds maximum size limit (64 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_TOO_MANY_KEYS: {
@@ -1340,7 +1495,8 @@ var ERRORS = {
     http_status: 400,
     title: "JWKS Too Many Keys",
     description: "JWKS contains more than maximum allowed keys (20)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_JWKS_URI_INVALID: {
@@ -1348,7 +1504,8 @@ var ERRORS = {
     http_status: 502,
     title: "JWKS URI Invalid",
     description: "jwks_uri in peac-issuer.json is not a valid HTTPS URL",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_BLOCKED: {
@@ -1356,7 +1513,8 @@ var ERRORS = {
     http_status: 403,
     title: "Key Fetch Blocked",
     description: "JWKS discovery blocked by SSRF protection (private IP, non-HTTPS, or blocked redirect)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_FAILED: {
@@ -1364,7 +1522,8 @@ var ERRORS = {
     http_status: 502,
     title: "Key Fetch Failed",
     description: "Network error while fetching JWKS from issuer",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_KEY_FETCH_TIMEOUT: {
@@ -1372,7 +1531,8 @@ var ERRORS = {
     http_status: 504,
     title: "Key Fetch Timeout",
     description: "JWKS discovery timed out (5 second limit)",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_MALFORMED_RECEIPT: {
@@ -1380,7 +1540,8 @@ var ERRORS = {
     http_status: 400,
     title: "Malformed Receipt",
     description: "Cannot parse receipt as JWS Compact Serialization",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_DIGEST_MISMATCH: {
@@ -1388,7 +1549,8 @@ var ERRORS = {
     http_status: 400,
     title: "Pointer Digest Mismatch",
     description: "Fetched receipt SHA-256 digest does not match pointer declaration",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_BLOCKED: {
@@ -1396,7 +1558,8 @@ var ERRORS = {
     http_status: 403,
     title: "Pointer Fetch Blocked",
     description: "Pointer URL fetch blocked by SSRF protection (private IP, non-HTTPS, or blocked redirect)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_FAILED: {
@@ -1404,7 +1567,8 @@ var ERRORS = {
     http_status: 502,
     title: "Pointer Fetch Failed",
     description: "Network error while fetching receipt from pointer URL",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_TIMEOUT: {
@@ -1412,7 +1576,8 @@ var ERRORS = {
     http_status: 504,
     title: "Pointer Fetch Timeout",
     description: "Pointer URL fetch timed out (5 second limit)",
-    retriable: true,
+    retryable: true,
+    next_action: "retry_after_delay",
     category: "verifier"
   },
   E_VERIFY_POINTER_FETCH_TOO_LARGE: {
@@ -1420,7 +1585,8 @@ var ERRORS = {
     http_status: 413,
     title: "Pointer Fetch Too Large",
     description: "Pointer URL response exceeds maximum size limit (256 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_POLICY_VIOLATION: {
@@ -1428,7 +1594,8 @@ var ERRORS = {
     http_status: 403,
     title: "Policy Violation",
     description: "Receipt violates verifier trust policy",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_RECEIPT_TOO_LARGE: {
@@ -1436,7 +1603,8 @@ var ERRORS = {
     http_status: 413,
     title: "Receipt Too Large",
     description: "Receipt exceeds maximum size limit (256 KB)",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   E_VERIFY_SCHEMA_INVALID: {
@@ -1444,7 +1612,8 @@ var ERRORS = {
     http_status: 400,
     title: "Schema Invalid",
     description: "Receipt claims do not conform to expected schema",
-    retriable: false,
+    retryable: false,
+    next_action: "abort",
     category: "verifier"
   },
   // Workflow error codes
@@ -1453,7 +1622,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow Context",
     description: "Workflow context does not conform to WorkflowContextSchema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_CYCLE_DETECTED: {
@@ -1461,7 +1631,8 @@ var ERRORS = {
     http_status: 400,
     title: "Workflow Cycle Detected",
     description: "Workflow DAG contains a cycle (not acyclic)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_DAG_INVALID: {
@@ -1469,7 +1640,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow DAG",
     description: "Workflow DAG semantics violated (self-parent, duplicate parents, or cycle detected)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_ID_INVALID: {
@@ -1477,7 +1649,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow ID",
     description: "Workflow ID does not match required format (wf_{ulid|uuid})",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_LIMIT_EXCEEDED: {
@@ -1485,7 +1658,8 @@ var ERRORS = {
     http_status: 400,
     title: "Workflow Limit Exceeded",
     description: "Workflow exceeds defined limits (parent count, ID length, etc.)",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_PARENT_NOT_FOUND: {
@@ -1493,7 +1667,8 @@ var ERRORS = {
     http_status: 400,
     title: "Parent Step Not Found",
     description: "Referenced parent step ID does not exist in the workflow",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_STEP_ID_INVALID: {
@@ -1501,7 +1676,8 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Step ID",
     description: "Step ID does not match required format (step_{ulid|uuid})",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   },
   E_WORKFLOW_SUMMARY_INVALID: {
@@ -1509,15 +1685,16 @@ var ERRORS = {
     http_status: 400,
     title: "Invalid Workflow Summary",
     description: "Workflow summary attestation does not conform to schema",
-    retriable: false,
+    retryable: false,
+    next_action: "retry_with_different_input",
     category: "workflow"
   }
 };
 function getError(code) {
   return ERRORS[code];
 }
-function isRetriable(code) {
-  return ERRORS[code]?.retriable ?? false;
+function isRetryable(code) {
+  return ERRORS[code]?.retryable ?? false;
 }
 var BUNDLE_ERRORS = {
   DUPLICATE_RECEIPT: "E_BUNDLE_DUPLICATE_RECEIPT",
@@ -1707,7 +1884,8 @@ function needsPurposeVary(purposeEnforced) {
 
 // src/carrier.ts
 var PEAC_RECEIPT_HEADER = "PEAC-Receipt";
+var PEAC_RECEIPT_URL_HEADER = "PEAC-Receipt-URL";
 
-export { AGENT_PROTOCOLS, ALGORITHMS, BUNDLE_ERRORS, BUNDLE_VERSION, CONSTANTS, CONTROL_ENGINES, DISCOVERY, DISPUTE_ERRORS, ERRORS, ERROR_CATEGORIES, ERROR_CODES, HASH, HEADERS, ISSUER_CONFIG, JWKS, LIMITS, PAYMENT_RAILS, PEAC_RECEIPT_HEADER, POLICY, PRIVATE_IP_RANGES, RECEIPT, REGISTRIES, TRANSPORT_METHODS, VARY_HEADERS, VERIFICATION_MODES, VERIFICATION_REPORT_VERSION, VERIFIER_LIMITS, VERIFIER_NETWORK, VERIFIER_POLICY_VERSION, WIRE_TYPE, WIRE_VERSION, applyPurposeVary, findAgentProtocol, findControlEngine, findPaymentRail, findTransportMethod, formatHash, getError, getPeacVaryHeaders, isRetriable, isValidHash, needsPurposeVary, parseHash };
+export { AGENT_PROTOCOLS, ALGORITHMS, BUNDLE_ERRORS, BUNDLE_VERSION, CONSTANTS, CONTROL_ENGINES, DISCOVERY, DISPUTE_ERRORS, ERRORS, ERROR_CATEGORIES, ERROR_CODES, HASH, HEADERS, ISSUER_CONFIG, JWKS, LIMITS, PAYMENT_RAILS, PEAC_RECEIPT_HEADER, PEAC_RECEIPT_URL_HEADER, POLICY, PRIVATE_IP_RANGES, RECEIPT, REGISTRIES, TRANSPORT_METHODS, VARY_HEADERS, VERIFICATION_MODES, VERIFICATION_REPORT_VERSION, VERIFIER_LIMITS, VERIFIER_NETWORK, VERIFIER_POLICY_VERSION, WIRE_TYPE, WIRE_VERSION, applyPurposeVary, findAgentProtocol, findControlEngine, findPaymentRail, findTransportMethod, formatHash, getError, getPeacVaryHeaders, isRetryable, isValidHash, needsPurposeVary, parseHash };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map