@peac/kernel 0.11.3 → 0.12.0-preview.2

package/dist/errors.mjs

@@ -34,6 +34,12 @@ var ERROR_CODES = {
   // Control error codes
   E_CONTROL_DENIED: "E_CONTROL_DENIED",
   E_CONTROL_REVIEW_REQUIRED: "E_CONTROL_REVIEW_REQUIRED",
+  // Cryptography error codes
+  E_JWS_B64_REJECTED: "E_JWS_B64_REJECTED",
+  E_JWS_CRIT_REJECTED: "E_JWS_CRIT_REJECTED",
+  E_JWS_EMBEDDED_KEY: "E_JWS_EMBEDDED_KEY",
+  E_JWS_MISSING_KID: "E_JWS_MISSING_KID",
+  E_JWS_ZIP_REJECTED: "E_JWS_ZIP_REJECTED",
   // Dispute error codes
   E_DISPUTE_DUPLICATE: "E_DISPUTE_DUPLICATE",
   E_DISPUTE_EXPIRED: "E_DISPUTE_EXPIRED",
@@ -107,6 +113,10 @@ var ERROR_CODES = {
   E_UCP_VERIFICATION_FAILED: "E_UCP_VERIFICATION_FAILED",
   // Validation error codes
   E_CONSTRAINT_VIOLATION: "E_CONSTRAINT_VIOLATION",
+  E_EAT_INVALID_CBOR: "E_EAT_INVALID_CBOR",
+  E_EAT_INVALID_COSE: "E_EAT_INVALID_COSE",
+  E_EAT_SIZE_EXCEEDED: "E_EAT_SIZE_EXCEEDED",
+  E_EAT_UNSUPPORTED_ALG: "E_EAT_UNSUPPORTED_ALG",
   E_EVIDENCE_NOT_JSON: "E_EVIDENCE_NOT_JSON",
   E_EXPIRED: "E_EXPIRED",
   E_INVALID_AMOUNT: "E_INVALID_AMOUNT",
@@ -114,16 +124,27 @@ var ERROR_CODES = {
   E_INVALID_CURRENCY: "E_INVALID_CURRENCY",
   E_INVALID_FORMAT: "E_INVALID_FORMAT",
   E_INVALID_ISSUER: "E_INVALID_ISSUER",
+  E_INVALID_KIND: "E_INVALID_KIND",
+  E_INVALID_PILLAR_VALUE: "E_INVALID_PILLAR_VALUE",
   E_INVALID_RAIL: "E_INVALID_RAIL",
   E_INVALID_RECEIPT_ID: "E_INVALID_RECEIPT_ID",
   E_INVALID_SUBJECT: "E_INVALID_SUBJECT",
+  E_INVALID_TYPE: "E_INVALID_TYPE",
+  E_ISS_NOT_CANONICAL: "E_ISS_NOT_CANONICAL",
   E_MISSING_EXP: "E_MISSING_EXP",
   E_MISSING_REQUIRED_CLAIM: "E_MISSING_REQUIRED_CLAIM",
   E_NOT_YET_VALID: "E_NOT_YET_VALID",
+  E_OCCURRED_AT_FUTURE: "E_OCCURRED_AT_FUTURE",
+  E_OCCURRED_AT_ON_CHALLENGE: "E_OCCURRED_AT_ON_CHALLENGE",
   E_PARSE_ATTESTATION_INVALID: "E_PARSE_ATTESTATION_INVALID",
   E_PARSE_COMMERCE_INVALID: "E_PARSE_COMMERCE_INVALID",
   E_PARSE_INVALID_INPUT: "E_PARSE_INVALID_INPUT",
+  E_PILLARS_NOT_SORTED: "E_PILLARS_NOT_SORTED",
+  E_POLICY_BINDING_FAILED: "E_POLICY_BINDING_FAILED",
+  E_UNSUPPORTED_WIRE_VERSION: "E_UNSUPPORTED_WIRE_VERSION",
+  E_WIRE_VERSION_MISMATCH: "E_WIRE_VERSION_MISMATCH",
   // Verification error codes
+  E_EAT_SIGNATURE_FAILED: "E_EAT_SIGNATURE_FAILED",
   E_INVALID_SIGNATURE: "E_INVALID_SIGNATURE",
   E_KEY_NOT_FOUND: "E_KEY_NOT_FOUND",
   E_KID_REUSE_DETECTED: "E_KID_REUSE_DETECTED",
@@ -445,6 +466,52 @@ var ERRORS = {
     next_action: "contact_issuer",
     category: "control"
   },
+  // Cryptography error codes
+  E_JWS_B64_REJECTED: {
+    code: "E_JWS_B64_REJECTED",
+    http_status: 400,
+    title: "JWS b64:false Rejected",
+    description: "JWS header contains b64:false (RFC 7797 unencoded payload); unencoded payloads are not supported",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_CRIT_REJECTED: {
+    code: "E_JWS_CRIT_REJECTED",
+    http_status: 400,
+    title: "JWS crit Header Rejected",
+    description: "JWS header contains a crit field; critical header extensions are not supported and are rejected",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_EMBEDDED_KEY: {
+    code: "E_JWS_EMBEDDED_KEY",
+    http_status: 400,
+    title: "JWS Embedded Key Rejected",
+    description: "JWS header contains an embedded key (jwk, x5c, x5u, or jku); embedded key material is rejected by the PEAC JOSE hardening rules",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_MISSING_KID: {
+    code: "E_JWS_MISSING_KID",
+    http_status: 400,
+    title: "JWS kid Missing or Invalid",
+    description: "JWS header kid field is absent, empty, or exceeds the maximum allowed length (256 characters)",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_ZIP_REJECTED: {
+    code: "E_JWS_ZIP_REJECTED",
+    http_status: 400,
+    title: "JWS zip Header Rejected",
+    description: "JWS header contains a zip compression field; payload compression is not supported",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
   // Dispute error codes
   E_DISPUTE_DUPLICATE: {
     code: "E_DISPUTE_DUPLICATE",
@@ -1054,6 +1121,42 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_EAT_INVALID_CBOR: {
+    code: "E_EAT_INVALID_CBOR",
+    http_status: 400,
+    title: "EAT Invalid CBOR",
+    description: "EAT token is not valid CBOR or the payload is not a CBOR map",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_EAT_INVALID_COSE: {
+    code: "E_EAT_INVALID_COSE",
+    http_status: 400,
+    title: "EAT Invalid COSE",
+    description: "EAT token is not a valid COSE_Sign1 structure per RFC 9052 Section 4.2",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_EAT_SIZE_EXCEEDED: {
+    code: "E_EAT_SIZE_EXCEEDED",
+    http_status: 400,
+    title: "EAT Size Exceeded",
+    description: "EAT token exceeds the 64 KB size limit enforced before CBOR decode",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_EAT_UNSUPPORTED_ALG: {
+    code: "E_EAT_UNSUPPORTED_ALG",
+    http_status: 400,
+    title: "EAT Unsupported Algorithm",
+    description: "COSE_Sign1 uses an unsupported algorithm; only EdDSA (alg: -8) is supported",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   E_EVIDENCE_NOT_JSON: {
     code: "E_EVIDENCE_NOT_JSON",
     http_status: 400,
@@ -1117,6 +1220,24 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_INVALID_KIND: {
+    code: "E_INVALID_KIND",
+    http_status: 400,
+    title: "Invalid Kind",
+    description: "Wire 0.2 receipt kind field is missing or not one of the accepted structural kinds (evidence, challenge)",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_INVALID_PILLAR_VALUE: {
+    code: "E_INVALID_PILLAR_VALUE",
+    http_status: 400,
+    title: "Invalid Pillar Value",
+    description: "Wire 0.2 pillars array contains an unrecognized pillar value outside the closed 10-value taxonomy",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   E_INVALID_RAIL: {
     code: "E_INVALID_RAIL",
     http_status: 400,
@@ -1144,6 +1265,24 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_INVALID_TYPE: {
+    code: "E_INVALID_TYPE",
+    http_status: 400,
+    title: "Invalid Type",
+    description: "Wire 0.2 receipt type field is missing or does not conform to the required grammar (reverse-DNS or absolute URI)",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_ISS_NOT_CANONICAL: {
+    code: "E_ISS_NOT_CANONICAL",
+    http_status: 400,
+    title: "Issuer Not Canonical",
+    description: "Wire 0.2 iss claim does not conform to canonical form: must be an https:// ASCII origin (no default port, no path) or a did: identifier",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   E_MISSING_EXP: {
     code: "E_MISSING_EXP",
     http_status: 400,
@@ -1171,6 +1310,24 @@ var ERRORS = {
     next_action: "retry_after_delay",
     category: "validation"
   },
+  E_OCCURRED_AT_FUTURE: {
+    code: "E_OCCURRED_AT_FUTURE",
+    http_status: 400,
+    title: "occurred_at in Future",
+    description: "Wire 0.2 occurred_at is more than the tolerance window ahead of the current time; the timestamp appears to be in the future",
+    retryable: false,
+    next_action: "retry_after_delay",
+    category: "validation"
+  },
+  E_OCCURRED_AT_ON_CHALLENGE: {
+    code: "E_OCCURRED_AT_ON_CHALLENGE",
+    http_status: 400,
+    title: "occurred_at on Challenge",
+    description: "Wire 0.2 occurred_at field is present on a challenge-kind receipt; occurred_at is only permitted on evidence-kind receipts",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   E_PARSE_ATTESTATION_INVALID: {
     code: "E_PARSE_ATTESTATION_INVALID",
     http_status: 400,
@@ -1198,7 +1355,52 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_PILLARS_NOT_SORTED: {
+    code: "E_PILLARS_NOT_SORTED",
+    http_status: 400,
+    title: "Pillars Not Sorted",
+    description: "Wire 0.2 pillars array is not in ascending lexicographic order or contains duplicates",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_POLICY_BINDING_FAILED: {
+    code: "E_POLICY_BINDING_FAILED",
+    http_status: 400,
+    title: "Policy Binding Failed",
+    description: "Wire 0.2 policy.digest does not match the computed digest of the provided policy document",
+    retryable: false,
+    next_action: "none",
+    category: "validation"
+  },
+  E_UNSUPPORTED_WIRE_VERSION: {
+    code: "E_UNSUPPORTED_WIRE_VERSION",
+    http_status: 400,
+    title: "Unsupported Wire Version",
+    description: "Receipt peac_version field specifies a wire version that is not supported by this implementation",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_WIRE_VERSION_MISMATCH: {
+    code: "E_WIRE_VERSION_MISMATCH",
+    http_status: 400,
+    title: "Wire Version Mismatch",
+    description: "JWS header typ value and peac_version payload claim indicate different wire versions; the receipt is incoherent",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   // Verification error codes
+  E_EAT_SIGNATURE_FAILED: {
+    code: "E_EAT_SIGNATURE_FAILED",
+    http_status: 400,
+    title: "EAT Signature Failed",
+    description: "COSE_Sign1 Ed25519 signature verification failed over the Sig_structure",
+    retryable: false,
+    next_action: "retry_with_different_key",
+    category: "verification"
+  },
   E_INVALID_SIGNATURE: {
     code: "E_INVALID_SIGNATURE",
     http_status: 400,