@request-seal/core 0.1.0 → 0.3.0

package/dist/discovery/node.js

@@ -3,18 +3,20 @@ import { promises as dns } from "node:dns";
 import { isIP } from "node:net";
 import * as tls from "node:tls";
 import { connect, checkServerIdentity } from "node:tls";
-import { err } from "../result.js";
+import { X509Certificate } from "node:crypto";
+import { err, ok } from "../result.js";
 import { withDeadline, isContext, run, remainingMs, } from "../context.js";
-import { discoveryError, custodyError } from "../errors/types.js";
+import { discoveryError } from "../errors/types.js";
 import { encodeBase64 } from "../bytes.js";
 import { Discovery as CoreDiscovery } from "./index.js";
 import { sourceUrl, normalizedHost, sourceAuthority, sourceOrigin, isDiscoverySource, DiscoverySource as CoreSource, } from "./source.js";
 import { addressAllowed } from "./address.js";
 import { ensure, unwrap, failure, options, clockValue, systemClock, sslError, list, } from "./support.js";
-import { fields, header, expiry, mediaType } from "./headers.js";
+import { fields, header, expiry, hasFreshness, mediaType } from "./headers.js";
 import { bodyDocument } from "./body.js";
 import { fromResource } from "./snapshot.js";
 import { decodeBody } from "./gzip.js";
+import { systemCertificateError } from "./node-trust.js";
 import { checkPeer, allowConnectionRetry } from "./node-connection.js";
 const lookup = dns.lookup.bind(dns);
 function remaining(context) {
@@ -41,6 +43,10 @@ async function resolve(host, context, servers) {
             ]);
             if (found.some((r) => r.status === "rejected" && r.reason?.code === "ETIMEOUT"))
                 throw discoveryError("deadline_exceeded");
+            // An authoritative NXDOMAIN on every query is a configuration error:
+            // the configured domain does not exist, so retrying cannot help.
+            if (found.every((r) => r.status === "rejected" && r.reason?.code === "ENOTFOUND"))
+                throw discoveryError("domain_not_found");
             answers = found.flatMap((r, i) => r.status === "fulfilled"
                 ? r.value.map((address) => ({ address, family: i === 0 ? 4 : 6 }))
                 : []);
@@ -53,21 +59,61 @@ async function resolve(host, context, servers) {
         try {
             answers = await lookup(host, { all: true });
         }
-        catch {
+        catch (error) {
+            // getaddrinfo's authoritative name-not-found is the same configuration
+            // error; any other resolver trouble may succeed on a later retry.
+            if (error &&
+                typeof error === "object" &&
+                error.code === "ENOTFOUND")
+                throw discoveryError("domain_not_found");
             throw discoveryError("resolution_failed");
         }
     }
     remaining(context);
-    ensure(answers.length >= 1 &&
-        answers.length <= 64 &&
-        answers.every((a) => isIP(a.address) === a.family), "resolution_failed");
-    return [...new Set(answers.map((a) => a.address))];
+    ensure(answers.every((a) => isIP(a.address) === a.family), "resolution_failed");
+    // Match the reference resolver: IPv6 first, retaining order within each family,
+    // then remove duplicates before applying the address bound.
+    const addresses = [...new Set(answers.sort((a, b) => b.family - a.family).map((a) => a.address))];
+    ensure(addresses.length >= 1 && addresses.length <= 64, "resolution_failed");
+    return addresses;
 }
+/**
+ * The OS trust store, or undefined when this runtime provides no usable one: Node before
+ * 22.15.0 (and Deno 2.5.6) lack `tls.getCACertificates`, and a host can return an empty
+ * store. Bundled roots are never a fallback (ADR 0007); callers get
+ * `discovery/transport_unavailable`, the same refusal as a denied store.
+ */
 function systemCertificates() {
     if (typeof tls.getCACertificates !== "function")
         return undefined;
-    const certificates = tls.getCACertificates("system");
-    return certificates.length > 0 ? certificates : undefined;
+    try {
+        const certificates = tls.getCACertificates("system");
+        return certificates.length > 0 ? certificates : undefined;
+    }
+    catch (error) {
+        systemCertificateError(error);
+    }
+}
+/**
+ * Check that the peer certificate names the host. An IP literal is matched against the
+ * certificate's iPAddress names by OpenSSL (`X509Certificate.checkIP`), never against DNS
+ * names or the subject. Node 22.23.1's `tls.checkServerIdentity` IDNA-normalizes the host
+ * before testing for an IP, and `domainToASCII("::1")` is "", so every IPv6 literal fails
+ * there with ERR_TLS_CERT_ALTNAME_INVALID; DNS hosts keep `tls.checkServerIdentity`.
+ */
+function checkHostIdentity(host, cert) {
+    if (!isIP(host))
+        return checkServerIdentity(host, cert);
+    try {
+        if (new X509Certificate(cert.raw).checkIP(host) !== undefined)
+            return undefined;
+    }
+    catch {
+        // A certificate OpenSSL cannot parse names no address.
+    }
+    return Object.assign(new Error("certificate does not name the IP address"), {
+        code: "ERR_TLS_CERT_ALTNAME_INVALID",
+    });
 }
 function tlsSocket(ip, url, source, context) {
     remaining(context);
@@ -78,7 +124,7 @@ function tlsSocket(ip, url, source, context) {
             encodeBase64(der) +
             "\n-----END CERTIFICATE-----");
     if (!ca)
-        throw custodyError("unsupported_format");
+        throw discoveryError("transport_unavailable");
     return new Promise((done, fail) => {
         const socket = connect(Object.assign(Object.create(null), {
             host: ip,
@@ -88,7 +134,7 @@ function tlsSocket(ip, url, source, context) {
             minVersion: "TLSv1.2",
             ALPNProtocols: ["http/1.1"],
             ca,
-            checkServerIdentity: (_name, cert) => checkServerIdentity(host, cert),
+            checkServerIdentity: (_name, cert) => checkHostIdentity(host, cert),
             lookup: () => {
                 throw discoveryError("address_denied");
             },
@@ -138,7 +184,7 @@ async function connected(url, source, context, servers) {
     }
     throw last;
 }
-async function get(url, source, context, servers) {
+async function get(url, source, context, servers, etag) {
     const socket = await connected(url, source, context, servers);
     // HTTPS receives only an already connected, peer-checked TLS socket. No proxy,
     // pooled connection or late DNS lookup participates in this private agent.
@@ -168,6 +214,7 @@ async function get(url, source, context, servers) {
                         : "application/json, application/jwk-set+json",
                     "Accept-Encoding": "gzip",
                     Connection: "close",
+                    ...(typeof etag === "string" ? { "If-None-Match": etag } : {}),
                 },
                 lookup: () => {
                     throw discoveryError("address_denied");
@@ -244,7 +291,14 @@ async function get(url, source, context, servers) {
                 }
             };
             socket.prependListener("data", onWire);
-            req.on("information", info => reject(discoveryError("unexpected_status", info.statusCode)));
+            // RFC 9110 Section 15.2: interim responses are provisional and precede
+            // the final status. Five are skipped, the reference bound; a sixth
+            // names a misbehaving publisher and rejects as a malformed response.
+            let interims = 0;
+            req.on("information", (info) => {
+                if (++interims > 5)
+                    reject(discoveryError("invalid_response"));
+            });
             req.on("upgrade", (res, upgraded) => {
                 reject(discoveryError("unexpected_status", res.statusCode));
                 upgraded.destroy();
@@ -346,8 +400,8 @@ function redirectUrl(current, location) {
         throw discoveryError("redirect_denied");
     }
 }
-async function resource(url, source, context, servers, hops = 0) {
-    const { status, fs, encoded } = await get(url, source, context, servers);
+async function resource(url, source, context, servers, hops = 0, etag) {
+    const { status, fs, encoded } = await get(url, source, context, servers, etag);
     if ([301, 302, 303, 307, 308].includes(status)) {
         ensure(source.maxRedirects > 0, "redirect_denied");
         ensure(hops < source.maxRedirects, "redirect_limit");
@@ -356,8 +410,15 @@ async function resource(url, source, context, servers, hops = 0) {
         const target = redirectUrl(url, location);
         ensure(source.redirectScope === "any_https" ||
             sourceOrigin(target) === sourceOrigin(sourceUrl(source.location)), "redirect_denied");
-        return resource(target, source, context, servers, hops + 1);
+        // A validator never crosses a redirect: the target is a different
+        // resource representation.
+        return resource(target, source, context, servers, hops + 1, undefined);
     }
+    // RFC 9111 Section 15.4.5: 304 is valid only as the answer to the
+    // conditional this client sent; an unsolicited 304 falls through to the
+    // unexpected-status rejection below.
+    if (status === 304 && typeof etag === "string")
+        return { notModified: true, fields: fs, location: url.href };
     if (status !== 200)
         throw discoveryError("unexpected_status", status);
     mediaType(fs, source.type);
@@ -367,12 +428,37 @@ async function resource(url, source, context, servers, hops = 0) {
     remaining(context);
     return { fields: fs, encoded, decoded, location: url.href };
 }
+/** Fetch a discovery key set with bounded HTTPS, address, and redirect policies, unconditionally. A `validators` option is accepted and ignored, so this function wires directly as a cache's fetch callback; use `fetchWithValidators` for conditional revalidation. */
 export async function fetch(source, input = {}) {
+    const r = await conditional(source, input, undefined);
+    // No validator was sent, so a 304 cannot occur; keep the total anyway.
+    if (r.ok && "notModified" in r.value && r.value.notModified === true)
+        return err(discoveryError("invalid_response"));
+    return r;
+}
+/** Conditionally fetch a discovery key set (RFC 9111 Section 4.3.4): send `If-None-Match` with the stored validator, and an unchanged source answers 304 as a `NotModified` outcome instead of a key set. `storedLifetime` seconds persist when the 304 carries no freshness directives of its own. */
+export async function fetchWithValidators(source, etag, storedLifetime, input = {}) {
+    try {
+        ensure(typeof etag === "string" &&
+            etag.length >= 1 &&
+            etag.length <= 512 &&
+            Number.isSafeInteger(storedLifetime) &&
+            storedLifetime >= 0, "invalid_options");
+    }
+    catch (e) {
+        return failure(e);
+    }
+    return conditional(source, input, {
+        etag: etag,
+        lifetime: storedLifetime,
+    });
+}
+async function conditional(source, input, validator) {
     try {
         ensure(isDiscoverySource(source), "invalid_source");
         if (source.cacerts === "os" && !systemCertificates())
-            return err(custodyError("unsupported_format"));
-        const a = options(input, ["timeoutMs", "clock", "context", "dnsServers"]);
+            return err(discoveryError("transport_unavailable"));
+        const a = options(input, ["timeoutMs", "clock", "context", "dnsServers", "validators"]);
         const timeout = Object.hasOwn(a, "timeoutMs")
             ? a.timeoutMs
             : source.timeoutMs;
@@ -409,15 +495,38 @@ export async function fetch(source, input = {}) {
         }), "invalid_options");
         const result = await run(context, async () => {
             try {
-                const outer = await resource(sourceUrl(source.location), source, context, servers);
+                const outer = await resource(sourceUrl(source.location), source, context, servers, 0, validator?.etag);
                 const now = clockValue(clock);
+                if ("notModified" in outer) {
+                    // RFC 9111 Sections 3.2 and 4.3.4: a 304's own directives
+                    // recalculate freshness; without them the stored representation's
+                    // lifetime persists. A different strong validator identifies a
+                    // different representation, so it cannot renew this one.
+                    const updated = header(outer.fields, "etag");
+                    ensure(updated === null || updated.length <= 512, "invalid_response");
+                    ensure(updated === null || updated === validator.etag, "invalid_response");
+                    const fresh = Object.freeze({
+                        notModified: true,
+                        etag: validator.etag,
+                        fetchedAt: now,
+                        expiresAt: hasFreshness(outer.fields)
+                            ? expiry(outer.fields, source, now)
+                            : now + validator.lifetime,
+                    });
+                    return ok(fresh);
+                }
                 if (source.type === "cimd") {
                     const doc = bodyDocument(outer.decoded, source);
                     ensure(doc.client_id === source.location, "client_id_mismatch");
                     ensure(!(Object.hasOwn(doc, "jwks") && Object.hasOwn(doc, "jwks_uri")), "ambiguous_key_source");
                     if (Object.hasOwn(doc, "jwks_uri")) {
                         const url = sourceUrl(doc.jwks_uri);
-                        ensure(sourceOrigin(url) === sourceOrigin(sourceUrl(source.location)), "redirect_denied");
+                        ensure(
+                        // Compare against the origin that served this document, not the
+                        // configured one: a permissive redirect scope can legitimately
+                        // move the document to a mirror, and its jwks_uri names that
+                        // mirror.
+                        sourceOrigin(url) === sourceOrigin(sourceUrl(outer.location)), "redirect_denied");
                         // The subresource has JWKS media/body ceilings, original CIMD provenance.
                         const nestedSource = unwrap(DiscoverySource.create({
                             ...source,
@@ -425,6 +534,10 @@ export async function fetch(source, input = {}) {
                             location: url.href,
                         }), "invalid_source");
                         const nested = await resource(url, nestedSource, context, servers);
+                        // The nested subresource is always fetched unconditionally, so a
+                        // 304 cannot occur here; keep the rejection total anyway.
+                        if ("notModified" in nested)
+                            throw discoveryError("unexpected_status");
                         const result = await fromResource(source, nested.decoded, nested.encoded, now, nested.fields, nested.location, expiry(outer.fields, source, now), true, context);
                         remaining(context);
                         return result;
@@ -446,14 +559,25 @@ export async function fetch(source, input = {}) {
         return failure(error, "invalid_options");
     }
 }
-export const Discovery = Object.freeze({ ...CoreDiscovery, fetch });
+/** Discovery resolution with the explicit Node HTTPS transport. */
+export const Discovery = Object.freeze({ ...CoreDiscovery,
+    /** Fetch a discovery key set through the bounded Node HTTPS transport. */
+    fetch,
+    /** Conditionally fetch a discovery key set (RFC 9111 Section 4.3.4). */
+    fetchWithValidators });
 /** Node source creation fails closed when the OS trust store is unavailable or empty. */
 export const DiscoverySource = Object.freeze({
     ...CoreSource,
+    /** Create a discovery source after validating Node transport options. */
     create(input) {
-        const result = CoreSource.create(input);
-        if (result.ok && result.value.cacerts === "os" && !systemCertificates())
-            return err(custodyError("unsupported_format"));
-        return result;
+        try {
+            const result = CoreSource.create(input);
+            if (result.ok && result.value.cacerts === "os" && !systemCertificates())
+                return err(discoveryError("transport_unavailable"));
+            return result;
+        }
+        catch (error) {
+            return failure(error, "invalid_source");
+        }
     },
 });

package/dist/discovery/proof.js

@@ -4,7 +4,7 @@ import { Message, Body, TransportFacts, } from "../message/index.js";
 import { SignatureBase } from "../signature-base/index.js";
 import { Crypto } from "../crypto/index.js";
 import { digest } from "../crypto/subtle.js";
-import { algorithms } from "../crypto/algorithm.js";
+import { algorithms, joseId } from "../crypto/algorithm.js";
 import { encodeBase64 } from "../bytes.js";
 import { sourceAuthority, sourceUrl, thumbprintId } from "./source.js";
 import { ensure, unwrap } from "./support.js";
@@ -145,7 +145,7 @@ export async function possessionProof(source, keys, location, fs, encoded, now,
         for (const algorithm of unwrap(algorithms(), "directory_signature_invalid")) {
             ensure(!context || remainingMs(context) > 0, "deadline_exceeded");
             if ((entry.assertedAlgorithm === null ||
-                entry.assertedAlgorithm === algorithm) &&
+                entry.assertedAlgorithm === joseId(algorithm)) &&
                 entry.key.bind(algorithm).ok &&
                 (!p.has("alg") || textParam(p, "alg") === algorithm)) {
                 if ((await Crypto.verify(algorithm, entry.key, sig.value.value, base)).ok) {

package/dist/discovery/snapshot.js

@@ -57,6 +57,8 @@ export async function fromResource(source, decoded, encoded, now, fs, location,
         }
         const bodyRevision = await revision(decoded);
         ensure(!context || remainingMs(context) > 0, "deadline_exceeded");
+        const storedEtag = header(fs, "etag");
+        ensure(storedEtag === null || storedEtag.length <= 512, "invalid_response");
         return ok(keySet({
             source,
             origin: sourceOrigin(sourceUrl(location)),
@@ -65,6 +67,7 @@ export async function fromResource(source, decoded, encoded, now, fs, location,
             expiresAt,
             revision: bodyRevision,
             proof: proven.proof,
+            etag: storedEtag,
         }));
     }
     catch (e) {

package/dist/discovery/source.d.ts

@@ -1,5 +1,7 @@
 import { type Result } from "../result.ts";
+/** Supported discovery source kinds. @inline */
 export type SourceType = "directory" | "jwks_uri" | "cimd";
+/** A branded HTTPS discovery source with bounded transport and cache policies. */
 export type DiscoverySource = Readonly<{
     type: SourceType;
     location: string;
@@ -18,9 +20,11 @@ export type DiscoverySource = Readonly<{
     maxTtl: number;
     negativeTtl: number;
 }>;
+/** Check the private brand of a discovery source. */
 export declare function isDiscoverySource(s: unknown): s is DiscoverySource;
 export declare function sourceIdentity(s: DiscoverySource): string;
 export declare function thumbprintId(value: unknown): value is string;
+/** Check whether a string is a valid directory key identifier. */
 export declare function directoryId(value: unknown): Result<boolean>;
 export declare function keyIdValid(s: DiscoverySource, v: unknown): v is string;
 /** Validate raw spelling before WHATWG normalization can erase a dot segment. */
@@ -29,7 +33,10 @@ export declare function normalizedHost(url: URL): string;
 export declare function sourceOrigin(url: URL): string;
 export declare function sourceAuthority(url: URL): string;
 export declare function createSource(input: unknown): Result<DiscoverySource>;
+/** Discovery source construction and directory identifier validation. */
 export declare const DiscoverySource: Readonly<{
+    /** Snapshot, validate, and brand an HTTPS discovery source. */
     create: typeof createSource;
+    /** Check the directory key identifier syntax. */
     directoryId: typeof directoryId;
 }>;

package/dist/discovery/source.js

@@ -15,6 +15,7 @@ const limits = Object.freeze({
     maxTtl: 86400,
     negativeTtl: 30,
 });
+/** Check the private brand of a discovery source. */
 export function isDiscoverySource(s) {
     return !!s && typeof s === "object" && sources.has(s);
 }
@@ -33,6 +34,7 @@ function validDirectoryId(v) {
         v.length <= 256 &&
         /^[\x20-\x7e]+$/.test(v));
 }
+/** Check whether a string is a valid directory key identifier. */
 export function directoryId(value) {
     return ok(validDirectoryId(value));
 }
@@ -193,7 +195,10 @@ export function createSource(input) {
         return failure(e, "invalid_source");
     }
 }
+/** Discovery source construction and directory identifier validation. */
 export const DiscoverySource = Object.freeze({
+    /** Snapshot, validate, and brand an HTTPS discovery source. */
     create: createSource,
+    /** Check the directory key identifier syntax. */
     directoryId,
 });

package/dist/discovery/support.js

@@ -1,4 +1,4 @@
-import { snapshotOptions, deepFreeze } from "../brand.js";
+import { snapshotOptions, deepFreeze, inspection } from "../brand.js";
 import { discoveryError, isRequestSealError } from "../errors/types.js";
 import { err } from "../result.js";
 export function ensure(value, reason) {
@@ -49,8 +49,7 @@ export function inspectable(value, facts) {
     const inspect = () => Object.freeze({ ...facts });
     Object.defineProperties(value, {
         toJSON: { value: inspect },
-        [Symbol.for("nodejs.util.inspect.custom")]: { value: inspect },
-        [Symbol.for("Deno.customInspect")]: { value: inspect },
+        ...inspection(inspect),
     });
     return Object.freeze(value);
 }

package/dist/errors/parity.d.ts

@@ -1,4 +1,5 @@
-export declare const ELIXIR_ERROR_PIN = "b2392871933d99641a7cb2ca2726aefd20081dee";
+/** The immutable reference release used for the error vocabulary. */
+export declare const ELIXIR_ERROR_PIN = "53b6690ccd5036d58b280d08cf0cacc6427262fe";
 declare const retryableRules: {
     readonly core: {
         readonly actor_unbound: {
@@ -37,6 +38,10 @@ declare const retryableRules: {
             readonly kind: "constant";
             readonly value: false;
         };
+        readonly deadline: {
+            readonly kind: "constant";
+            readonly value: true;
+        };
         readonly digest_mismatch: {
             readonly kind: "constant";
             readonly value: false;
@@ -65,6 +70,10 @@ declare const retryableRules: {
             readonly kind: "constant";
             readonly value: false;
         };
+        readonly internal: {
+            readonly kind: "constant";
+            readonly value: false;
+        };
         readonly invalid_accept_signature: {
             readonly kind: "constant";
             readonly value: false;
@@ -511,6 +520,10 @@ declare const retryableRules: {
             readonly kind: "constant";
             readonly value: false;
         };
+        readonly invalid_options: {
+            readonly kind: "constant";
+            readonly value: false;
+        };
         readonly invalid_signature: {
             readonly kind: "constant";
             readonly value: false;
@@ -639,6 +652,10 @@ declare const retryableRules: {
             readonly kind: "constant";
             readonly value: false;
         };
+        readonly domain_not_found: {
+            readonly kind: "constant";
+            readonly value: false;
+        };
         readonly invalid_key_set: {
             readonly kind: "constant";
             readonly value: false;
@@ -669,7 +686,7 @@ declare const retryableRules: {
         };
         readonly resolution_failed: {
             readonly kind: "constant";
-            readonly value: false;
+            readonly value: true;
         };
         readonly revoked_key: {
             readonly kind: "constant";
@@ -696,7 +713,7 @@ declare const retryableRules: {
             readonly minimum: 500;
             readonly maximum: 599;
             readonly path: "lib/request_seal/discovery.ex";
-            readonly line: 301;
+            readonly line: 517;
         };
         readonly unknown_key: {
             readonly kind: "constant";
@@ -903,6 +920,7 @@ declare const retryableRules: {
     };
 };
 export declare const ERROR_RETRYABLE: typeof retryableRules;
+/** The pinned reason, layer, and retryability table. */
 export declare const ERROR_PARITY: readonly Readonly<{
     readonly kind: "core";
     readonly layer: "binding";
@@ -1113,6 +1131,11 @@ export declare const ERROR_PARITY: readonly Readonly<{
     readonly layer: "input";
     readonly reason: "unsupported_component";
     readonly rule_id: "core/input.unsupported_component";
+} | {
+    readonly kind: "core";
+    readonly layer: "internal";
+    readonly reason: "internal";
+    readonly rule_id: "core/internal.internal";
 } | {
     readonly kind: "core";
     readonly layer: "key";
@@ -1198,6 +1221,11 @@ export declare const ERROR_PARITY: readonly Readonly<{
     readonly layer: "quorum";
     readonly reason: "binding_unsatisfied";
     readonly rule_id: "core/quorum.binding_unsatisfied";
+} | {
+    readonly kind: "core";
+    readonly layer: "quorum";
+    readonly reason: "deadline";
+    readonly rule_id: "core/quorum.deadline";
 } | {
     readonly kind: "core";
     readonly layer: "quorum";
@@ -1480,6 +1508,10 @@ export declare const ERROR_PARITY: readonly Readonly<{
     readonly kind: "crypto";
     readonly reason: "invalid_key";
     readonly rule_id: "crypto/invalid_key";
+} | {
+    readonly kind: "crypto";
+    readonly reason: "invalid_options";
+    readonly rule_id: "crypto/invalid_options";
 } | {
     readonly kind: "crypto";
     readonly reason: "invalid_signature";
@@ -1604,6 +1636,10 @@ export declare const ERROR_PARITY: readonly Readonly<{
     readonly kind: "discovery";
     readonly reason: "directory_unsigned";
     readonly rule_id: "discovery/directory_unsigned";
+} | {
+    readonly kind: "discovery";
+    readonly reason: "domain_not_found";
+    readonly rule_id: "discovery/domain_not_found";
 } | {
     readonly kind: "discovery";
     readonly reason: "invalid_key_set";
@@ -1882,13 +1918,18 @@ export declare const ERROR_PARITY: readonly Readonly<{
     readonly reason: "untrusted_proxy";
     readonly rule_id: "adapter/untrusted_proxy";
 }>[];
+/** A pinned error reason and its layers and retryability metadata. */
 export type ParityEntry = typeof ERROR_PARITY[number];
+/** An error family present in the pinned parity table. */
 export type ErrorKind = ParityEntry["kind"];
+/** The allowed reason vocabulary for an error family. */
 export type Reason<K extends ErrorKind> = Extract<ParityEntry, {
     kind: K;
 }>["reason"];
+/** The allowed layer vocabulary for an error family. */
 export type Layer<K extends "core" | "jose"> = Extract<ParityEntry, {
     kind: K;
 }>["layer"];
+/** The complete set of rule IDs derived from the parity table. */
 export declare const RULE_IDS: ReadonlySet<string>;
 export {};