identitycli

const (

	// EnrollConfirmPrompt is shown on errOut to ask the member to confirm the
	// fingerprint matches the one the admin gave them out of band.
	EnrollConfirmPrompt = "Confirm this matches the fingerprint your admin gave you out-of-band [y/N]: "
	// EnrollAutoConfirmedNote is printed instead of the prompt when --yes is set.
	EnrollAutoConfirmedNote = "auto-confirmed via --yes"
	// EnrollConfirmedNote is the interactive-confirm result word shown in the
	// summary when the member accepted the OOB fingerprint prompt.
	EnrollConfirmedNote = "confirmed"
	// EnrollNetworkLabel prefixes the printed network id.
	EnrollNetworkLabel = "network: "
	// EnrollRelayLabel prefixes the printed relay base URL.
	EnrollRelayLabel = "relay: "
	// EnrollFingerprintLabel prefixes the printed fingerprint (= network id).
	EnrollFingerprintLabel = "fingerprint: "
	// EnrollSignedNote confirms the request signed AND self-verified
	// (proof-of-possession passed).
	EnrollSignedNote = "✓ signed & self-verified"
	// EnrollNextStepNote tells the member to hand the emitted request to the admin.
	EnrollNextStepNote = "hand this to your admin out-of-band; they run `vaultmind identity enroll-add`."
	// EnrollAnchorPinnedNote confirms the OOB-confirmed network root was persisted
	// so a future `vaultmind doctor` authenticates registry verification against it.
	EnrollAnchorPinnedNote = "✓ pinned this network's root (a future `vaultmind doctor` will authenticate against it)"
)

const (
	// ErrEnrollEmptyInvite is returned when --invite is empty.
	ErrEnrollEmptyInvite = "identitycli: --invite is required (a vmenroll1: token or enroll URL)"
	// ErrEnrollEmptyDisplayName is returned when --display-name is empty.
	ErrEnrollEmptyDisplayName = "identitycli: --display-name is required"
	// ErrEnrollEmptySlug is returned when --slug is empty.
	ErrEnrollEmptySlug = "identitycli: --slug is required"
	// ErrEnrollEmptyPubKey is returned when --pubkey is empty.
	ErrEnrollEmptyPubKey = "identitycli: --pubkey is required (your base64-std ed25519 identity pubkey)"
	// ErrEnrollEmptyTransportPubKey is returned when --transport-pubkey is empty.
	ErrEnrollEmptyTransportPubKey = "identitycli: --transport-pubkey is required (your base64-std WireGuard pubkey)"
	// ErrEnrollEmptyAnchorPath is returned when AnchorStorePath is empty. The cmd
	// layer always resolves it (xdg.DataFile); an empty value is a PROGRAMMING
	// error, surfaced fail-closed before any network/signer interaction.
	ErrEnrollEmptyAnchorPath = "identitycli: AnchorStorePath is empty (programming error: the cmd layer must set it)"

	// ErrEnrollSelfVerify is returned when proof-of-possession self-verification
	// fails: the running signer holds a DIFFERENT key than --pubkey.
	ErrEnrollSelfVerify = "" /* 168-byte string literal not displayed */
	// ErrEnrollPersistAnchor wraps a failure to persist the OOB-confirmed trust
	// anchor. Enroll FAILS CLOSED on it: the request is NOT emitted, so there is
	// never a half-state (a request handed to the admin without the pinned root).
	ErrEnrollPersistAnchor = "identitycli: persist network trust anchor"
)

const (

	// EnrollAddAddedLabel prefixes the added binding's slug.
	EnrollAddAddedLabel = "added: "
	// EnrollAddPubKeyLabel prefixes the added binding's pubkey.
	EnrollAddPubKeyLabel = "pubkey: "
	// EnrollAddKeyEpochLabel prefixes the added binding's key_epoch.
	EnrollAddKeyEpochLabel = "key_epoch: "
	// EnrollAddEpochLabel prefixes the new registry epoch.
	EnrollAddEpochLabel = "new registry epoch: "
	// EnrollAddWindowLabel prefixes the issuance window (valid_from..valid_until).
	EnrollAddWindowLabel = "issuance window: "
	// EnrollAddNextStepNote tells the admin to root-sign the emitted registry.
	EnrollAddNextStepNote = "NEXT: run the ROOT signer and pipe this to `vaultmind identity sign-registry`."
	// EnrollAddTransportNote surfaces that transport fields are not yet carried
	// into the binding (WireGuard wiring is a later slice).
	EnrollAddTransportNote = "NOTE: transport_pubkey/transport_endpoint are NOT yet carried into the binding (WireGuard = later slice)."
)

const (
	// ErrEnrollAddEmptyRequest is returned when the request input is empty.
	ErrEnrollAddEmptyRequest = "identitycli: enrollment request is empty"

	// ErrEnrollAddPoP is returned when proof-of-possession fails: the request sig
	// does not verify under its own pubkey.
	ErrEnrollAddPoP = "identitycli: proof-of-possession failed: the request signature does not verify under its pubkey"

	// ErrEnrollAddNoNetwork is returned when neither --root-pubkey nor
	// --network-id is supplied (cannot resolve the admin network).
	ErrEnrollAddNoNetwork = "identitycli: at least one of --root-pubkey or --network-id is required to resolve the admin network"
	// ErrEnrollAddNetworkSpecifierDisagree is returned when --root-pubkey-derived
	// network and --network-id are both supplied but disagree.
	ErrEnrollAddNetworkSpecifierDisagree = "identitycli: --root-pubkey-derived network and --network-id disagree"
	// ErrEnrollAddCrossNetwork is returned when the request's network_id is not
	// the admin network (cross-network request refused).
	ErrEnrollAddCrossNetwork = "identitycli: cross-network request refused"

	// ErrEnrollAddSignedNeedsRootPubKey is returned when a signed-envelope
	// --registry is supplied without --root-pubkey (cannot integrity-verify).
	ErrEnrollAddSignedNeedsRootPubKey = "identitycli: a signed-envelope --registry requires --root-pubkey to integrity-verify it"
	// ErrEnrollAddUntrustedRegistry is returned when a signed-envelope --registry
	// root signature does not verify (refusing to mutate untrusted state).
	ErrEnrollAddUntrustedRegistry = "identitycli: current registry root signature invalid — refusing to mutate untrusted state"
	// ErrEnrollAddUnrecognizedRegistry is returned when the --registry input is
	// neither a signed envelope nor an unsigned wireRegistry.
	ErrEnrollAddUnrecognizedRegistry = "identitycli: unrecognized registry shape (expected an unsigned wireRegistry or a signed distribution envelope)"
	// ErrEnrollAddLiveSlugExists is returned when the slug already has a live
	// binding (rotation is out of scope for v1; revoke before re-adding).
	ErrEnrollAddLiveSlugExists = "identitycli: slug already has a live binding; revoke before re-adding"
	// ErrEnrollAddTupleExists is returned when the {slug,key_epoch} tuple already
	// exists in the current registry.
	ErrEnrollAddTupleExists = "identitycli: a binding with this {slug,key_epoch} already exists"
	// ErrEnrollAddEpochOverflow is returned when bumping the epoch would exceed
	// the JCS-safe ceiling (MaxSafeEpoch).
	ErrEnrollAddEpochOverflow = "identitycli: new registry epoch exceeds the JCS-safe ceiling"
)

const (
	// PubKeyLabel prefixes the printed public key. Only the PUBLIC key is ever
	// printed by Init.
	PubKeyLabel = "public_key (ed25519, base64): "
	// SigLabel prefixes the printed signature.
	SigLabel = "signature (ed25519, base64): "
)

const (
	// ErrEnvelopeParse is returned by SignEnvelope when the envelope JSON cannot
	// be decoded (bad JSON, unknown field, or trailing data — strict, fail closed).
	ErrEnvelopeParse = "identitycli: parse envelope JSON"
	// ErrEnvelopeBadFromPubKey is returned when fromPubKeyB64 is set but not valid
	// base64 of an ed25519 public key.
	ErrEnvelopeBadFromPubKey = "identitycli: from_pubkey must be base64 of an ed25519 public key"
)

const (
	// InviteTokenLabel prefixes the printed bootstrap token. It is an OUTPUT label,
	// not a secret; the regex secret-scanner false-positives because the value ends
	// just before the next label's opening quote.
	InviteTokenLabel = "token: " // nosemgrep: go-hardcoded-secret -- output label, not a credential
	// InviteURLLabel prefixes the printed enroll URL (token in the fragment).
	InviteURLLabel = "url: "
	// InviteFingerprintLabel prefixes the printed OOB fingerprint (the network id).
	InviteFingerprintLabel = "fingerprint (share out-of-band): "
	// InviteConfirmNote is the one-line instruction printed under the fingerprint:
	// the member MUST confirm this value with the admin over a TRUSTED channel.
	InviteConfirmNote = "The member must confirm this fingerprint with you over a trusted channel before enrolling."
)

const (
	// ErrEnrollmentParse is returned by SignEnrollment when the enrollment JSON
	// cannot be decoded (bad JSON, unknown field, or trailing data — strict, fail
	// closed).
	ErrEnrollmentParse = "identitycli: parse enrollment JSON"
	// ErrEnrollmentMarshalResult wraps a marshal failure of the sign result.
	ErrEnrollmentMarshalResult = "identitycli: marshal sign-enrollment result"
)

const (
	// ErrRegistryParse is returned by SignRegistry when the registry JSON cannot
	// be decoded (bad JSON, unknown field, or trailing data — strict, fail closed).
	ErrRegistryParse = "identitycli: parse registry JSON"
	// ErrRegistryBadPubKey is returned when a binding's pubkey is not valid
	// base64-std of a validatable ed25519 public key.
	ErrRegistryBadPubKey = "identitycli: binding pubkey must be base64-std of an ed25519 public key"
	// ErrRegistryMarshalDist wraps a distribution-envelope marshal failure.
	ErrRegistryMarshalDist = "identitycli: marshal distribution envelope"
	// ErrRegistryRevokedAtNegative is returned when a binding's revoked_at is
	// negative (a pre-epoch revocation timestamp is nonsensical — fail closed).
	ErrRegistryRevokedAtNegative = "identitycli: binding revoked_at must not be negative"
)

const ErrInviteBadRootPubKey = "identitycli: root pubkey must be base64-std of an ed25519 public key"