apierror

const (
	// Plugin publish / sync path (ADR-0034, as amended).
	PluginUnsigned             = "plugin_unsigned"              // 422 — no signature bundle attached to the index
	PluginVerificationFailed   = "plugin_verification_failed"   // 422 — signature present but invalid / fail-closed trust error
	PluginSignerMismatch       = "plugin_signer_mismatch"       // 422 — signer identity disagrees with the TOFU-pinned one
	PluginVersionImmutable     = "plugin_version_immutable"     // 409 — (ns,id,version) already published with different content
	PluginCoordinateMismatch   = "plugin_coordinate_mismatch"   // 422 — signed config's plugin field disagrees with the published <ns>/<id> coordinate
	PluginSyncNotEnabled       = "plugin_sync_not_enabled"      // 501 — hub verifier not configured (operational)
	InteractivePublishDisabled = "interactive_publish_disabled" // 403 — interactive publish off; use CI trusted publishing
	TagVersionMismatch         = "tag_version_mismatch"         // 422 — config version != index tag
	MalformedIndex             = "malformed_index"              // 422 — bad child media types / missing layers / empty evaluates
	RegistryNotAllowed         = "registry_not_allowed"         // 400 — repository not the <ns>/plugins/<id> shape

	// Shared transport / drift codes.
	CoordinateMismatch = "coordinate_mismatch" // 400 — request body repository != URL coordinate
	Forbidden          = "forbidden"           // 403 — caller lacks ownership / write authority
	RegistryDiverged   = "registry_diverged"   // 502 — registry digest drifted after ingest (read path)
)