apierror

const (
	// Plugin publish / sync path (ADR-0034, as amended).
	PluginUnsigned             = "plugin_unsigned"              // 422 — no signature bundle attached to the index
	PluginVerificationFailed   = "plugin_verification_failed"   // 422 — signature present but invalid / fail-closed trust error
	PluginSignerMismatch       = "plugin_signer_mismatch"       // 422 — signer identity disagrees with the TOFU-pinned one
	PluginVersionImmutable     = "plugin_version_immutable"     // 409 — (ns,id,version) already published with different content
	PluginCoordinateMismatch   = "plugin_coordinate_mismatch"   // 422 — signed config's plugin field disagrees with the published <ns>/<id> coordinate
	PluginSyncNotEnabled       = "plugin_sync_not_enabled"      // 501 — hub verifier not configured (operational)
	InteractivePublishDisabled = "interactive_publish_disabled" // 403 — interactive publish off; use CI trusted publishing
	TagVersionMismatch         = "tag_version_mismatch"         // 422 — config version != index tag
	MalformedIndex             = "malformed_index"              // 422 — bad child media types / missing layers / empty evaluates
	RegistryNotAllowed         = "registry_not_allowed"         // 400 — repository not the <ns>/plugins/<id> shape

	// Catalog publish / sync path (ADR-0045). The catalog analogue of the
	// plugin codes above: the hub verifies a catalog bundle's Sigstore
	// signature (discovered as an OCI referrer of the bundle) at ingest and
	// TOFU-pins the canonical signer identity per (namespace, catalog_id).
	// Same reject matrix, same 422 status, same identity scheme as plugins —
	// one trust model across both artifact kinds.
	CatalogUnsigned           = "catalog_unsigned"            // 422 — no signature referrer found on the bundle
	CatalogVerificationFailed = "catalog_verification_failed" // 422 — signature present but invalid / fail-closed trust error
	CatalogSignerMismatch     = "catalog_signer_mismatch"     // 422 — signer identity disagrees with the TOFU-pinned one

	// Publication-license requirement (ADR-0037) — shared across the catalog/bundle
	// sync path and the plugin sync path; the carrier differs (catalog bundles use
	// the org.opencontainers.image.licenses OCI annotation; plugins use the signed
	// pluginspec.Config.License field), the code does not. Rejected when a license
	// is absent or not a well-formed SPDX expression; a well-formed-but-unknown id
	// is accepted (no version-skew false-reject). To resolve: declare an SPDX
	// expression — see https://spdx.org/licenses — or a LicenseRef-… token for a
	// custom/proprietary license. 422 (the bundle parsed and is otherwise valid but
	// violates the license precondition), consistent with the policy-precondition
	// reading of the 422 codes above rather than the field-shape 400s.
	LicenseRequired = "license_required" // 422 — no valid publication license declared

	// Shared transport / drift codes.
	CoordinateMismatch = "coordinate_mismatch" // 400 — request body repository != URL coordinate
	Forbidden          = "forbidden"           // 403 — caller lacks ownership / write authority
	RegistryDiverged   = "registry_diverged"   // 502 — registry digest drifted after ingest (read path)
)