{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://aidid.im/schemas/login/login-error.schema.json",
  "title": "AIDID Login Failure",
  "description": "The fail-closed failure object returned by the RP-side SDK (`verifySignInResponse` / `verifyMembershipCredential` / `toFailure`). Every failure path yields this shape — never a silent success. This is the SDK result contract, not an HTTP contract: an RP chooses its own status code and transport for it.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "ok",
    "error",
    "message"
  ],
  "properties": {
    "ok": {
      "const": false,
      "description": "Always `false` for a failure."
    },
    "error": {
      "enum": [
        "invalid_response",
        "invalid_request",
        "message_mismatch",
        "nonce_mismatch",
        "domain_mismatch",
        "nonce_unknown",
        "nonce_replayed",
        "request_expired",
        "chain_mismatch",
        "did_not_found",
        "did_deactivated",
        "invalid_public_key",
        "verification_method_not_found",
        "vm_not_authentication_authorized",
        "unsupported_proof_type",
        "signature_invalid",
        "endpoint_unavailable",
        "vc_issuer_unconfigured",
        "vc_verification_failed",
        "did_denied",
        "not_implemented"
      ],
      "description": "Stable machine-readable error code (SPEC-LOGIN-v1 §13). Every code maps to a specific §7 check."
    },
    "message": {
      "type": "string",
      "description": "Human-readable diagnostic. Not stable; never branch on it."
    }
  },
  "examples": [
    {
      "ok": false,
      "error": "message_mismatch",
      "message": "signed message does not match the request"
    }
  ],
  "x-aidid": {
    "spec": {
      "doc": "AIDID_第三方登录规范_v1.md",
      "section": "§13",
      "version": "v1.3"
    },
    "status": "implemented",
    "source": [
      "frontend/packages/aidid-login-sdk/src/errors.js#toFailure",
      "frontend/packages/aidid-login-sdk/src/verify.js#verifySignInResponse"
    ],
    "enumBindings": [
      {
        "pointer": "/properties/error/enum",
        "source": "SIGNIN_ERROR_CODES"
      }
    ],
    "note": "`did_denied` and `not_implemented` exist in `SIGNIN_ERROR_CODES` but are NOT in the spec §13 table: `did_denied` is emitted by the RP-maintained deny list (verify.js step 7), while `not_implemented` is reserved — it has no use site in this repo yet.",
    "honestLimit": "This is the SDK's fail-closed result object; an RP decides its own HTTP status codes, headers and body wrapping, so a wire-level contract for the RP login endpoint is not defined here."
  }
}