Error codes

akua.lock is out of sync with akua.toml — akua lock --check found drift. Re-run akua lock without --check to refresh.

A dep alias referenced by import <alias> (or pkg.render({package = "<alias>"})) in package.k resolves to a kind that's unreachable from KCL. Most common case: an Akua/KCL-module dep was misclassified as a Helm chart by...

akua.toml declares a git = "..." dep whose URL contains embedded credentials (https://user:pass@host/...). Rejected at parse time so the credential never reaches the lockfile or git history. Pass credentials via the...

akua.toml declares a repo (HTTPS Helm repository) dep that is missing the required chart field.

akua.toml declares a repo dep that is missing the required version field (a semver constraint is mandatory for reproducibility).

akua.toml declares a repo dep whose URL contains embedded credentials (https://user:pass@host/...). Rejected at parse time so the credential never reaches the lockfile or git history. Pass credentials via the SDK auth...

akua.toml declares a repo dep whose chart value contains path separators (/, \) or .. — a chart name must be a plain single-component name. Rejected at parse time to prevent path confusion in the chart cache.

akua.toml declares an oci dep whose URL contains embedded credentials (oci://user:pass@host/...). Rejected at parse time so the credential never reaches the lockfile or git history. Pass credentials via the SDK auth...

CLI --auth <prefix>=<user>:<password> value (or --auth-file TOML payload) didn't parse. Distinct from E_INVALID_FLAG so agents can branch on credential-input shape errors specifically.

CLI-level flag value didn't parse — --timeout=5min, --max-depth=foo, etc. Distinct from E_INPUTS_PARSE (which covers inputs.yaml content) so agents can branch on the right thing.

A render produced more output than the host is willing to buffer from the sandboxed worker (the per-render stdout ceiling — a DoS bound on shared hosts). The Package renders, but its manifest set is too large to...

Package called an engine plugin whose WASM backend hasn't shipped yet (docs/roadmap.md tracks the blocked features). Shell-out is not an option — see CLAUDE.md "No shell-out, ever."

Package argument to an engine plugin resolved to a path outside the Package directory (traversal / symlink escape).

pkg.render re-entered a Package already on the render stack — composition cycle. Caught before the inner load to bound recursion; covers both direct and transitive cycles.

pkg.render exceeded the render-stack depth cap. Default is generous (16); hitting it usually means runaway composition through fresh Packages, which cycle detection alone can't catch.

pkg.render was called after the wall-clock deadline the outer caller installed for the render had already expired.

A dep in akua.toml failed to resolve (missing path, not-a-directory, OCI/git fetch failure, lockfile mismatch). Covers all dep kinds — path / oci / git / vendor — not chart-specific. See chart_resolver and vendor.

akua render --strict: a plugin was handed a raw-string chart path instead of a typed charts.* import. Surfaces the Package authoring site that needs to migrate.

Cosign signature failed cryptographic verification, or the payload disagrees with the fetched digest. Attacker-side signal — someone served bytes the configured key didn't approve.

A cosign public key was configured but the registry has no .sig sidecar (or it's malformed). Publisher-side signal — actionable by the artifact's author, not the consumer.

akua publish failed to upload the artifact. Wraps every registry- side failure (auth rejected, upload PUT non-2xx, manifest malformed).

akua pull couldn't retrieve / extract the requested artifact.

Hosted Akua API auth token is required but was not provided.

Hosted Akua API token was rejected as invalid or expired.

Hosted Akua API token is valid but lacks permission for the request.

Requested CLI option or hosted API bridge feature is not implemented.

Hosted Akua API request failed before a structured response was available.