/** Typed capability errors carrying a machine-readable reason (no console.log; explicit errors). */
export type CapabilityErrorReason =
  | 'ttl_too_long'
  | 'ttl_too_short'
  | 'wildcard_host'
  | 'empty_sub'
  | 'malformed'
  | 'expired'
  | 'not_yet_valid'
  | 'aud_mismatch'
  | 'bad_signature'
  | 'replayed'
  | 'no_cnf'
  | 'bad_cnf'

export class CapabilityError extends Error {
  readonly reason: CapabilityErrorReason
  constructor(reason: CapabilityErrorReason, message?: string) {
    super(message ?? reason)
    this.name = 'CapabilityError'
    this.reason = reason
  }
}
