identity

var (
	// ErrMissingID reports an identity without a durable ID.
	ErrMissingID = errors.New("missing id")
	// ErrMissingHash reports an identity without a key hash.
	ErrMissingHash = errors.New("missing hash")
	// ErrMissingScopes reports an identity without any granted scope.
	ErrMissingScopes = errors.New("missing scopes")
	// ErrInvalidName reports an invalid identity name.
	ErrInvalidName = errors.New("invalid name: must be 1-255 characters")
	// ErrInvalidScope reports an empty identity scope.
	ErrInvalidScope = errors.New("invalid scope: must be non-empty")
	// ErrInvalidModel reports an empty allowed-model entry.
	ErrInvalidModel = errors.New("invalid model: must be non-empty")
	// ErrInvalidExpiration reports an expiration before identity creation.
	ErrInvalidExpiration = errors.New("expires_at must be after created_at")
)

var (
	// ErrRepositoryRequired reports a missing storage adapter.
	ErrRepositoryRequired = errors.New("identity storage is required")
	// ErrNotFound reports a missing identity.
	ErrNotFound = errors.New("identity not found")
	// ErrConflict reports an existing identity or stale revision.
	ErrConflict = errors.New("identity revision conflict")
	// ErrCorruptRecord reports invalid durable identity data.
	ErrCorruptRecord = errors.New("identity record is invalid")
	// ErrHashImmutable reports an attempted hash mutation.
	ErrHashImmutable = errors.New("identity hash is immutable")
)

var ErrIssuerRequired = errors.New("identity issuer repository is required")