errors

var (
	// ErrInvalidConfig is a sentinel error indicating token configuration is incomplete or inconsistent.
	//
	// This is used when a token kind is selected but the corresponding nested configuration is missing.
	ErrInvalidConfig = errors.New("token: invalid config")

	// ErrInvalidMatch is a sentinel error indicating a token comparison failed to match.
	//
	// Implementations typically use this for cryptographic or structural mismatches
	// (for example signature/MAC mismatch, invalid encoding, etc.) and should wrap
	// this error so callers can detect it via errors.Is while still preserving context.
	ErrInvalidMatch = errors.New("token: invalid match")

	// ErrInvalidIssuer is a sentinel error indicating the issuer claim is invalid.
	//
	// For claim-based token formats, this commonly corresponds to an "iss" claim
	// mismatch. The JWT verifier returns this sentinel on issuer mismatch, so callers
	// can detect it with errors.Is. The PASETO verifier instead surfaces issuer rule
	// failures as an upstream [github.com/alexfalkowski/go-service/v2/token/paseto.RuleError],
	// which does not match this sentinel; SSH tokens do not carry an issuer.
	ErrInvalidIssuer = errors.New("token: invalid issuer")

	// ErrInvalidAudience is a sentinel error indicating the audience claim is invalid.
	//
	// For claim-based token formats, this commonly corresponds to an "aud" claim
	// mismatch. The JWT and SSH verifiers return this sentinel on audience mismatch, so
	// callers can detect it with errors.Is. The PASETO verifier instead surfaces audience
	// rule failures as an upstream [github.com/alexfalkowski/go-service/v2/token/paseto.RuleError],
	// which does not match this sentinel.
	ErrInvalidAudience = errors.New("token: invalid audience")

	// ErrInvalidSubject is a sentinel error indicating the subject claim is invalid.
	//
	// For claim-based token formats, this commonly corresponds to a missing or empty
	// "sub" claim after the token has otherwise been structurally and cryptographically validated.
	ErrInvalidSubject = errors.New("token: invalid subject")

	// ErrInvalidAlgorithm is a sentinel error indicating the token used an unexpected algorithm.
	//
	// Implementations may return or wrap this when a token is signed/encrypted with an
	// algorithm that does not match the expected configuration.
	ErrInvalidAlgorithm = errors.New("token: invalid algorithm")

	// ErrInvalidKeyID is a sentinel error indicating a key identifier is missing or unexpected.
	//
	// This is commonly used when a JWT header or PASETO footer "kid" is missing
	// or does not select a configured key id.
	ErrInvalidKeyID = errors.New("token: invalid key id")

	// ErrInvalidTime is a sentinel error indicating a token is not valid for the current time.
	//
	// This commonly covers expiration and not-before failures (for example expired tokens
	// or tokens that are not yet valid).
	ErrInvalidTime = errors.New("token: invalid time")
)