confirmation

var (
	// ErrTokenMalformed signals a token whose on-wire shape is wrong
	// (missing "." separator, undecodable base64, undecodable JSON).
	ErrTokenMalformed = errors.New("confirmation token malformed")
	// ErrTokenSignatureMismatch signals a token whose HMAC does not
	// match the configured secret. Includes wrong-secret and
	// payload-tampering cases.
	ErrTokenSignatureMismatch = errors.New("confirmation token signature mismatch")
	// ErrTokenExpired signals a token whose exp is at or before
	// time.Now (per the Signer's clock).
	ErrTokenExpired = errors.New("confirmation token expired")
	// ErrTokenBindingMismatch signals a token whose embedded claims
	// disagree with the verifier's expected binding (different tool
	// name, different args fingerprint, different
	// tenant/subject/session, different risk class).
	ErrTokenBindingMismatch = errors.New("confirmation token binding mismatch")
	// ErrTokenVersionUnsupported signals a token whose on-wire
	// version byte differs from TokenVersion. Rolling forward
	// requires accepting older versions explicitly; the default is
	// to reject.
	ErrTokenVersionUnsupported = errors.New("confirmation token version unsupported")
	// ErrSecretTooShort signals a Config whose secret has fewer than
	// MinSecretBytes raw bytes. Returned by Signer construction.
	ErrSecretTooShort = errors.New("confirmation token secret too short")
)

var ErrHostedSecretRequired = errors.New("CLOCKIFY_CONFIRMATION_TOKEN_SECRET is required for hosted profiles (multi-replica deployments need a shared HMAC secret)")

var FingerprintExcludedKeys = []string{
	"dry_run",
	"confirmation_token",
}