apierror

const (

	// ErrorCodeExpiredToken indicates a JWT access or refresh token has expired.
	ErrorCodeExpiredToken ErrorCode = "expired_token"
	// ErrorCodeExpiredAPIKey indicates an API key has passed its expiration date.
	ErrorCodeExpiredAPIKey ErrorCode = "api_key_expired" // #nosec G101 - This is an error code constant, not a hardcoded credential
	// ErrorCodeRevokedAPIKey indicates an API key was explicitly revoked by the owner or OpenMRP.
	ErrorCodeRevokedAPIKey ErrorCode = "api_key_revoked" // #nosec G101 - This is an error code constant, not a hardcoded credential
	// ErrorCodeInvalidCredentials indicates the provided credentials are wrong.
	ErrorCodeInvalidCredentials ErrorCode = "invalid_credentials" // #nosec G101 - This is an error code constant, not a hardcoded credential
	// ErrorCodeInsufficientPerms indicates the caller is authenticated but lacks the required role or permission.
	ErrorCodeInsufficientPerms ErrorCode = "insufficient_permissions"
	// ErrorCodePaymentRequired indicates the account's subscription is in a non-active state (past_due, canceled, unpaid) and must be resolved before the account can continue using the platform.
	ErrorCodePaymentRequired ErrorCode = "payment_required"

	// ErrorCodeAgentSpendingCapReached indicates the account has reached its configured monthly agent (LLM) spending cap, so the run was refused. The caller must raise or remove the cap to continue running agents.
	ErrorCodeAgentSpendingCapReached ErrorCode = "agent_spending_cap_reached"

	// ErrorCodeValidationFailed is a general validation failure indicating that the request is invalid.
	ErrorCodeValidationFailed ErrorCode = "validation_failed"
	// ErrorCodeMissingField indicates a required field was not provided in the request body.
	ErrorCodeMissingField ErrorCode = "missing_field"
	// ErrorCodeInvalidFormat indicates a field value does not match the expected format (e.g. invalid email).
	ErrorCodeInvalidFormat ErrorCode = "invalid_format"
	// ErrorCodeMethodNotAllowed indicates the HTTP method is not supported for this endpoint.
	ErrorCodeMethodNotAllowed ErrorCode = "method_not_allowed"

	// ErrorCodeResourceNotFound indicates the requested resource does not exist.
	ErrorCodeResourceNotFound ErrorCode = "resource_not_found"
	// ErrorCodeResourceExists indicates a resource with the same unique constraint already exists.
	ErrorCodeResourceExists ErrorCode = "resource_exists"
	// ErrorCodeResourceConflict indicates a state conflict that prevents the operation (e.g. duplicate username, optimistic locking failure).
	ErrorCodeResourceConflict ErrorCode = "resource_conflict"
	// ErrorCodeResourceGone indicates the resource existed but has been permanently deleted.
	ErrorCodeResourceGone ErrorCode = "resource_gone"

	// ErrorCodeIdempotencyInProgress indicates a request with the same idempotency key is currently being processed. The client should retry after a short delay.
	ErrorCodeIdempotencyInProgress ErrorCode = "idempotency_in_progress"

	// ErrorCodeLimitExceeded indicates the account has reached a plan-imposed resource limit (e.g. maximum sandbox accounts). The caller must upgrade their plan to increase the limit.
	ErrorCodeLimitExceeded ErrorCode = "limit_exceeded"
	// ErrorCodeRegistrationClosed indicates that public registration for the requested plan code has reached its capacity. Distinct from limit_exceeded, which applies to per-account resource quotas (e.g. sandbox count).
	ErrorCodeRegistrationClosed ErrorCode = "registration_closed"

	// ErrorCodeRateLimitExceeded indicates the caller has exceeded the allowed request rate. The client should back off and retry.
	ErrorCodeRateLimitExceeded ErrorCode = "rate_limit_exceeded"

	// ErrorCodeParameterMissing indicates a required query or path parameter was not provided.
	ErrorCodeParameterMissing ErrorCode = "parameter_missing"
	// ErrorCodeParameterInvalid indicates a parameter value is not valid (e.g. negative limit).
	ErrorCodeParameterInvalid ErrorCode = "parameter_invalid"
	// ErrorCodeParameterUnknown indicates an unrecognized parameter was sent in the request.
	ErrorCodeParameterUnknown ErrorCode = "parameter_unknown"
	// ErrorCodeParametersExclusive indicates two mutually exclusive parameters were both provided.
	ErrorCodeParametersExclusive ErrorCode = "parameters_exclusive"

	// ErrorCodeInternalError is an unexpected server-side failure. Transient; safe to retry.
	ErrorCodeInternalError ErrorCode = "internal_error"
	// ErrorCodeSvcUnavailable indicates a downstream service is temporarily unreachable. Transient.
	ErrorCodeSvcUnavailable ErrorCode = "service_unavailable"
	// ErrorCodeExternalSvcError indicates a third-party dependency returned an error. Transient.
	ErrorCodeExternalSvcError ErrorCode = "external_service_error"
	// ErrorCodeTimeout indicates the operation exceeded its deadline. Transient.
	ErrorCodeTimeout ErrorCode = "timeout"
	// ErrorCodeConnectionError indicates a network-level failure to a downstream service. Transient.
	ErrorCodeConnectionError ErrorCode = "connection_error"
	// ErrorCodeRequestTimeout indicates the overall request exceeded its deadline. Transient.
	ErrorCodeRequestTimeout ErrorCode = "request_timeout"
	// ErrorCodeClientClosedRequest indicates the client disconnected before the server finished. Not transient — the server cannot meaningfully retry on behalf of a disconnected client.
	ErrorCodeClientClosedRequest ErrorCode = "client_closed_request"

	// ErrorCodeAPIVersionRequired indicates the OpenMRP-Version header was missing from the request.
	ErrorCodeAPIVersionRequired ErrorCode = "api_version_required"
	// ErrorCodeAPIVersionInvalid indicates the requested API version string is not recognized.
	ErrorCodeAPIVersionInvalid ErrorCode = "api_version_invalid"
	// ErrorCodeAPIVersionTooOld indicates the requested API version is below the minimum supported by the endpoint.
	ErrorCodeAPIVersionTooOld ErrorCode = "api_version_too_old"
)

const (
	// ErrorTypeAPI covers server-side failures (5xx). Generally transient and safe to retry.
	ErrorTypeAPI ErrorType = "api_error"
	// ErrorTypeIdempotency covers idempotency key conflicts. May be transient (concurrent duplicate request) or permanent (reused key with different parameters).
	ErrorTypeIdempotency ErrorType = "idempotency_error"
	// ErrorTypeInvalidRequest covers client-side mistakes (bad input, missing auth, not found). Generally not retryable — the client must fix the request before resending.
	ErrorTypeInvalidRequest ErrorType = "invalid_request_error"
)