/**
 * Every error this API returns has the shape { error: { code, message } }.
 *
 * - `code` is stable: clients translate it and branch on it.
 * - `message` is English, meant for logs and developers. It can change, so
 *   clients should never show it to users or compare against it.
 */
export type ErrorCode =
  | 'VALIDATION_FAILED'
  | 'TOO_MANY_REQUESTS'
  | 'UNAUTHORIZED'
  | 'NOT_FOUND'
  | 'SERVER_ERROR'
  // login. Wrong password and unknown email deliberately share one code,
  // so the response never reveals whether an address is registered.
  | 'INVALID_CREDENTIALS'
  | 'ACCOUNT_BANNED'
  | 'EMAIL_NOT_VERIFIED'
  // mobile login code exchange
  | 'LOGIN_CODE_REQUIRED'
  | 'INVALID_LOGIN_CODE'
  | 'LOGIN_CODE_EXPIRED'
  // email verification
  | 'INVALID_VERIFICATION_LINK'
  // signup with the email of an account that was never verified
  | 'EMAIL_PENDING_VERIFICATION'
  | 'USER_NOT_FOUND'
  // password reset
  | 'INVALID_RESET_TOKEN'
  // refresh tokens
  | 'NO_REFRESH_TOKEN'
  | 'INVALID_REFRESH_TOKEN'
  | 'REFRESH_TOKEN_REUSED'

export function apiError(code: ErrorCode, message: string, extra: Record<string, unknown> = {}) {
  return { error: { code, message, ...extra } }
}