"""Shared exception types + the CLI exit-code contract.

Exit codes (SPEC §4): ``0`` clean · ``1`` findings · ``2`` usage / credential /
load error. :class:`CredentialError` and :class:`UsageError` both map to ``2``.
"""

from __future__ import annotations

EXIT_OK = 0
EXIT_FINDINGS = 1
EXIT_ERROR = 2


class SecretsError(Exception):
    """Base for every mgf-secrets error that the CLI turns into exit 2."""


class CredentialError(SecretsError):
    """A missing/expired credential or an unreachable owned surface.

    Never carries a secret value — only where to look and how to recover.
    """


class UsageError(SecretsError):
    """Bad invocation (unknown id, bad flag) — exit 2."""
