Module bearer 

Bearer-token parsing + broker handoff.

SP-streamable-http §4.4 + SP-token-broker-phase2 §4.4: extract Authorization: Bearer …, look it up via the broker’s resolve_bearer extension point, surface the result as a typed outcome the route handler maps to a precise HTTP status + headers.

Phase-2 mapping (spec §4.4):

outcome	HTTP status	header
Validated(_) / Anonymous	200 (continue)	—
HeaderMissing (require_bearer)	401	WWW-Authenticate: Bearer
BearerEmpty	400	—
NoBrokerConfigured	501	—
Unknown (broker Ok(None))	401	WWW-Authenticate: Bearer error="invalid_token"
Expired (broker Err(Expired))	401	WWW-Authenticate: Bearer error="invalid_token", error_description="expired"
Revoked(_) (broker Err(Revoked))	401	WWW-Authenticate: Bearer error="invalid_token", error_description="revoked"
BrokerNotConfigured (broker Err(NotConfigured))	501	—
Lookup(_) (broker Err(Lookup) — transient)	503	Retry-After: 5
Internal(_) (broker Err(Internal) — bug)	500	—

Enums

BearerOutcome

Outcome of a single bearer resolution.

Functions

resolve_bearer

Parse the optional Authorization: Bearer … header from headers and run the broker policy described in SP-streamable-http §4.4 + SP-token-broker-phase2 §4.4. Returns a typed BearerOutcome.