codlet-core
Runtime-neutral authentication primitives for codlet.
This crate holds pure types, policy objects, cryptographic lookup-key derivation, lifecycle state machines, and storage traits. It has no web framework, database, or async-executor dependencies.
codlet authenticates a subject; the host application authorizes that subject. This crate never decides membership, roles, permissions, or resource access.
Status: pre-release (v0.4.0). The complete primitive and orchestration layers are implemented: code generation/HMAC derivation, lifecycle classifiers, storage traits, cookie policy, rate limiting, error model, audit events, and the
authmanagers for complete end-to-end flows. Production adapters (Workers/D1, SQLx) are the next step.
License
Apache-2.0