ppoppo-token 0.2.0

//! RFC 9068 access-token profile.
//!
//! Public surface: a single `verify` / `issue` entry-point pair plus
//! the supporting types (`Claims`, `VerifyConfig`, `IssueConfig`,
//! `IssueRequest`, `AuthError`, `IssueError`, and the operational ports
//! for replay/session/epoch revocation).
//!
//! ── Profile boundary ────────────────────────────────────────────────────
//!
//! Every type that is RFC 9068-coupled (sv epoch, jti replay, sid
//! liveness, `cat`/`account_type`/`caps`/`scopes`/`admin`/`active_ppnum`/
//! `delegator`/`dlg_depth` domain claims, `at+jwt` typ pin) lives here.
//! The OIDC Core 1.0 id-token profile (Phase 10.1+) carries its own
//! `Claims<S>` / `VerifyConfig` / `IssueConfig` shapes inside
//! `crate::id_token::*` and never imports from this module.
//!
//! Shared JOSE primitives (`Algorithm`, `KeySet`, `SigningKey`, `Jwk`,
//! `Jwks`) live at the crate root — neither profile owns them.
//!
//! Engine submodules (`crate::engine::*`) are `pub(crate)`; the
//! `verify` / `issue` re-exports below are the only paths through which
//! consumers reach the JWS check pipeline (M51/M52/M54 structural).

pub(crate) mod claims;
pub(crate) mod epoch_revocation;
pub(crate) mod error;
pub(crate) mod issue_config;
pub(crate) mod issue_error;
pub(crate) mod issue_request;
pub(crate) mod replay_defense;
pub(crate) mod session_revocation;
pub(crate) mod verify_config;

pub use self::claims::Claims;
pub use self::epoch_revocation::{EpochRevocation, EpochRevocationError};
pub use self::error::AuthError;
pub use self::issue_config::IssueConfig;
pub use self::issue_error::IssueError;
pub use self::issue_request::IssueRequest;
pub use self::replay_defense::{ReplayDefense, ReplayDefenseError};
pub use self::session_revocation::{SessionRevocation, SessionRevocationError};
pub use self::verify_config::VerifyConfig;

pub use crate::engine::{issue, verify};