//! Authentication modules.
//!
//! Phase 1 ships NIP-98 structural verification (tag layout,
//! URL/method/payload match, timestamp tolerance). Schnorr signature
//! verification is the `nip98-schnorr` feature on [`nip98`]. Sprint 11
//! adds [`self_signed`] — the Controlled Identifier verifier abstraction
//! (row 152) used to fan out across did:key, NIP-98, did:nostr, etc.
/// The `ReplayStore` seam (ADR-060 Decision 2): the single-use-nonce contract
/// extracted from the reference cache so every tier consumes one named
/// semantics rather than re-deriving replay handling. Carries no runtime
/// dependency, so the pure-logic `core` surface (wasm32 / CF-Workers) can
/// depend on it and supply its own implementor.
/// NIP-98 single-use replay guard (F3), the reference [`replay_store::ReplayStore`]
/// implementor. Gated behind `nip98-replay`; the native single-process pod
/// tier wires it into every request so a captured token cannot be replayed
/// within the ~120s tolerance window.