Module token 

Per-delegator AI delegation tokens with dual signatures (ADR-023).

Each token carries two Ed25519 signatures:

1. Delegator signature (human’s identity key) — proves authorization
2. Token binding signature (one-time token_key) — binds to project.yaml entry

Tokens are passed via --token flag or JOY_TOKEN env var to joy auth.

Structs

CreateTokenResult

Result of creating a token: the encoded token string + the public key to store.

DelegationClaims

Claims encoded in a delegation token.

DelegationToken

A delegation token with dual signatures.

Functions

create_token

Create a delegation token with dual signatures.

decode_token

Decode a token from its portable string representation.

encode_token

Encode a token as a portable string (joy_t_<base64>).

is_token

Check if a string looks like a delegation token (has the joy_t_ prefix).

validate_token

Validate a delegation token against both the delegator’s key and the token_key.