Module credential 

The credential records a Connect may carry in its authentication bytes.

ACCESS-001 R2: a Lys pass is admitted as a second credential kind beside WirePassV1, as a new record and never as trailing fields on V1. The two records are told apart by their first byte; everything after the Lys record’s tag is the pass exactly as Lys issued it, so the server hands it to lys-pass unchanged and never parses it here.

The bearer token the server may also accept is not a record: it has no tag and is compared whole, before any record is read. Classification runs only on bytes the bearer comparison refused.

Enums

CredentialKindError

Why bytes are not a credential record.

WireCredential

A credential record classified by its first byte.

Constants

LYS_PASS_V1_TAG

First byte of a Lys pass record; the rest is the pass as Lys issued it.

WIRE_PASS_V1_TAG

First byte of a WirePassV1 record, owned by the server’s pass checker.