Crate lys_pass 

Shared pass verification and permission contracts for products.

Re-exports

pub use membership::GrantLog;

pub use membership::MembershipDecision;

pub use membership::MembershipRequest;

pub use membership::Subject;

pub use membership::Verdict;

pub use refusal::Refusal;

pub use rights::Claims;

pub use rights::Decision;

pub use rights::Holder;

pub use rights::Mode;

pub use rights::Right;

pub use rights::Target;

pub use verify::CLOCK_SKEW;

pub use verify::KeySet;

pub use verify::VerifiedPass;

Modules

binding

A pass’s grant binding (DIRECTORY-089 R2): the signed statement, separate from the pass, of the grant log, the revision and the complete ancestry each of the pass’s rights was decided from.

conformance

Shared route vectors expose product permission drift as a gate failure.

deliberate

Deliberate permission questions require a complete live Lys answer.

drafts

Products pull approved drafts and retain their own atomic execution receipts.

membership

The one shared channel membership contract (ACCESS-006 R1).

membership_admission

Scoped guest admission (ACCESS-006 R4): a subject is admitted to a workspace when it holds at least one current grant within it, and refused NO_CURRENT_GRANT when it holds none.

membership_conformance

Shared channel membership vectors (ACCESS-006 R1, R7): one world and one list of questions, shipped as JSON so Lys’s provider and every product adapter run the same cases and fail the same way.

membership_pages

Membership pages (ACCESS-006 R3): the resources one subject may take an action on within a workspace, and the subjects who may take an action on one channel, a bounded page at a time.

refusal

One permission refusal shape for every product route.

rights

Rights name resources already reached by the issuer, never a local graph.

verify

Strict Ed25519 verification against a caller-owned published key cache.

Structs

TokenRequest

Borrowed authorization-code exchange inputs, never retained by the client.

TokenResponse

A token response owned by the product that requested it.

Enums

Error

A named refusal at a token, key or live-contract boundary.