Module auth 

Offline Client–Host authorization. No Space, cloud session or transport ownership.

Structs

AuthError

Only authenticated responses may drive refresh/retry. Rejections precede dispatch.

AuthorizationReceipt

ClaimRequest

POST /v1/auth/claim. A Host provisioned over Bluetooth refuses a claim without the token it handed out at setup with 403 HOST_CLAIM_TOKEN_REQUIRED.

ClientBinding

ContextRequest

EnrollmentChallenge

EnrollmentChallengeRequest

EnrollmentRequest

Grant

Cloud claims are short-lived evidence for registration, never LAN bearer credentials.

HostContext

LocalAuthorization

Possession

PublicKey

Public P-256 point; x/y are exactly 32 bytes, base64url without padding.

SigningKey

SigningKeySet

A complete authoritative snapshot from the configured HTTPS cloud.

Enums

ErrorCode

SigningKeyStatus

Verification-only permits an overlap. Disabled never accepts proofs or bindings.

Constants

CLAIM_TOKEN_REQUIRED

ENROLLMENT_PROOF_TTL_SECONDS

KEY_REFRESH_INTERVAL_SECONDS

PROTOCOL

REQUEST_WINDOW_SECONDS