Module token 

PIC Token JWT (pic+jwt): the external envelope.

pic.root carries the unpadded Base64url encoding of the exact binary PIC Continuity COSE bytes. Candidate tokens are workload-signed (iss optional — identity metadata, not the source of trust); settled tokens are signed by the trusted settlement authority.

Signing is delegated to crate::trust::ArtifactSigner, so any JOSE stack can plug in; an Ed25519 implementation ships behind the ed25519 feature.

Structs

DecodedToken

A decoded (not yet verified) PIC Token JWT.

PicClaim

The pic claim.

PicTokenClaims

PIC Token JWT claims.

Functions

decode_token

Decodes a compact JWS without verifying the signature.

sign_token

Signs claims into a compact JWS with typ = "pic+jwt".

verify_token

Decodes and verifies a PIC Token JWT signature.