Module capabilities 

Capability advertisement primitives — what a backend tells a client about its authentication surface, served at _info.

Per AUTHZ-S01-output §2: a backend extends its _info response with an optional auth_capabilities field carrying a BackendAuthCapabilities. Clients (synapse CLI, gamma, generated SDKs, agents) read it to decide which authentication flow to drive.

These types are not sealed — the cryptographic anchor is AuthContext / VerifiedUser in this same crate. Capability-advertisement types carry contract metadata; they belong here with the auth primitives so the dependency graph and the orphan-rule defense extend uniformly per AUTHZ-0 §“Crate-level isolation amplifies the seal”.

Each newtype follows the strong-typing skill: Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize; #[serde(transparent)] for single-field wrappers; validation at the wire boundary via a try_new constructor; as_str() accessor; Display for tracing.

Structs

BackendAuthCapabilities

What the backend advertises at _info’s auth_capabilities field.

ClientId

OIDC client_id opaque identifier.

CookieName

A cookie name (e.g. "plexus_session"). RFC 6265 token-set validation.

HeaderName

An HTTP header name (e.g. "Authorization").

IssuerUrl

An OIDC-style issuer URL.

MethodPath

A dotted method path like auth.login or cone.send_message.

Enums

AuthMechanism

Tagged union of supported auth mechanisms a backend advertises.

BackendAuthCapabilitiesError

Why a BackendAuthCapabilities::new rejected its input.

ClientIdError

Why a ClientId::try_new rejected its input.

CookieNameError

Why a CookieName::try_new rejected its input.

HeaderNameError

Why a HeaderName::try_new rejected its input.

IssuerUrlError

Why an IssuerUrl::try_new rejected its input.

MethodPathError

Why a MethodPath::try_new rejected its input.