Module token 

Forge push token — a macaroon-lite HMAC bearer.

Wire format: f1.<b64url(json claims)>.<b64url(HMAC-SHA256)>. The MAC covers the f1.<claims> prefix so neither the version tag nor the claims can be swapped without invalidating it. Verification is constant-time (via hmac::Mac::verify_slice) and checks version + expiry. Cites JSS forge token.js behaviour by name only; the implementation is original.

A token is minted from an already-authenticated caller (NIP-98 or a pod session) so subsequent forge requests present the cheap bearer instead of re-signing every call.

Enums

TokenError

Token verify/mint failure modes.

Constants

TOKEN_VERSION

Current token format version.

Functions

mint

Mint a token for agent, valid for ttl seconds from iat. Returns None for an anonymous caller (nothing to authorise).

verify

Verify a token at now, returning the reconstructed caller identity.