//! Authentication for Clawmates (spec §16: SSO + RBAC).
//!
//! `local` mode: argon2id password hashes and opaque bearer tokens whose
//! SHA-256 hashes are stored in `auth_sessions`. This is the zero-dependency
//! appliance mode for air-gapped installs; OIDC SSO shares the same session
//! storage and `AuthedUser` output.

mod bootstrap;
mod jwt;
mod service;
mod token;

pub use bootstrap::bootstrap_owner;
pub use jwt::{ExternalClaims, JwtError, JwtVerifier};
pub use service::{
    AuthError, AuthService, AuthedUser, SCOPE_AGENT_DOOR, SCOPE_FULL, SCOPE_SKILLS_READ,
    SESSION_TTL,
};
pub use token::SessionToken;