feat(buzz-auth): NIP-FI Phase A PR 4 — production authority interface spine

Cargo.toml

@@ -104,7 +104,7 @@ chrono  = { version = "0.4", features = ["serde"] }
 jsonwebtoken = { version = "10.4.0", default-features = false, features = ["aws_lc_rs"] }
 
 # HTTP client (webhook delivery)
-reqwest = { version = "0.13", features = ["json", "rustls"], default-features = false }
+reqwest = { version = "0.13", features = ["json", "rustls", "stream"], default-features = false }
 
 # Cryptography
 sha2      = "0.11"

crates/buzz-auth/Cargo.toml

@@ -14,13 +14,16 @@ dev = []
 [dev-dependencies]
 # `use_pem` enables EncodingKey::from_ec_pem for minting ES256 test assertions.
 jsonwebtoken = { version = "10.4.0", default-features = false, features = ["aws_lc_rs", "use_pem"] }
+tokio        = { workspace = true, features = ["test-util"] }
 
 [dependencies]
 buzz-core = { workspace = true }
 base64       = { workspace = true }
 chrono       = { workspace = true }
 jsonwebtoken = { workspace = true }
 nostr        = { workspace = true }
+futures-util = { workspace = true }
+reqwest      = { workspace = true }
 serde        = { workspace = true }
 serde_json   = { workspace = true }
 tokio        = { workspace = true }

crates/buzz-auth/src/lib.rs

@@ -46,11 +46,15 @@ pub use rate_limit::{
 pub use scope::{parse_scopes, Scope};
 
 pub use nip_fi::{
-    AssertionKeySet, AssertionPolicyId, CanonicalCapabilities, ClientSubjectPosture,
-    ConfidentialAssertion, DenialClass, FederatedAssertionVerifier, FederatedIdentity,
-    FreshnessClass, IssuerKeySource, IssuerPolicy, IssuerPolicyError, IssuerRegistry,
-    RevalidationDependencies, SubjectClass, SubjectClassContract, TokenClass, TransportContractId,
-    VerifiedAssertion, VerifierError, CLIENT_ATTACHED_HEADER, NOSTR_PUBKEY_CLAIM,
+    validate_nip_fi_config, AdmissionError, AssertionKeySet, AssertionPolicyId, BindingProposal,
+    BindingProvenance, CanonicalCapabilities, ClientSubjectPosture, ConfidentialAssertion,
+    DenialClass, ExactProtectedUse, FederatedAssertionVerifier, FederatedIdentity,
+    FederatedIdentityDiscovery, FreshnessClass, HttpJwksFetcher, IssuerJwksConfig, IssuerKeySource,
+    IssuerPolicy, IssuerPolicyError, IssuerRegistry, JwksFetchError, JwksFetcher, NipFiMode,
+    NipFiStartupError, OperationIntent, PreparedDependencyVersions, ProductionJwksSource,
+    ProofTransport, ProtectedObjectKind, RevalidationDependencies, RouteCapability, SubjectClass,
+    SubjectClassContract, TokenClass, TransportContractId, VerifiedAssertion,
+    VerifiedServerDirectContext, VerifierError, CLIENT_ATTACHED_HEADER, NOSTR_PUBKEY_CLAIM,
     OAUTH_CLIENT_ID_CLAIM,
 };