Trusted local facts returned by a configured token verifier or minter.
t is opaque: new/1 is the sanctioned constructor, and consumer code that
builds the struct literally violates the opacity contract Dialyzer enforces
(contract_with_opaque). Opacity is a construction convention, not a
runtime seal — the anti-forgery boundary is the admission path itself:
verified facts enter only through DSL-configured verifier/minter callbacks
under a bounded context, and reserved action-input names cannot pose as
them (see AshOnetime.Verifier for the callback contract).
Summary
Functions
Mints Verified facts — the sanctioned constructor for the opaque t.
Types
Functions
Mints Verified facts — the sanctioned constructor for the opaque t.
Accepts a keyword list with key (non-empty binary, no length cap — the
key bound is per-action configuration), issued_at (DateTime), verifier_id
(non-empty binary of at most 128 bytes), and the
optional expires_at (DateTime at or after issued_at; defaults to nil).
Unknown, duplicate, and missing keys are rejected, as are DateTimes whose
calendar fields are forged — new/1 never raises.
Returns {:ok, verified} or {:error, reason} naming the violated
invariant. The bar is the one every internal consumer already holds a
Verified to (admission's bounded binaries, the store's verifier-id
bound, the window's expiry ordering and datetime probing), checked at
mint time so a host minter learns of a bad fact before it reaches
admission.