# `AshOnetime.Verified`
[🔗](https://github.com/baselabs/ash_onetime/blob/v1.5.0/lib/ash_onetime/verified.ex#L1)

Trusted local facts returned by a configured token verifier or minter.

`t` is opaque: `new/1` is the sanctioned constructor, and consumer code that
builds the struct literally violates the opacity contract Dialyzer enforces
(`contract_with_opaque`). Opacity is a construction convention, not a
runtime seal — the anti-forgery boundary is the admission path itself:
verified facts enter only through DSL-configured verifier/minter callbacks
under a bounded context, and reserved action-input names cannot pose as
them (see `AshOnetime.Verifier` for the callback contract).

# `t`

```elixir
@opaque t()
```

# `new`

```elixir
@spec new(keyword()) :: {:ok, t()} | {:error, String.t()}
```

Mints `Verified` facts — the sanctioned constructor for the opaque `t`.

Accepts a keyword list with `key` (non-empty binary, no length cap — the
key bound is per-action configuration), `issued_at` (DateTime), `verifier_id`
(non-empty binary of at most 128 bytes), and the
optional `expires_at` (DateTime at or after `issued_at`; defaults to nil).
Unknown, duplicate, and missing keys are rejected, as are DateTimes whose
calendar fields are forged — `new/1` never raises.

Returns `{:ok, verified}` or `{:error, reason}` naming the violated
invariant. The bar is the one every internal consumer already holds a
`Verified` to (admission's bounded binaries, the store's verifier-id
bound, the window's expiry ordering and datetime probing), checked at
mint time so a host minter learns of a bad fact before it reaches
admission.

---

*Consult [api-reference.md](api-reference.md) for complete listing*