Accrue.Entitlements.Offline.KeyProvider behaviour (accrue v1.5.0)

Host-owned offline proof signing and public-key material boundary.

Implementations keep signing custody outside Accrue; only public_keys/1 is consumed by the public JWKS renderer.

Summary

public_key()

@type public_key() :: %{required(String.t()) => String.t()}

@callback public_keys(keyword()) :: {:ok, [public_key()]} | {:error, :config_invalid}

@callback sign(
  binary(),
  keyword()
) :: {:ok, binary()} | {:error, :unavailable | :config_invalid}

@spec render_public_keys([map()], map()) ::
  {:ok, %{required(String.t()) => [map()]}} | {:error, :config_invalid}