@spec cert_der(AttestoPhoenix.Config.t()) :: (Plug.Conn.t() -> binary() | nil) | nil

Adapt the configured mTLS certificate extractor to the verifier's 1-arity callback form.

@spec htu(AttestoPhoenix.Config.t()) :: (Plug.Conn.t() -> String.t())

Resolve the canonical request URL callback used for DPoP htu.

@spec nonce_check(AttestoPhoenix.Config.t()) ::
  (String.t() | nil -> :ok | {:error, :use_dpop_nonce}) | nil

Resolve the server-issued nonce validator, or nil when unused.

@spec nonce_issue(AttestoPhoenix.Config.t()) :: (-> String.t()) | nil

Resolve the fresh-nonce issuer, or nil when nonce checks are unused.

@spec protected_resource_opts(AttestoPhoenix.Config.t()) :: keyword()

Build the DPoP/mTLS options consumed by Attesto.Plug.Authenticate.

This is the protected-resource path: replay checking is disabled when DPoP is disabled, while htu, nonce, nonce issuance, and certificate extraction are resolved from the same Phoenix config used by the endpoint.

@spec replay_check(AttestoPhoenix.Config.t()) :: (String.t(), pos_integer() -> any())

Adapt the configured replay callback to the verifier's 2-arity form.

@spec verification_opts(AttestoPhoenix.Config.t(), map(), keyword()) :: keyword()

Build the conn-free options for Attesto.DPoP.verify_proof/2.

:replay_check defaults to :inline, which preserves the behavior of proof binding at PAR and device authorization. Pass replay_check: :deferred for the token endpoint; that mode omits the callback and leaves the returned replay identity for the caller to commit after grant validation.

nonce_check: true adds the configured nonce callback. It is opt-in because not every DPoP proof path currently requires server-issued nonces. http_method_default preserves the device-authorization default for direct callers that do not populate the request method.