···11+import Foundation
22+33+public protocol AuthTokenProvider: Sendable {
44+ /// Returns auth headers to attach to the given request URL, or nil if no
55+ /// auth is available. DPoP-bound providers will supply both
66+ /// `Authorization` and `DPoP` headers.
77+ func authHeaders(for request: URLRequest) async throws -> [String: String]?
88+99+ /// Called when the server rejected the previous token so the provider can
1010+ /// refresh before the caller retries.
1111+ func reportTokenRejected() async
1212+}
1313+1414+public struct AnonymousAuthTokenProvider: AuthTokenProvider {
1515+ public init() {}
1616+ public func authHeaders(for request: URLRequest) async throws -> [String: String]? { nil }
1717+ public func reportTokenRejected() async {}
1818+}