sprints work

src/__Libraries/StellaOps.Audit.ReplayToken/Sha256ReplayTokenGenerator.cs

@@ -35,6 +35,19 @@ public sealed class Sha256ReplayTokenGenerator : IReplayTokenGenerator
         return new ReplayToken(hashHex, _timeProvider.GetUtcNow());
     }
 
+    public ReplayToken GenerateWithExpiration(ReplayTokenRequest request, TimeSpan? expiration = null)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+
+        var canonical = Canonicalize(request);
+        var hashHex = ComputeHash(canonical);
+
+        var now = _timeProvider.GetUtcNow();
+        var expiresAt = now + (expiration ?? ReplayToken.DefaultExpiration);
+
+        return new ReplayToken(hashHex, now, expiresAt, ReplayToken.DefaultAlgorithm, ReplayToken.VersionWithExpiration);
+    }
+
     public bool Verify(ReplayToken token, ReplayTokenRequest request)
     {
         ArgumentNullException.ThrowIfNull(token);
@@ -44,6 +57,27 @@ public sealed class Sha256ReplayTokenGenerator : IReplayTokenGenerator
         return string.Equals(token.Value, computed.Value, StringComparison.OrdinalIgnoreCase);
     }
 
+    public ReplayTokenVerificationResult VerifyWithExpiration(ReplayToken token, ReplayTokenRequest request)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+        ArgumentNullException.ThrowIfNull(request);
+
+        // Check hash first
+        var computed = Generate(request);
+        if (!string.Equals(token.Value, computed.Value, StringComparison.OrdinalIgnoreCase))
+        {
+            return ReplayTokenVerificationResult.Invalid;
+        }
+
+        // Check expiration
+        if (token.IsExpired(_timeProvider.GetUtcNow()))
+        {
+            return ReplayTokenVerificationResult.Expired;
+        }
+
+        return ReplayTokenVerificationResult.Valid;
+    }
+
     private string ComputeHash(string input)
     {
         var bytes = Encoding.UTF8.GetBytes(input);