Module revocation 

JTI-based token revocation.

Revoked token identifiers are stored in a backend that supports TTL-based expiry. Retention must include the verifier’s clock leeway, including its final accepted second.

Structs

InMemoryRevocationStore

In-memory revocation store with lazy expiry sweeps. Suitable for single-instance deployments and testing.

RevocationHealth

Local, nonblocking health of a revocation dependency.

RevocationIdentity

Signature-verified identity needed to check an ancestor’s revocation.

Enums

RevokeOutcome

Whether a revoke request created a new entry.

RevokedBy

The rule which revoked a validated token.

Traits

RevocationStore

Trait for pluggable revocation backends. The harness wires this to the StateStore (Redis for distributed deployments, in-memory otherwise).