Module jwks 

JWKS cache freshness and on-demand refresh decisions.

Structs

JwksCacheFacts

Values read around one key validation.

Enums

JwksCacheDecision

Whether a validator may use one observed JWKS cache generation.

JwksOnDemandDecision

Whether an on-demand signal may start a fetch.

Functions

jwks_cache_admission

Admit only a stable, fully published cache generation that is not stale.

jwks_on_demand_refresh_decision

Keep the limiter monotonic and fail closed across wall-clock rollback: refresh exactly when jwks_on_demand_refresh_allowed holds, stamping now_ms as the new last-refresh time.

jwks_publication_generations

Enter an odd write phase and commit the next even generation, or preserve the prior cache. Never wrap: an old reader generation cannot recur.