Retrieve a record by jti; returns null if missing or expired. A revoked record is still returned so the caller can distinguish replay of a rotated token from an unknown token.
Revoke a token by jti.
Revoke every refresh token in the requested token's family.
Returns the affected records so the caller can also revoke their paired
access credentials through its separately configured store. Remote
implementations must serialize this operation with rotate() for the
same family: durably mark the family revoked and revoke current members in
one operation, while rotate() atomically rejects a marked family. A
rotation ordered before this operation must have its successor included;
one ordered after it must not persist a successor.
Atomically consume a live refresh token and persist its successor.
Remote implementations must make the conditional live-token check, parent revocation, successor write, and family-revoked-marker check one atomic operation. This prevents two concurrent refresh requests from minting independent descendants and prevents a rotation after family revocation.
In-memory implementation of RefreshTokenStore.
Entries expire lazily on get() and through amortised sweeps on save() and rotate(), deleting records whose expiresAt <= runtime.now(). Unexpired revoked records remain available for rotation reuse detection. No background job is needed; memory follows unexpired records plus the doubling-threshold sweep slack.