The revocation stores that a verification consults, travelling as one
bundle (#367) so a call site cannot forget half of them.
denylist — Wave 1 (§4.5): denylist.has(jti) runs after all
signature/expiry/type checks; a hit throws reason: "revoked".
subjectRevocation — #296: a token whose iat is at or before the
subject's revocation watermark throws reason: "revoked". The companion
to the denylist rather than a replacement: the denylist revokes a token
by identity, the watermark revokes every token a subject held as of a
moment — which is what a credential change needs, since the jtis
outstanding for a subject are not enumerable.
Both fields stay individually optional inside the bundle: whether each
store exists is the composition's decision (#363). What the bundle removes
is the call site's ability to not ask.
The revocation stores that a verification consults, travelling as one bundle (#367) so a call site cannot forget half of them.
denylist— Wave 1 (§4.5):denylist.has(jti)runs after all signature/expiry/type checks; a hit throwsreason: "revoked".subjectRevocation— #296: a token whoseiatis at or before the subject's revocation watermark throwsreason: "revoked". The companion to the denylist rather than a replacement: the denylist revokes a token by identity, the watermark revokes every token a subject held as of a moment — which is what a credential change needs, since the jtis outstanding for a subject are not enumerable.Both fields stay individually optional inside the bundle: whether each store exists is the composition's decision (#363). What the bundle removes is the call site's ability to not ask.