Build a TokenValidator from cfg. The returned delegate verifies a bearer
JWT and yields a TokenInfo (valid == false on any failure). Plug it into
ResourceServerConfig.validator.
Concurrency: the returned validator and its internal JwksCache hold
unsynchronized mutable state (the cached PEM keys and fetch timestamp). Like
the rest of the SDK they are bound to vibe.d's default single-threaded event
loop, where the only fiber yield is the JWKS network fetch (which completes
before the cache is mutated), so concurrent fibers never corrupt the cache.
Do not share the validator across worker threads; running the router with
HTTPServerOption.distribute or worker threads is unsupported (see the
concurrency contract in mcp.transport.session).
Build a TokenValidator from cfg. The returned delegate verifies a bearer JWT and yields a TokenInfo (valid == false on any failure). Plug it into ResourceServerConfig.validator.
Concurrency: the returned validator and its internal JwksCache hold unsynchronized mutable state (the cached PEM keys and fetch timestamp). Like the rest of the SDK they are bound to vibe.d's default single-threaded event loop, where the only fiber yield is the JWKS network fetch (which completes before the cache is mutated), so concurrent fibers never corrupt the cache. Do not share the validator across worker threads; running the router with HTTPServerOption.distribute or worker threads is unsupported (see the concurrency contract in mcp.transport.session).