@proof-holdings/delegation-verifier 0.1.0 → 0.2.0

package/dist/keyset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyset.js","sourceRoot":"","sources":["../src/keyset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGpC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAU,CAAC;AAG5E,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,oGAAoG;AACpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,MAAM,CAAC;AAkFxD,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,IAAI,EAAE,IAAI,GAAG,EAAE;QACf,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,IAAI,GAAG,EAAE;QAClB,OAAO,EAAE,IAAI,GAAG,EAAE;QAClB,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AAErE,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAA4B,EAAE,SAA6B;IACxF,MAAM,MAAM,GAAc;QACxB,GAAG;QACH,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC;QAC/B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;QACnB,gBAAgB,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS;QACjD,MAAM,EAAE,GAAG,CAAC,YAAY,KAAK,IAAI;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS;QACT,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IAC5E,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC;IACvE,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;IACrE,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAClE,IAAI,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAAE,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,MAAiB;IAClC,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC;AAClH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,OAAO,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,CAAY,EAAE,CAAY;IAClD,OAAO,CACL,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAC/B,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QACnB,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB;QACzC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACvB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,GAAuB;IACxE,OAAO,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,IAAI,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;IACnF,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,OAA2B;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,MAAiB,EAAE,UAAkB;IACtD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/B,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,SAAS;QAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB;IACpC,OAAO;QACL,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkB,EAClB,IAA6B,EAC7B,GAAuB;IAEvB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;;YAC1C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,oFAAoF;IACpF,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC/F,IAAI,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/E,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,0BAA0B;wBAChC,GAAG;wBACH,OAAO,EAAE,wDAAwD,GAAG,GAAG;qBACxE;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5E,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,uFAAuF;QACvF,8EAA8E;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,KAAK,IAAI,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;oBAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/B,CAAC;YACD,SAAS;QACX,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;QACvB,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,aAAa,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,sBAAsB;gBAC5B,GAAG;gBACH,OAAO,EAAE,yDAAyD,GAAG,+BAA+B;aACrG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QACxD,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC,aAAa,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACnG,KAAK,CAAC,aAAa,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;YACrG,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,0BAA0B;gBAChC,GAAG;gBACH,OAAO,EAAE,6CAA6C,GAAG,4EAA4E;aACtI,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;YAAE,SAAS;QACtD,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,KAAK,CAAC,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC,aAAa,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,GAAG;YACH,OAAO,EAAE,2BAA2B,GAAG,2CAA2C;SACnF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,UAAU,GAAG,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,gBAAgB,GAAG,uBAAuB,EAAE,CAAC;gBACnF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,uGAAuG;QACvG,OAAO,KAAK,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,GAAG;gBACH,OAAO,EAAE,QAAQ,GAAG,gFAAgF;aACrG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAE3B,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBACtF,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,OAAO,EAAE,sBAAsB,SAAS,CAAC,GAAG,2CAA2C;iBACxF,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB;YACzB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,OAAO,EAAE,sBAAsB,SAAS,CAAC,GAAG,2EAA2E;SACxH,CAAC,CAAC;QACH,8FAA8F;QAC9F,wBAAwB;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,OAAO,EAAE,iCAAiC,SAAS,CAAC,GAAG,6BAA6B;aACrF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,IAAI,UAAU,GAAG,OAAO,CAAC,SAAS,GAAG,2BAA2B;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACrB,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAChC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAkB,EAAE,GAAuB,EAAE,MAAiB;IACvF,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,6FAA6F;IAC7F,wEAAwE;IACxE,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAC3D,CAAC;IACF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3E,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAC5B,MAAiB,EACjB,KAAqC,EACrC,YAAqB;IAErB,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACpD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC3D,IAAI,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,uBAAuB;QAAE,OAAO,oBAAoB,CAAC;IACxF,IAAI,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,uBAAuB;QAAE,OAAO,oBAAoB,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACrF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAkB,EAAE,SAAsB;IAChF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,KAAkB;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,EAAE,iBAAiB;QACpB,kBAAkB,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChG,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;YAC3C,GAAG,CAAC,MAAM,CAAC,aAAa;gBACtB,CAAC,CAAC;oBACE,cAAc,EAAE;wBACd,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS;wBAC1C,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ;wBACxC,kBAAkB,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM;qBAC1D;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;QACtD,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;KAC7G,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,GAAuB;IACvD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,GAAuB;IACzE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvD,gGAAgG;YAChG,MAAM,aAAa,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC/C,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpH,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;YAC1C,MAAM,CAAC,SAAS,GAAG,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC;YAClE,MAAM,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC;YAC3C,IACE,QAAQ,CAAC,aAAa,CAAC;gBACvB,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC;gBACvC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC;gBACtC,aAAa,CAAC,aAAa,CAAC,kBAAkB,CAAC;gBAC/C,aAAa,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAC9C,CAAC;gBACD,MAAM,CAAC,aAAa,GAAG;oBACrB,SAAS,EAAE,aAAa,CAAC,UAAU;oBACnC,QAAQ,EAAE,aAAa,CAAC,SAAS;oBACjC,SAAS,EAAE,QAAQ,CAAC,aAAa,CAAC,kBAAkB,EAAE,GAAG,CAAC;iBAC3D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;gBAAE,SAAS;YACpG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,GAAG,CAAC,MAAM;gBAAE,SAAS;YAChG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAChD,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,IAAI,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;YACtB,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/status.d.ts

@@ -32,6 +32,7 @@
  * trusted issuer — it arrives INSIDE the artifact being verified, so treating it as an address
  * to fetch would hand an attacker both the status authority and an SSRF primitive.
  */
+import type { KeySetOptions } from './jwks.js';
 import type { FetchLike, TrustedIssuer } from './types.js';
 export type StatusOutcome = {
     state: 'valid';
@@ -81,6 +82,8 @@ export declare function checkDelegationStatus(params: {
     timeoutMs: number;
     now: Date;
     clockToleranceSeconds: number;
+    /** Omitted: the package defaults, as `verifyDelegation` applies them. */
+    keySetOptions?: KeySetOptions;
 }): Promise<StatusOutcome>;
 export {};
 //# sourceMappingURL=status.d.ts.map

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAClB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzC,iFAAiF;GAC/E;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACvC,yDAAyD;GACvD;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAWpE;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5F;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,IAAI,CAS3F;AA+ND;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;IACV,qBAAqB,EAAE,MAAM,CAAC;CAC/B,GAAG,OAAO,CAAC,aAAa,CAAC,CA0BzB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAClB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzC,iFAAiF;GAC/E;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACvC,yDAAyD;GACvD;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAWpE;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5F;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,IAAI,CAS3F;AAuOD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;IACV,qBAAqB,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,aAAa,CAAC,CA2BzB"}

package/dist/status.js

@@ -33,7 +33,7 @@
  * to fetch would hand an attacker both the status authority and an SSRF primitive.
  */
 import { base64UrlToBytes, isRecord, parseJwt } from './jwt.js';
-import { getVerificationKeys, isSupportedAlgorithm, MAX_REMOTE_BODY_BYTES, verifySignature } from './jwks.js';
+import { DEFAULT_MAX_JWKS_AGE_MS, isSupportedAlgorithm, MAX_REMOTE_BODY_BYTES, resolveVerificationKeys, verifyWithCandidates, } from './jwks.js';
 const STATUS_VALID = 0;
 const STATUS_REVOKED = 1;
 const STATUS_SUSPENDED = 2;
@@ -148,35 +148,41 @@ async function checkStatusList(params) {
             message: `status list must carry typ "statuslist+jwt", got ${JSON.stringify(parsed.header.typ)}`,
         };
     }
-    let keys;
-    try {
-        keys = await getVerificationKeys({
-            jwksUri: issuer.jwksUri,
-            kid: typeof parsed.header.kid === 'string' ? parsed.header.kid : undefined,
-            alg,
-            fetch: params.fetch,
-            timeoutMs: params.timeoutMs,
-        });
-    }
-    catch (error) {
-        return {
-            state: 'unavailable',
-            message: `status list signing key unavailable: ${error instanceof Error ? error.message : String(error)}`,
-        };
-    }
-    if (keys.length === 0) {
-        return { state: 'unavailable', message: 'status list is signed by an unknown key' };
-    }
-    let signatureOk = false;
-    for (const key of keys) {
-        if (await verifySignature(key, alg, parsed.signingInput, parsed.signature)) {
-            signatureOk = true;
+    // The list's key is held to the same policy as the delegation's, under its own family: a
+    // revoked, borrowed or out-of-window key is "cannot answer", which falls through to the endpoint.
+    const resolution = await resolveVerificationKeys({
+        jwksUri: issuer.jwksUri,
+        kid: typeof parsed.header.kid === 'string' ? parsed.header.kid : undefined,
+        alg,
+        family: 'status-list',
+        fetch: params.fetch,
+        timeoutMs: params.timeoutMs,
+        ...params.keySetOptions,
+    });
+    switch (resolution.kind) {
+        case 'unavailable':
+            return { state: 'unavailable', message: `status list signing key unavailable: ${resolution.message}` };
+        case 'stale':
+            return { state: 'unavailable', message: 'status list signing key unavailable: the cached issuer JWKS is stale' };
+        case 'revoked':
+            return { state: 'unavailable', message: `status list signing key "${resolution.kid}" has been revoked by the issuer` };
+        case 'wrong_purpose':
+            return { state: 'unavailable', message: `status list signing key "${resolution.kid}" is not a status-list key` };
+        case 'unknown':
+            return { state: 'unavailable', message: 'status list is signed by an unknown key' };
+        case 'keys':
             break;
-        }
     }
-    if (!signatureOk) {
+    const verdict = await verifyWithCandidates(resolution, alg, parsed.signingInput, parsed.signature, {
+        iat: parsed.payload.iat,
+        exp: parsed.payload.exp,
+    });
+    if (verdict === 'bad_signature') {
         return { state: 'unavailable', message: 'status list signature is invalid' };
     }
+    if (verdict !== 'ok') {
+        return { state: 'unavailable', message: `status list signing key policy violated: ${verdict}` };
+    }
     // The list must say it is the list we asked for, or a valid list from the same issuer could
     // be replayed in place of another one.
     if (parsed.payload.sub !== claim.uri) {
@@ -302,6 +308,7 @@ export async function checkDelegationStatus(params) {
             timeoutMs: params.timeoutMs,
             now: params.now,
             clockToleranceSeconds: params.clockToleranceSeconds,
+            keySetOptions: params.keySetOptions ?? { maxJwksAgeMs: DEFAULT_MAX_JWKS_AGE_MS },
         });
         // Authoritative for `valid`/`revoked`/`suspended` — the fold (h-status-list-cascade-fold)
         // makes those three the issuer's whole answer for this delegation's own bit.

package/dist/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAc9G,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACrG,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,OAAO,CAAC,KAAiB;IACtC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,KAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,KAAa,EAAE,IAAY;IAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC;IAC9C,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC;AAC5C,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAO9B;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEjC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,wCAAwC,MAAM,CAAC,MAAM,GAAG;SACtG,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;YAC9E,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,qDAAqD;YACrD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC/F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAElF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,4FAA4F;IAC5F,yFAAyF;IACzF,uDAAuD;IACvD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,oDAAoD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,mBAAmB,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YAC1E,GAAG;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC1G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IAC/E,CAAC;IAED,4FAA4F;IAC5F,uCAAuC;IACvC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IAC3G,CAAC;IAED,sFAAsF;IACtF,+EAA+E;IAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,UAAU,GAAG,GAAG,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,kDAAkD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACpH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,mFAAmF;QACnF,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;IAC1H,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,IAAI,EAAE,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAKlC;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,8EAA8E;SAC/H,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACnD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/F,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAE1C,6FAA6F;IAC7F,6FAA6F;IAC7F,2FAA2F;IAC3F,yFAAyF;IACzF,2FAA2F;IAC3F,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;QACrF,KAAK,WAAW;YACd,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;QACzF,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;QACrF,KAAK,oBAAoB;YACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;QACtF;YACE,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,4DAA4D,MAAM,IAAI,MAAM,GAAG;aACzF,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAQ3C;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC;YACxC,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,CAAC,CAAC;QACH,0FAA0F;QAC1F,6EAA6E;QAC7E,2FAA2F;QAC3F,4CAA4C;QAC5C,IAAI,WAAW,CAAC,KAAK,KAAK,aAAa,IAAI,WAAW,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACjF,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,mBAAmB,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAenB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACrG,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,OAAO,CAAC,KAAiB;IACtC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,KAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,KAAa,EAAE,IAAY;IAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC;IAC9C,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC;AAC5C,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAQ9B;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEjC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,wCAAwC,MAAM,CAAC,MAAM,GAAG;SACtG,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;YAC9E,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,qDAAqD;YACrD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC/F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAElF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,4FAA4F;IAC5F,yFAAyF;IACzF,uDAAuD;IACvD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,oDAAoD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,kGAAkG;IAClG,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC;QAC/C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC1E,GAAG;QACH,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,MAAM,CAAC,aAAa;KACxB,CAAC,CAAC;IACH,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,aAAa;YAChB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,wCAAwC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzG,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,sEAAsE,EAAE,CAAC;QACnH,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,UAAU,CAAC,GAAG,kCAAkC,EAAE,CAAC;QACzH,KAAK,eAAe;YAClB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,UAAU,CAAC,GAAG,4BAA4B,EAAE,CAAC;QACnH,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;QACtF,KAAK,MAAM;YACT,MAAM;IACV,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE;QACjG,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;QACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;KACxB,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,4CAA4C,OAAO,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,4FAA4F;IAC5F,uCAAuC;IACvC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IAC3G,CAAC;IAED,sFAAsF;IACtF,+EAA+E;IAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,UAAU,GAAG,GAAG,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,kDAAkD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACpH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,mFAAmF;QACnF,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;IAC1H,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,IAAI,EAAE,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAKlC;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,8EAA8E;SAC/H,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACnD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/F,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAE1C,6FAA6F;IAC7F,6FAA6F;IAC7F,2FAA2F;IAC3F,yFAAyF;IACzF,2FAA2F;IAC3F,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;QACrF,KAAK,WAAW;YACd,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;QACzF,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;QACrF,KAAK,oBAAoB;YACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;QACtF;YACE,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,4DAA4D,MAAM,IAAI,MAAM,GAAG;aACzF,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAU3C;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC;YACxC,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE,YAAY,EAAE,uBAAuB,EAAE;SACjF,CAAC,CAAC;QACH,0FAA0F;QAC1F,6EAA6E;QAC7E,2FAA2F;QAC3F,4CAA4C;QAC5C,IAAI,WAAW,CAAC,KAAK,KAAK,aAAa,IAAI,WAAW,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACjF,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,mBAAmB,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -2,7 +2,7 @@
  * Public types of the Proof of Delegation reference verifier.
  *
  * The library verifies a delegation token — an attestation that the domain in `principal`
- * authorized the artifact in `delegate` for a set of capability scopes. It attests NOTHING
+ * authorized the artifact in `delegate`. It attests NOTHING
  * about the artifact's quality, safety or the business behind it, and it is not a statement
  * that anyone "verified" the server.
  *
@@ -48,6 +48,40 @@ export interface TrustedIssuer {
     statusListOrigins?: string[];
 }
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+ * Where the verifier persists a key set between processes, so an applied tombstone survives a
+ * restart (and a serverless cold start). Supplied by the caller — this package has no storage of
+ * its own. `state` is an opaque string. A failing store never fails a verification.
+ */
+export interface KeySetStore {
+    load(jwksUri: string): Promise<string | null | undefined> | string | null | undefined;
+    save(jwksUri: string, state: string): Promise<void> | void;
+}
+export type JwksEventType = 
+/** A tombstone was seen for the first time and is waiting for a confirming fetch. */
+'tombstone_pending'
+/** A second fetch at least 5 minutes later confirmed the tombstone. */
+ | 'tombstone_applied'
+/** Anomaly: the tombstone names a key last seen live. Applied by the same rule. */
+ | 'tombstone_for_live_key'
+/** A JWKS narrowed a confirmed key's window; applied only if a fetch 5+ minutes later agrees. */
+ | 'window_narrowing_pending'
+/** A second fetch at least 5 minutes later served the same narrowed window; it now applies. */
+ | 'window_narrowing_applied'
+/** A JWKS moved a confirmed key's window wider and was refused whole. */
+ | 'window_widening_rejected'
+/** A JWKS served new key material under a confirmed kid; the first-seen key is kept. */
+ | 'key_material_changed'
+/** A confirmed registry key stopped being served before its retention ended. */
+ | 'kid_vanished'
+/** The caller's `keySetStore` failed to load or save. */
+ | 'store_error';
+export interface JwksEvent {
+    type: JwksEventType;
+    jwksUri: string;
+    kid?: string;
+    message: string;
+}
 export interface VerifyOptions {
     /** REQUIRED, no default. An empty list fails closed with `no_trust_policy`. */
     trustedIssuers: TrustedIssuer[];
@@ -59,12 +93,6 @@ export interface VerifyOptions {
      * trimming and lowercasing.
      */
     expectedPrincipal?: string;
-    /**
-     * Scopes the delegation must grant. Compared as EXACT strings against the token's own
-     * `scope` (trimmed only): scope grammar belongs to the issuer, and imposing one issuer's
-     * rules here would make another issuer's grants unaskable.
-     */
-    requiredScopes?: string[];
     /**
      * `required` (default) — the delegation's status list is checked, and the issuer's status
      * endpoint is asked too whenever the list cannot answer on its own (see `status.ts` for
@@ -82,16 +110,39 @@ export interface VerifyOptions {
     now?: Date;
     /** Injected fetch (tests, proxies, non-Node runtimes). Defaults to global fetch. */
     fetch?: FetchLike;
-    /** Per-request network timeout in ms. Default 5000. */
+    /** Per-request network timeout in ms, also bounding each `keySetStore` call. Default 5000. */
     timeoutMs?: number;
+    /**
+     * How old a cached key set may be when a refetch FAILS. Under the bound the verifier keeps
+     * using the cache's confirmed keys; over it, the answer is `jwks_stale`. A healthy issuer is still refetched
+     * every 10 minutes. Default 24h. Above 25 days is `invalid_options`: the issuer publishes its
+     * next key about 30 days ahead, and a cache older than that can miss it.
+     */
+    maxJwksAgeMs?: number;
+    /** Persist the key set (tombstones included) across processes. */
+    keySetStore?: KeySetStore;
+    /** Receives key-set anomalies and tombstone progress. Default: ignored. */
+    onJwksEvent?: (event: JwksEvent) => void;
 }
 export type FailureReason = 
 /** The call itself is wrong (missing `delegate`, malformed trust entry). */
 'invalid_options'
 /** `trustedIssuers` was empty — the library has no default trust. */
- | 'no_trust_policy' | 'malformed_token' | 'untrusted_issuer' | 'unsupported_algorithm' | 'unknown_key' | 'bad_signature' | 'jwks_unavailable' | 'not_a_delegation' | 'unsupported_schema' | 'expired' | 'not_yet_valid' | 'malformed_claims' | 'principal_mismatch'
+ | 'no_trust_policy' | 'malformed_token' | 'untrusted_issuer' | 'unsupported_algorithm' | 'unknown_key' | 'bad_signature' | 'jwks_unavailable'
+/** The issuer revoked the signing key (an applied JWKS tombstone). Carries `pullHint`. */
+ | 'key_revoked'
+/** A refetch failed and the cached key set is older than `maxJwksAgeMs`. */
+ | 'jwks_stale'
+/** The signing key belongs to another key family than this token. */
+ | 'wrong_key_purpose'
+/** The token's `iat` lies outside the signing key's window (5 minutes of skew allowed). */
+ | 'outside_key_window'
+/** `exp` lies beyond `iat` plus the signing key's `max_token_lifetime`. */
+ | 'token_lifetime_exceeded' | 'not_a_delegation'
+/** The token's `delegation_schema_version` major is not 2 (a 1.x token carries `scope`). */
+ | 'unsupported_version' | 'expired' | 'not_yet_valid' | 'malformed_claims' | 'principal_mismatch'
 /** The token attests some OTHER artifact than the one the caller resolved. */
- | 'delegate_mismatch' | 'scope_not_granted'
+ | 'delegate_mismatch'
 /** The status-list uri in the token does not belong to the trusted issuer. */
  | 'status_uri_untrusted' | 'status_unavailable' | 'revoked' | 'suspended'
 /** The issuer has no record of this delegation — distinct from "it could not answer". */
@@ -103,8 +154,8 @@ export type FailureReason =
 export type FailureOutcome = 'invalid' | 'unconfirmed';
 /**
  * Whether a `FailureReason` means "checked, and it's bad" (`invalid`) or "could not check"
- * (`unconfirmed`). The three status-channel reasons that mean the revocation check itself
- * failed are `unconfirmed`; every other reason is a completed check with a negative verdict,
+ * (`unconfirmed`). The reasons in `UNCONFIRMED_REASONS` mean the key or revocation check itself
+ * could not run, and are `unconfirmed`; every other reason is a completed check with a negative verdict,
  * including a call-shape error — `verifyDelegation` always receives a well-formed
  * `VerifyOptions` in practice, so those are `invalid` for exhaustiveness, not because they
  * occur.
@@ -116,7 +167,6 @@ export interface VerifiedDelegation {
     principal: string;
     /** Canonical artifact identifier, byte-equal to what the caller resolved. */
     delegate: string;
-    scope: string[];
     /** Public handle of the domain control proof underneath this delegation. */
     controlProof: string;
     /** Public handle of the delegation itself (`ph_dlg_*` for proof.holdings). */
@@ -150,6 +200,22 @@ export interface VerificationFailure {
     /** `classifyFailureReason(reason)` — set for every failure, never left for the caller to derive. */
     outcome: FailureOutcome;
     message: string;
+    /**
+     * `key_revoked` only: where a re-signed token can be fetched — the trusted issuer's origin and
+     * the token's own handle. The handle is read from a token whose signature was NOT checked (its
+     * key is revoked), so treat it as an address to ask, never as a verified identity.
+     */
+    pullHint?: {
+        issuerOrigin: string;
+        handle: string;
+    };
+    /** `jwks_stale` only: age of the cached key set in seconds, or null when unknown. */
+    cacheAgeSeconds?: number | null;
+    /** `jwks_stale` only: what to refetch, and the exported function that does it. */
+    refreshHint?: {
+        jwksUri: string;
+        method: 'refreshJwks';
+    };
 }
 export type VerificationResult = VerificationSuccess | VerificationFailure;
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,yEAAyE;IACzE,QAAQ,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,oFAAoF;IACpF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa;AACvB,4EAA4E;AAC1E,iBAAiB;AACnB,qEAAqE;GACnE,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,aAAa,GACb,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,SAAS,GACT,eAAe,GACf,kBAAkB,GAClB,oBAAoB;AACtB,8EAA8E;GAC5E,mBAAmB,GACnB,mBAAmB;AACrB,8EAA8E;GAC5E,sBAAsB,GACtB,oBAAoB,GACpB,SAAS,GACT,WAAW;AACb,yFAAyF;GACvF,oBAAoB;AACtB,8CAA8C;GAC5C,gBAAgB;AAClB,kFAAkF;GAChF,uBAAuB,CAAC;AAE5B,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AAQvD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc,CAE3E;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,IAAI,CAAC;IACZ,2DAA2D;IAC3D,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,oGAAoG;IACpG,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACtF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,MAAM,aAAa;AACvB,qFAAqF;AACnF,mBAAmB;AACrB,uEAAuE;GACrE,mBAAmB;AACrB,mFAAmF;GACjF,wBAAwB;AAC1B,iGAAiG;GAC/F,0BAA0B;AAC5B,+FAA+F;GAC7F,0BAA0B;AAC5B,yEAAyE;GACvE,0BAA0B;AAC5B,wFAAwF;GACtF,sBAAsB;AACxB,gFAAgF;GAC9E,cAAc;AAChB,yDAAyD;GACvD,aAAa,CAAC;AAElB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,yEAAyE;IACzE,QAAQ,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,oFAAoF;IACpF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,MAAM,aAAa;AACvB,4EAA4E;AAC1E,iBAAiB;AACnB,qEAAqE;GACnE,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,aAAa,GACb,eAAe,GACf,kBAAkB;AACpB,0FAA0F;GACxF,aAAa;AACf,4EAA4E;GAC1E,YAAY;AACd,qEAAqE;GACnE,mBAAmB;AACrB,2FAA2F;GACzF,oBAAoB;AACtB,2EAA2E;GACzE,yBAAyB,GACzB,kBAAkB;AACpB,4FAA4F;GAC1F,qBAAqB,GACrB,SAAS,GACT,eAAe,GACf,kBAAkB,GAClB,oBAAoB;AACtB,8EAA8E;GAC5E,mBAAmB;AACrB,8EAA8E;GAC5E,sBAAsB,GACtB,oBAAoB,GACpB,SAAS,GACT,WAAW;AACb,yFAAyF;GACvF,oBAAoB;AACtB,8CAA8C;GAC5C,gBAAgB;AAClB,kFAAkF;GAChF,uBAAuB,CAAC;AAE5B,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AASvD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc,CAE3E;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,IAAI,CAAC;IACZ,2DAA2D;IAC3D,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,oGAAoG;IACpG,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kFAAkF;IAClF,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC"}

package/dist/types.js

@@ -2,7 +2,7 @@
  * Public types of the Proof of Delegation reference verifier.
  *
  * The library verifies a delegation token — an attestation that the domain in `principal`
- * authorized the artifact in `delegate` for a set of capability scopes. It attests NOTHING
+ * authorized the artifact in `delegate`. It attests NOTHING
  * about the artifact's quality, safety or the business behind it, and it is not a statement
  * that anyone "verified" the server.
  *
@@ -19,12 +19,13 @@
 const UNCONFIRMED_REASONS = new Set([
     'status_unavailable',
     'jwks_unavailable',
+    'jwks_stale',
     'status_uri_untrusted',
 ]);
 /**
  * Whether a `FailureReason` means "checked, and it's bad" (`invalid`) or "could not check"
- * (`unconfirmed`). The three status-channel reasons that mean the revocation check itself
- * failed are `unconfirmed`; every other reason is a completed check with a negative verdict,
+ * (`unconfirmed`). The reasons in `UNCONFIRMED_REASONS` mean the key or revocation check itself
+ * could not run, and are `unconfirmed`; every other reason is a completed check with a negative verdict,
  * including a call-shape error — `verifyDelegation` always receives a well-formed
  * `VerifyOptions` in practice, so those are `invalid` for exhaustiveness, not because they
  * occur.

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA8GH,MAAM,mBAAmB,GAA+B,IAAI,GAAG,CAAC;IAC9D,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkKH,MAAM,mBAAmB,GAA+B,IAAI,GAAG,CAAC;IAC9D,oBAAoB;IACpB,kBAAkB;IAClB,YAAY;IACZ,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC"}

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAIV,kBAAkB,EAClB,aAAa,EACd,MAAM,YAAY,CAAC;AAgDpB,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyNzG"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAMV,kBAAkB,EAClB,aAAa,EACd,MAAM,YAAY,CAAC;AAuDpB,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgPzG"}

package/dist/verify.js

@@ -7,16 +7,19 @@
  * worth asking the issuer about.
  */
 import { canonicalizeDelegate, DelegateIdentifierError } from './delegate.js';
-import { getVerificationKeys, isSupportedAlgorithm, verifySignature } from './jwks.js';
+import { DEFAULT_MAX_JWKS_AGE_MS, isSupportedAlgorithm, MAX_JWKS_AGE_CAP_MS, resolveVerificationKeys, verifyWithCandidates, } from './jwks.js';
 import { parseJwt } from './jwt.js';
 import { checkDelegationStatus } from './status.js';
 import { classifyFailureReason } from './types.js';
-/** Delegation token schema versions this verifier understands (major-compatible). */
-const SUPPORTED_SCHEMA_MAJOR = '1';
+/**
+ * Delegation token schema versions this verifier understands (major-compatible). Schema 2.0
+ * removed `scope`; a 1.x token is refused with `unsupported_version`.
+ */
+const SUPPORTED_SCHEMA_MAJOR = '2';
 const DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
 const DEFAULT_TIMEOUT_MS = 5_000;
-function fail(reason, message) {
-    return { valid: false, reason, outcome: classifyFailureReason(reason), message };
+function fail(reason, message, extra = {}) {
+    return { valid: false, reason, outcome: classifyFailureReason(reason), message, ...extra };
 }
 function findTrustedIssuer(issuers, iss) {
     if (typeof iss !== 'string' || iss.length === 0)
@@ -74,16 +77,10 @@ export async function verifyDelegation(token, options) {
     catch (error) {
         return fail('invalid_options', error instanceof DelegateIdentifierError ? error.message : 'delegate could not be canonicalized');
     }
-    // Compared as exact strings, deliberately NOT through the issuer-side scope canonicalizer:
-    // scope grammar is the issuer's, and running another issuer's `mcp:tools/call` through
-    // proof.holdings' kebab-case rules would make the requirement unaskable rather than merely
-    // over-constrained.
-    let requiredScopes = [];
+    // Removed in 0.2.0 together with the claim. Refused rather than ignored: an untyped caller still
+    // passing it would otherwise read a valid answer as "the scopes I required were granted".
     if (options.requiredScopes !== undefined) {
-        if (!Array.isArray(options.requiredScopes) || options.requiredScopes.some((entry) => typeof entry !== 'string')) {
-            return fail('invalid_options', 'requiredScopes must be an array of strings');
-        }
-        requiredScopes = options.requiredScopes.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+        return fail('invalid_options', 'requiredScopes is no longer supported: delegation schema 2.0 carries no scope');
     }
     // Validated like every other option rather than trusted: this is the pin that closes the
     // sibling attack, and a non-string reaching `normalizePrincipal` would throw out of a
@@ -94,6 +91,21 @@ export async function verifyDelegation(token, options) {
             return fail('invalid_options', 'expectedPrincipal must be a non-empty string when supplied');
         }
     }
+    if (options.maxJwksAgeMs !== undefined) {
+        const age = options.maxJwksAgeMs;
+        if (typeof age !== 'number' || !Number.isInteger(age) || age <= 0 || age > MAX_JWKS_AGE_CAP_MS) {
+            return fail('invalid_options', `maxJwksAgeMs must be a whole number of milliseconds from 1 to ${MAX_JWKS_AGE_CAP_MS} (25 days)`);
+        }
+    }
+    if (options.keySetStore !== undefined) {
+        const store = options.keySetStore;
+        if (!store || typeof store.load !== 'function' || typeof store.save !== 'function') {
+            return fail('invalid_options', 'keySetStore must provide load(jwksUri) and save(jwksUri, state)');
+        }
+    }
+    if (options.onJwksEvent !== undefined && typeof options.onJwksEvent !== 'function') {
+        return fail('invalid_options', 'onJwksEvent must be a function');
+    }
     const issuers = Array.isArray(options.trustedIssuers) ? options.trustedIssuers.filter(isValidIssuerEntry) : [];
     if (issuers.length === 0) {
         return fail('no_trust_policy', 'trustedIssuers is empty: this verifier has no built-in trust list, so the caller must name the issuers it accepts (each with an https jwksUri)');
@@ -124,9 +136,9 @@ export async function verifyDelegation(token, options) {
     }
     const schemaVersion = claims.delegation_schema_version;
     if (typeof schemaVersion !== 'string' || schemaVersion.split('.')[0] !== SUPPORTED_SCHEMA_MAJOR) {
-        return fail('unsupported_schema', `delegation_schema_version ${JSON.stringify(schemaVersion)} is not supported (this verifier understands ${SUPPORTED_SCHEMA_MAJOR}.x)`);
+        return fail('unsupported_version', `delegation_schema_version ${JSON.stringify(schemaVersion)} is not supported (this verifier understands ${SUPPORTED_SCHEMA_MAJOR}.x)`);
     }
-    const { sub, principal, delegate, control_proof: controlProof, scope, iat, exp } = claims;
+    const { sub, principal, delegate, control_proof: controlProof, iat, exp } = claims;
     if (typeof sub !== 'string' ||
         sub.length === 0 ||
         typeof principal !== 'string' ||
@@ -135,12 +147,9 @@ export async function verifyDelegation(token, options) {
         delegate.length === 0 ||
         typeof controlProof !== 'string' ||
         controlProof.length === 0 ||
-        !Array.isArray(scope) ||
-        scope.length === 0 ||
-        scope.some((entry) => typeof entry !== 'string') ||
         typeof iat !== 'number' ||
         typeof exp !== 'number') {
-        return fail('malformed_claims', 'token is missing one of sub / principal / delegate / control_proof / scope / iat / exp');
+        return fail('malformed_claims', 'token is missing one of sub / principal / delegate / control_proof / iat / exp');
     }
     if (nowSeconds > exp + clockToleranceSeconds) {
         return fail('expired', 'delegation expired');
@@ -159,44 +168,52 @@ export async function verifyDelegation(token, options) {
     if (delegate !== expectedDelegate) {
         return fail('delegate_mismatch', `delegation attests ${JSON.stringify(delegate)}, but the artifact you resolved is ${JSON.stringify(expectedDelegate)}`);
     }
-    const grantedScopes = scope;
-    const grantedTrimmed = grantedScopes.map((entry) => entry.trim());
-    const missing = requiredScopes.filter((required) => !grantedTrimmed.includes(required));
-    if (missing.length > 0) {
-        return fail('scope_not_granted', `delegation does not grant: ${missing.join(', ')}`);
-    }
     // ---------------------------------------------------------------- signature
-    let keys;
-    try {
-        keys = await getVerificationKeys({
-            jwksUri: issuer.jwksUri,
-            kid: typeof parsed.header.kid === 'string' ? parsed.header.kid : undefined,
-            alg,
-            fetch: fetchImpl,
-            timeoutMs,
-        });
-    }
-    catch (error) {
-        // "I could not check" is not "the token is bad" — it gets its own reason.
-        return fail('jwks_unavailable', error instanceof Error ? error.message : 'JWKS could not be fetched');
-    }
-    if (keys.length === 0) {
-        return fail('unknown_key', 'no key in the issuer JWKS matches this token');
-    }
-    let signatureOk = false;
-    for (const key of keys) {
-        if (await verifySignature(key, alg, parsed.signingInput, parsed.signature)) {
-            signatureOk = true;
+    const keySetOptions = {
+        maxJwksAgeMs: options.maxJwksAgeMs ?? DEFAULT_MAX_JWKS_AGE_MS,
+        keySetStore: options.keySetStore,
+        onJwksEvent: options.onJwksEvent,
+    };
+    const resolution = await resolveVerificationKeys({
+        jwksUri: issuer.jwksUri,
+        kid: typeof parsed.header.kid === 'string' ? parsed.header.kid : undefined,
+        alg,
+        family: 'delegation',
+        fetch: fetchImpl,
+        timeoutMs,
+        ...keySetOptions,
+    });
+    switch (resolution.kind) {
+        case 'unavailable':
+            // "I could not check" is not "the token is bad" — it gets its own reason.
+            return fail('jwks_unavailable', resolution.message);
+        case 'stale':
+            return fail('jwks_stale', `the issuer JWKS could not be refetched and the cached copy is older than maxJwksAgeMs (${keySetOptions.maxJwksAgeMs} ms)`, { cacheAgeSeconds: resolution.cacheAgeSeconds, refreshHint: { jwksUri: issuer.jwksUri, method: 'refreshJwks' } });
+        case 'revoked':
+            // Decided before the signature: the key is revoked, whoever signed with it.
+            return fail('key_revoked', `the issuer revoked signing key "${resolution.kid}"`, {
+                pullHint: { issuerOrigin: new URL(issuer.jwksUri).origin, handle: sub },
+            });
+        case 'wrong_purpose':
+            return fail('wrong_key_purpose', `signing key "${resolution.kid}" is not a delegation key`);
+        case 'unknown':
+            return fail('unknown_key', 'no key in the issuer JWKS matches this token');
+        case 'keys':
             break;
-        }
     }
-    if (!signatureOk)
+    const verdict = await verifyWithCandidates(resolution, alg, parsed.signingInput, parsed.signature, { iat, exp });
+    if (verdict === 'bad_signature')
         return fail('bad_signature', 'token signature is invalid');
+    if (verdict === 'outside_key_window') {
+        return fail('outside_key_window', "token iat lies outside the signing key's window");
+    }
+    if (verdict === 'token_lifetime_exceeded') {
+        return fail('token_lifetime_exceeded', "token exp lies beyond iat plus the signing key's max_token_lifetime");
+    }
     const delegation = {
         issuer: issuer.issuer,
         principal,
         delegate,
-        scope: grantedScopes,
         controlProof,
         delegationId: sub,
         issuedAt: new Date(iat * 1000),
@@ -218,6 +235,7 @@ export async function verifyDelegation(token, options) {
         timeoutMs,
         now,
         clockToleranceSeconds,
+        keySetOptions,
     });
     switch (status.state) {
         case 'valid':