// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
// ══════════════════════════════════════════════════════════════════
// KeyResolver: interface, policy, and result types (M3)
// ══════════════════════════════════════════════════════════════════
// A KeyResolver maps a key locator (a DID, a DID URL with a #kid
// fragment, or a direct JWKS endpoint plus an optional kid) to a
// single Ed25519 verification key, expressed as the 64-char hex
// string the existing crypto/keys.ts verify() consumes.
//
// This file defines ONLY the protocol surface. It introduces no
// network behavior, no registry, and no hosted service. Concrete
// resolution lives in resolver.ts (reference implementation) and
// did-cycles.ts (the did:cycles -> JWKS mapping).
//
// SECURITY POSTURE: every resolver in this module defaults to
// fail-closed. "Could not fetch the key" is never "signature valid".
// ══════════════════════════════════════════════════════════════════
/** Default fetch timeout, matching the existing did:web resolver. */
export const DEFAULT_TIMEOUT_MS = 10_000;
/** Conservative cache defaults: 5 min positive, 30 s negative. */
export const DEFAULT_CACHE_POLICY = {
    ttlMs: 5 * 60_000,
    negativeTtlMs: 30_000,
    maxEntries: 256,
};
//# sourceMappingURL=types.js.map