Module resolution 

Card resolution verification (the certificate-chain walk behind resolve --hub and verify-presentation). Lives in core so the CLI, the WASM verifier, and the SDKs run the same code path. Card resolution verification: the certificate-chain walk that backs resolve --hub and verify-presentation.

Lifted verbatim from the CLI (packages/cli/src/commands/resolve.rs) so the same code path runs in the CLI, the WASM verifier, and every SDK. Pure and time-injected: the caller supplies now and the trust roots. No I/O, no system clock.

Structs

ChainVerdict

A card verified through the certificate chain rather than a direct leaf pin: which cert artifact vouched, and the subject key it certified.

ResolutionBundle

A resolution bundle: exactly the signed bytes a verifier needs to decide whether an agent’s current card is trustworthy. No I/O — the caller (the CLI over the network, the WASM verifier / SDKs in a browser) assembles it and supplies now.

ResolutionVerdict

The trust verdict for a resolution bundle: is the card authentic (directly pinned or chain-certified), and is it revoked? Capability grading and provenance are the caller’s concern; this is only the trust decision.

Functions

chain_verify_card

Walk the certificate chain for a card whose signer key is NOT directly pinned: find a served agent_cert.v1 that (in this order, fail-closed at every step):

verifier_from_trust

Build an offline Verifier from the client’s pinned trust roots. An agent whose key the client has not pinned simply will not verify, which is the honest answer, not an error.

verify_resolution

Decide whether a resolution bundle’s card is trustworthy against the caller’s pinned trust roots at now. Mirrors the CLI resolve --hub decision exactly: verify the card signature (direct leaf pin), else walk the certificate chain; then honor an authorized, verifying revocation (self-revocation by the card key, or an issuer pinned under Revoker).