# `RequestSeal.Discovery.Resolution`
[🔗](https://github.com/baselabs/request_seal/blob/v0.5.2/lib/request_seal/discovery/resolution.ex#L1)

Public key and explicit discovery provenance. `key_id` is the selected
lookup ID; `thumbprint` is always the computed cryptographic identity. `algorithm` is the selected
cryptographic algorithm; `asserted_algorithm` is the source's HTTP token, if
present. Neither the source nor a possession proof establishes a principal or
authorizes an operation. Default inspection hides key material and provenance.
`revision` is the resolved KeySet's SHA-256 revision, propagated by lookup.
`expires_at` bounds the key/proof lifetime; KeySet separately bounds HTTP cache
freshness. Access fields explicitly when applying caller trust policy.

# `t`

```elixir
@type t() :: %RequestSeal.Discovery.Resolution{
  algorithm: RequestSeal.Crypto.algorithm(),
  asserted_algorithm: binary() | nil,
  expires_at: integer(),
  fetched_at: integer(),
  key: RequestSeal.PublicKey.t(),
  key_id: binary(),
  location: binary(),
  origin: binary(),
  proof: :signed | :unsigned | :not_applicable,
  revision: binary() | nil,
  source_type: :directory | :jwks_uri | :cimd,
  thumbprint: binary()
}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*