CLI: --jwks flag should accept file:// URLs and bare filesystem paths

[aeoess]

Problem

@veritasacta/verify CLI's --jwks flag currently fails on file:// URLs and bare filesystem paths with jwks_fetch_failed, accepting only HTTP/HTTPS URLs.

Local-development reproduction:

npx @veritasacta/verify test-vectors/cross-verify-bundle.json \
  --jwks test-vectors/keys/aps-ku-cross-verify.jwks
# → jwks_fetch_failed

The README under test-vectors/ documents this exact form of invocation as the local-development path, so the failure breaks every reader who tries to run the test-vector suite locally without spinning up a hosting layer first.

Proposed scope

• Accept file:// URLs by reading the file from disk
• Accept bare filesystem paths (relative + absolute) by interpreting them as files
• Preserve existing HTTP/HTTPS behavior unchanged
• Cite the resolved path in CLI output so users can confirm what was loaded

Why a separate issue

Surfaced during review of PR #7 (feat(test-vectors): APS DecisionLineageReceipt for ku_4b3f7c2a9d8e1f05). Both @aeoess and @desiorac agreed the fix belongs in the v0.7 scope alongside the draft-02 enforcement work, kept out of PR #7 to keep that PR focused. Filing here so it does not get absorbed into the draft-02 PR or lost between reviews.

Reference

• @desiorac on PR feat(test-vectors): APS DecisionLineageReceipt for ku_4b3f7c2a9d8e1f05 #7 (2026-05-01): "file:// and bare path handling belong in the 0.7 scope alongside the enforcement work."

— Tymofii Pidlisnyi (aeoess)

[tomjwxf]

Agreed. Treating this as the canonical issue for the local JWKS path work.

I opened #11 with the fix: #11

What it does:

• preserves existing HTTP(S) JWKS behavior
• adds file:// JWKS loading from local disk
• adds bare relative and absolute filesystem path support
• reports the resolved local JWKS path in the key source
• adds unit coverage for absolute path, file://, relative path, and unsupported URL schemes

Verification from the PR branch:

npm ci
npm test
node --test test/unit/jwks.test.js
node cli.js --self-test

Current result: npm test passes 223/223.

One repo-hygiene note: the standalone VeritasActa/verify repo was behind the published @veritasacta/verify@0.6.0 CLI source. The PR syncs the standalone repo to the current CLI source and includes the JWKS fix in that synced tree, so future issue review happens against the code users actually run.

[tomjwxf]

Resolved in #11 and published as @veritasacta/verify@0.6.1.\n\nWhat changed:\n- --jwks now resolves HTTP(S), file://, absolute filesystem paths, and bare relative filesystem paths.\n- Local JWKS sources are reported as resolved paths in verifier output.\n- Added unit coverage for absolute, file://, relative, and unsupported-scheme cases.\n- Fixed the CI test glob so Node 20 resolves the unit/integration tests correctly.\n\nValidation:\n- GitHub CI green on Node 20 and Node 22.\n- Local release checks: npm test 223/223, node cli.js --self-test, node cli.js --self-check.\n- npm registry confirms latest = 0.6.1.\n\nInstall/update:\nsh\nnpm install -g @veritasacta/verify@latest\n