Cardano Updates

The cancel() method previously used .catch() with a re-throw for non-AbortError rejections. Since the promise returned by .catch() was never consumed, this caused unhandled promise rejections.

Fixed by aborting the controller first, then attaching a no-op .catch() handler to silence the rejection. Any errors from the task remain accessible via the callback() method.

Signed-off-by: A-Chronicle <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [tmp](https://github.com/raszi/node-tmp).


Updates `tmp` from 0.2.5 to 0.2.7
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>

- Add JSDoc comment to onlyOne() explaining context parameter and failure modes
- Add inline comments to getAllMediators() error throws explaining each check
- Add tests verifying onlyOne() throws descriptive errors for empty/multiple results
- Add tests verifying getAllMediators() throws descriptive errors for missing links/DIDs

Signed-off-by: A-Chronicle <[email protected]>

getAllMediators() had bare throw new Error() calls with no message
at two failure points, making debugging impossible.

Changes:
- Missing link error now reports the hostId and which link is missing
- Empty DID error reports hostId and which DIDs resolved to null

Signed-off-by: A-Chronicle <[email protected]>

Signed-off-by: A-Chronicle <[email protected]>

The onlyOne() method in Pluto threw a generic Error("something wrong") with no context about what was being looked up or why it failed.

Changes:
- Accept optional context string to identify the caller and query
- Distinguish between empty results (arr.length === 0) and null item
- Report the actual count when multiple results found
- Pass context from getPairByDID() and getPairByName() callers

Fixes #648

Signed-off-by: A-Chronicle <[email protected]>

The validateField method in PresentationVerify passes the filter.pattern
from the presentation definition directly to new RegExp() without any
safety checks. An attacker can craft a presentation request with a regex
pattern that causes catastrophic backtracking (e.g. (a|aa)+b), blocking
the JavaScript event loop indefinitely.

This is an unauthenticated attack vector since the presentation definition
originates from an external verifier.

Add a safeRegex utility that:
- Validates the pattern is a non-empty string
- Enforces a maximum pattern length of 256 characters
- Verifies the pattern compiles as a valid regex
- Detects and rejects patterns with nested quantifiers (ReDoS vectors)
- Detects and rejects patterns with alternation inside quantified groups

Fixes #646

Signed-off-by: A-Chronicle <[email protected]>

The validateField method in PresentationVerify passes the filter.pattern
from the presentation definition directly to new RegExp() without any
safety checks. An attacker can craft a presentation request with a regex
pattern that causes catastrophic backtracking (e.g. (a|aa)+b), blocking
the JavaScript event loop indefinitely.

This is an unauthenticated attack vector since the presentation definition
originates from an external verifier.

Add a safeRegex utility that:
- Validates the pattern is a non-empty string
- Enforces a maximum pattern length of 256 characters
- Verifies the pattern compiles as a valid regex
- Detects and rejects patterns with nested quantifiers (ReDoS vectors)
- Detects and rejects patterns with alternation inside quantified groups

Fixes #646

Signed-off-by: A-Chronicle <[email protected]>