Cardano Updates

Signed-off-by: Ansita <[email protected]>

Signed-off-by: ansita20 <[email protected]>

Signed-off-by: iammdzaidalam <[email protected]>

Replace the generic FindDIDSigningKeys with six explicit, purpose-specific classes:
- FindIssuerSigningKeys: for credential issuance (assertionMethod)
- FindAuthenticationSigningKeys: for proving DID ownership (authentication)
- FindKeyAgreementSigningKeys: for encryption/key agreement (keyAgreement)
- FindCapabilityInvocationSigningKeys: for invoking delegated capabilities
- FindCapabilityDelegationSigningKeys: for delegating capabilities to others
- FindRevocationSigningKeys: for revoking credentials/keys

This improves code clarity and scalability by making the purpose of each key
type explicit at the API level. Each search function includes comprehensive
W3C DID Core Specification references and documentation.

All explicit finders are thin wrappers delegating to the refactored
FindSigningKeys implementation that now supports all six DID verification
relationships via PURPOSE_TO_VERIFICATION_RELATIONSHIP mapping.

Fixes #596

Signed-off-by: Anshika Chaubey <[email protected]>

NumericDate claims per RFC 7519 must be emitted in seconds, not milliseconds.
Several SDK code paths were using Date.now() directly, which returns milliseconds,
causing tokens to be emitted with iat/exp values interpreted as far-future dates
when conforming verifiers parse them as seconds. This breaks interoperability with
RFC 7519-compliant consumers.

Fixed affected sites:
- HandleRequestCredential.ts: createJWT() and createSDJWT() methods
- CreateCredentialRequest.ts: OID4VCI proof JWT

All NumericDate claims now use Math.floor(Date.now() / 1000) to emit seconds.

Tests added to verify iat/exp are in seconds (NumericDate range):
- HandleRequestCredential.test.ts: RFC 7519 NumericDate Compliance tests
- CreateCredentialRequest.test.ts: OIDC proof JWT iat seconds validation

Fixes #610

Signed-off-by: Anshika Chaubey <[email protected]>

Bumps the npm_and_yarn group with 1 update in the / directory: [fast-uri](https://github.com/fastify/fast-uri).


Updates `fast-uri` from 3.1.0 to 3.1.2
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: iammdzaidalam <[email protected]>

Fixes #553 — remove console.log(err) from SDJWT.verify() catch block
Fixes #554 — add temporal claim validation (exp/nbf) per RFC 7519

Changes:
- Check exp claim (§4.1.4): return false if current time >= exp
- Check nbf claim (§4.1.5): return false if current time < nbf
- Remove console.log: empty catch block, consistent with JWT.verify()
- Use string literals for claim keys to keep import type-only
- Remove static temporal fixtures; tests use vi.useFakeTimers()
  to control system clock and build SD-JWT payloads dynamically

Matches the areTimestampsValid() pattern in JWT.verify (#550, #552).
Credentials without exp/nbf keep current behavior (no enforcement).

Signed-off-by: Abhigyan Singh <[email protected]>

Signed-off-by: iammdzaidalam <[email protected]>

Signed-off-by: Seydi Charyyev <[email protected]>

SonarCloud flags `JWT.verify` (`packages/lib/sdk/src/pollux/utils/jwt/JWT.ts`)
as exceeding the cognitive-complexity threshold (16, allowed 15) due to
the inline exp and nbf checks added in #550 and #552.

Extract the temporal-claim validation into a small private helper
`areTimestampsValid(payload)`:

- Drops `verify`'s cognitive complexity from 16 to 13 (under the
  threshold) by replacing two inline if-blocks with one delegated call.
- Centralises the RFC 7519 §4.1.4 (exp) and §4.1.5 (nbf) handling in a
  single, focused method, which makes future additions (e.g. `iat`
  validation, see #610) and reuse from the SDJWT verifier easier.
- Behaviour is unchanged: same checks, same return value, same
  short-circuit ordering (exp before nbf, before signature verification).

No public API change. 765/765 tests pass locally on this branch.

Signed-off-by: Seydi Charyyev <[email protected]>

Signed-off-by: Zaid <[email protected]>
Signed-off-by: iammdzaidalam <[email protected]>
Signed-off-by: iammdzaidalam <[email protected]>

Signed-off-by: A-Chronicle <[email protected]>

Signed-off-by: Seydi Charyyev <[email protected]>

SonarCloud flags four blocks of commented-out code as MAJOR code smells.
The blocks are dead — unused, unreachable, and not maintained — and only
add noise when reading these files. Removing them closes the
corresponding SonarCloud issues.

- packages/lib/sdk/src/plugins/internal/oidc/connection/CreateAuthorizationRequest.ts:
  remove commented-out PKCE/nonce/code_challenge branches; the explanatory
  TODO is kept since it documents the still-pending work.
- packages/lib/sdk/src/plugins/internal/oidc/connection/ProcessCallbackUrl.ts:
  remove commented-out implicit/hybrid flow rejection.
- packages/shared/domain/src/utils/guards.ts: remove the commented-out
  notEmptyArray export and its orphaned JSDoc block.
- packages/lib/sdk/src/plugins/internal/oea/index.ts: remove two
  commented-out plugin.register calls referencing protocol types and
  handlers that no longer exist (HandlePresentationRequest is not
  imported, the OEA.ProtocolType.* members do not exist).

No behavior change; no tests touched. 765/765 tests pass locally.

Signed-off-by: Seydi Charyyev <[email protected]>

Replaces console.log with silent error handling to prevent leaking error details
to stdout in production. Matches the error handling pattern used in JWT.verify().

Signed-off-by: A-Chronicle <[email protected]>

Replaces console.log with silent error handling to prevent leaking error details
to stdout in production. Matches the error handling pattern used in JWT.verify().

Signed-off-by: A-Chronicle <[email protected]>

Signed-off-by: Seydi Charyyev <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [ip-address](https://github.com/beaugunderson/ip-address).


Updates `ip-address` from 10.1.0 to 10.2.0
- [Commits](https://github.com/beaugunderson/ip-address/commits)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>

JWT.verify did not validate the nbf (not before) claim, so JWTs with
nbf in the future were incorrectly considered valid. This is a
security issue per RFC 7519 Section 4.1.5.

Added an explicit nbf check after JWT decode: if nbf is present and
the current time is before it, verify() returns false. JWTs without
an nbf claim keep the previous behavior (no nbf enforced).

This is a sister fix to #489/#550 (which addressed the exp claim).

Adding the nbf check exposed pre-existing bugs in JWT/SDJWT creation
paths that emitted nbf as milliseconds (Date.now()) instead of
seconds (NumericDate per RFC 7519). Without correction these tokens
would be rejected by the new check, breaking
createPresentationForRequestProof and credential issuance. Three
creation sites are corrected to seconds:

  - src/plugins/internal/dif/PresentationRequest.ts (VP nbf)
  - src/plugins/internal/didcomm/tasks/HandleRequestCredential.ts
    (JWT and SDJWT credential nbf)

The hardcoded VP JWT in tests/plugins/dif/PresentationVerify.test.ts
and the credential fixture in tests/fixtures/credentials/jwt.ts
contained nbf in milliseconds and have been regenerated with valid
(seconds) timestamps. Inline currentDate.getTime() test data has
been corrected to Math.floor(.../1000).

Note: iat and exp in the same creation paths are also emitted as
milliseconds; this does not block the new nbf check (exp in ms is
interpreted as far future and passes) but violates RFC 7519. Filed
separately.

Closes #551

Signed-off-by: Seydi Charyyev <[email protected]>

Replaces console.log with silent error handling to prevent leaking error details
to stdout in production. Matches the error handling pattern used in JWT.verify().

Signed-off-by: A-Chronicle <[email protected]>

Signed-off-by: Dev10-sys <[email protected]>