Cardano Updates

The SDK sent MediationKeysUpdateList to the mediator but did not process
the response, so per-recipient failures reported by the mediator went
unnoticed.

Register a handler for the keylist-update-response protocol message.
Each entry in body.updated is inspected; results other than success or
no_change are logged as warnings with the recipient DID and action.
Confirmed against the Identus mediator (MediatorCoordinationExecuter.scala)
which returns this response with tuples of (recipient_did, action, result).

Closes #391

Signed-off-by: Seydi Charyyev <[email protected]>

JWT.verify did not validate the nbf (not before) claim, so JWTs with nbf in the future were incorrectly considered valid. This is a security issue per RFC 7519 Section 4.1.5.

Added an explicit nbf check after JWT decode: if nbf is present and the current time is before it, verify() returns false. JWTs without an nbf claim keep the previous behavior (no nbf enforced).

This is a sister fix to #489/#550 (which addressed the exp claim).

Closes #551

Signed-off-by: Seydi Charyyev <[email protected]>

JWT.verify did not validate the exp (expiration) claim, so expired JWTs were incorrectly considered valid. This is a security issue per RFC 7519 Section 4.1.4.

Added an explicit exp check after JWT decode: if exp is present and the current time is at or past it, verify() returns false. JWTs without an exp claim keep the previous behavior (no expiration enforced).

Closes #489

Signed-off-by: Seydi Charyyev <[email protected]>

Signed-off-by: Yummy-Yums <[email protected]>

Signed-off-by: Yummy-Yums <[email protected]>

Signed-off-by: Yummy-Yums <[email protected]>

Replaces 13 instances of generic `throw new Error()` with domain-specific
error types (`PolluxError.InvalidCredentialError`, `CastorError.NotPossibleToResolveDID`,
`CastorError.InvalidKeyError`) across the JWT/SDJWT utility layer.

This enables callers to programmatically distinguish between error types
(e.g., invalid DID document vs invalid key vs invalid credential), which
is essential for the Identity Portal to display meaningful error messages.

Files changed:
- SDJWT.ts: 6 errors replaced
- JWT.ts: 4 errors replaced
- ResolveDID.ts: 1 error replaced
- CreateJwt.ts: 1 error replaced
- CreateSDJWT.ts: 1 error replaced
- Added tests for error type verification

Signed-off-by: Abhigyan Singh <[email protected]>

Fixes #553 — replaced console.log with silent catch in verification
error path, consistent with JWT.verify behavior.

Fixes #554 — added exp and nbf temporal claim validation per
RFC 7519 §4.1.4 and §4.1.5. SDJWT.verify now returns false for
expired or not-yet-valid credentials.

Changes:
- Check exp claim before signature verification; return false if expired
- Check nbf claim before signature verification; return false if too early
- Remove console.log(err) from catch block (was leaking error details)
- Change import from type-only to value import for Domain (needed for
  runtime access to JWT.Claims enum)

Signed-off-by: abhigyan1102 <[email protected]>
Signed-off-by: Abhigyan Singh <[email protected]>

Signed-off-by: Abhigyan Singh <[email protected]>

Signed-off-by: Abhigyan Singh <[email protected]>

Signed-off-by: Abhigyan Singh <[email protected]>

Signed-off-by: Francisco Javier Ribo Labrador <[email protected]>

Signed-off-by: Francisco Javier Ribo Labrador <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Allain Magyar <[email protected]>

Signed-off-by: Francisco Javier Ribo Labrador <[email protected]>

JWT.verify did not validate the nbf (not before) claim, so JWTs with nbf in the future were incorrectly considered valid. This is a security issue per RFC 7519 Section 4.1.5.

Added an explicit nbf check after JWT decode: if nbf is present and the current time is before it, verify() returns false. JWTs without an nbf claim keep the previous behavior (no nbf enforced).

This is a sister fix to #489/#550 (which addressed the exp claim).

Closes #551

Signed-off-by: Seydi Charyyev <[email protected]>

JWT.verify did not validate the exp (expiration) claim, so expired JWTs were incorrectly considered valid. This is a security issue per RFC 7519 Section 4.1.4.

Added an explicit exp check after JWT decode: if exp is present and the current time is at or past it, verify() returns false. JWTs without an exp claim keep the previous behavior (no expiration enforced).

Closes #489

Signed-off-by: Seydi Charyyev <[email protected]>