@agentunion/fastaun 0.5.26 → 0.5.28

package/dist/org-protocol.js

@@ -133,7 +133,7 @@ export class CredentialRenewal {
             if (proof.ver !== 'aun-membership-status/1' || proof.org_id !== credential.iss || proof.member_aid !== actor || proof.credential_cid !== credential.cid
                 || proof.membership_id !== binding.membership_id || proof.role !== binding.role || proof.version !== member.version
                 || proof.status !== 'active' || proof.credential_status !== 'active' || proof.responder !== service || proof.target !== actor || proof.request_id !== query.request_id || proof.nonce !== query.nonce
-                || !isInt(proof.as_of) || proof.as_of > now + 300 || !isInt(proof.expires_at) || proof.expires_at <= now || proof.expires_at <= proof.as_of || proof.expires_at > proof.as_of + 300
+                || !isInt(proof.as_of) || proof.as_of > now + 300 || !isInt(proof.expires_at) || now > proof.expires_at + 300 || proof.expires_at <= proof.as_of || proof.expires_at > proof.as_of + 300
                 || !isRecord(proof.signature) || proof.signature.timestamp !== proof.as_of)
                 throw invalid('current membership proof does not match the query');
             const cert = await this.ports.certificate(service, String(proof.signature.cert_fingerprint));
@@ -231,9 +231,9 @@ export class CredentialRenewal {
             verifyMembershipBinding(binding, resolve, now, String(orgSigner), true);
             check();
             const service = 'credential.' + String(payload.org_id).split('.').slice(1).join('.');
-            if (!isInt(receipt.registered_at) || !isInt(receipt.exp) || receipt.exp > receipt.registered_at + 300 || receipt.registered_at > now)
+            if (!isInt(receipt.registered_at) || !isInt(receipt.exp) || receipt.exp > receipt.registered_at + 300 || receipt.registered_at > now + 300)
                 throw invalid('membership receipt window is invalid');
-            const late = now >= receipt.exp;
+            const late = now > receipt.exp + 300;
             verifyRegistrationReceipt(receipt, credential, { request_id: binding.request_id, nonce: binding.nonce, registrar_aid: payload.org_id }, resolve, service, late ? receipt.registered_at : now);
             check();
             const validUntil = Math.min(Number(credential.exp), late ? await this.status(credential, actor, false, receipt.registered_at) : receipt.exp);
@@ -245,7 +245,7 @@ export class CredentialRenewal {
                 return;
             const issuerCertificate = certificates.get(String(credential.signature.cert_fingerprint));
             await this.rememberNow(credential, { membership_binding: binding, registrationReceipt: receipt, terms, version: payload.version,
-                service_aid: 'org.' + String(payload.org_id).split('.').slice(1).join('.'), long_term: credential.exp === Math.floor(Date.parse(new X509Certificate(issuerCertificate).validTo) / 1000) }, actor, { ...guard, current: () => guard.current() && Date.now() / 1000 < validUntil });
+                service_aid: 'org.' + String(payload.org_id).split('.').slice(1).join('.'), long_term: credential.exp === Math.floor(Date.parse(new X509Certificate(issuerCertificate).validTo) / 1000) }, actor, { ...guard, current: () => guard.current() && Date.now() / 1000 <= validUntil + 300 });
         });
     }
     observe(method, params, result) {
@@ -298,7 +298,7 @@ export class CredentialRenewal {
                         }
                         if (initial.submission && initial.received_result && !initial.successor_cid)
                             await this.receiveNow(String(initial.credential.iss), initial.received_result, undefined, true);
-                        else if (initial.incoming?.payload.exp > Math.trunc(Date.now() / 1000))
+                        else if (initial.incoming && Math.trunc(Date.now() / 1000) <= initial.incoming.payload.exp + 300)
                             await this.receiveNow(initial.incoming.from, initial.incoming.payload);
                         const record = (await this.ports.load(actor))[cid];
                         if (record.commit_pending)
@@ -370,7 +370,7 @@ export class CredentialRenewal {
     }
     async verifyEnvelope(from, payload, expected, replay = false) {
         const now = Math.trunc(Date.now() / 1000);
-        if (from !== expected || payload.ver !== 'aun-credential-renewal/1' || !isInt(payload.iat) || !isInt(payload.exp) || payload.iat > (replay ? payload.iat : now) || payload.exp <= (replay ? payload.iat : now) || payload.exp > payload.iat + 300 || !isRecord(payload.signature))
+        if (from !== expected || payload.ver !== 'aun-credential-renewal/1' || !isInt(payload.iat) || !isInt(payload.exp) || payload.exp <= payload.iat || !replay && (now < payload.iat - 300 || now > payload.exp + 300) || payload.exp > payload.iat + 300 || !isRecord(payload.signature))
             throw invalid('renewal message identity or validity is invalid');
         const cert = await this.ports.certificate(expected, String(payload.signature.cert_fingerprint));
         const unsigned = { ...payload };
@@ -395,7 +395,7 @@ export class CredentialRenewal {
         if (!isRecord(proof) || proof.ver !== 'aun-credential-status/1' || proof.credentialCid !== credential.cid || proof.credential_hash !== digest(credential)
             || proof.issuerAid !== credential.iss || proof.subjectAid !== credential.sub || proof.expiresAt !== credential.exp || proof.responder !== target
             || proof.request_id !== query.request_id || proof.nonce !== query.nonce || proof.target !== actor
-            || !isInt(proof.asOf) || !isInt(proof.proofExpiresAt) || proof.asOf > now + 300 || proof.proofExpiresAt <= proof.asOf || proof.proofExpiresAt <= now || proof.proofExpiresAt > proof.asOf + 300
+            || !isInt(proof.asOf) || !isInt(proof.proofExpiresAt) || proof.asOf > now + 300 || proof.proofExpiresAt <= proof.asOf || now > proof.proofExpiresAt + 300 || proof.proofExpiresAt > proof.asOf + 300
             || !isRecord(proof.signature) || proof.signature.timestamp !== proof.asOf)
             throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'renewal status proof does not match the query');
         const cert = await this.ports.certificate(target, String(proof.signature.cert_fingerprint));
@@ -404,7 +404,7 @@ export class CredentialRenewal {
         verifyAgentSignature(proof.signature, unsigned, target, () => cert, now, false);
         if (proof.status !== 'active' && !(allowExpired && proof.status === 'expired' && proof.credentialStatus === 'expired' && Array.isArray(proof.chain) && proof.chain.every((item) => item.status === 'active')))
             throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'renewal credential is not active');
-        if (registrationConfirmedAt !== undefined && (proof.asOf < requestedAt || proof.asOf > now || !isInt(proof.registrationConfirmedAt) || proof.registrationConfirmedAt < registrationConfirmedAt || proof.registrationConfirmedAt > proof.asOf || proof.credentialStatus !== 'active' || proof.proofExpiresAt <= Math.trunc(Date.now() / 1000)))
+        if (registrationConfirmedAt !== undefined && (proof.asOf < requestedAt - 300 || proof.asOf > now + 300 || !isInt(proof.registrationConfirmedAt) || proof.registrationConfirmedAt < registrationConfirmedAt - 300 || proof.registrationConfirmedAt > proof.asOf || proof.credentialStatus !== 'active' || Math.trunc(Date.now() / 1000) > proof.proofExpiresAt + 300))
             throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'membership registration confirmation is invalid');
         if (confirmation)
             Object.assign(confirmation, structuredClone(proof));
@@ -414,7 +414,7 @@ export class CredentialRenewal {
         if (!isRecord(value) || !['credential.renewal.request', 'credential.renewal.result'].includes(String(value.type)))
             return false;
         const payload = value;
-        if (!replay && isInt(payload.exp) && payload.exp <= Math.trunc(Date.now() / 1000))
+        if (!replay && isInt(payload.exp) && Math.trunc(Date.now() / 1000) > payload.exp + 300)
             return true;
         const isRequest = payload.type === 'credential.renewal.request';
         const actor = localIssuer ?? this.ports.currentAid();
@@ -614,8 +614,8 @@ export class CredentialRenewal {
                     if (!isRecord(proof) || proof.ver !== 'aun-membership-status/1' || proof.org_id !== credential.iss || proof.member_aid !== actor || proof.credential_cid !== credential.cid
                         || proof.membership_id !== params.membership_binding.membership_id || proof.role !== params.membership_binding.role || proof.version !== Number(params.expected_version) + 1
                         || proof.status !== 'active' || proof.credential_status !== 'active' || proof.responder !== record.service_aid || proof.target !== actor || proof.request_id !== query.request_id || proof.nonce !== query.nonce
-                        || !isInt(proof.as_of) || proof.as_of < Number(query.request_binding.iat) || proof.as_of > now || !isInt(proof.expires_at) || proof.expires_at <= now || proof.expires_at > proof.as_of + 300
-                        || !isRecord(proof.signature) || proof.signature.timestamp !== proof.as_of || proofExpiresAt <= now)
+                        || !isInt(proof.as_of) || proof.as_of < Number(query.request_binding.iat) - 300 || proof.as_of > now + 300 || !isInt(proof.expires_at) || now > proof.expires_at + 300 || proof.expires_at > proof.as_of + 300
+                        || !isRecord(proof.signature) || proof.signature.timestamp !== proof.as_of || now > proofExpiresAt + 300)
                         throw invalid('renewal membership confirmation is invalid');
                     const cert = await this.ports.certificate(record.service_aid, String(proof.signature.cert_fingerprint));
                     const unsigned = { ...proof };
@@ -660,7 +660,7 @@ export class CredentialRenewal {
             records[cid].successor_cid = credential.cid;
             records[cid].response = structuredClone(payload);
             records[cid].commit_pending = true;
-            const recoveryGuard = { current: () => Date.now() / 1000 >= Number(credential.nbf) && Date.now() / 1000 < Math.min(recoveryValidUntil, Number(credential.exp)) };
+            const recoveryGuard = { current: () => Date.now() / 1000 >= Number(credential.nbf) - 300 && Date.now() / 1000 <= Math.min(recoveryValidUntil, Number(credential.exp)) + 300 };
             if (!recoveryGuard.current())
                 throw invalid('renewal recovery confirmation has expired');
             await this.ports.save(actor, records, recoveryGuard);
@@ -687,7 +687,7 @@ export class CredentialRenewal {
         const validUntil = await this.status(credential, actor, false, record.registration_submitted_at, confirmation);
         records[String(credential.cid)] = { credential: structuredClone(credential), long_term: true, issued: true };
         records[cid].registration_confirmation = confirmation;
-        const guard = { current: () => Date.now() / 1000 >= Number(credential.nbf) && Date.now() / 1000 < Math.min(validUntil, Number(credential.exp)) };
+        const guard = { current: () => Date.now() / 1000 >= Number(credential.nbf) - 300 && Date.now() / 1000 <= Math.min(validUntil, Number(credential.exp)) + 300 };
         if (!guard.current())
             throw invalid('registration recovery confirmation has expired');
         await this.ports.save(actor, records, guard);
@@ -782,7 +782,7 @@ export class CredentialRenewal {
             return Promise.resolve();
         return this.serial(async () => {
             const actor = this.ports.currentAid();
-            const current = () => this.ports.currentAid() === actor && guard.current() && Date.now() / 1000 < Number(payload.expires_at);
+            const current = () => this.ports.currentAid() === actor && guard.current() && Date.now() / 1000 <= Number(payload.expires_at) + 300;
             if (!current())
                 throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'credential revocation event was superseded');
             const list = payload.type === 'credential.revocationList';
@@ -831,7 +831,7 @@ export class CredentialRenewal {
             check();
             const records = await this.ports.load(actor);
             check();
-            const authorities = new Set();
+            const authorities = new Set(Object.keys(state.authorities));
             for (const record of Object.values(records)) {
                 if (!isRecord(record) || !isRecord(record.credential))
                     continue;
@@ -869,7 +869,7 @@ export class CredentialRenewal {
                     const now = Math.trunc(Date.now() / 1000);
                     if (!isRecord(proof) || proof.responder !== authority || proof.target !== actor || proof.request_id !== query.request_id || proof.nonce !== query.nonce || proof.issuer_aid !== ''
                         || !Array.isArray(proof.events) || proof.events.length > 1000 || typeof proof.next_cursor !== 'string'
-                        || !isInt(proof.as_of) || proof.as_of <= 0 || proof.as_of > now + 300 || !isInt(proof.expires_at) || proof.expires_at <= now || proof.expires_at <= proof.as_of || proof.expires_at > proof.as_of + 300
+                        || !isInt(proof.as_of) || proof.as_of <= 0 || proof.as_of > now + 300 || !isInt(proof.expires_at) || now > proof.expires_at + 300 || proof.expires_at <= proof.as_of || proof.expires_at > proof.as_of + 300
                         || !isRecord(proof.signature) || proof.signature.timestamp !== proof.as_of)
                         throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'revocation list does not match the query');
                     let last = since;
@@ -893,7 +893,7 @@ export class CredentialRenewal {
                         Object.defineProperty(revoked, String(event.cid), { value: Math.max(Object.hasOwn(revoked, String(event.cid)) ? Number(revoked[String(event.cid)]) : 0, Number(event.event_seq)), enumerable: true, configurable: true, writable: true });
                     next.authorities[authority] = { revoked, since_event_seq: proof.next_cursor === '' ? last : Number(proof.next_cursor), cursor: proof.next_cursor, as_of: proof.as_of, expires_at: proof.expires_at };
                     expiresAt = Math.min(expiresAt, Number(proof.expires_at), Date.parse(new X509Certificate(certificate).validTo) / 1000);
-                    const commitGuard = { ...guard, current: () => epoch === this.queryEpoch && scope === this.queryScope() && this.ports.currentAid() === actor && (!guard || guard.current()) && Date.now() / 1000 < expiresAt };
+                    const commitGuard = { ...guard, current: () => epoch === this.queryEpoch && scope === this.queryScope() && this.ports.currentAid() === actor && (!guard || guard.current()) && Date.now() / 1000 <= expiresAt + 300 };
                     if (!commitGuard.current())
                         throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'revocation list expired before persistence');
                     await this.ports.saveRevocations(actor, next, commitGuard);
@@ -928,7 +928,7 @@ export async function verifyServiceEvent(eventName, payload, context) {
     if (typeof context.targetAid !== 'string' || !AID_RE.test(context.targetAid))
         throw invalid('service event target is invalid');
     const now = context.now ?? Math.trunc(Date.now() / 1000);
-    if (!isInt(now) || !isInt(payload.as_of) || !isInt(payload.expires_at) || payload.as_of <= 0 || payload.expires_at <= payload.as_of || payload.expires_at > payload.as_of + 300 || payload.as_of > now + 300 || now >= payload.expires_at)
+    if (!isInt(now) || !isInt(payload.as_of) || !isInt(payload.expires_at) || payload.as_of <= 0 || payload.expires_at <= payload.as_of || payload.expires_at > payload.as_of + 300 || payload.as_of > now + 300 || now > payload.expires_at + 300)
         throw invalid('service event time window is invalid');
     if (!Array.isArray(payload.target_aids) || !payload.target_aids.length || payload.target_aids.some((target) => typeof target !== 'string' || !AID_RE.test(target)))
         throw invalid('service event target is invalid');
@@ -970,7 +970,7 @@ export async function verifyServiceEvent(eventName, payload, context) {
     catch {
         throw new ProtocolError('CREDENTIAL_SIGNATURE_INVALID', 'service event signature is invalid');
     }
-    if ((context.now ?? Math.trunc(Date.now() / 1000)) >= payload.expires_at)
+    if ((context.now ?? Math.trunc(Date.now() / 1000)) > payload.expires_at + 300)
         throw invalid('service event time window is invalid');
     return { signature_valid: true, credential_known: known };
 }
@@ -1232,7 +1232,7 @@ function validConstraintRegex(value) {
     }
     return !inside;
 }
-function validateCapability(capability) {
+export function validateCapability(capability) {
     const constraints = capability.constraints;
     if (!Array.isArray(constraints) || constraints.length > 64)
         throw invalid('capability constraints are invalid');
@@ -1547,7 +1547,7 @@ export function createRepresentationProof(credential, params, binding, signer, p
     return proof;
 }
 export function signTransferAcceptance(proposal, signer) {
-    if (!isRecord(proposal) || proposal.ver !== 'aun-org-transfer/1' || proposal.target_member_aid !== signer.aid || !isInt(proposal.exp) || proposal.exp <= Math.trunc(Date.now() / 1000))
+    if (!isRecord(proposal) || proposal.ver !== 'aun-org-transfer/1' || proposal.target_member_aid !== signer.aid || !isInt(proposal.exp) || Math.trunc(Date.now() / 1000) > proposal.exp + 300)
         throw invalid('transfer proposal does not match the accepting identity');
     const payload = { ...proposal };
     delete payload.signature;
@@ -1739,9 +1739,9 @@ export function prepareOrganizationRequest(method, params, target, signer, optio
             throw representationBindingInvalid('invitation rejection requires a distinct action identity');
         value.credentials = credentials;
         const now = Math.trunc(Date.now() / 1000);
-        if (now >= Number(binding.exp))
+        if (now > Number(binding.exp) + 300)
             throw representationBindingInvalid('membership binding has expired');
-        let exp = Math.min(now + 300, Number(binding.exp));
+        let exp = Number(binding.exp);
         for (const field of ['credential_template', 'registration_authorization'])
             if (field in value) {
                 const material = value[field];
@@ -1749,8 +1749,8 @@ export function prepareOrganizationRequest(method, params, target, signer, optio
                     throw invalid('admission material expiry is invalid');
                 exp = Math.min(exp, material.exp);
             }
-        const request = Object.hasOwn(value, 'request_binding') ? value.request_binding : { ver: 'aun-membership-admission-request/1', request_id: value.request_id, nonce: value.nonce, target, method, params_hash: digest(orgRequestBindingParams(method, value)), membership_id: binding.membership_id, iat: now, exp };
-        if (!isRecord(request) || Object.keys(request).length !== 9 || Object.keys(request).some((key) => !['ver', 'request_id', 'nonce', 'target', 'method', 'params_hash', 'membership_id', 'iat', 'exp'].includes(key)) || request.ver !== 'aun-membership-admission-request/1' || request.request_id !== value.request_id || request.nonce !== value.nonce || request.target !== target || request.method !== method || request.membership_id !== binding.membership_id || request.params_hash !== digest(orgRequestBindingParams(method, value)) || !isInt(request.iat) || !isInt(request.exp) || request.iat < 0 || request.iat > now || request.iat < Number(binding.iat) || request.exp <= now || request.exp > request.iat + 300 || request.exp > exp)
+        const request = Object.hasOwn(value, 'request_binding') ? value.request_binding : { ver: 'aun-membership-admission-request/1', request_id: value.request_id, nonce: value.nonce, target, method, params_hash: digest(orgRequestBindingParams(method, value)), membership_id: binding.membership_id, iat: now, exp: Math.min(now + 300, exp) };
+        if (!isRecord(request) || Object.keys(request).length !== 9 || Object.keys(request).some((key) => !['ver', 'request_id', 'nonce', 'target', 'method', 'params_hash', 'membership_id', 'iat', 'exp'].includes(key)) || request.ver !== 'aun-membership-admission-request/1' || request.request_id !== value.request_id || request.nonce !== value.nonce || request.target !== target || request.method !== method || request.membership_id !== binding.membership_id || request.params_hash !== digest(orgRequestBindingParams(method, value)) || !isInt(request.iat) || !isInt(request.exp) || request.iat < 0 || request.iat > now + 300 || request.iat < Number(binding.iat) || request.exp <= request.iat || now > request.exp + 300 || request.exp > request.iat + 300 || request.exp > exp)
             throw representationBindingInvalid('admission request binding does not match request');
         value.request_binding = request;
         if (value.for === undefined || value.for === signer.aid)
@@ -1847,7 +1847,7 @@ export function verifyCredential(credential, context) {
         if (isRecord(proof))
             statusProofs.push(proof);
         if (proof != null || document !== value) {
-            if (!isRecord(proof) || proof.ver !== 'aun-credential-status/1' || typeof proof.credentialCid !== 'string' || !proof.credentialCid || typeof proof.credential_hash !== 'string' || !DIGEST_RE.test(proof.credential_hash) || !isInt(proof.asOf) || !isInt(proof.proofExpiresAt) || proof.asOf > now + 300 || proof.proofExpiresAt <= proof.asOf || proof.proofExpiresAt > proof.asOf + 300 || now >= proof.proofExpiresAt)
+            if (!isRecord(proof) || proof.ver !== 'aun-credential-status/1' || typeof proof.credentialCid !== 'string' || !proof.credentialCid || typeof proof.credential_hash !== 'string' || !DIGEST_RE.test(proof.credential_hash) || !isInt(proof.asOf) || !isInt(proof.proofExpiresAt) || proof.asOf > now + 300 || proof.proofExpiresAt <= proof.asOf || proof.proofExpiresAt > proof.asOf + 300 || now > proof.proofExpiresAt + 300)
                 throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'trusted credential status proof is invalid');
             if (typeof proof.responder !== 'string' || !AID_RE.test(proof.responder) || !proof.responder.startsWith('credential.') || typeof proof.request_id !== 'string' || !proof.request_id || typeof proof.nonce !== 'string' || !proof.nonce || typeof proof.target !== 'string' || !AID_RE.test(proof.target) || !isRecord(proof.signature) || proof.signature.timestamp !== proof.asOf)
                 throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'trusted credential status proof is incomplete');
@@ -1934,17 +1934,17 @@ export function verifyCredential(credential, context) {
         validateCredentialCapability(credential, { ns: context.ns, action: context.action, resource: context.resource, params: context.params, units: context.units, now: completedAt, client_ip: context.clientIp, proof_chain: context.proofChain }, () => true);
         validateRequestBinding(context.requestBinding, context.method, context.target, context.params ?? {}, String(value.cid), context.nonce ?? '', context.requestId ?? '', completedAt);
         for (const proof of statusProofs) {
-            if (proof.asOf > completedAt + 300 || completedAt >= proof.proofExpiresAt)
+            if (proof.asOf > completedAt + 300 || completedAt > proof.proofExpiresAt + 300)
                 throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'trusted credential status proof is invalid');
         }
         for (const material of resolvedCertificates) {
             const certificate = new X509Certificate(certificatePem(material));
-            if (completedAt < new Date(certificate.validFrom).getTime() / 1000 || completedAt > new Date(certificate.validTo).getTime() / 1000)
+            if (completedAt < new Date(certificate.validFrom).getTime() / 1000 - 300 || completedAt > new Date(certificate.validTo).getTime() / 1000 + 300)
                 throw new ProtocolError('CREDENTIAL_SIGNATURE_INVALID', 'certificate is not valid');
         }
         if (verifiedRepresentation) {
             const { proof, request } = verifiedRepresentation;
-            if (completedAt < proof.iat || completedAt >= proof.exp)
+            if (completedAt < proof.iat - 300 || completedAt > proof.exp + 300)
                 throw representationBindingInvalid('representation time window is invalid');
             validateRepresentationContext(proof, value, request, completedAt);
         }
@@ -1958,7 +1958,7 @@ export function validateCredentialAt(credential, now, audience, proofChain) {
     const value = credential;
     const nbf = value.nbf;
     const exp = value.exp;
-    if (!isInt(nbf) || !isInt(exp) || now < nbf || now >= exp)
+    if (!isInt(nbf) || !isInt(exp) || now < nbf - 300 || now > exp + 300)
         throw new ProtocolError('CREDENTIAL_EXPIRED', 'credential is outside its validity window');
     if (audience !== undefined) {
         if (!Array.isArray(value.aud) || !value.aud.includes(audience))
@@ -2146,7 +2146,10 @@ function capabilitiesNarrower(child, parent, subject, depth) {
 function verifyAgentSignature(signatureValue, payload, expectedAid, resolveCertificate, now, enforceWindow = true) {
     const certPem = certificatePem(resolveCertificate(String(signatureValue.cert_fingerprint)));
     const lower = payload.iat ?? payload.registered_at;
-    if (enforceWindow && typeof lower === 'number' && (Number(signatureValue.timestamp) < lower || Number(signatureValue.timestamp) >= Number(payload.exp)))
+    const outsideWindow = typeof lower === 'number' && (payload.ver === 'aun-org-transfer/1'
+        ? Number(signatureValue.timestamp) < lower - 300 || Number(signatureValue.timestamp) > Number(payload.exp) + 300
+        : Number(signatureValue.timestamp) < lower || Number(signatureValue.timestamp) >= Number(payload.exp));
+    if (enforceWindow && outsideWindow)
         throw new Error('signature timestamp is outside the signed object window');
     if (!certPem)
         throw new Error('certificate is missing');
@@ -2285,7 +2288,7 @@ export function validateMembershipBindingAt(binding, now, expectedRole) {
     const value = binding;
     const iat = value.iat;
     const exp = value.exp;
-    if (!isInt(now) || !isInt(iat) || !isInt(exp) || now < iat || now >= exp)
+    if (!isInt(now) || !isInt(iat) || !isInt(exp) || now < iat - 300 || now > exp + 300)
         throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'membership binding is outside its validity window');
     if (expectedRole !== undefined && value.role !== expectedRole)
         throw invalid('membership role is invalid');
@@ -2341,7 +2344,7 @@ export function validateRegistrationReceipt(receipt, credential, request, expect
         throw new ProtocolError('CREDENTIAL_REGISTRATION_RECEIPT_MISMATCH', 'receipt registrar does not match request');
     if (expectedServiceAid !== undefined && receipt.service_aid !== expectedServiceAid)
         throw new ProtocolError('CREDENTIAL_REGISTRATION_RECEIPT_INVALID', 'receipt service AID mismatch');
-    if (now !== undefined && (!isInt(now) || now < receipt.registered_at || now >= receipt.exp))
+    if (now !== undefined && (!isInt(now) || now < receipt.registered_at - 300 || now > receipt.exp + 300))
         throw new ProtocolError('CREDENTIAL_REGISTRATION_RECEIPT_INVALID', 'receipt is outside its validity window');
     signature(receipt.signature);
 }
@@ -2410,7 +2413,7 @@ export function validateRequestBinding(binding, method, target, params, credenti
         throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'request binding is invalid');
     if (binding.request_id !== requestId || binding.nonce !== nonce || binding.target !== target || binding.method !== method || binding.credential_cid !== credentialCid || binding.params_hash !== digest(orgRequestBindingParams(method, params)))
         throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'request binding does not match request');
-    if (!isInt(binding.iat) || !isInt(binding.exp) || binding.exp <= binding.iat || binding.exp > binding.iat + 300 || !isInt(now) || now < binding.iat || now >= binding.exp)
+    if (!isInt(binding.iat) || !isInt(binding.exp) || binding.exp <= binding.iat || binding.exp > binding.iat + 300 || !isInt(now) || now < binding.iat - 300 || now > binding.exp + 300)
         throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'request binding is outside its validity window');
 }
 function representationBindingInvalid(message) {
@@ -2467,7 +2470,7 @@ export function verifyRepresentationProof(proof, credential, request, resolveCer
             throw representationBindingInvalid('representation proof AID is invalid');
     if (!DIGEST_RE.test(proof.params_hash))
         throw representationBindingInvalid('representation params_hash is invalid');
-    if (!isInt(proof.iat) || !isInt(proof.exp) || proof.exp <= proof.iat || !isInt(now) || now < proof.iat || now >= proof.exp)
+    if (!isInt(proof.iat) || !isInt(proof.exp) || proof.exp <= proof.iat || !isInt(now) || now < proof.iat - 300 || now > proof.exp + 300)
         throw representationBindingInvalid('representation time window is invalid');
     validateRepresentationSignature(proof.signature);
     if (!isRecord(credential))
@@ -2490,7 +2493,7 @@ export function verifyRepresentationProof(proof, credential, request, resolveCer
         const timestamp = proof.signature.timestamp;
         if (timestamp > now + 300 || timestamp < proof.iat || timestamp >= proof.exp)
             throw new Error('representation signature timestamp is outside its window');
-        if (timestamp < Math.floor(new Date(cert.validFrom).getTime() / 1000) || timestamp > Math.floor(new Date(cert.validTo).getTime() / 1000) || now < Math.floor(new Date(cert.validFrom).getTime() / 1000) || now > Math.floor(new Date(cert.validTo).getTime() / 1000))
+        if (timestamp < Math.floor(new Date(cert.validFrom).getTime() / 1000) || timestamp > Math.floor(new Date(cert.validTo).getTime() / 1000) || now < Math.floor(new Date(cert.validFrom).getTime() / 1000) - 300 || now > Math.floor(new Date(cert.validTo).getTime() / 1000) + 300)
             throw new Error('certificate is not valid at signature or verification time');
         const payload = { ...proof };
         delete payload.signature;