@orangecheck/sdk 1.16.0 → 1.16.1

package/dist/index.mjs

@@ -213,6 +213,7 @@ function logVerificationError(protocol, identifier, error, context) {
 }
 
 // src/utils/time.ts
+var ISSUED_AHEAD_MS = 12e4;
 var RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
 function rfc3339Ms(value) {
   if (!value || !RFC3339.test(value)) return null;
@@ -451,6 +452,15 @@ async function verify(input, opts = {}) {
         return { ok: false, codes, network, attestation_id };
       }
     }
+    const issued = rfc3339Ms(parsed.core.issued_at);
+    if (issued === null) {
+      codes.push("decode_error");
+      return { ok: false, codes, network, attestation_id };
+    }
+    if (issued > Date.now() + ISSUED_AHEAD_MS) {
+      codes.push("not_yet_valid");
+      return { ok: false, codes, network, attestation_id };
+    }
     if (parsed.expires !== void 0) {
       const exp = rfc3339Ms(parsed.expires);
       if (exp === null || exp < Date.now()) {
@@ -1179,7 +1189,6 @@ function extractAttestationIdFromUrl(url) {
 }
 
 // src/check.ts
-var ISSUED_AHEAD_MS = 12e4;
 var MAX_CANDIDATES = 20;
 async function check(params) {
   const {
@@ -2359,6 +2368,11 @@ var STATUS_META = {
     detail: "This signature has passed its expiration date. Generate a new signature with a fresh message.",
     severity: "error"
   },
+  not_yet_valid: {
+    label: "Not valid yet",
+    detail: "The message is dated ahead of this clock. It counts once that time arrives, or once a clock that is wrong is set right.",
+    severity: "error"
+  },
   network_testmode: {
     label: "Test network detected",
     detail: "This signature uses testnet or signet. Test networks are for development only and cannot be verified in production mode.",