Changelog

Privacy-unlinking: epoch-key credential rotation + public BBS+ issuer endpoint

Verified credentials now rotate signing epochs, so repeated presentations of the same credential can't be correlated by a colluding set of verifiers. The BBS+ issuer endpoint is public — any relying party can validate proofs without routing through Solidus.

• Epoch-key rotation with reissuance batch + revoke-now path
• Credential envelope v2 carries epoch metadata through OID4VCI holder delivery
• Revocation via epoch-key expiry — no separate status-list round-trip

Embeddable capture SDK live at capture.solidus.network

The document + liveness capture flow that used to live only inside hosted /s/ session pages now ships as a standalone SDK relying parties can embed directly in their own product.

• Same OCR/MRZ/liveness pipeline as the hosted flow, packaged for embedding
• Deployed and reachable at capture.solidus.network

Webhook delivery pinned against DNS-rebinding SSRF

Webhook test-fire and delivery now re-resolve and pin the destination IP at request time, closing a DNS-rebinding path that could point a webhook at an internal address after the initial SSRF check passed.

• SSRF pin consolidated into a shared package — was duplicated across 4 call sites
• Applies to both webhook Test and live delivery

GPU-aware verification with hardened MRZ fallback

The public demo and live verification flow now read a capability signal and degrade gracefully when GPU inference capacity isn't available, instead of failing outright.

• Capability signal drives document-only degradation under no-GPU conditions
• No-GPU MRZ fallback hardened for glare and uneven captures
• Public demo now runs against the real /live pipeline, not a mock

Native OCR/MRZ pipeline overhaul + face-match on completion

The document and liveness pipeline runs entirely on Solidus's own inference stack — no third-party KYC vendor in the loop. Reworked this cycle to actually hold up against real phone captures, not just clean test images.

• GPU OCR (EasyOCR) primary for MRZ reading, tesseract fallback
• CLAHE preprocessing for low-contrast MRZ bands; full-resolution band read
• Guided document capture with real-time quality gates (lighting, glare, framing)
• Face-match result now surfaced on the /s/ completion screen

NFC passport/eID chip-read step (flag-gated rollout)

Passport and eID NFC chip reading landed as an optional step in the hosted flow, with the passive-authentication verdict checked against a CSCA trust store. Rolling out behind a feature flag — off by default while it stabilizes.

• QR hand-off to a native app / PWA for the chip read — browsers can't read NFC directly
• Server-polled status; never self-completes without a server verdict
• Passive-auth verdict surfaced on the verification detail page

Live video-verifier call path (TR compliance)

An optional live video-call step is now available in the hosted flow for jurisdictions that require an operator-attended verification. Availability-gated to when an operator is staffed.

• Server-minted RTC tokens; operator console + applicant call-step UI
• Call is recorded into the MASAK-required audit trail

MASAK-compliant session recording, resumable chunked upload

Verification sessions can now record an uninterrupted audit stream of the KYC session, uploaded to R2 in resumable chunks so a dropped connection doesn't lose the recording — built to meet MASAK's audit-trail requirement.

• Fail-open: a recording glitch doesn't block the applicant's verification
• Chunks resume from the last confirmed offset, not from scratch

Anti-AI liveness: randomized multi-action + voice challenge

Liveness now steps the user through a randomized sequence of actions, scored server-side per action — built to resist a pre-recorded or AI-generated replay, not just a single static check.

• CSPRNG-shuffled action sequence, not a fixed script
• Per-action scoring is server-authoritative

OID4VCI pre-authorized code issuance flow

Credentials can now be issued to a wallet via the OpenID for Verifiable Credential Issuance pre-authorized code flow — the standard flow wallets expect, instead of a Solidus-specific issuance API.

BBS+ selective disclosure, live end-to-end on testnet

BBS+ signatures shipped end-to-end on testnet — a holder can present a subset of a credential's attributes and prove they're signed, without revealing the attributes they didn't choose to share.

SD-JWT VC issuance + W3C VC Data Model 2.0 migration

Verifiable credentials moved to the W3C VC Data Model 2.0 shape (validFrom/validUntil replacing issuanceDate/expirationDate) and gained SD-JWT VC as an issuance format with key-binding JWT presentation. Published as @solidus-network/* 0.2.0 — breaking for anything reading the old VC 1.1 field names.

• SD-JWT VC issuance + verification
• KB-JWT holder-key-bound presentation
• validFrom/validUntil replace issuanceDate/expirationDate