@pagopa/io-react-native-wallet 2.2.0 → 2.4.0

package/lib/typescript/credentials-catalogue/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/credentials-catalogue/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAmDzB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqB5B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAatC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,2BAA2B,CACnC,CAAC"}

package/lib/typescript/index.d.ts

@@ -2,6 +2,7 @@ import type { AuthorizationContext } from "./utils/auth";
 import { fixBase64EncodingOnKey } from "./utils/jwk";
 import "react-native-url-polyfill/auto";
 import * as Credential from "./credential";
+import * as CredentialsCatalogue from "./credentials-catalogue";
 import * as PID from "./pid";
 import * as SdJwt from "./sd-jwt";
 import * as Mdoc from "./mdoc";
@@ -13,6 +14,6 @@ import * as Logging from "./utils/logging";
 import { AuthorizationDetail, AuthorizationDetails } from "./utils/par";
 import { createCryptoContextFor } from "./utils/crypto";
 import type { IntegrityContext } from "./utils/integrity";
-export { SdJwt, Mdoc, PID, Credential, WalletInstanceAttestation, WalletInstance, Errors, Trust, createCryptoContextFor, AuthorizationDetail, AuthorizationDetails, fixBase64EncodingOnKey, Logging, };
+export { SdJwt, Mdoc, PID, Credential, CredentialsCatalogue, WalletInstanceAttestation, WalletInstance, Errors, Trust, createCryptoContextFor, AuthorizationDetail, AuthorizationDetails, fixBase64EncodingOnKey, Logging, };
 export type { IntegrityContext, AuthorizationContext };
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,gCAAgC,CAAC;AAExC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,OAAO,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,UAAU,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,yBAAyB,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,cAAc,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,EACL,KAAK,EACL,IAAI,EACJ,GAAG,EACH,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,MAAM,EACN,KAAK,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,OAAO,GACR,CAAC;AAEF,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,gCAAgC,CAAC;AAExC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,oBAAoB,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,GAAG,MAAM,OAAO,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,UAAU,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,yBAAyB,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,cAAc,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,EACL,KAAK,EACL,IAAI,EACJ,GAAG,EACH,UAAU,EACV,oBAAoB,EACpB,yBAAyB,EACzB,cAAc,EACd,MAAM,EACN,KAAK,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,OAAO,GACR,CAAC;AAEF,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC"}

package/lib/typescript/utils/auth.d.ts

@@ -49,4 +49,15 @@ export declare const AuthorizationErrorShape: z.ZodObject<{
  * Type of the identification result.
  */
 export type AuthorizationResult = z.infer<typeof AuthorizationResultShape>;
+/**
+ * MRTD PoP Challenge Info response structure
+ */
+export declare const AuthorizationChallengeResultShape: z.ZodObject<{
+    challenge_info: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    challenge_info: string;
+}, {
+    challenge_info: string;
+}>;
+export type AuthorizationChallengeResult = z.infer<typeof AuthorizationChallengeResultShape>;
 //# sourceMappingURL=auth.d.ts.map

package/lib/typescript/utils/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrE;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAInC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrE;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAInC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE3E;;GAEG;AAEH,eAAO,MAAM,iCAAiC;;;;;;EAE5C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,iCAAiC,CACzC,CAAC"}

package/lib/typescript/utils/par.d.ts

@@ -1,7 +1,7 @@
 import { type CryptoContext } from "@pagopa/io-react-native-jwt";
 import * as z from "zod";
 export type AuthorizationDetail = z.infer<typeof AuthorizationDetail>;
-export declare const AuthorizationDetail: z.ZodObject<{
+export declare const AuthorizationDetail: z.ZodUnion<[z.ZodObject<{
     type: z.ZodLiteral<"openid_credential">;
     credential_configuration_id: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -10,9 +10,24 @@ export declare const AuthorizationDetail: z.ZodObject<{
 }, {
     type: "openid_credential";
     credential_configuration_id: string;
-}>;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"it_l2+document_proof">;
+    idphinting: z.ZodString;
+    challenge_method: z.ZodLiteral<"mrtd+ias">;
+    challenge_redirect_uri: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "it_l2+document_proof";
+    idphinting: string;
+    challenge_method: "mrtd+ias";
+    challenge_redirect_uri: string;
+}, {
+    type: "it_l2+document_proof";
+    idphinting: string;
+    challenge_method: "mrtd+ias";
+    challenge_redirect_uri: string;
+}>]>;
 export type AuthorizationDetails = z.infer<typeof AuthorizationDetails>;
-export declare const AuthorizationDetails: z.ZodArray<z.ZodObject<{
+export declare const AuthorizationDetails: z.ZodArray<z.ZodUnion<[z.ZodObject<{
     type: z.ZodLiteral<"openid_credential">;
     credential_configuration_id: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -21,7 +36,22 @@ export declare const AuthorizationDetails: z.ZodArray<z.ZodObject<{
 }, {
     type: "openid_credential";
     credential_configuration_id: string;
-}>, "many">;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"it_l2+document_proof">;
+    idphinting: z.ZodString;
+    challenge_method: z.ZodLiteral<"mrtd+ias">;
+    challenge_redirect_uri: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "it_l2+document_proof";
+    idphinting: string;
+    challenge_method: "mrtd+ias";
+    challenge_redirect_uri: string;
+}, {
+    type: "it_l2+document_proof";
+    idphinting: string;
+    challenge_method: "mrtd+ias";
+    challenge_redirect_uri: string;
+}>]>, "many">;
 export type ParResponse = z.infer<typeof ParResponse>;
 export declare const ParResponse: z.ZodObject<{
     request_uri: z.ZodString;

package/lib/typescript/utils/par.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../src/utils/par.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAOzB,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACxE,eAAO,MAAM,oBAAoB;;;;;;;;;WAA+B,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,eAAO,MAAM,WAAW;;;;;;;;;EAGtB,CAAC;AAEH,KAAK,kBAAkB,GACnB;IAAE,oBAAoB,EAAE,oBAAoB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,kBAAkB,CAAC;AAEvB;;GAEG;AACH,eAAO,MAAM,cAAc;sBAKL,aAAa;cACrB,WAAW,CAAC,OAAO,CAAC;oBAGjB,MAAM,6BACQ,MAAM,4FAS9B,iBAAiB,KACnB,QAAQ,MAAM,CA0EhB,CAAC"}
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../src/utils/par.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAOzB,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;IAW9B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACxE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;aAA+B,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,eAAO,MAAM,WAAW;;;;;;;;;EAGtB,CAAC;AAEH,KAAK,kBAAkB,GACnB;IAAE,oBAAoB,EAAE,oBAAoB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,kBAAkB,CAAC;AAEvB;;GAEG;AACH,eAAO,MAAM,cAAc;sBAKL,aAAa;cACrB,WAAW,CAAC,OAAO,CAAC;oBAGjB,MAAM,6BACQ,MAAM,4FAS9B,iBAAiB,KACnB,QAAQ,MAAM,CA0EhB,CAAC"}

package/lib/typescript/utils/zod.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @see https://github.com/JacobWeisenburger/zod_utilz/blob/main/src/stringToJSON.ts
+ */
+import { z } from "zod";
+declare const literalSchema: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+type Literal = z.infer<typeof literalSchema>;
+type Json = Literal | {
+    [key: string]: Json;
+} | Json[];
+export declare const json: () => z.ZodType<Json, z.ZodTypeDef, Json>;
+export declare const stringToJSONSchema: z.ZodEffects<z.ZodString, string | number | boolean | {
+    [key: string]: Json;
+} | Json[] | null, string>;
+export {};
+//# sourceMappingURL=zod.d.ts.map

package/lib/typescript/utils/zod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod.d.ts","sourceRoot":"","sources":["../../../src/utils/zod.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,aAAa,iEAA2D,CAAC;AAE/E,KAAK,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE7C,KAAK,IAAI,GAAG,OAAO,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,EAAE,CAAC;AAMvD,eAAO,MAAM,IAAI,2CAAmB,CAAC;AAErC,eAAO,MAAM,kBAAkB;;0BAS3B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/io-react-native-wallet",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Provide data structures, helpers and API for IO Wallet",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -64,6 +64,7 @@
     "@types/react": "^19.0.0",
     "@types/react-native": "0.70.0",
     "@types/url-parse": "^1.4.11",
+    "auto-changelog": "^2.5.0",
     "del-cli": "^5.0.0",
     "eslint": "^8.4.1",
     "eslint-plugin-prettier": "^5.2.3",
@@ -73,12 +74,13 @@
     "react": "19.0.0",
     "react-native": "0.78.3",
     "react-native-builder-bob": "^0.20.0",
+    "release-it": "^15.0.0",
     "typed-openapi": "^0.4.1",
     "typescript": "5.0.4"
   },
   "peerDependencies": {
-    "@pagopa/io-react-native-iso18013": "*",
     "@pagopa/io-react-native-crypto": "*",
+    "@pagopa/io-react-native-iso18013": "*",
     "@pagopa/io-react-native-jwt": "*",
     "react": "*",
     "react-native": "*"
@@ -87,6 +89,23 @@
     "node": ">= 16.0.0"
   },
   "packageManager": "yarn@1.22.19",
+  "release-it": {
+    "git": {
+      "commitMessage": "chore: release version ${version}",
+      "tagName": "v${version}",
+      "changelog": "yarn auto-changelog --stdout --commit-limit false -u --template https://raw.githubusercontent.com/release-it/release-it/master/templates/changelog-compact.hbs"
+    },
+    "hooks": {
+      "after:bump": "yarn auto-changelog -p && git add ."
+    },
+    "npm": {
+      "publish": false
+    },
+    "github": {
+      "release": true
+    },
+    "plugins": {}
+  },
   "jest": {
     "preset": "react-native",
     "modulePathIgnorePatterns": [

package/src/credential/index.ts

@@ -2,5 +2,6 @@ import * as Issuance from "./issuance";
 import * as Presentation from "./presentation";
 import * as Status from "./status";
 import * as Trustmark from "./trustmark";
+import * as Offer from "./offer";
 
-export { Issuance, Presentation, Status, Trustmark };
+export { Issuance, Presentation, Status, Trustmark, Offer };

package/src/credential/issuance/01-start-flow.ts

@@ -1,7 +1,7 @@
 /**
  * WARNING: This is the first function to be called in the issuing flow. The next function to be called is {@link evaluateIssuerTrust}.
  * The beginning of the issuing flow.
- * To be implemented accordind to the user touchpoint
+ * To be implemented according to the user touchpoint
  *
  * @returns The configuration ID of the Credential to be issued and the url of the Issuer
  */

package/src/credential/issuance/03-start-user-authorization.ts

@@ -9,6 +9,7 @@ import { LogLevel, Logger } from "../../utils/logging";
 export type StartUserAuthorization = (
   issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
   credentialIds: string[],
+  proof: { proofType: "none" } | { proofType: "mrtd-pop"; idpHinting: string },
   context: {
     wiaCryptoContext: CryptoContext;
     walletInstanceAttestation: string;
@@ -114,21 +115,26 @@ const selectResponseMode = (
  * it is possible to use the same access token for the issuance of all requested credentials.
  * This is an HTTP POST request containing the Wallet Instance identifier (client id), the code challenge and challenge method as specified by PKCE according to RFC 9126
  * along with the WTE and its proof of possession (WTE-PoP).
- * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details),
- * the application session identifier on the Wallet Instance side (state),
+ * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details), challenge method and
+ * redirect URI for the document proof step (if L2 flow), the application session identifier on the Wallet Instance side (state),
  * the method (query or form_post.jwt) by which the Authorization Server
  * should transmit the Authorization Response containing the authorization code issued upon the end user's authentication (response_mode)
  * to the Wallet Instance's Token Endpoint to obtain the Access Token, and the redirectUri of the Wallet Instance where the Authorization Response
  * should be delivered. The redirect is achived by using a custom URL scheme that the Wallet Instance is registered to handle.
  * @param issuerConf The issuer configuration
  * @param credentialIds The credential configuration IDs to be requested
- * @param ctx The context object containing the Wallet Instance's cryptographic context, the Wallet Instance's attestation, the redirect URI and the fetch implementation
+ * @param proof The configuration for the proof to be used in the request: "none" for standard flows, "document" for L2+ with MRTD verification.
+ * @param ctx The context object containing;
+ *  - wiaCryptoContext: the Wallet Instance's cryptographic context
+ *  - walletInstanceAttestation: the Wallet Instance's attestation
+ *  - redirectUri: the redirect URI
+ *  - appFetch: (optional) the fetch implementation
  * @returns The URI to which the end user should be redirected to start the authentication flow, along with the client id, the code verifier and the credential definition(s)
  */
-
 export const startUserAuthorization: StartUserAuthorization = async (
   issuerConf,
   credentialIds,
+  proof,
   ctx
 ) => {
   const {
@@ -151,11 +157,28 @@ export const startUserAuthorization: StartUserAuthorization = async (
   const parEndpoint =
     issuerConf.oauth_authorization_server.pushed_authorization_request_endpoint;
   const aud = issuerConf.openid_credential_issuer.credential_issuer;
-  const credentialDefinition = credentialIds.map((c) =>
-    selectCredentialDefinition(issuerConf, c)
-  );
   const responseMode = selectResponseMode(issuerConf, credentialIds);
   const getPar = makeParRequest({ wiaCryptoContext, appFetch });
+
+  const credentialDefinition = [
+    ...credentialIds.map((c) => selectCredentialDefinition(issuerConf, c)),
+  ];
+
+  if (proof.proofType === "mrtd-pop") {
+    /**
+     * When we requests a PID using eID Substantial Authentication with MRTD Verification, we must include
+     * an additional Authorization Details Object in the authorization_details
+     *
+     * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
+     */
+    credentialDefinition.push({
+      type: "it_l2+document_proof",
+      idphinting: proof.idpHinting,
+      challenge_method: "mrtd+ias",
+      challenge_redirect_uri: redirectUri,
+    });
+  }
+
   const issuerRequestUri = await getPar(
     parEndpoint,
     walletInstanceAttestation,

package/src/credential/issuance/04-complete-user-authorization.ts

@@ -1,6 +1,8 @@
 import {
+  AuthorizationChallengeResultShape,
   AuthorizationErrorShape,
   AuthorizationResultShape,
+  type AuthorizationChallengeResult,
   type AuthorizationResult,
 } from "../../utils/auth";
 import { hasStatusOrThrow, type Out } from "../../utils/misc";
@@ -28,6 +30,10 @@ export type CompleteUserAuthorizationWithQueryMode = (
   authRedirectUrl: string
 ) => Promise<AuthorizationResult>;
 
+export type ContinueUserAuthorizationWithMRTDPoPChallenge = (
+  authRedirectUrl: string
+) => Promise<AuthorizationChallengeResult>;
+
 export type CompleteUserAuthorizationWithFormPostJwtMode = (
   requestObject: Out<GetRequestedCredentialToBePresented>,
   pid: string,
@@ -54,6 +60,42 @@ export type BuildAuthorizationUrl = (
   authUrl: string;
 }>;
 
+/**
+ * WARNING: this function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID, and the PID
+ * issuance requires a MRTD PoP challenge.
+ * @param authRedirectUrl The URL to which the end user should be redirected to start the MRTD PoP validation flow
+ * @returns the authorization response which contains the challenge
+ */
+export const continueUserAuthorizationWithMRTDPoPChallenge: ContinueUserAuthorizationWithMRTDPoPChallenge =
+  async (authRedirectUrl) => {
+    Logger.log(
+      LogLevel.DEBUG,
+      `The requested credential is a PersonIdentificationData and requires MRTD PoP, starting MRTD PoP validation from auth redirect`
+    );
+    const query = parseUrl(authRedirectUrl).query;
+
+    const authResParsed = AuthorizationChallengeResultShape.safeParse(query);
+    if (!authResParsed.success) {
+      const authErr = AuthorizationErrorShape.safeParse(query);
+      if (!authErr.success) {
+        Logger.log(
+          LogLevel.ERROR,
+          `Error while parsing the authorization response: ${authResParsed.error.message}`
+        );
+        throw new AuthorizationError(authResParsed.error.message); // an error occured while parsing the result and the error
+      }
+      Logger.log(
+        LogLevel.ERROR,
+        `Error while authorizating with the idp: ${JSON.stringify(authErr)}`
+      );
+      throw new AuthorizationIdpError(
+        authErr.data.error,
+        authErr.data.error_description
+      );
+    }
+    return authResParsed.data;
+  };
+
 /**
  * WARNING: This function must be called after {@link startUserAuthorization}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
  * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
@@ -97,7 +139,7 @@ export const completeUserAuthorizationWithQueryMode: CompleteUserAuthorizationWi
   async (authRedirectUrl) => {
     Logger.log(
       LogLevel.DEBUG,
-      `The requeste credential is a PersonIdentificationData, completing the user authorization with query mode`
+      `The requested credential is a PersonIdentificationData, completing the user authorization with query mode`
     );
     const query = parseUrl(authRedirectUrl).query;
 

package/src/credential/issuance/README.md

@@ -23,30 +23,45 @@ graph TD;
     6[obtainCredential]
     7[verifyAndParseCredential]
     credSel{Is credential an eID?}
+    proofSel{Requires MRTD PoP?}
+    M1[continueUserAuthorizationWithMRTDPoPChallenge]
+    subgraph MRTD PoP flow
+    M2[verifyAndParseChallengeInfo]
+    M3[initChallenge]
+    M4[validateChallenge]
+    end
 
     0 --> 1
     1 --> 2
     2 --> 3
     3 --> credSel
-    credSel -->|Yes| E4
+    credSel -->|Yes| proofSel
     credSel -->|No| C4
+    proofSel --> |Yes| M1
+    proofSel --> |No| E4
     C4 --> C4.1
     C4.1 --> 5
     E4 --> 5
     5 --> 6
     6 --> 7
+
+    M1 --> M2
+    M2 --> M3
+    M3 --> M4
+    M4 --> E4
+
 ```
 
 ## Mapped results
 
 The following errors are mapped to a `IssuerResponseError` with specific codes.
 
-|HTTP Status|Error Code|Description|
-|-----------|----------|-----------|
-|`201 Created`|`ERR_CREDENTIAL_ISSUING_NOT_SYNCHRONOUS`| This response is returned by the credential issuer when the request has been queued because the credential cannot be issued synchronously. The consumer should try to obtain the credential at a later time. Although `201 Created` is not considered an error, it is mapped as an error in this context in order to handle the case where the credential issuance is not synchronous. This allows keeping the flow consistent and handle the case where the credential is not immediately available.|
-|`403 Forbidden`|`ERR_CREDENTIAL_INVALID_STATUS`|This response is returned by the credential issuer when the requested credential has an invalid status. It might contain more details in the `reason` property.|
-|`404 Not Found`|`ERR_CREDENTIAL_INVALID_STATUS`| This response is returned by the credential issuer when the authenticated user is not entitled to receive the requested credential. It might contain more details in the `reason` property.|
-|`*`|`ERR_ISSUER_GENERIC_ERROR`|This is a generic error code to map unexpected errors that occurred when interacting with the Issuer.|
+| HTTP Status     | Error Code                               | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| --------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `201 Created`   | `ERR_CREDENTIAL_ISSUING_NOT_SYNCHRONOUS` | This response is returned by the credential issuer when the request has been queued because the credential cannot be issued synchronously. The consumer should try to obtain the credential at a later time. Although `201 Created` is not considered an error, it is mapped as an error in this context in order to handle the case where the credential issuance is not synchronous. This allows keeping the flow consistent and handle the case where the credential is not immediately available. |
+| `403 Forbidden` | `ERR_CREDENTIAL_INVALID_STATUS`          | This response is returned by the credential issuer when the requested credential has an invalid status. It might contain more details in the `reason` property.                                                                                                                                                                                                                                                                                                                                       |
+| `404 Not Found` | `ERR_CREDENTIAL_INVALID_STATUS`          | This response is returned by the credential issuer when the authenticated user is not entitled to receive the requested credential. It might contain more details in the `reason` property.                                                                                                                                                                                                                                                                                                           |
+| `*`             | `ERR_ISSUER_GENERIC_ERROR`               | This is a generic error code to map unexpected errors that occurred when interacting with the Issuer.                                                                                                                                                                                                                                                                                                                                                                                                 |
 
 ## Strong authentication for eID issuance (Query Mode)
 
@@ -60,6 +75,17 @@ CIE+PIN(L3) requires a different flow due to the physical card presence. Helper
 
 The expected result from the authentication process is in provided in the query string as defined in the [JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)](https://openid.net/specs/oauth-v2-jarm.html#name-response-mode-queryjwt).
 
+#### eID Substantial Authentication (L2+) with MRTD Verification
+
+MRTD Verification is a sub-flow of the Issuance flow and is used when the requested eID requires **eID Substantial Authentication (LoA3) with MRTD (Machine Readable Travel Document) Verification**. This method provides an alternative to CIEid LoA High authentication, requiring two distinct steps to complete the authorization:
+
+1. **Primary Authentication**: LoA3 electronic identification (SPID or CIEid L2).
+2. **MRTD Proof of Possession (PoP)**: Electronic document reading and cryptographic verification.
+
+This process is initiated by the Authorization Server responding to the primary authentication step with a redirect that includes a challenge in the query string, which is handled by the `continueUserAuthorizationWithMRTDPoPChallenge` function. Once the MRTD PoP is completed, the user must continue the PID issuance flow with the `completeUserAuthorizationWithQueryMode` function.
+
+Complete documentation for the MRTD PoP flow can be found here: [mrtd-pop](./mrtd-pop/README.md)
+
 ## Authentication through credentials (Form Post JWT Mode)
 
 When the credential is different than an eID, the flow requires the user to present other credentials in order to obtain the requested one. This is done through the `getRequestedCredentialToBePresented` followed by the `completeUserAuthorizationWithFormPostJwtMode`.
@@ -122,8 +148,9 @@ const { issuerConf } = await Credential.Issuance.evaluateIssuerTrust(issuerUrl);
 // Start user authorization
 const { issuerRequestUri, clientId, codeVerifier } =
   await Credential.Issuance.startUserAuthorization(
-    issuerConf, 
-    [credentialId], 
+    issuerConf,
+    [credentialId],
+    { proofType: "none" },
     {
       walletInstanceAttestation,
       redirectUri: REDIRECT_URI,
@@ -199,10 +226,10 @@ const { parsedCredential } =
     issuerConf,
     credential,
     credential_configuration_id,
-    { 
-      credentialCryptoContext, 
+    {
+      credentialCryptoContext,
       ignoreMissingAttributes: true,
-      includeUndefinedAttributes: false 
+      includeUndefinedAttributes: false
     },
     mockX509CertRoot
   );
@@ -285,6 +312,7 @@ const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
   await Credential.Issuance.startUserAuthorization(
     issuerConf,
     [credentialId], // Request authorization for one or more credentials
+    { proofType: "none" },
     {
       walletInstanceAttestation,
       redirectUri,
@@ -296,12 +324,7 @@ const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
 // Complete the authorization process with query mode with the authorizationContext which opens the browser
 const { code } =
   await Credential.Issuance.completeUserAuthorizationWithQueryMode(
-    issuerRequestUri,
-    clientId,
-    issuerConf,
-    idpHint,
-    redirectUri,
-    authorizationContext
+    issuerRequestUri
   );
 
 // Create DPoP context which will be used for the whole issuance flow
@@ -372,3 +395,117 @@ return {
 The result of this flow is a raw credential and a parsed credential which must be stored securely in the wallet along with its crypto key.
 
 </details>
+
+<details>
+  <summary>eID issuance flow with MRTD PoP validation</summary>
+
+```ts
+/**
+ *
+ * Previous steps are the sames as the "eID issuance flow" example
+ *
+ */
+
+// Start user authorization indicating "mrtd-pop" as the proof type with the idpHint of the
+// chosen identification method
+const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
+  await Credential.Issuance.startUserAuthorization(
+    issuerConf,
+    [credentialId],
+    { proofType: "mrtd-pop", idpHinting: idpHint },
+    {
+      walletInstanceAttestation,
+      redirectUri: redirectUri,
+      wiaCryptoContext,
+      appFetch,
+    }
+  );
+
+// Obtain the Authorization URL
+const { authUrl } = await Credential.Issuance.buildAuthorizationUrl(
+  issuerRequestUri,
+  clientId,
+  issuerConf,
+  idpHint
+);
+
+// Extract challenge info from the Authorization URL
+const { challenge_info } =
+  await Credential.Issuance.continueUserAuthorizationWithMRTDPoPChallenge(
+    authUrl
+  );
+
+// Verify and parse challenge info and extract challenge data: initialization url, session and nonce
+const {
+  htu: initUrl,
+  mrtd_auth_session,
+  mrtd_pop_jwt_nonce,
+} = await Credential.Issuance.MRTDPoP.verifyAndParseChallengeInfo(
+  issuerConf,
+  challenge_info,
+  { wiaCryptoContext }
+);
+
+// Initialize challenge and obtain the challenge text to sign the CIE PACE protocol and validation url
+const {
+  htu: validationUrl,
+  challenge,
+  mrtd_pop_nonce,
+} = await Credential.Issuance.MRTDPoP.initChallenge(
+  issuerConf,
+  initUrl,
+  mrtd_auth_session,
+  mrtd_pop_jwt_nonce,
+  {
+    walletInstanceAttestation,
+    wiaCryptoContext,
+    appFetch,
+  }
+);
+
+// CIE cryptographic interaction: you need to sign the challenge with the CIE through NFC interaction
+const { nis, mrtds } = /* NFC interactions functions */
+
+// Validate challenge
+const { mrtd_val_pop_nonce, redirect_uri } =
+  await Credential.Issuance.MRTDPoP.validateChallenge(
+    issuerConf,
+    validationUrl,
+    mrtd_auth_session,
+    mrtd_pop_nonce,
+    mrtd,
+    ias,
+    {
+      walletInstanceAttestation,
+      wiaCryptoContext,
+      appFetch,
+    }
+  );
+
+// Build the callback url
+const { callbackUrl } = await Credential.Issuance.buildChallengeCallbackUrl(
+  redirect_uri,
+  mrtd_val_pop_nonce,
+  mrtd_auth_session
+);
+
+// The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+const authRedirectUrl = /* From a browser or webview redirect */
+
+// Complete the authorization process with query mode using the returned callback url
+const { code } =
+  await Credential.Issuance.completeUserAuthorizationWithQueryMode(
+    authRedirectUrl
+  );
+
+/**
+ *
+ * The next steps are the same as the "eID issuance flow" example
+ *
+ */
+};
+```
+
+The result of this flow is a raw credential and a parsed credential which must be stored securely in the wallet along with its crypto key.
+
+</details>

package/src/credential/issuance/index.ts

@@ -8,15 +8,17 @@ import {
   type StartUserAuthorization,
 } from "./03-start-user-authorization";
 import {
+  continueUserAuthorizationWithMRTDPoPChallenge,
   completeUserAuthorizationWithQueryMode,
   completeUserAuthorizationWithFormPostJwtMode,
   parseAuthorizationResponse,
   buildAuthorizationUrl,
+  getRequestedCredentialToBePresented,
+  type ContinueUserAuthorizationWithMRTDPoPChallenge,
   type CompleteUserAuthorizationWithQueryMode,
   type CompleteUserAuthorizationWithFormPostJwtMode,
   type GetRequestedCredentialToBePresented,
   type BuildAuthorizationUrl,
-  getRequestedCredentialToBePresented,
 } from "./04-complete-user-authorization";
 import { authorizeAccess, type AuthorizeAccess } from "./05-authorize-access";
 import {
@@ -28,12 +30,15 @@ import {
   type VerifyAndParseCredential,
 } from "./07-verify-and-parse-credential";
 import * as Errors from "./errors";
+import * as MRTDPoP from "./mrtd-pop";
 
 export {
+  MRTDPoP,
   evaluateIssuerTrust,
   startUserAuthorization,
   buildAuthorizationUrl,
   completeUserAuthorizationWithQueryMode,
+  continueUserAuthorizationWithMRTDPoPChallenge,
   getRequestedCredentialToBePresented,
   completeUserAuthorizationWithFormPostJwtMode,
   authorizeAccess,
@@ -47,6 +52,7 @@ export type {
   EvaluateIssuerTrust,
   StartUserAuthorization,
   BuildAuthorizationUrl,
+  ContinueUserAuthorizationWithMRTDPoPChallenge,
   CompleteUserAuthorizationWithQueryMode,
   GetRequestedCredentialToBePresented,
   CompleteUserAuthorizationWithFormPostJwtMode,