@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/lib/typescript/credential/issuance/api/02-start-user-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"02-start-user-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/02-start-user-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAAsB,CACpB,UAAU,EAAE,YAAY,EACxB,aAAa,EAAE,MAAM,EAAE,EACvB,KAAK,EACD;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GACrB;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EACjD,OAAO,EAAE;QACP,gBAAgB,EAAE,aAAa,CAAC;QAChC,yBAAyB,EAAE,MAAM,CAAC;QAClC,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GACA,OAAO,CAAC;QACT,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;QAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;CACJ"}
+{"version":3,"file":"02-start-user-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/02-start-user-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,sBAAsB,CACpB,UAAU,EAAE,YAAY,EACxB,aAAa,EAAE,MAAM,EAAE,EACvB,KAAK,EACD;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,GAC7C;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EACzB,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yBAAyB,EAAE,MAAM,CAAC;QAClC,gBAAgB,EAAE,aAAa,CAAC;KACjC,GACA,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;QAC5C,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;CACJ"}

package/lib/typescript/credential/issuance/api/03-complete-user-authorization.d.ts

@@ -1,38 +1,26 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
-import type { AuthorizationChallengeResult, AuthorizationResult } from "../../../utils/auth";
 import type { RequestObject } from "../../../credential/presentation/api";
 import type { EvaluateDcqlQueryApi } from "../../../credential/presentation/api/06-evaluate-dcql-query";
+import type { AuthorizationChallengeResult, AuthorizationResult } from "../../../utils/auth";
 import type { Out } from "../../../utils/misc";
 import type { IssuerConfig } from "./IssuerConfig";
-export type EvaluatedDcqlQuery = Out<EvaluateDcqlQueryApi["evaluateDcqlQuery"]>;
 export interface CompleteUserAuthorizationApi {
     /**
-     * WARNING: This function must be called after {@link startUserAuthorization}. The next step is evaluating the returned request object's DCQL query with {@link EvaluateDcqlQueryApi.evaluateDcqlQuery}.
+     * WARNING: This function must be called after {@link startUserAuthorization}.
      *
-     * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
-     * It is used as a first step to complete the user authorization by obtaining the requested credential to be presented from the authorization server.
-     * The information is obtained by performing a GET request to the authorization endpoint with request_uri and client_id parameters.
+     * The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+     * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
      * @since 1.0.0
      *
      * @param issuerRequestUri the URI of the issuer where the request is sent
      * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
      * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
-     * @param appFetch (optional) fetch api implementation. Default: built-in fetch
-     * @returns the request object which contains the credential to be presented in order to obtain the requested credential
-     * @throws {ValidationFailed} if an error while validating the response
-     */
-    getRequestedCredentialToBePresented(issuerRequestUri: string, clientId: string, issuerConf: IssuerConfig, appFetch?: GlobalFetch["fetch"]): Promise<RequestObject>;
-    /**
-     * WARNING: This function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID.
-     *
-     * Complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
-     * This function parses the authorization redirect URL to extract the authorization response.
-     * @since 1.0.0
-     *
-     * @param authRedirectUrl The URL to which the end user should be redirected to start the authentication flow
-     * @returns the authorization response which contains code, state and iss
+     * @param idpHint Unique identifier of the IDP selected by the user (optional)
+     * @returns An object containing the authorization URL
      */
-    completePidUserAuthorizationWithQueryMode(authRedirectUrl: string): Promise<AuthorizationResult>;
+    buildAuthorizationUrl(issuerRequestUri: string, clientId: string, issuerConf: IssuerConfig, idpHint?: string): Promise<{
+        authUrl: string;
+    }>;
     /**
      * Complete user authorization when the response mode is "query" and the requested credential is an Electronic Attestation of Attributes (EAA).
      * This type of credentials requires a PID to be presented to complete the authorization process and then obtain an access token.
@@ -50,6 +38,17 @@ export interface CompleteUserAuthorizationApi {
         /** Function to fetch the final redirect uri; it allows full control on how redirects are handled. If not provided, `appFetch` is used. */
         fetchFinalRedirectUri?: (url: string) => Promise<string | undefined>;
     }): Promise<AuthorizationResult>;
+    /**
+     * WARNING: This function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID.
+     *
+     * Complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
+     * This function parses the authorization redirect URL to extract the authorization response.
+     * @since 1.0.0
+     *
+     * @param authRedirectUrl The URL to which the end user should be redirected to start the authentication flow
+     * @returns the authorization response which contains code, state and iss
+     */
+    completePidUserAuthorizationWithQueryMode(authRedirectUrl: string): Promise<AuthorizationResult>;
     /**
      * WARNING: This function must be called after {@link getRequestedCredentialToBePresented} and after evaluating the request object's DCQL query with {@link EvaluateDcqlQueryApi.evaluateDcqlQuery}. The next function to be called is {@link authorizeAccess}.
      *
@@ -65,8 +64,8 @@ export interface CompleteUserAuthorizationApi {
      * @throws {ValidationFailed} if an error while validating the response
      */
     completeUserAuthorizationWithFormPostJwtMode(requestObject: RequestObject, issuerConf: IssuerConfig, evaluatedDcqlQuery: EvaluatedDcqlQuery, context: {
-        wiaCryptoContext: CryptoContext;
         appFetch?: GlobalFetch["fetch"];
+        wiaCryptoContext: CryptoContext;
     }): Promise<AuthorizationResult>;
     /**
      * WARNING: this function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID, and the PID
@@ -78,20 +77,21 @@ export interface CompleteUserAuthorizationApi {
      */
     continueUserAuthorizationWithMRTDPoPChallenge(authRedirectUrl: string): Promise<AuthorizationChallengeResult>;
     /**
-     * WARNING: This function must be called after {@link startUserAuthorization}.
+     * WARNING: This function must be called after {@link startUserAuthorization}. The next step is evaluating the returned request object's DCQL query with {@link EvaluateDcqlQueryApi.evaluateDcqlQuery}.
      *
-     * The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
-     * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
+     * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
+     * It is used as a first step to complete the user authorization by obtaining the requested credential to be presented from the authorization server.
+     * The information is obtained by performing a GET request to the authorization endpoint with request_uri and client_id parameters.
      * @since 1.0.0
      *
      * @param issuerRequestUri the URI of the issuer where the request is sent
      * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
      * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
-     * @param idpHint Unique identifier of the IDP selected by the user (optional)
-     * @returns An object containing the authorization URL
+     * @param appFetch (optional) fetch api implementation. Default: built-in fetch
+     * @returns the request object which contains the credential to be presented in order to obtain the requested credential
+     * @throws {ValidationFailed} if an error while validating the response
      */
-    buildAuthorizationUrl(issuerRequestUri: string, clientId: string, issuerConf: IssuerConfig, idpHint?: string): Promise<{
-        authUrl: string;
-    }>;
+    getRequestedCredentialToBePresented(issuerRequestUri: string, clientId: string, issuerConf: IssuerConfig, appFetch?: GlobalFetch["fetch"]): Promise<RequestObject>;
 }
+export type EvaluatedDcqlQuery = Out<EvaluateDcqlQueryApi["evaluateDcqlQuery"]>;
 //# sourceMappingURL=03-complete-user-authorization.d.ts.map

package/lib/typescript/credential/issuance/api/03-complete-user-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"03-complete-user-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/03-complete-user-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACxG,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,MAAM,kBAAkB,GAAG,GAAG,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAEhF,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;;;;;;;;OAcG;IACH,mCAAmC,CACjC,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,YAAY,EACxB,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;OASG;IACH,yCAAyC,CACvC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;;;;;;;OAUG;IACH,yCAAyC,CACvC,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,YAAY,EACxB,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QACR,yDAAyD;QACzD,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,0IAA0I;QAC1I,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;KACtE,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;;;;;;;;;;OAaG;IACH,4CAA4C,CAC1C,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,YAAY,EACxB,kBAAkB,EAAE,kBAAkB,EACtC,OAAO,EAAE;QACP,gBAAgB,EAAE,aAAa,CAAC;QAChC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;KACjC,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;;;;OAOG;IACH,6CAA6C,CAC3C,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAEzC;;;;;;;;;;;;OAYG;IACH,qBAAqB,CACnB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,YAAY,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjC"}
+{"version":3,"file":"03-complete-user-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/03-complete-user-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACxG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;;;;;;OAYG;IACH,qBAAqB,CACnB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,YAAY,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEhC;;;;;;;;;;OAUG;IACH,yCAAyC,CACvC,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,YAAY,EACxB,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QACR,yDAAyD;QACzD,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,0IAA0I;QAC1I,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;KACtE,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;;;;;;OASG;IACH,yCAAyC,CACvC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;;;;;;;;;;OAaG;IACH,4CAA4C,CAC1C,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,YAAY,EACxB,kBAAkB,EAAE,kBAAkB,EACtC,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,gBAAgB,EAAE,aAAa,CAAC;KACjC,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;;;;OAOG;IACH,6CAA6C,CAC3C,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;OAcG;IACH,mCAAmC,CACjC,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,YAAY,EACxB,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED,MAAM,MAAM,kBAAkB,GAAG,GAAG,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC,CAAC"}

package/lib/typescript/credential/issuance/api/04-authorize-access.d.ts

@@ -22,10 +22,10 @@ export interface AuthorizeAccessApi {
      * @throws {IssuerResponseError} with a specific code for more context
      */
     authorizeAccess(issuerConf: IssuerConfig, code: string, redirectUri: string, codeVerifier: string, context: {
+        appFetch?: GlobalFetch["fetch"];
+        dPopCryptoContext: CryptoContext;
         walletInstanceAttestation: string;
         wiaCryptoContext: CryptoContext;
-        dPopCryptoContext: CryptoContext;
-        appFetch?: GlobalFetch["fetch"];
     }): Promise<{
         accessToken: TokenResponse;
     }>;

package/lib/typescript/credential/issuance/api/04-authorize-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"04-authorize-access.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/04-authorize-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,CACb,UAAU,EAAE,YAAY,EACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;QACP,yBAAyB,EAAE,MAAM,CAAC;QAClC,gBAAgB,EAAE,aAAa,CAAC;QAChC,iBAAiB,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;KACjC,GACA,OAAO,CAAC;QAAE,WAAW,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"04-authorize-access.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/04-authorize-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,CACb,UAAU,EAAE,YAAY,EACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,iBAAiB,EAAE,aAAa,CAAC;QACjC,yBAAyB,EAAE,MAAM,CAAC;QAClC,gBAAgB,EAAE,aAAa,CAAC;KACjC,GACA,OAAO,CAAC;QAAE,WAAW,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC5C"}

package/lib/typescript/credential/issuance/api/05-obtain-credential.d.ts

@@ -1,7 +1,7 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
 import type { Out } from "../../../utils/misc";
-import type { IssuerConfig } from "./IssuerConfig";
 import type { AuthorizeAccessApi } from "./04-authorize-access";
+import type { IssuerConfig } from "./IssuerConfig";
 import type { CredentialFormat } from "./types";
 export interface ObtainCredentialApi {
     /**
@@ -26,10 +26,10 @@ export interface ObtainCredentialApi {
         credential_configuration_id: string;
         credential_identifier?: string;
     }, context: {
-        dPopCryptoContext: CryptoContext;
+        appFetch?: GlobalFetch["fetch"];
         credentialCryptoContext: CryptoContext;
+        dPopCryptoContext: CryptoContext;
         walletUnitAttestation?: string;
-        appFetch?: GlobalFetch["fetch"];
     }): Promise<{
         credential: string;
         format: CredentialFormat;
@@ -46,10 +46,10 @@ export interface ObtainCredentialApi {
         credential_configuration_id: string;
         credential_identifier: string;
     }, context: {
-        dPopCryptoContext: CryptoContext;
+        appFetch?: GlobalFetch["fetch"];
         credentialCryptoContexts: CryptoContext[];
+        dPopCryptoContext: CryptoContext;
         walletUnitAttestation?: string;
-        appFetch?: GlobalFetch["fetch"];
     }): Promise<{
         credential: string;
         format: CredentialFormat;

package/lib/typescript/credential/issuance/api/05-obtain-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"05-obtain-credential.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/05-obtain-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CACd,UAAU,EAAE,YAAY,EACxB,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,EACtE,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE;QACpB,2BAA2B,EAAE,MAAM,CAAC;QACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,EACD,OAAO,EAAE;QACP,iBAAiB,EAAE,aAAa,CAAC;QACjC,uBAAuB,EAAE,aAAa,CAAC;QACvC,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;KACjC,GACA,OAAO,CAAC;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,gBAAgB,CAAC;KAC1B,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,sBAAsB,CACpB,UAAU,EAAE,YAAY,EACxB,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,EACtE,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE;QACpB,2BAA2B,EAAE,MAAM,CAAC;QACpC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,EACD,OAAO,EAAE;QACP,iBAAiB,EAAE,aAAa,CAAC;QACjC,wBAAwB,EAAE,aAAa,EAAE,CAAC;QAC1C,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;KACjC,GACA,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,EAAE,CAAC,CAAC;CAChE"}
+{"version":3,"file":"05-obtain-credential.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/05-obtain-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CACd,UAAU,EAAE,YAAY,EACxB,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,EACtE,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE;QACpB,2BAA2B,EAAE,MAAM,CAAC;QACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,EACD,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,uBAAuB,EAAE,aAAa,CAAC;QACvC,iBAAiB,EAAE,aAAa,CAAC;QACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,GACA,OAAO,CAAC;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,gBAAgB,CAAC;KAC1B,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,sBAAsB,CACpB,UAAU,EAAE,YAAY,EACxB,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,EACtE,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE;QACpB,2BAA2B,EAAE,MAAM,CAAC;QACpC,qBAAqB,EAAE,MAAM,CAAC;KAC/B,EACD,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,wBAAwB,EAAE,aAAa,EAAE,CAAC;QAC1C,iBAAiB,EAAE,aAAa,CAAC;QACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,GACA,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,EAAE,CAAC,CAAC;CAChE"}

package/lib/typescript/credential/issuance/api/06-verify-and-parse-credential.d.ts

@@ -32,9 +32,9 @@ export interface VerifyAndParseCredentialApi {
          */
         validateCertificateChain?: boolean;
     }, x509CertRoot?: string): Promise<{
-        parsedCredential: ParsedCredential;
         expiration: Date;
         issuedAt: Date | undefined;
+        parsedCredential: ParsedCredential;
     }>;
 }
 //# sourceMappingURL=06-verify-and-parse-credential.d.ts.map

package/lib/typescript/credential/issuance/api/06-verify-and-parse-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"06-verify-and-parse-credential.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/06-verify-and-parse-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,CACtB,UAAU,EAAE,YAAY,EACxB,UAAU,EAAE,MAAM,EAClB,yBAAyB,EAAE,MAAM,EACjC,OAAO,EAAE;QACP,uBAAuB,EAAE,aAAa,CAAC;QACvC;;WAEG;QACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC;;WAEG;QACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;QACrC;;WAEG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QACT,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,UAAU,EAAE,IAAI,CAAC;QACjB,QAAQ,EAAE,IAAI,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;CACJ"}
+{"version":3,"file":"06-verify-and-parse-credential.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/06-verify-and-parse-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,CACtB,UAAU,EAAE,YAAY,EACxB,UAAU,EAAE,MAAM,EAClB,yBAAyB,EAAE,MAAM,EACjC,OAAO,EAAE;QACP,uBAAuB,EAAE,aAAa,CAAC;QACvC;;WAEG;QACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC;;WAEG;QACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;QACrC;;WAEG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QACT,UAAU,EAAE,IAAI,CAAC;QACjB,QAAQ,EAAE,IAAI,GAAG,SAAS,CAAC;QAC3B,gBAAgB,EAAE,gBAAgB,CAAC;KACpC,CAAC,CAAC;CACJ"}

package/lib/typescript/credential/issuance/api/IssuerConfig.d.ts

@@ -4,14 +4,55 @@ import { z } from "zod";
  */
 export type IssuerConfig = z.infer<typeof IssuerConfig>;
 export declare const IssuerConfig: z.ZodObject<{
-    credential_issuer: z.ZodString;
-    authorization_servers: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-    pushed_authorization_request_endpoint: z.ZodString;
     authorization_endpoint: z.ZodString;
-    token_endpoint: z.ZodString;
-    nonce_endpoint: z.ZodString;
-    status_assertion_endpoint: z.ZodOptional<z.ZodString>;
+    authorization_servers: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+    credential_configurations_supported: z.ZodRecord<z.ZodString, z.ZodIntersection<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        format: z.ZodLiteral<"dc+sd-jwt">;
+        vct: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        doctype: z.ZodString;
+        format: z.ZodLiteral<"mso_mdoc">;
+    }, z.core.$strip>], "format">, z.ZodObject<{
+        authentic_source: z.ZodOptional<z.ZodString>;
+        claims: z.ZodArray<z.ZodObject<{
+            display: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                locale: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$strip>>>;
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodNull]>>;
+        }, z.core.$strip>>;
+        display: z.ZodArray<z.ZodObject<{
+            locale: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>>;
+        issuance_errors_supported: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            display: z.ZodArray<z.ZodObject<{
+                description: z.ZodString;
+                locale: z.ZodString;
+                title: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>>;
+        scope: z.ZodString;
+    }, z.core.$strip>>>;
     credential_endpoint: z.ZodString;
+    credential_issuance_batch_size: z.ZodOptional<z.ZodNumber>;
+    credential_issuer: z.ZodString;
+    encrypted_response_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    federation_entity: z.ZodObject<{
+        contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodString>;
+        federation_fetch_endpoint: z.ZodOptional<z.ZodString>;
+        federation_historical_keys_endpoint: z.ZodOptional<z.ZodString>;
+        federation_list_endpoint: z.ZodOptional<z.ZodString>;
+        federation_resolve_endpoint: z.ZodOptional<z.ZodString>;
+        federation_trust_mark_endpoint: z.ZodOptional<z.ZodString>;
+        federation_trust_mark_list_endpoint: z.ZodOptional<z.ZodString>;
+        federation_trust_mark_status_endpoint: z.ZodOptional<z.ZodString>;
+        homepage_uri: z.ZodOptional<z.ZodString>;
+        logo_uri: z.ZodOptional<z.ZodString>;
+        organization_name: z.ZodOptional<z.ZodString>;
+        policy_uri: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
     keys: z.ZodArray<z.ZodObject<{
         alg: z.ZodOptional<z.ZodString>;
         crv: z.ZodOptional<z.ZodString>;
@@ -33,57 +74,16 @@ export declare const IssuerConfig: z.ZodObject<{
         qi: z.ZodOptional<z.ZodString>;
         use: z.ZodOptional<z.ZodString>;
         x: z.ZodOptional<z.ZodString>;
-        y: z.ZodOptional<z.ZodString>;
         x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
         x5t: z.ZodOptional<z.ZodString>;
         "x5t#S256": z.ZodOptional<z.ZodString>;
         x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
-    credential_configurations_supported: z.ZodRecord<z.ZodString, z.ZodIntersection<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        format: z.ZodLiteral<"dc+sd-jwt">;
-        vct: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        format: z.ZodLiteral<"mso_mdoc">;
-        doctype: z.ZodString;
-    }, z.core.$strip>], "format">, z.ZodObject<{
-        scope: z.ZodString;
-        display: z.ZodArray<z.ZodObject<{
-            name: z.ZodString;
-            locale: z.ZodString;
-        }, z.core.$strip>>;
-        claims: z.ZodArray<z.ZodObject<{
-            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodNull]>>;
-            display: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                name: z.ZodString;
-                locale: z.ZodString;
-            }, z.core.$strip>>>;
-        }, z.core.$strip>>;
-        authentic_source: z.ZodOptional<z.ZodString>;
-        issuance_errors_supported: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-            display: z.ZodArray<z.ZodObject<{
-                title: z.ZodString;
-                description: z.ZodString;
-                locale: z.ZodString;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>>>;
-    federation_entity: z.ZodObject<{
-        federation_fetch_endpoint: z.ZodOptional<z.ZodString>;
-        federation_list_endpoint: z.ZodOptional<z.ZodString>;
-        federation_resolve_endpoint: z.ZodOptional<z.ZodString>;
-        federation_trust_mark_status_endpoint: z.ZodOptional<z.ZodString>;
-        federation_trust_mark_list_endpoint: z.ZodOptional<z.ZodString>;
-        federation_trust_mark_endpoint: z.ZodOptional<z.ZodString>;
-        federation_historical_keys_endpoint: z.ZodOptional<z.ZodString>;
-        endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodString>;
-        organization_name: z.ZodOptional<z.ZodString>;
-        homepage_uri: z.ZodOptional<z.ZodString>;
-        policy_uri: z.ZodOptional<z.ZodString>;
-        logo_uri: z.ZodOptional<z.ZodString>;
-        contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$loose>;
-    credential_issuance_batch_size: z.ZodOptional<z.ZodNumber>;
-    encrypted_response_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    nonce_endpoint: z.ZodString;
+    pushed_authorization_request_endpoint: z.ZodString;
     response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    status_assertion_endpoint: z.ZodOptional<z.ZodString>;
+    token_endpoint: z.ZodString;
 }, z.core.$strip>;
 //# sourceMappingURL=IssuerConfig.d.ts.map

package/lib/typescript/credential/issuance/api/IssuerConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IssuerConfig.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/IssuerConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8CxB;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBvB,CAAC"}
+{"version":3,"file":"IssuerConfig.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/IssuerConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+CxB;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBvB,CAAC"}

package/lib/typescript/credential/issuance/api/index.d.ts

@@ -5,11 +5,11 @@ import { type AuthorizeAccessApi } from "./04-authorize-access";
 import { type ObtainCredentialApi } from "./05-obtain-credential";
 import { type VerifyAndParseCredentialApi } from "./06-verify-and-parse-credential";
 import { type MRTDPoPApi } from "./mrtd-pop";
-export interface IssuanceApi extends EvaluateIssuerTrustApi, StartUserAuthorizationApi, CompleteUserAuthorizationApi, AuthorizeAccessApi, ObtainCredentialApi, VerifyAndParseCredentialApi {
+export interface IssuanceApi extends AuthorizeAccessApi, CompleteUserAuthorizationApi, EvaluateIssuerTrustApi, ObtainCredentialApi, StartUserAuthorizationApi, VerifyAndParseCredentialApi {
     MRTDPoP: MRTDPoPApi;
 }
-export type { IssuerConfig } from "./IssuerConfig";
 export type { EvaluatedDcqlQuery } from "./03-complete-user-authorization";
+export type { IssuerConfig } from "./IssuerConfig";
 export type * as MRTDPoP from "./mrtd-pop";
 export type * from "./types";
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/credential/issuance/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,KAAK,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,WACf,SAAQ,sBAAsB,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B;IAC7B,OAAO,EAAE,UAAU,CAAC;CACrB;AAED,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,YAAY,KAAK,OAAO,MAAM,YAAY,CAAC;AAC3C,mBAAmB,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,KAAK,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,WACf,SAAQ,kBAAkB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B;IAC7B,OAAO,EAAE,UAAU,CAAC;CACrB;AAED,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,KAAK,OAAO,MAAM,YAAY,CAAC;AAC3C,mBAAmB,SAAS,CAAC"}

package/lib/typescript/credential/issuance/api/mrtd-pop/index.d.ts

@@ -3,24 +3,16 @@ import type { IssuerConfig } from "../IssuerConfig";
 import type { IasPayload, MrtdPayload, MrtdPoPChallenge, MrtdPopVerificationResult, MrtdProofChallengeInfo } from "./types";
 export interface MRTDPoPApi {
     /**
-     * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
-     *
-     * This function performs the following steps:
-     * 1. Validates the JWT signature using the issuer's JWKS.
-     * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
-     * 3. Verifies that the `aud` claim matches the client's public key ID.
-     * 4. Checks that the JWT is not expired and was not issued in the future.
-     *
-     * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
-     * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
-     * @param context - The context containing the WIA crypto context used to retrieve the client public key.
-     * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
-     * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
-     * or the JWT is expired/not yet valid.
+     * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+     * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
+     * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
+     * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
+     * @param authSession - The MRTD authentication session identifier used for session binding.
+     * @returns An object containing the callback URL
      */
-    verifyAndParseChallengeInfo(issuerConf: IssuerConfig, challengeInfoJwt: string, context: {
-        wiaCryptoContext: CryptoContext;
-    }): Promise<MrtdProofChallengeInfo>;
+    buildChallengeCallbackUrl(redirectUri: string, valPopNonce: string, authSession: string): Promise<{
+        callbackUrl: string;
+    }>;
     /**
      * Initializes the MRTD challenge with the data received from the issuer after the primary authentication.
      * This function must be called after {@link verifyAndParseChallengeInfo}.
@@ -34,9 +26,9 @@ export interface MRTDPoPApi {
      * @returns The payload of the MRTD PoP Challenge JWT.
      */
     initChallenge(issuerConf: IssuerConfig, initUrl: string, mrtd_auth_session: string, mrtd_pop_jwt_nonce: string, context: {
-        wiaCryptoContext: CryptoContext;
-        walletInstanceAttestation: string;
         appFetch?: GlobalFetch["fetch"];
+        walletInstanceAttestation: string;
+        wiaCryptoContext: CryptoContext;
     }): Promise<MrtdPoPChallenge>;
     /**
      * Validates the MRTD signed challenge by sending the MRTD and IAS payloads to the issuer.
@@ -54,21 +46,29 @@ export interface MRTDPoPApi {
      * @returns The MRTD PoP Verification Result containing the validation nonce and redirect URI to complete the flow.
      */
     validateChallenge(issuerConf: IssuerConfig, verifyUrl: string, mrtd_auth_session: string, mrtd_pop_nonce: string, mrtd: MrtdPayload, ias: IasPayload, context: {
-        wiaCryptoContext: CryptoContext;
-        walletInstanceAttestation: string;
         appFetch?: GlobalFetch["fetch"];
+        walletInstanceAttestation: string;
+        wiaCryptoContext: CryptoContext;
     }): Promise<MrtdPopVerificationResult>;
     /**
-     * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
-     * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
-     * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
-     * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
-     * @param authSession - The MRTD authentication session identifier used for session binding.
-     * @returns An object containing the callback URL
+     * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
+     *
+     * This function performs the following steps:
+     * 1. Validates the JWT signature using the issuer's JWKS.
+     * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
+     * 3. Verifies that the `aud` claim matches the client's public key ID.
+     * 4. Checks that the JWT is not expired and was not issued in the future.
+     *
+     * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
+     * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
+     * @param context - The context containing the WIA crypto context used to retrieve the client public key.
+     * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
+     * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
+     * or the JWT is expired/not yet valid.
      */
-    buildChallengeCallbackUrl(redirectUri: string, valPopNonce: string, authSession: string): Promise<{
-        callbackUrl: string;
-    }>;
+    verifyAndParseChallengeInfo(issuerConf: IssuerConfig, challengeInfoJwt: string, context: {
+        wiaCryptoContext: CryptoContext;
+    }): Promise<MrtdProofChallengeInfo>;
 }
 export * from "./types";
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/credential/issuance/api/mrtd-pop/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/credential/issuance/api/mrtd-pop/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;OAeG;IACH,2BAA2B,CACzB,UAAU,EAAE,YAAY,EACxB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE;QACP,gBAAgB,EAAE,aAAa,CAAC;KACjC,GACA,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC;;;;;;;;;;;OAWG;IACH,aAAa,CACX,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,EACzB,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE;QACP,gBAAgB,EAAE,aAAa,CAAC;QAChC,yBAAyB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;KACjC,GACA,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE7B;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CACf,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,UAAU,EACf,OAAO,EAAE;QACP,gBAAgB,EAAE,aAAa,CAAC;QAChC,yBAAyB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;KACjC,GACA,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;OAOG;IACH,yBAAyB,CACvB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrC;AAED,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/credential/issuance/api/mrtd-pop/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,UAAU;IACzB;;;;;;;OAOG;IACH,yBAAyB,CACvB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEpC;;;;;;;;;;;OAWG;IACH,aAAa,CACX,UAAU,EAAE,YAAY,EACxB,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,EACzB,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,yBAAyB,EAAE,MAAM,CAAC;QAClC,gBAAgB,EAAE,aAAa,CAAC;KACjC,GACA,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE7B;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CACf,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,UAAU,EACf,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAChC,yBAAyB,EAAE,MAAM,CAAC;QAClC,gBAAgB,EAAE,aAAa,CAAC;KACjC,GACA,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;;;;;;;;OAeG;IACH,2BAA2B,CACzB,UAAU,EAAE,YAAY,EACxB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE;QACP,gBAAgB,EAAE,aAAa,CAAC;KACjC,GACA,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC;AAED,cAAc,SAAS,CAAC"}

package/lib/typescript/credential/issuance/api/mrtd-pop/types.d.ts

@@ -1,34 +1,34 @@
-export type MrtdPayload = {
+export interface IasPayload {
+    challenge_signed: string;
+    ias_pk: string;
+    sod_ias: string;
+}
+export interface MrtdPayload {
     dg1: string;
     dg11: string;
     sod_mrtd: string;
-};
-export type IasPayload = {
-    ias_pk: string;
-    sod_ias: string;
-    challenge_signed: string;
-};
-export type MrtdProofChallengeInfo = {
-    iss: string;
-    aud: string;
-    iat: number;
-    exp: number;
-    status: "require_interaction";
-    type: "mrtd+ias";
-    mrtd_auth_session: string;
-    state: string;
-    mrtd_pop_jwt_nonce: string;
-    htu: string;
-    htm: "POST";
-};
-export type MrtdPoPChallenge = {
+}
+export interface MrtdPoPChallenge {
     challenge: string;
     mrtd_pop_nonce: string;
-    pop_verify_endpoint: string;
     mrz?: string;
-};
-export type MrtdPopVerificationResult = {
+    pop_verify_endpoint: string;
+}
+export interface MrtdPopVerificationResult {
     mrtd_val_pop_nonce: string;
     redirect_uri: string;
-};
+}
+export interface MrtdProofChallengeInfo {
+    aud: string;
+    exp: number;
+    htm: "POST";
+    htu: string;
+    iat: number;
+    iss: string;
+    mrtd_auth_session: string;
+    mrtd_pop_jwt_nonce: string;
+    state: string;
+    status: "require_interaction";
+    type: "mrtd+ias";
+}
 //# sourceMappingURL=types.d.ts.map

package/lib/typescript/credential/issuance/api/mrtd-pop/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/credential/issuance/api/mrtd-pop/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/credential/issuance/api/mrtd-pop/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,UAAU,CAAC;CAClB"}

package/lib/typescript/credential/issuance/api/types.d.ts

@@ -1,28 +1,25 @@
 import * as z from "zod";
-export type CredentialFormat = "dc+sd-jwt" | "mso_mdoc";
-export type ParsedCredential = {
-    /** Attribute key */
-    [claim: string]: {
-        name: /* if i18n is provided */ Record<string, string> | /* if no i18n is provided */ string | undefined;
-        value: unknown;
-    };
-};
 export type AuthorizationDetail = z.infer<typeof AuthorizationDetail>;
+export type CredentialFormat = "dc+sd-jwt" | "mso_mdoc";
+export type ParsedCredential = Record<string, {
+    name: /* if i18n is provided */ Record<string, string> | /* if no i18n is provided */ string | undefined;
+    value: unknown;
+}>;
 export declare const AuthorizationDetail: z.ZodObject<{
-    type: z.ZodLiteral<"openid_credential">;
     credential_configuration_id: z.ZodString;
     credential_identifiers: z.ZodArray<z.ZodString>;
+    type: z.ZodLiteral<"openid_credential">;
 }, z.core.$strip>;
 export type TokenResponse = z.infer<typeof TokenResponse>;
 export declare const TokenResponse: z.ZodObject<{
     access_token: z.ZodString;
-    refresh_token: z.ZodOptional<z.ZodString>;
     authorization_details: z.ZodArray<z.ZodObject<{
-        type: z.ZodLiteral<"openid_credential">;
         credential_configuration_id: z.ZodString;
         credential_identifiers: z.ZodArray<z.ZodString>;
+        type: z.ZodLiteral<"openid_credential">;
     }, z.core.$strip>>;
     expires_in: z.ZodOptional<z.ZodNumber>;
+    refresh_token: z.ZodOptional<z.ZodString>;
     token_type: z.ZodString;
 }, z.core.$strip>;
 //# sourceMappingURL=types.d.ts.map

package/lib/typescript/credential/issuance/api/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC;AAGxD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,oBAAoB;IACpB,CAAC,KAAK,EAAE,MAAM,GAAG;QACf,IAAI,EACA,yBAAyB,CAAC,MAAM,CAC9B,MAAM,EACN,MAAM,CACP,GACD,4BAA4B,CAAC,MAAM,GACnC,SAAS,CAAC;QACd,KAAK,EAAE,OAAO,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,eAAO,MAAM,aAAa;;;;;;;;;;iBAMxB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/api/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC;AAGxD,MAAM,MAAM,gBAAgB,GAAG,MAAM,CACnC,MAAM,EACN;IACE,IAAI,EACA,yBAAyB,CAAC,MAAM,CAC9B,MAAM,EACN,MAAM,CACP,GACD,4BAA4B,CAAC,MAAM,GACnC,SAAS,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CACF,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,eAAO,MAAM,aAAa;;;;;;;;;;iBAMxB,CAAC"}

package/lib/typescript/credential/issuance/common/02-start-user-authorization.d.ts

@@ -1,6 +1,6 @@
-import { AuthorizationDetail } from "../../../utils/par";
 import type { IssuerConfig } from "../api";
-type ResponseMode = "query" | "form_post.jwt";
+import { AuthorizationDetail } from "../../../utils/par";
+type ResponseMode = "form_post.jwt" | "query";
 /**
  * Ensures that the credential type requested is supported by the issuer and contained in the
  * issuer configuration.

package/lib/typescript/credential/issuance/common/02-start-user-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"02-start-user-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/common/02-start-user-authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,KAAK,YAAY,GAAG,OAAO,GAAG,eAAe,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACrC,YAAY,YAAY,EACxB,cAAc,MAAM,KACnB,mBAmBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC7B,YAAY,YAAY,EACxB,eAAe,MAAM,EAAE,KACtB,YAwCF,CAAC"}
+{"version":3,"file":"02-start-user-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/common/02-start-user-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAI3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,KAAK,YAAY,GAAG,eAAe,GAAG,OAAO,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACrC,YAAY,YAAY,EACxB,cAAc,MAAM,KACnB,mBAmBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC7B,YAAY,YAAY,EACxB,eAAe,MAAM,EAAE,KACtB,YA6CF,CAAC"}

package/lib/typescript/credential/issuance/common/06-verify-and-parse-credential.mdoc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"06-verify-and-parse-credential.mdoc.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/common/06-verify-and-parse-credential.mdoc.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAkC,MAAM,QAAQ,CAAC;AAsL1E,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,0BAA0B,CA2C9E,CAAC"}
+{"version":3,"file":"06-verify-and-parse-credential.mdoc.d.ts","sourceRoot":"","sources":["../../../../../src/credential/issuance/common/06-verify-and-parse-credential.mdoc.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAkC,MAAM,QAAQ,CAAC;AA6L1E,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,0BAA0B,CA8C9E,CAAC"}