@pagopa/io-react-native-wallet 3.7.4 → 3.8.2

package/lib/typescript/module/key-attestation/v1.4.6/types.d.ts

@@ -0,0 +1,58 @@
+import * as z from "zod";
+export type KeyAttestationJwt = z.infer<typeof KeyAttestationJwt>;
+export declare const KeyAttestationJwt: z.ZodObject<{
+    header: z.ZodIntersection<z.ZodObject<{
+        alg: z.ZodString;
+        kid: z.ZodString;
+        trust_chain: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        typ: z.ZodString;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        typ: z.ZodLiteral<"key-attestation+jwt">;
+    }, z.core.$strip>>;
+    payload: z.ZodObject<{
+        attested_keys: z.ZodArray<z.ZodObject<{
+            alg: z.ZodOptional<z.ZodString>;
+            crv: z.ZodOptional<z.ZodString>;
+            d: z.ZodOptional<z.ZodString>;
+            dp: z.ZodOptional<z.ZodString>;
+            dq: z.ZodOptional<z.ZodString>;
+            e: z.ZodOptional<z.ZodString>;
+            ext: z.ZodOptional<z.ZodBoolean>;
+            k: z.ZodOptional<z.ZodString>;
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            kid: z.ZodOptional<z.ZodString>;
+            kty: z.ZodEnum<{
+                RSA: "RSA";
+                EC: "EC";
+            }>;
+            n: z.ZodOptional<z.ZodString>;
+            p: z.ZodOptional<z.ZodString>;
+            q: z.ZodOptional<z.ZodString>;
+            qi: z.ZodOptional<z.ZodString>;
+            use: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodString>;
+            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            x5t: z.ZodOptional<z.ZodString>;
+            "x5t#S256": z.ZodOptional<z.ZodString>;
+            x5u: z.ZodOptional<z.ZodString>;
+            y: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        exp: z.ZodNumber;
+        iat: z.ZodNumber;
+        iss: z.ZodString;
+        key_storage: z.ZodArray<z.ZodString>;
+        status: z.ZodObject<{
+            status_list: z.ZodObject<{
+                idx: z.ZodNumber;
+                uri: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        user_authentication: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type KeyAttestationResponse = z.infer<typeof KeyAttestationResponse>;
+export declare const KeyAttestationResponse: z.ZodObject<{
+    key_attestation: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/module/key-attestation/v1.4.6/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/key-attestation/v1.4.6/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAKzB,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQ5B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC"}

package/lib/typescript/module/key-attestation/v1.4.6/utils.d.ts

@@ -0,0 +1,7 @@
+import { KeyAttestationJwt } from "./types.js";
+/**
+ * Decode a given JWT to get the parsed Key Attestation object they define.
+ * It ensures the provided data is in a valid shape, but it DOES NOT verify the signature.
+ */
+export declare function decode(token: string): KeyAttestationJwt;
+//# sourceMappingURL=utils.d.ts.map

package/lib/typescript/module/key-attestation/v1.4.6/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../../src/key-attestation/v1.4.6/utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAS,CAAC;AAE5C;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAMvD"}

package/lib/typescript/module/mdoc/const.d.ts

@@ -0,0 +1,3 @@
+export declare const MDOC_DEFAULT_NAMESPACE = "org.iso.18013.5.1";
+export declare const MDOC_VERIFICATION_IDENTIFIER = "verification";
+//# sourceMappingURL=const.d.ts.map

package/lib/typescript/module/mdoc/const.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../../src/mdoc/const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,4BAA4B,iBAAiB,CAAC"}

package/lib/typescript/module/mdoc/converter.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Extracts the date value of a given elementIdentifier from an MDOC object.
+ * Searches through the issuerSigned namespaces and attempts to parse the value as a Date.
+ * The expected date format is "YYYY-MM-DD".
+ * Returns the Date object if found, otherwise returns null.
+ */
+export declare function extractElementValueAsDate(elementValue: string): Date | null;
+//# sourceMappingURL=converter.d.ts.map

package/lib/typescript/module/mdoc/converter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../../src/mdoc/converter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAmB3E"}

package/lib/typescript/module/mdoc/index.d.ts

@@ -0,0 +1,10 @@
+import { CBOR } from "@pagopa/io-react-native-iso18013";
+import type { Presentation } from "../credential/presentation/index.js";
+export * from "./utils.js";
+export declare const verify: (token: string, x509CertRoot: string) => Promise<{
+    issuerSigned: CBOR.IssuerSigned;
+}>;
+export declare const prepareVpTokenMdoc: (requestNonce: string, generatedNonce: string, clientId: string, responseUri: string, docType: string, keyTag: string, [verifiableCredential, presentationFrame]: Presentation) => Promise<{
+    vp_token: string;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/mdoc/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/mdoc/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAoB,MAAM,kCAAkC,CAAC;AAI1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAA4B,CAAC;AAM/D,cAAc,YAAS,CAAC;AAExB,eAAO,MAAM,MAAM,GACjB,OAAO,MAAM,EACb,cAAc,MAAM,KACnB,OAAO,CAAC;IAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAA;CAAE,CAoC7C,CAAC;AA2BF,eAAO,MAAM,kBAAkB,GAC7B,cAAc,MAAM,EACpB,gBAAgB,MAAM,EACtB,UAAU,MAAM,EAChB,aAAa,MAAM,EACnB,SAAS,MAAM,EACf,QAAQ,MAAM,EACd,2CAA2C,YAAY,KACtD,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;CAClB,CAwBA,CAAC"}

package/lib/typescript/module/mdoc/utils.d.ts

@@ -0,0 +1,33 @@
+import type { IssuanceApi } from "../credential/issuance/index.js";
+import type { Out } from "../utils/misc.js";
+/**
+ * @param namespace The mdoc credential `namespace`
+ * @param key The claim attribute key
+ * @returns A string consisting of the concatenation of the namespace and the claim key, separated by a colon
+ */
+export declare const getParsedCredentialClaimKey: (namespace: string, key: string) => string;
+/**
+ * Extract and validate the `verification` claim from an mdoc parsed credential.
+ *
+ * This method is **synchronous**, so it requires a credential that was already parsed.
+ *
+ * @param parsedCredential The parsed mdoc credential
+ * @returns The verification claim or undefined if it wasn't found
+ */
+export declare const getVerificationFromParsedCredential: (parsedCredential: Out<IssuanceApi["verifyAndParseCredential"]>["parsedCredential"]) => {
+    assurance_level: string;
+    trust_framework: string;
+} | undefined;
+/**
+ * Extract and validate the `verification` claim from an MDOC credential.
+ *
+ * This method is **asynchronous**. See {@link getVerificationFromParsedCredential} for the synchronous version.
+ *
+ * @param token The raw MDOC credential
+ * @returns The verification claim or undefined if it wasn't found
+ */
+export declare const getVerification: (token: string) => Promise<{
+    assurance_level: string;
+    trust_framework: string;
+} | undefined>;
+//# sourceMappingURL=utils.d.ts.map

package/lib/typescript/module/mdoc/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/mdoc/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAe,CAAC;AAKzC;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GAAI,WAAW,MAAM,EAAE,KAAK,MAAM,WACnD,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,GAC9C,kBAAkB,GAAG,CACnB,WAAW,CAAC,0BAA0B,CAAC,CACxC,CAAC,kBAAkB,CAAC;;;aAStB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM;;;cAUlD,CAAC"}

package/lib/typescript/module/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/typescript/module/sd-jwt/index.d.ts

@@ -0,0 +1,92 @@
+import type { Presentation } from "../credential/presentation/index.js";
+export * from "./utils.js";
+/**
+ * Decode a given SD-JWT with Disclosures to get the parsed SD-JWT object they define.
+ * It ensures provided data is in a valid shape.
+ *
+ * It DOES NOT verify token signature nor check disclosures are correctly referenced by the SD-JWT.
+ *
+ * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
+ * @returns The parsed SD-JWT token and the parsed disclosures
+ */
+export declare const decode: (token: string) => {
+    disclosures: {
+        decoded: unknown[];
+        encoded: string | undefined;
+    }[];
+    sdJwt: {
+        header: {
+            alg: string;
+            kid: string;
+            typ: "dc+sd-jwt" | "vc+sd-jwt";
+            trust_chain?: string[] | undefined;
+            vctm?: string[] | undefined;
+            x5c?: string[] | undefined;
+        };
+        payload: {
+            _sd: string[];
+            _sd_alg: "sha-256";
+            cnf: {
+                jwk: {
+                    kty: "RSA" | "EC";
+                    alg?: string | undefined;
+                    crv?: string | undefined;
+                    d?: string | undefined;
+                    dp?: string | undefined;
+                    dq?: string | undefined;
+                    e?: string | undefined;
+                    ext?: boolean | undefined;
+                    k?: string | undefined;
+                    key_ops?: string[] | undefined;
+                    kid?: string | undefined;
+                    n?: string | undefined;
+                    p?: string | undefined;
+                    q?: string | undefined;
+                    qi?: string | undefined;
+                    use?: string | undefined;
+                    x?: string | undefined;
+                    x5c?: string[] | undefined;
+                    x5t?: string | undefined;
+                    "x5t#S256"?: string | undefined;
+                    x5u?: string | undefined;
+                    y?: string | undefined;
+                };
+            };
+            exp: number;
+            iss: string;
+            status: {
+                status_list: {
+                    idx: number;
+                    uri: string;
+                };
+            } | {
+                status_assertion: {
+                    credential_hash_alg: "sha-256";
+                };
+            };
+            sub: string;
+            vct: string;
+            iat?: number | undefined;
+            "vct#integrity"?: string | undefined;
+        };
+    };
+};
+/**
+ * Prepares a Verified Presentation (VP) token to be sent as part of an
+ * authorization response in an OpenID 4 Verifiable Presentations flow.
+ *
+ * @param nonce - The nonce provided by the relying party.
+ * @param client_id - The client identifier of the relying party.
+ * @param presentation - An object containing the verifiable credential, the claims to disclose,
+ *                       and the cryptographic context for signing.
+ * @returns An object containing the signed VP token (`vp_token`).
+ *
+ * @remarks
+ *  1. The `disclose()` function is used to produce a token with only the requested claims.
+ *  2. A KB-JWT is then signed, including sd_hash and `nonce`.
+ *  3. The `vp_token` is composed of the disclosed VP and the KB-JWT.
+ */
+export declare const prepareVpToken: (nonce: string, client_id: string, [verifiableCredential, presentationFrame, cryptoContext]: Presentation) => Promise<{
+    vp_token: string;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/sd-jwt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/sd-jwt/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAA4B,CAAC;AAK/D,cAAc,YAAS,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,MAAM,EACb,WAAW,MAAM,EACjB,0DAA0D,YAAY,KACrE,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;CAClB,CA2BA,CAAC"}

package/lib/typescript/module/sd-jwt/types.d.ts

@@ -0,0 +1,104 @@
+import { z } from "zod";
+/**
+ * For backward compatibility reasons it is still necessary to support the legacy SD-JWT
+ * in a few flows (for instance status assertion and presentation of the old eID).
+ */
+export type SupportedSdJwtLegacyFormat = typeof LEGACY_SD_JWT;
+export declare const LEGACY_SD_JWT = "vc+sd-jwt";
+/**
+ * Type for a Verifiable Credential base SD-JWT.
+ * It only contains common claims across versions.
+ */
+export type SdJwt4VCBase = z.infer<typeof SdJwt4VCBase>;
+export declare const SdJwt4VCBase: z.ZodObject<{
+    header: z.ZodObject<{
+        alg: z.ZodString;
+        kid: z.ZodString;
+        trust_chain: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        typ: z.ZodEnum<{
+            "dc+sd-jwt": "dc+sd-jwt";
+            "vc+sd-jwt": "vc+sd-jwt";
+        }>;
+        vctm: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    payload: z.ZodObject<{
+        _sd: z.ZodArray<z.ZodString>;
+        _sd_alg: z.ZodLiteral<"sha-256">;
+        cnf: z.ZodObject<{
+            jwk: z.ZodObject<{
+                alg: z.ZodOptional<z.ZodString>;
+                crv: z.ZodOptional<z.ZodString>;
+                d: z.ZodOptional<z.ZodString>;
+                dp: z.ZodOptional<z.ZodString>;
+                dq: z.ZodOptional<z.ZodString>;
+                e: z.ZodOptional<z.ZodString>;
+                ext: z.ZodOptional<z.ZodBoolean>;
+                k: z.ZodOptional<z.ZodString>;
+                key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                kid: z.ZodOptional<z.ZodString>;
+                kty: z.ZodEnum<{
+                    RSA: "RSA";
+                    EC: "EC";
+                }>;
+                n: z.ZodOptional<z.ZodString>;
+                p: z.ZodOptional<z.ZodString>;
+                q: z.ZodOptional<z.ZodString>;
+                qi: z.ZodOptional<z.ZodString>;
+                use: z.ZodOptional<z.ZodString>;
+                x: z.ZodOptional<z.ZodString>;
+                x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                x5t: z.ZodOptional<z.ZodString>;
+                "x5t#S256": z.ZodOptional<z.ZodString>;
+                x5u: z.ZodOptional<z.ZodString>;
+                y: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        exp: z.ZodNumber;
+        iat: z.ZodOptional<z.ZodNumber>;
+        iss: z.ZodString;
+        status: z.ZodUnion<readonly [z.ZodObject<{
+            status_list: z.ZodObject<{
+                idx: z.ZodNumber;
+                uri: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>, z.ZodObject<{
+            status_assertion: z.ZodObject<{
+                credential_hash_alg: z.ZodLiteral<"sha-256">;
+            }, z.core.$strip>;
+        }, z.core.$strip>]>;
+        sub: z.ZodString;
+        vct: z.ZodString;
+        "vct#integrity": z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * Object containing User authentication and User data verification information.
+ * Useful to extract the assurance level to determine L2/L3 authentication.
+ */
+export type Verification = z.infer<typeof Verification>;
+export declare const Verification: z.ZodObject<{
+    assurance_level: z.ZodString;
+    trust_framework: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Metadata for a digital credential. This information is retrieved from the URL defined in the `vct` claim.
+ *
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.0.1/en/credential-data-model.html#digital-credential-metadata-type
+ */
+export type TypeMetadata = z.infer<typeof TypeMetadata>;
+export declare const TypeMetadata: z.ZodObject<{
+    data_source: z.ZodObject<{
+        authentic_source: z.ZodObject<{
+            contacts: z.ZodArray<z.ZodString>;
+            homepage_uri: z.ZodURL;
+            logo_uri: z.ZodURL;
+            organization_code: z.ZodString;
+            organization_name: z.ZodString;
+        }, z.core.$strip>;
+        trust_framework: z.ZodString;
+    }, z.core.$strip>;
+    description: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/module/sd-jwt/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sd-jwt/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,aAAa,CAAC;AAC9D,eAAO,MAAM,aAAa,cAAc,CAAC;AAWzC;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+BvB,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,eAAO,MAAM,YAAY;;;iBAGvB,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,eAAO,MAAM,YAAY;;;;;;;;;;;;;iBAavB,CAAC"}

package/lib/typescript/module/sd-jwt/utils.d.ts

@@ -0,0 +1,19 @@
+import { TypeMetadata, Verification } from "./types.js";
+/**
+ * Retrieve the Type Metadata for a credential and verify its integrity.
+ * @param issuerUrl The Credential Issuer base url
+ * @param vct The VCT as a URN
+ * @param vctIntegrity The integrity hash
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns The credential metadata {@link TypeMetadata}
+ */
+export declare const fetchTypeMetadata: (issuerUrl: string, vct: string, vctIntegrity: string, context?: {
+    appFetch?: typeof fetch;
+}) => Promise<TypeMetadata>;
+/**
+ * Extract and validate the `verification` claim from disclosures.
+ * @param credentialSdJwt The raw credential SD-JWT
+ * @returns The verification claim or undefined if it wasn't found
+ */
+export declare const getVerification: (credentialSdJwt: string) => undefined | Verification;
+//# sourceMappingURL=utils.d.ts.map

package/lib/typescript/module/sd-jwt/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/sd-jwt/utils.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAS,CAAC;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,KAAK,MAAM,EACX,cAAc,MAAM,EACpB,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,KAAK,CAAC;CACpB,KACL,OAAO,CAAC,YAAY,CAgCtB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,iBAAiB,MAAM,KACtB,SAAS,GAAG,YAed,CAAC"}

package/lib/typescript/module/trust/api/TrustAnchorConfig.d.ts

@@ -0,0 +1,58 @@
+import * as z from "zod";
+/**
+ * Common Trust Anchor configuration
+ * @public
+ */
+export type TrustAnchorConfig = z.infer<typeof TrustAnchorConfig>;
+export declare const TrustAnchorConfig: z.ZodObject<{
+    federation_entity: z.ZodObject<{
+        contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodString>;
+        federation_fetch_endpoint: z.ZodOptional<z.ZodString>;
+        federation_historical_keys_endpoint: z.ZodOptional<z.ZodString>;
+        federation_list_endpoint: z.ZodOptional<z.ZodString>;
+        federation_resolve_endpoint: z.ZodOptional<z.ZodString>;
+        federation_trust_mark_endpoint: z.ZodOptional<z.ZodString>;
+        federation_trust_mark_list_endpoint: z.ZodOptional<z.ZodString>;
+        federation_trust_mark_status_endpoint: z.ZodOptional<z.ZodString>;
+        homepage_uri: z.ZodOptional<z.ZodString>;
+        logo_uri: z.ZodOptional<z.ZodString>;
+        organization_name: z.ZodOptional<z.ZodString>;
+        policy_uri: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+    jwt: z.ZodObject<{
+        header: z.ZodObject<{
+            alg: z.ZodString;
+            kid: z.ZodString;
+            typ: z.ZodLiteral<"entity-statement+jwt">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    keys: z.ZodArray<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodEnum<{
+            RSA: "RSA";
+            EC: "EC";
+        }>;
+        n: z.ZodOptional<z.ZodString>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+//# sourceMappingURL=TrustAnchorConfig.d.ts.map

package/lib/typescript/module/trust/api/TrustAnchorConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustAnchorConfig.d.ts","sourceRoot":"","sources":["../../../../../src/trust/api/TrustAnchorConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAKzB;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAU5B,CAAC"}

package/lib/typescript/module/trust/api/index.d.ts

@@ -0,0 +1,43 @@
+import { type X509CertificateOptions } from "@pagopa/io-react-native-crypto";
+import type { ParsedToken } from "../common/utils.js";
+import type { TrustAnchorConfig } from "./TrustAnchorConfig.js";
+export interface TrustApi {
+    /**
+     * Build a not-verified trust chain for a given Relying Party (RP) entity.
+     *
+     * @param relyingPartyEntityBaseUrl The base URL of the RP entity
+     * @param trustAnchorConfig The entity configuration of the known trust anchor.
+     * @param appFetch An optional instance of the http client to be used.
+     * @returns A list of signed tokens that represent the trust chain, in the order of the chain (from the RP to the Trust Anchor)
+     * @throws {FederationError} When an element of the chain fails to parse or other build steps fail.
+     */
+    buildTrustChain(relyingPartyEntityBaseUrl: string, trustAnchorConfig: TrustAnchorConfig, appFetch?: typeof fetch): Promise<string[]>;
+    /**
+     * Get the common Trust Anchor Configuration, which is uniform across versions.
+     *
+     * @param trustAnchorBaseUrl The Trust Anchor base URL
+     * @returns The Trust Anchor Configuration object
+     */
+    getTrustAnchorEntityConfiguration(trustAnchorBaseUrl: string, ctx?: FetchContext): Promise<TrustAnchorConfig>;
+    /**
+     * Verify a given trust chain is actually valid.
+     * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
+     *
+     * @param trustAnchorEntity The entity configuration of the known trust anchor
+     * @param chain The chain of statements to be validated
+     * @param x509Options Options for the verification process
+     * @param appFetch (optional) fetch api implementation
+     * @param renewOnFail Whether to attempt to renew the trust chain if the initial validation fails
+     * @returns The result of the chain validation
+     * @throws {FederationError} If the chain is not valid
+     */
+    verifyTrustChain(trustAnchorEntity: TrustAnchorConfig, chain: string[], x509Options?: X509CertificateOptions, ctx?: {
+        appFetch?: typeof fetch;
+        renewOnFail?: boolean;
+    }): Promise<ParsedToken[]>;
+}
+interface FetchContext {
+    appFetch?: typeof fetch;
+}
+export { type TrustAnchorConfig };
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/trust/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/trust/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAqB,CAAC;AAE7D,MAAM,WAAW,QAAQ;IACvB;;;;;;;;OAQG;IACH,eAAe,CACb,yBAAyB,EAAE,MAAM,EACjC,iBAAiB,EAAE,iBAAiB,EACpC,QAAQ,CAAC,EAAE,OAAO,KAAK,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB;;;;;OAKG;IACH,iCAAiC,CAC/B,kBAAkB,EAAE,MAAM,EAC1B,GAAG,CAAC,EAAE,YAAY,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE9B;;;;;;;;;;;OAWG;IACH,gBAAgB,CACd,iBAAiB,EAAE,iBAAiB,EACpC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,CAAC,EAAE,sBAAsB,EACpC,GAAG,CAAC,EAAE;QACJ,QAAQ,CAAC,EAAE,OAAO,KAAK,CAAC;QACxB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC3B;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,EAAE,OAAO,KAAK,CAAC;CACzB;AAED,OAAO,EAAE,KAAK,iBAAiB,EAAE,CAAC"}

package/lib/typescript/module/trust/common/build-chain.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import type { TrustApi } from "../api/index.js";
+import type { BaseEntityConfiguration, EntityStatement } from "./types.js";
+interface BuilderConfig {
+    EntityConfigurationShape: z.ZodType<BaseEntityConfiguration>;
+    EntityStatementShape: z.ZodType<EntityStatement>;
+}
+/**
+ * Factory function to create `buildTrustChain`.
+ * @param config Version specific Entity shapes
+ * @returns `buildTrustChain` function compliant with the public API
+ */
+export declare function createBuildTrustChain(config: BuilderConfig): TrustApi["buildTrustChain"];
+/**
+ * Factory function to create `gatherTrustChain`.
+ * @param config Version specific Entity shapes
+ * @returns `gatherTrustChain` function.
+ */
+export declare function createGatherTrustChain({ EntityConfigurationShape, EntityStatementShape, }: BuilderConfig): (entityBaseUrl: string, appFetch: typeof fetch, isLeaf?: boolean) => Promise<string[]>;
+export {};
+//# sourceMappingURL=build-chain.d.ts.map

package/lib/typescript/module/trust/common/build-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-chain.d.ts","sourceRoot":"","sources":["../../../../../src/trust/common/build-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,YAAS,CAAC;AAgBxE,UAAU,aAAa;IACrB,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,GACpB,QAAQ,CAAC,iBAAiB,CAAC,CA4D7B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,wBAAwB,EACxB,oBAAoB,GACrB,EAAE,aAAa,IAEZ,eAAe,MAAM,EACrB,UAAU,OAAO,KAAK,EACtB,gBAAa,KACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAgErB"}

package/lib/typescript/module/trust/common/errors.d.ts

@@ -0,0 +1,103 @@
+import type { CertificateValidationStatus } from "@pagopa/io-react-native-crypto";
+import { IoWalletError } from "../../utils/errors.js";
+/**
+ * Base class for all federation-specific errors.
+ */
+export declare class FederationError extends IoWalletError {
+    readonly details: Record<string, unknown> | undefined;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * General error thrown during the trust chain building process.
+ */
+export declare class BuildTrustChainError extends FederationError {
+    code: string;
+    constructor(message: string, details?: {
+        [key: string]: unknown;
+        relyingPartyUrl?: string;
+        trustAnchorKid?: string;
+    });
+}
+export declare class FederationListParseError extends FederationError {
+    code: string;
+    constructor(message: string, details: {
+        parseError?: string;
+        url: string;
+    });
+}
+/**
+ * Error thrown when a 'federation_fetch_endpoint' is missing in an entity's configuration.
+ */
+export declare class MissingFederationFetchEndpointError extends FederationError {
+    code: string;
+    constructor(message: string, details: {
+        entityBaseUrl: string;
+        missingInEntityUrl: string;
+    });
+}
+/**
+ * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
+ */
+export declare class MissingX509CertsError extends FederationError {
+    code: string;
+    constructor(message: string);
+}
+/**
+ * Error thrown if the Relying Party is not found in the Trust Anchor's federation list.
+ */
+export declare class RelyingPartyNotAuthorizedError extends FederationError {
+    code: string;
+    constructor(message: string, details: {
+        federationListEndpoint?: string;
+        relyingPartyUrl: string;
+    });
+}
+/**
+ * Error thrown when the Trust Anchor's key is missing a 'kid'.
+ */
+export declare class TrustAnchorKidMissingError extends FederationError {
+    code: string;
+    constructor(message?: string);
+}
+/**
+ * Error thrown when a trust chain is unexpectedly empty.
+ */
+export declare class TrustChainEmptyError extends FederationError {
+    code: string;
+    constructor(message?: string);
+}
+/**
+ * Error thrown when renewing a trust chain fails.
+ * This class itself might be used or could be considered a more general renewal error.
+ */
+export declare class TrustChainRenewalError extends FederationError {
+    code: string;
+    constructor(message: string, details?: {
+        [key: string]: unknown;
+        originalChain?: string[];
+    });
+}
+/**
+ * Error thrown when a token is unexpectedly missing from a trust chain during processing.
+ */
+export declare class TrustChainTokenMissingError extends FederationError {
+    code: string;
+    constructor(message: string, details?: {
+        index?: number;
+    });
+}
+/**
+ * Error thrown when an X.509 certificate validation fails.
+ * This is used to indicate issues with the certificate chain or signature verification.
+ */
+export declare class X509ValidationError extends FederationError {
+    code: string;
+    constructor(message: string, details?: {
+        [key: string]: unknown;
+        kid?: string;
+        tokenIndex?: number;
+        x509ErrorMessage?: string;
+        x509ValidationStatus?: CertificateValidationStatus;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/lib/typescript/module/trust/common/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../src/trust/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAElF,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAoB,CAAC;AAEnE;;GAEG;AACH,qBAAa,eAAgB,SAAQ,aAAa;IAChD,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAK/D;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;IAC9C,IAAI,SAAsC;gBAGjD,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB;CAIJ;AAED,qBAAa,wBAAyB,SAAQ,eAAe;IAClD,IAAI,SAA0C;gBAE3C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;CAG3E;AAED;;GAEG;AACH,qBAAa,mCAAoC,SAAQ,eAAe;IAC7D,IAAI,SAA+C;gBAG1D,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE;CAIjE;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;IAC/C,IAAI,SAAgC;gBACjC,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,eAAe;IACxD,IAAI,SAA0C;gBAGrD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE;CAIxE;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,eAAe;IACpD,IAAI,SAAsC;gBACvC,OAAO,SAAgD;CAGpE;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;IAC9C,IAAI,SAA+B;gBAChC,OAAO,SAAiC;CAGrD;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IAChD,IAAI,SAAwC;gBAGnD,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;CAIjE;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,eAAe;IACrD,IAAI,SAAuC;gBAExC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;CAG1D;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,eAAe;IAC7C,IAAI,SAAoC;gBAG/C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;KACpD;CAIJ"}