@pagopa/io-react-native-wallet 2.5.0 → 3.0.0

package/src/mdoc/index.ts

@@ -1,4 +1,4 @@
-import { CBOR, COSE } from "@pagopa/io-react-native-iso18013";
+import { CBOR, COSE, ISO18013_7 } from "@pagopa/io-react-native-iso18013";
 import { b64utob64 } from "jsrsasign";
 import {
   verifyCertificateChain,
@@ -6,9 +6,14 @@ import {
   type PublicKey,
   type X509CertificateOptions,
 } from "@pagopa/io-react-native-crypto";
-import { MissingX509CertsError, X509ValidationError } from "../trust/errors";
+import {
+  MissingX509CertsError,
+  X509ValidationError,
+} from "../trust/common/errors";
 import { IoWalletError } from "../utils/errors";
 import { convertBase64DerToPem, getSigninJwkFromCert } from "../utils/crypto";
+import type { Presentation } from "src/credential/presentation";
+import { removePadding } from "@pagopa/io-react-native-jwt";
 export * from "./utils";
 
 export const verify = async (
@@ -92,3 +97,39 @@ const verifyMdocSignature = async (coseSign1: string, cert: string) => {
 
   if (!signatureCorrect) throw new Error("Invalid mDoc signature");
 };
+
+export const prepareVpTokenMdoc = async (
+  requestNonce: string,
+  generatedNonce: string,
+  clientId: string,
+  responseUri: string,
+  docType: string,
+  keyTag: string,
+  [verifiableCredential, presentationFrame]: Presentation
+): Promise<{
+  vp_token: string;
+}> => {
+  /* verifiableCredential is a IssuerSigned structure */
+  const documents = [
+    {
+      issuerSignedContent: b64utob64(verifiableCredential),
+      alias: keyTag,
+      docType,
+    },
+  ];
+
+  /* clientId,responseUri,requestNonce are retrieved by Auth Request Object */
+  /* create DeviceResponse as { documents: { docType, issuerSigned, deviceSigned }, version, status } */
+  const vp_token = await ISO18013_7.generateOID4VPDeviceResponse(
+    clientId,
+    responseUri,
+    requestNonce,
+    generatedNonce,
+    documents,
+    presentationFrame as ISO18013_7.AcceptedFields
+  );
+
+  return {
+    vp_token: removePadding(vp_token),
+  };
+};

package/src/mdoc/utils.ts

@@ -1,6 +1,6 @@
 import { CBOR } from "@pagopa/io-react-native-iso18013";
 import { Verification } from "../sd-jwt/types";
-import type { VerifyAndParseCredential } from "../credential/issuance";
+import type { IssuanceApi } from "../credential/issuance";
 import type { Out } from "../utils/misc";
 import { MDOC_DEFAULT_NAMESPACE } from "./const";
 
@@ -21,7 +21,9 @@ export const getParsedCredentialClaimKey = (namespace: string, key: string) =>
  * @returns The verification claim or undefined if it wasn't found
  */
 export const getVerificationFromParsedCredential = (
-  parsedCredential: Out<VerifyAndParseCredential>["parsedCredential"]
+  parsedCredential: Out<
+    IssuanceApi["verifyAndParseCredential"]
+  >["parsedCredential"]
 ) => {
   const verificationKey = getParsedCredentialClaimKey(
     `${MDOC_DEFAULT_NAMESPACE}.IT`,

package/src/sd-jwt/__test__/types.test.ts

@@ -1,80 +1,4 @@
-import { Disclosure, SdJwt4VC, Verification } from "../types";
-
-describe("SdJwt4VC", () => {
-  it("should accept a valid token", () => {
-    // example provided at https://italia.github.io/eidas-it-wallet-docs/en/pid-data-model.html
-    const token = {
-      header: {
-        typ: "dc+sd-jwt",
-        alg: "RS512",
-        kid: "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
-      },
-      payload: {
-        _sd: [
-          "0q1D5Jmav6pQaEh_J_Fcv_uNNMQIgCyhQOxqlY4l3qU",
-          "KCJ-AVNv88d-xj6sUIAOJxFnbUh3rHXDKkIH1lFqbRs",
-          "M9lo9YxDNIXrAq2qWeiCA40zpJ_zYfFdR_4AEALcRtU",
-          "czgjUk0nqRCswShChCjdS6A1-v47d_qTCSFIvIHhMoI",
-          "nGnQr7clm3tfTp8yjL_uHrDSOtzR2PVb8S7GeLdAqBQ",
-          "xNIVwlpSsaZ8CJSf0gz5x_75VRWWc6V1mlpejdCrqUs",
-        ],
-        sub: "216f8946-9ecb-4819-9309-c076f34a7e11",
-        _sd_alg: "sha-256",
-        vct: "PersonIdentificationData",
-        "vct#integrity":
-          "13e25888ac7b8a3a6d61440da787fccc81654e61085732bcacd89b36aec32675",
-        iss: "https://pidprovider.example.com",
-        issuing_country: "IT",
-        issuing_authority: "Istituto Poligrafico e Zecca dello Stato",
-        cnf: {
-          jwk: {
-            kty: "EC",
-            crv: "P-256",
-            kid: "zEv_qGSL5r0_F67j2dwEgUJmBgbMNSEJ5K_iH1PYc7A",
-            x: "0Pj7v_afNp9ETJx11JbYgkI7yQpd0rtiYuo5feuAN2o",
-            y: "XB62Um02vHqedkOzSfJ5hdtjPz-zmV9jmWh4sKgdD9o",
-          },
-        },
-        exp: 1751107255,
-        status: {
-          status_assertion: {
-            credential_hash_alg: "sha-256",
-          },
-        },
-      },
-    };
-
-    const { success } = SdJwt4VC.safeParse(token);
-
-    expect(success).toBe(true);
-  });
-});
-
-describe("Disclosure", () => {
-  it("should accept a valid disclosure", () => {
-    // example provided at https://italia.github.io/eidas-it-wallet-docs/en/pid-data-model.html
-    const value = [
-      "2GLC42sKQveCfGfryNRN9w",
-      "evidence",
-      [
-        {
-          type: "electronic_record",
-          record: {
-            type: "eidas.it.cie",
-            source: {
-              organization_name: "Ministero dell'Interno",
-              organization_id: "m_it",
-              country_code: "IT",
-            },
-          },
-        },
-      ],
-    ];
-
-    const { success } = Disclosure.safeParse(value);
-    expect(success).toBe(true);
-  });
-});
+import { Verification } from "../types";
 
 describe("Verification.time", () => {
   test.each([

package/src/sd-jwt/__test__/utils.test.ts

@@ -1,13 +1,9 @@
+import { legacyPid, pid } from "../__mocks__/sd-jwt";
 import { getVerification } from "..";
-import { pid } from "../__mocks__/sd-jwt";
-
-const { signed, token } = pid;
 
 describe("SD-JWT getVerification", () => {
   it("extracts the verification claims correctly", () => {
-    const disclosure =
-      "WyJxTGxVdkNKY3hwX3d4MVY5dHFPbFFRIiwidmVyaWZpY2F0aW9uIix7ImV2aWRlbmNlIjpbeyJhdHRlc3RhdGlvbiI6eyJkYXRlX29mX2lzc3VhbmNlIjoiMjAyNS0wNi0yMyIsInZvdWNoZXIiOnsib3JnYW5pemF0aW9uIjoiTWluaXN0ZXJvIGRlbGwnSW50ZXJubyJ9LCJ0eXBlIjoiZGlnaXRhbF9hdHRlc3RhdGlvbiIsInJlZmVyZW5jZV9udW1iZXIiOiIxMjM0NTY3ODkifSwidGltZSI6IjIwMjUtMDYtMjNUMTM6MTQ6MjVaIiwidHlwZSI6InZvdWNoIn1dLCJ0cnVzdF9mcmFtZXdvcmsiOiJpdF9jaWUiLCJhc3N1cmFuY2VfbGV2ZWwiOiJoaWdoIn1d";
-    expect(getVerification(`${signed}~${disclosure}`)).toEqual({
+    expect(getVerification(pid)).toEqual({
       evidence: [
         {
           attestation: {
@@ -26,12 +22,6 @@ describe("SD-JWT getVerification", () => {
   });
 
   it("returns undefined when the verification claim is not found", () => {
-    expect(getVerification(token)).toBeUndefined();
-  });
-
-  it("throws when the verification claim is invalid", () => {
-    const disclosure =
-      "WyJxTGxVdkNKY3hwX3d4MVY5dHFPbFFRIiwidmVyaWZpY2F0aW9uIix7InRydXN0X2ZyYW1ld29yayI6ICJpdF9jaWUiLCJhc3N1cmFuY2VfbGV2ZWwiOiAic3Vic3RhbnRpYWwifV0";
-    expect(() => getVerification(`${signed}~${disclosure}`)).toThrow();
+    expect(getVerification(legacyPid)).toBeUndefined();
   });
 });

package/src/sd-jwt/index.ts

@@ -1,177 +1,35 @@
-import { z } from "zod";
-
-import {
-  decode as decodeJwt,
-  sha256ToBase64,
-  SignJWT,
-  verify as verifyJwt,
-} from "@pagopa/io-react-native-jwt";
-import { Disclosure, type DisclosureWithEncoded, SdJwt4VC } from "./types";
-import { verifyDisclosure } from "./verifier";
-import type { JWK } from "../utils/jwk";
-import * as Errors from "./errors";
-import { Base64 } from "js-base64";
-import { type Presentation } from "../credential/presentation/types";
+import { sha256ToBase64, SignJWT } from "@pagopa/io-react-native-jwt";
+import { decodeSdJwtSync } from "@sd-jwt/decode";
+import { present } from "@sd-jwt/present";
+import { digest } from "@sd-jwt/crypto-nodejs";
+import type { Presentation } from "src/credential/presentation";
+import { SdJwt4VCBase } from "./types";
 
 export * from "./utils";
 
-const decodeDisclosure = (encoded: string): DisclosureWithEncoded => {
-  const utf8String = Base64.decode(encoded); // Decode Base64 into UTF-8 string
-  const decoded = Disclosure.parse(JSON.parse(utf8String));
-  return { decoded, encoded };
-};
-
 /**
  * Decode a given SD-JWT with Disclosures to get the parsed SD-JWT object they define.
  * It ensures provided data is in a valid shape.
  *
  * It DOES NOT verify token signature nor check disclosures are correctly referenced by the SD-JWT.
- * Use {@link verify} instead
  *
- * @function
  * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- * @param customSchema (optional) Schema to use to parse the SD-JWT. Default: SdJwt4VC
- *
  * @returns The parsed SD-JWT token and the parsed disclosures
- *
  */
-export const decode = <S extends z.ZodType<SdJwt4VC>>(
-  token: string,
-  customSchema?: S
-): {
-  sdJwt: z.infer<S>;
-  disclosures: DisclosureWithEncoded[];
-} => {
-  // token are expected in the form "sd-jwt~disclosure0~disclosure1~...~disclosureN~"
-  if (token.slice(-1) === "~") {
-    token = token.slice(0, -1);
-  }
-  const [rawSdJwt = "", ...rawDisclosures] = token.split("~");
-
-  // get the sd-jwt as object
-  // validate it's a valid SD-JWT for Verifiable Credentials
-  const decodedJwt = decodeJwt(rawSdJwt);
+export const decode = (token: string) => {
+  const decoded = decodeSdJwtSync(token, digest);
 
-  // use a custom parsed if provided, otherwise use base SdJwt4VC
-  const parser = customSchema || SdJwt4VC;
-
-  const sdJwt = parser.parse({
-    header: decodedJwt.protectedHeader,
-    payload: decodedJwt.payload,
+  const sdJwt = SdJwt4VCBase.parse({
+    header: decoded.jwt.header,
+    payload: decoded.jwt.payload,
   });
-
-  // get disclosures as list of triples
-  // validate each triple
-  // throw a validation error if at least one fails to parse
-  const disclosures = rawDisclosures.map(decodeDisclosure);
-
+  const disclosures = decoded.disclosures.map((disclosure) => ({
+    encoded: disclosure._digest,
+    decoded: [disclosure.salt, disclosure.key, disclosure.value],
+  }));
   return { sdJwt, disclosures };
 };
 
-/**
- * Select disclosures from a given SD-JWT with Disclosures.
- * Claims relate with disclosures by their name.
- *
- * @function
- * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- * @param claims The list of claims to be disclosed
- *
- * @throws {ClaimsNotFoundBetweenDisclosures} When one or more claims does not relate to any discloure.
- * @throws {ClaimsNotFoundInToken} When one or more claims are not contained in the SD-JWT token.
- * @returns The encoded token with only the requested disclosures, along with the path each claim can be found on the SD-JWT token
- *
- */
-export const disclose = async (
-  token: string,
-  claims: string[]
-): Promise<{ token: string; paths: { claim: string; path: string }[] }> => {
-  const [rawSdJwt, ...rawDisclosures] = token.split("~");
-  const { sdJwt, disclosures } = decode(token, SdJwt4VC);
-
-  // for each claim, return the path on which they are located in the SD-JWT token
-  const paths = await Promise.all(
-    claims.map(async (claim) => {
-      const disclosure = disclosures.find(
-        ({ decoded: [, name] }) => name === claim
-      );
-
-      // check every claim represents a known disclosure
-      if (!disclosure) {
-        throw new Errors.ClaimsNotFoundBetweenDisclosures(claim);
-      }
-
-      const hash = await sha256ToBase64(disclosure.encoded);
-
-      // _sd is defined in verified_claims.claims and verified_claims.verification
-      // we must look into both
-      if (sdJwt.payload._sd.includes(hash)) {
-        const index = sdJwt.payload._sd.indexOf(hash);
-        return { claim, path: `verified_claims.claims._sd[${index}]` };
-      }
-
-      throw new Errors.ClaimsNotFoundInToken(claim);
-    })
-  );
-
-  // The disclosures in the new SD-JWT aligned with version 1.0
-  // include a trailing "~" character.
-  // To avoid parsing errors, it is necessary to filter the array
-  // to remove any empty strings
-  const filteredDisclosures = rawDisclosures.filter(Boolean).filter((d) => {
-    const {
-      decoded: [, name],
-    } = decodeDisclosure(d);
-    return claims.includes(name);
-  });
-
-  // compose the final disclosed token
-  const disclosedToken = [rawSdJwt, ...filteredDisclosures].join("~");
-  return { token: disclosedToken, paths };
-};
-
-/**
- * Verify a given SD-JWT with Disclosures
- * Same as {@link decode} plus:
- *   - token signature verification
- *   - ensure disclosures are well-defined inside the SD-JWT
- *
- * @async @function
- *
- *
- * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- * @param publicKey The single public key or an array of public keys to validate the signature.
- * @param customSchema Schema to use to parse the SD-JWT
- *
- * @returns The parsed SD-JWT token and the parsed disclosures
- *
- */
-export const verify = async <S extends z.ZodType<SdJwt4VC>>(
-  token: string,
-  publicKey: JWK | JWK[],
-  customSchema?: S
-): Promise<{ sdJwt: z.infer<S>; disclosures: Disclosure[] }> => {
-  // get decoded data
-  const [rawSdJwt = ""] = token.split("~");
-  const decoded = decode(token, customSchema);
-
-  //Check signature
-  await verifyJwt(rawSdJwt, publicKey);
-
-  //Check disclosures in sd-jwt
-  const claims = [...decoded.sdJwt.payload._sd];
-
-  await Promise.all(
-    decoded.disclosures.map(
-      async (disclosure) => await verifyDisclosure(disclosure, claims)
-    )
-  );
-
-  return {
-    sdJwt: decoded.sdJwt,
-    disclosures: decoded.disclosures.map((d) => d.decoded),
-  };
-};
-
 /**
  * Prepares a Verified Presentation (VP) token to be sent as part of an
  * authorization response in an OpenID 4 Verifiable Presentations flow.
@@ -190,15 +48,15 @@ export const verify = async <S extends z.ZodType<SdJwt4VC>>(
 export const prepareVpToken = async (
   nonce: string,
   client_id: string,
-  [verifiableCredential, requestedClaims, cryptoContext]: Presentation
+  [verifiableCredential, presentationFrame, cryptoContext]: Presentation
 ): Promise<{
   vp_token: string;
 }> => {
   // Produce a VP token with only requested claims from the verifiable credential
-  const { token: vp } = await disclose(verifiableCredential, requestedClaims);
+  const vp = await present(verifiableCredential, presentationFrame, digest);
 
   // <Issuer-signed JWT>~<Disclosure 1>~<Disclosure N>~
-  const sd_hash = await sha256ToBase64(`${vp}~`);
+  const sd_hash = await sha256ToBase64(vp);
 
   const kbJwt = await new SignJWT(cryptoContext)
     .setProtectedHeader({
@@ -212,11 +70,8 @@ export const prepareVpToken = async (
     .setAudience(client_id)
     .setIssuedAt()
     .sign();
-
   // <Issuer-signed JWT>~<Disclosure 1>~...~<Disclosure N>~<KB-JWT>
-  const vp_token = [vp, kbJwt].join("~");
+  const vp_token = [vp, kbJwt].join("");
 
   return { vp_token };
 };
-
-export { SdJwt4VC, Errors };

package/src/sd-jwt/types.ts

@@ -1,24 +1,6 @@
-import { JWK } from "../utils/jwk";
 import { z } from "zod";
-
-export const UnixTime = z.number().min(0).max(2147483647000);
-export type UnixTime = z.infer<typeof UnixTime>;
-
-export type ObfuscatedDisclosures = z.infer<typeof ObfuscatedDisclosures>;
-export const ObfuscatedDisclosures = z.object({ _sd: z.array(z.string()) });
-
-/**
- * A triple of values in the form of {salt, claim name, claim value} that represent a parsed disclosure.
- *
- * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-04
- * @see https://vcstuff.github.io/draft-terbu-sd-jwt-vc/draft-terbu-oauth-sd-jwt-vc.html
- */
-export type Disclosure = z.infer<typeof Disclosure>;
-export const Disclosure = z.tuple([
-  /* salt */ z.string(),
-  /* claim name */ z.string(),
-  /* claim value */ z.unknown(),
-]);
+import { UnixTime } from "../utils/zod";
+import { JWK } from "../utils/jwk";
 
 /**
  * For backward compatibility reasons it is still necessary to support the legacy SD-JWT
@@ -27,29 +9,21 @@ export const Disclosure = z.tuple([
 export type SupportedSdJwtLegacyFormat = typeof LEGACY_SD_JWT;
 export const LEGACY_SD_JWT = "vc+sd-jwt";
 
-/**
- * Encoding depends on the serialization algorithm used when generating the disclosure tokens.
- * The SD-JWT reference itself take no decision about how to handle whitespaces in serialized objects.
- * For such reason, we may find conveninent to have encoded and decode values stored explicitly in the same structure.
- * Please note that `encoded` can always decode into `decode`, but `decode` may or may not be encoded with the same value of `encoded`
- *
- * @see https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-05.html#name-disclosures-for-object-prop
- */
-export type DisclosureWithEncoded = {
-  decoded: Disclosure;
-  encoded: string;
-};
-
 const StatusAssertion = z.object({
   credential_hash_alg: z.literal("sha-256"),
 });
 
+const StatusList = z.object({
+  idx: z.string(),
+  uri: z.string(),
+});
+
 /**
- * Type for a Verifiable Credential in SD-JWT format.
- * It supports both the older and the new data model for backward compatibility.
+ * Type for a Verifiable Credential base SD-JWT.
+ * It only contains common claims across versions.
  */
-export type SdJwt4VC = z.infer<typeof SdJwt4VC>;
-export const SdJwt4VC = z.object({
+export type SdJwt4VCBase = z.infer<typeof SdJwt4VCBase>;
+export const SdJwt4VCBase = z.object({
   header: z.object({
     typ: z.enum(["dc+sd-jwt", LEGACY_SD_JWT]),
     alg: z.string(),
@@ -58,31 +32,28 @@ export const SdJwt4VC = z.object({
     x5c: z.array(z.string()).optional(),
     vctm: z.array(z.string()).optional(),
   }),
-  payload: z.intersection(
-    z.object({
-      iss: z.string(),
-      sub: z.string(),
-      iat: UnixTime.optional(),
-      exp: UnixTime,
-      _sd_alg: z.literal("sha-256"),
-      status: z
-        .union([
-          // Credentials v1.0
-          z.object({ status_assertion: StatusAssertion }),
-          // Legacy credentials v0.7.1
-          z.object({ status_attestation: StatusAssertion }),
-        ])
-        .optional(),
-      cnf: z.object({
-        jwk: JWK,
-      }),
-      vct: z.string(),
-      "vct#integrity": z.string().optional(),
-      issuing_authority: z.string().optional(),
-      issuing_country: z.string().optional(),
+  payload: z.object({
+    _sd: z.array(z.string()),
+    _sd_alg: z.literal("sha-256"),
+    iss: z.string(),
+    sub: z.string(),
+    iat: UnixTime.optional(),
+    exp: UnixTime,
+    cnf: z.object({
+      jwk: JWK,
     }),
-    ObfuscatedDisclosures
-  ),
+    status: z.union([
+      z.object({
+        status_list: StatusList,
+      }),
+      z.object({
+        /** @deprecated Use `status.status_list` */
+        status_assertion: StatusAssertion,
+      }),
+    ]),
+    vct: z.string(),
+    "vct#integrity": z.string().optional(),
+  }),
 });
 
 /**
@@ -111,7 +82,7 @@ export const Verification = z.object({
 /**
  * Metadata for a digital credential. This information is retrieved from the URL defined in the `vct` claim.
  *
- * @see https://italia.github.io/eid-wallet-it-docs/v0.9.1/en/pid-eaa-data-model.html#digital-credential-metadata-type
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.0.1/en/credential-data-model.html#digital-credential-metadata-type
  */
 export type TypeMetadata = z.infer<typeof TypeMetadata>;
 export const TypeMetadata = z.object({
@@ -127,5 +98,4 @@ export const TypeMetadata = z.object({
       logo_uri: z.string().url(),
     }),
   }),
-  // TODO: add more fields
 });

package/src/sd-jwt/utils.ts

@@ -1,4 +1,6 @@
 import { sha256ToBase64 } from "@pagopa/io-react-native-jwt";
+import { decodeSdJwtSync, getClaimsSync } from "@sd-jwt/decode";
+import { digest } from "@sd-jwt/crypto-nodejs";
 import { hasStatusOrThrow } from "../utils/misc";
 import { TypeMetadata, Verification } from "./types";
 import {
@@ -6,8 +8,6 @@ import {
   IssuerResponseError,
   ValidationFailed,
 } from "../utils/errors";
-import { decode } from ".";
-import { getValueFromDisclosures } from "./converters";
 
 /**
  * Retrieve the Type Metadata for a credential and verify its integrity.
@@ -62,12 +62,15 @@ export const fetchTypeMetadata = async (
 export const getVerification = (
   credentialSdJwt: string
 ): Verification | undefined => {
-  const { disclosures } = decode(credentialSdJwt);
-  const verificationDisclosure = getValueFromDisclosures(
-    disclosures.map((d) => d.decoded),
-    "verification"
+  const decoded = decodeSdJwtSync(credentialSdJwt, digest);
+
+  const claims = getClaimsSync<Record<string, unknown>>(
+    decoded.jwt.payload,
+    decoded.disclosures,
+    digest
   );
-  return verificationDisclosure
-    ? Verification.parse(verificationDisclosure)
+
+  return claims.verification
+    ? Verification.parse(claims.verification)
     : undefined;
 };

package/src/trust/README.md

@@ -38,15 +38,24 @@ sequenceDiagram
 ### Validate a trust chain
 
 ```ts
-import { validateTrustChain } from "./trust";
+import { IoWallet } from "@pagopa/io-react-native-wallet";
 import { trustAnchorEntityConfiguration } from "./your-data";
 import { chain } from "./your-data"; // array of JWTs, starting from leaf
 
-const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
+const wallet = new IoWallet({ version: "1.0.0" });
+
+const result = await wallet.Trust.verifyTrustChain(
+  trustAnchorEntityConfiguration, 
+  chain, 
+  {
     connectTimeout: 3000,
     readTimeout: 3000,
     requireCrl: false,
-});
+  },
+  {
+    renewOnFail: true // Optional trust chain renewal
+  }
+);
 ```
 
 * The `chain` must be an array of signed JWT strings.
@@ -55,6 +64,9 @@ const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
 
 ### Renew a trust chain
 
+[>!NOTE]
+> Internal only
+
 ```ts
 import { renewTrustChain } from "./trust";
 
@@ -66,9 +78,11 @@ This will fetch updated JWTs from each authority in the chain.
 ### Build a trust chain
 
 ```ts
-import { buildTrustChain } from "./trust";
+import { IoWallet } from "@pagopa/io-react-native-wallet";
 
-const chain = await buildTrustChain({
+const wallet = new IoWallet({ version: "1.0.0" });
+
+const chain = await wallet.Trust.buildTrustChain({
   leaf: "https://example-leaf",
   trustAnchor: trustAnchorEntityConfiguration,
 });
@@ -90,18 +104,17 @@ const chain = await buildTrustChain({
 ### Build and Validate Example
 
 ```ts
-import {
-  buildTrustChain,
-  validateTrustChain,
-} from "./trust";
+import { IoWallet } from "@pagopa/io-react-native-wallet";
 import { trustAnchorEntityConfiguration } from "./your-data";
 
-const chain = await buildTrustChain({
+const wallet = new IoWallet({ version: "1.0.0" });
+
+const chain = await wallet.Trust.buildTrustChain({
   leaf: "https://example-leaf",
   trustAnchor: trustAnchorEntityConfiguration,
 });
 
-const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
+const result = await wallet.Trust.verifyTrustChain(trustAnchorEntityConfiguration, chain, {
   connectTimeout: 3000,
   readTimeout: 3000,
   requireCrl: true,

package/src/trust/api/TrustAnchorConfig.ts

@@ -0,0 +1,20 @@
+import * as z from "zod";
+import { JWK } from "../../utils/jwk";
+import { FederationEntityMetadata } from "../common/types";
+
+/**
+ * Common Trust Anchor configuration
+ * @public
+ */
+export type TrustAnchorConfig = z.infer<typeof TrustAnchorConfig>;
+export const TrustAnchorConfig = z.object({
+  jwt: z.object({
+    header: z.object({
+      typ: z.literal("entity-statement+jwt"),
+      alg: z.string(),
+      kid: z.string(),
+    }),
+  }),
+  keys: z.array(JWK),
+  federation_entity: FederationEntityMetadata,
+});