@pagopa/io-react-native-wallet 3.6.4 → 3.7.0

package/src/credential/presentation/api/types.ts

@@ -10,14 +10,14 @@ export type PresentationParams = z.infer<typeof PresentationParams>;
 export const PresentationParams = z.object({
   client_id: z.string().nonempty(),
   request: z.string().optional(),
-  request_uri: z.string().url().optional(),
+  request_uri: z.url().optional(),
   request_uri_method: z.enum(["get", "post"]).optional(),
   state: z.string().optional(),
 });
 
 export type WalletMetadata = z.infer<typeof WalletMetadata>;
 export const WalletMetadata = z.object({
-  authorization_endpoint: z.string().url(),
+  authorization_endpoint: z.url(),
   client_id_prefixes_supported: z.array(z.string()).optional(),
   client_id_schemes_supported: z.array(z.string()).optional(),
   request_object_signing_alg_values_supported: z.array(z.string()).optional(),

package/src/credential/presentation/index.ts

@@ -2,4 +2,4 @@ import * as Errors from "./common/errors";
 export { Errors };
 export type * from "./api";
 export { RemotePresentation as V1_0_0 } from "./v1.0.0";
-export { RemotePresentation as V1_3_3 } from "./v1.3.3";
+export { RemotePresentation as V1_4_6 } from "./v1.4.6";

package/src/credential/presentation/{v1.3.3 → v1.4.6}/01-start-flow.ts

@@ -8,16 +8,20 @@ import { InvalidQRCodeError } from "../common/errors";
 export const startFlowFromQR: RemotePresentationApi["startFlowFromQR"] = (
   params,
 ) => {
-  const parsed = PresentationParams.safeParse(params);
+  const nonNullParams = Object.fromEntries(
+    Object.entries(params).filter(([_, value]) => value !== null),
+  );
+  const parsed = PresentationParams.safeParse({
+    ...nonNullParams,
+    request_uri_method: nonNullParams.request_uri_method ?? "get",
+  });
 
   if (!parsed.success) {
     throw new InvalidQRCodeError(parsed.error.message);
   }
 
   try {
-    const validatedParams = validateAuthorizationRequestParams(parsed.data);
-
-    return validatedParams;
+    return validateAuthorizationRequestParams(parsed.data);
   } catch (e) {
     throw new InvalidQRCodeError(e instanceof Error ? e.message : String(e));
   }

package/src/credential/presentation/{v1.3.3 → v1.4.6}/02-evaluate-rp-trust.ts

@@ -1,6 +1,6 @@
 import type { RemotePresentationApi } from "../api";
 
-import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/entities";
+import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.4.6/entities";
 import { mapToRelyingPartyConfig } from "./mappers";
 
 export const evaluateRelyingPartyTrust: RemotePresentationApi["evaluateRelyingPartyTrust"] =

package/src/credential/presentation/{v1.3.3 → v1.4.6}/05-verify-request-object.ts

@@ -1,15 +1,15 @@
 import {
   ClientIdPrefix,
+  createX509HashClientId,
   extractClientIdPrefix,
   parseAuthorizeRequest as sdkParseAuthorizeRequest,
 } from "@pagopa/io-wallet-oid4vp";
-import QuickCrypto from "react-native-quick-crypto";
 
 import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
 import type { RawRequestObject } from "./types";
 
 import { partialCallbacks } from "../../../utils/callbacks";
-import { sdkConfigV1_3 } from "../../../utils/config";
+import { sdkConfigV1_4 } from "../../../utils/config";
 import { IoWalletError } from "../../../utils/errors";
 import { InvalidRequestObjectError } from "../common/errors";
 import { mapToRequestObject } from "./mappers";
@@ -21,7 +21,7 @@ export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
       callbacks: {
         verifyJwt: partialCallbacks.verifyJwt,
       },
-      config: sdkConfigV1_3,
+      config: sdkConfigV1_4,
       requestObjectJwt: requestObjectEncodedJwt,
     }).catch(mapSdkRequestObjectError);
 
@@ -30,7 +30,7 @@ export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
     const { clientId, prefix } = extractClientIdPrefix(fullClientId);
 
     if (prefix === ClientIdPrefix.X509_HASH) {
-      validateX509HashClient(rawRequestObject.header.x5c, clientId);
+      await validateX509HashClient(fullClientId, rawRequestObject.header.x5c);
     }
 
     if (
@@ -73,23 +73,16 @@ const validateOpenIDFederationClient = (
   }
 };
 
-const validateX509HashClient = (
-  certificateChain: string[],
-  x509Hash: string,
+const validateX509HashClient = async (
+  fullClientId: string,
+  certificateChain: string[] = [],
 ) => {
-  const cert = certificateChain[0];
-
-  if (!cert) {
-    throw new InvalidRequestObjectError(
-      "Certificate chain is empty, cannot validate x509_hash",
-    );
-  }
-
-  const calculatedHash = QuickCrypto.createHash("sha-256")
-    .update(cert, "base64")
-    .digest("base64url");
+  const calculatedHash = await createX509HashClientId({
+    certificateChain,
+    hash: partialCallbacks.hash,
+  });
 
-  if (x509Hash !== calculatedHash) {
+  if (fullClientId !== calculatedHash) {
     throw new InvalidRequestObjectError(
       "x509_hash does not match the hash of the x5c leaf certificate",
     );

package/src/credential/presentation/{v1.3.3 → v1.4.6}/07-send-authorization-response.ts

@@ -8,7 +8,7 @@ import type { RemotePresentationApi } from "../api";
 import { prepareVpTokenMdoc } from "../../../mdoc";
 import { prepareVpToken } from "../../../sd-jwt";
 import { partialCallbacks } from "../../../utils/callbacks";
-import { sdkConfigV1_3 } from "../../../utils/config";
+import { sdkConfigV1_4 } from "../../../utils/config";
 import { createCryptoContextFor } from "../../../utils/crypto";
 import {
   IoWalletError,
@@ -139,7 +139,7 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
           encryptJwe: partialCallbacks.encryptJwe,
           generateRandom: partialCallbacks.generateRandom,
         },
-        config: sdkConfigV1_3,
+        config: sdkConfigV1_4,
         requestObject,
         rpJwks,
         vp_token,

package/src/credential/presentation/{v1.3.3 → v1.4.6}/mappers.ts

@@ -1,7 +1,7 @@
 import type { RelyingPartyConfig } from "../api/RelyingPartyConfig";
 import type { RequestObject } from "../api/types";
 
-import { RelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/types";
+import { RelyingPartyEntityConfiguration } from "../../../trust/v1.4.6/types";
 import { createMapper } from "../../../utils/mappers";
 import { RawRequestObject } from "./types";
 

package/src/credential/status/README.md

@@ -2,7 +2,7 @@
 
 This flow is used to obtain the credential status from its credential issuer. The following methods are currently supported:
 - Status Assertion (v1.0.0)
-- Token Status List (v1.3.3)
+- Token Status List (v1.4.6)
 
 Each step in the flow is imported from the related file which is named with a sequential number.
 
@@ -100,7 +100,7 @@ return {
 ```ts
 import { IoWallet } from "@pagopa/io-react-native-wallet";
 
-const wallet = new IoWallet({ version: "1.3.3" });
+const wallet = new IoWallet({ version: "1.4.6" });
 
 const credentialIssuerUrl = "https://issuer.example.com";
 

package/src/credential/status/index.ts

@@ -1,3 +1,3 @@
 export * from "./api";
 export { CredentialStatus as V1_0_0 } from "./v1.0.0";
-export { CredentialStatus as V1_3_3 } from "./v1.3.3";
+export { CredentialStatus as V1_4_6 } from "./v1.4.6";

package/src/credential/status/{v1.3.3 → v1.4.6}/03-get-status.ts

@@ -6,14 +6,14 @@ import { IoWalletError } from "../../../utils/errors";
 
 /**
  * Mapping of status bits to their corresponding meaning as defined in the specification.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/credential-revocation.html#token-status-lists
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/credential-revocation.html#token-status-lists
  */
 const CredentialStatusMap = {
   0x00: "VALID",
   0x01: "INVALID",
   0x02: "SUSPENDED",
   0x03: "UPDATE",
-  0x0b: "ATTRIBUTE_UPDATE",
+  0x0f: "ATTRIBUTE_UPDATE",
 } as const;
 
 type CredentialStatusBit = keyof typeof CredentialStatusMap;

package/src/credential/trustmark/index.ts

@@ -1,3 +1,3 @@
 export type * from "./api";
 export { Trustmark as V1_0_0 } from "./v1.0.0";
-export { Trustmark as V1_3_3 } from "./v1.3.3";
+export { Trustmark as V1_4_6 } from "./v1.4.6";

package/src/credential/trustmark/{v1.3.3 → v1.4.6}/get-credential-trustmark.ts

@@ -3,5 +3,5 @@ import { type TrustmarkApi as Api } from "../api";
 
 export const getCredentialTrustmark: Api["getCredentialTrustmark"] =
   async () => {
-    throw new UnimplementedFeatureError("getCredentialTrustmark", "1.3.3");
+    throw new UnimplementedFeatureError("getCredentialTrustmark", "1.4.6");
   };

package/src/credentials-catalogue/api/DigitalCredentialsCatalogue.ts

@@ -73,9 +73,9 @@ export const CredentialFormat = z.object({
   configuration_id: z.string(),
   docType: z.string().optional(),
   format: z.enum(["dc+sd-jwt", "mso_mdoc"]),
-  schema_uri: z.string().url().optional(),
+  schema_uri: z.url().optional(),
   "schema_uri#integrity": z.string().optional(),
-  vct: z.string().url().optional(),
+  vct: z.url().optional(),
 });
 export type CredentialFormat = z.infer<typeof CredentialFormat>;
 
@@ -161,7 +161,7 @@ export const DigitalCredentialsCatalogue = z.object({
   iat: UnixTime,
   localization: LocalizationInfo.optional(),
   taxonomy: Taxonomy.optional(),
-  taxonomy_uri: z.string().url(),
+  taxonomy_uri: z.url(),
 });
 export type DigitalCredentialsCatalogue = z.infer<
   typeof DigitalCredentialsCatalogue

package/src/credentials-catalogue/index.ts

@@ -1,3 +1,3 @@
 export type * from "./api";
 export { CredentialsCatalogue as V1_0_0 } from "./v1.0.0";
-export { CredentialsCatalogue as V1_3_3 } from "./v1.3.3";
+export { CredentialsCatalogue as V1_4_6 } from "./v1.4.6";

package/src/credentials-catalogue/v1.0.0/types.ts

@@ -39,9 +39,9 @@ const CredentialFormat = z.object({
   configuration_id: z.string(),
   docType: z.string().optional(),
   format: z.enum(["dc+sd-jwt", "mso_mdoc"]),
-  schema_uri: z.string().url().optional(),
+  schema_uri: z.url().optional(),
   "schema_uri#integrity": z.string().optional(),
-  vct: z.string().url().optional(),
+  vct: z.url().optional(),
 });
 
 const Claim = z.object({
@@ -90,7 +90,7 @@ export const DigitalCredentialsCatalogueJwt = z.object({
     credentials: z.array(DigitalCredential),
     exp: UnixTime,
     iat: UnixTime,
-    taxonomy_uri: z.string().url(),
+    taxonomy_uri: z.url(),
   }),
 });
 export type DigitalCredentialsCatalogueJwt = z.infer<

package/src/credentials-catalogue/{v1.3.3 → v1.4.6}/fetch-and-parse-catalogue.ts

@@ -1,4 +1,4 @@
-import { getTrustAnchorEntityConfiguration } from "../../trust/v1.0.0/entities"; // TODO: use trust from v1.3.3
+import { getTrustAnchorEntityConfiguration } from "../../trust/v1.0.0/entities"; // TODO: use trust from v1.4.6
 import { type CredentialsCatalogueApi as Api } from "../api";
 import { mapToCredentialsCatalogue } from "./mappers";
 import {

package/src/credentials-catalogue/{v1.3.3 → v1.4.6}/types.ts

@@ -148,7 +148,7 @@ const JwtHeader = z.object({
 
 /**
  * Schema registry, available at a dedicated endpoint.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/registry.html#schema-registry
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/registry.html#schema-registry
  */
 export const SchemaRegistry = z.object({
   last_modified: z.string().optional(),
@@ -160,7 +160,7 @@ export type SchemaRegistry = z.infer<typeof SchemaRegistry>;
 
 /**
  * Authentic Source registry, available at a dedicated endpoint.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/registry.html#authentic-source-registry
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/registry.html#authentic-source-registry
  */
 export const AuthenticSourceRegistry = z.object({
   authentic_sources: z.array(AuthenticSource),
@@ -180,7 +180,7 @@ export type AuthenticSourceRegistry = z.infer<typeof AuthenticSourceRegistry>;
 
 /**
  * The Digital Credentials Catalogue published by the Trust Anchor.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/registry.html#digital-credentials-catalog
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/registry.html#digital-credentials-catalog
  */
 export const DigitalCredentialsCatalogueJwt = z.object({
   header: JwtHeader,
@@ -209,7 +209,7 @@ export type DigitalCredentialsCatalogueJwt = z.infer<
 /**
  * Registry discovery info, used to discover all the Registry Infrastructure endpoints.
  * This is the entrypoint to build the full catalogue.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/registry.html#registry-discovery-endpoint
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/registry.html#registry-discovery-endpoint
  */
 const RegistryDiscoveryEndpoints = z.object({
   authentic_sources: z.string(),
@@ -263,7 +263,7 @@ const TaxonomyDomain = z.object({
 /**
  * Taxonomy registry, available at a dedicated endpoint.
  * Provides a hierarchical classification of domains, classes, and purposes.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/registry.html#taxonomy
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/registry.html#taxonomy
  */
 export const TaxonomyRegistry = z.object({
   description_l10n_id: z.string(),

package/src/credentials-catalogue/{v1.3.3 → v1.4.6}/utils.ts

@@ -14,7 +14,7 @@ type FetchRegistryParams<T> = {
 /**
  * Utility to fetch an entity from the Registry Infrastructure.
  * The function supports `application/json` and signed JOSE/JWT responses.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/registry.html
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/registry.html
  *
  * @param url The url to fetch from
  * @param params.schema The Zod schema to validate the response
@@ -73,7 +73,7 @@ export const fetchRegistry = async <T>(
 /**
  * Fetch a locale bundle file from the Registry Infrastructure.
  * Bundle files are flat JSON objects mapping l10n_id keys to translated strings.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/registry.html
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/registry.html
  *
  * @param baseUri The base URI from a registry's localization object
  * @param locale The locale code (e.g. "it", "en")

package/src/index.ts

@@ -10,11 +10,13 @@ import * as RemotePresentation from "./credential/presentation";
 import * as CredentialStatus from "./credential/status";
 import * as Trustmark from "./credential/trustmark";
 import * as CredentialsCatalogue from "./credentials-catalogue";
+import * as KeyAttestation from "./key-attestation";
 import * as Mdoc from "./mdoc";
 import * as SdJwt from "./sd-jwt";
 import * as Trust from "./trust";
 import {
   createCryptoContextFor,
+  getJwkFromCertificateChain,
   type KeyAttestationCryptoContext,
 } from "./utils/crypto";
 import * as Errors from "./utils/errors";
@@ -23,7 +25,6 @@ import * as Logging from "./utils/logging";
 import { AuthorizationDetail, AuthorizationDetails } from "./utils/par";
 import * as WalletInstance from "./wallet-instance";
 import * as WalletInstanceAttestation from "./wallet-instance-attestation";
-import * as WalletUnitAttestation from "./wallet-unit-attestation";
 
 export {
   AuthorizationDetail,
@@ -35,6 +36,8 @@ export {
   CredentialStatus,
   Errors,
   fixBase64EncodingOnKey,
+  getJwkFromCertificateChain,
+  KeyAttestation,
   Logging,
   Mdoc,
   RemotePresentation,
@@ -43,7 +46,6 @@ export {
   Trustmark,
   WalletInstance,
   WalletInstanceAttestation,
-  WalletUnitAttestation,
 };
 
 export type {

package/src/{wallet-unit-attestation → key-attestation}/README.md

@@ -1,15 +1,15 @@
-# Wallet Unit Attestation
+# Key Attestation
 
-This flow is used to obtain a [**Wallet Unit Attestation**](https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/wallet-solution-requirements.html#wallet-unit-attestation-requirements). The WUA is bound to one or more cryptographic keys, that must be provided by the consumer application:
-- `keyAttestationCryptoContext` one or more objects that extend the `CryptoContext` with a function to generate a WSCD-stored key with an optional key attestation (Android only); these are the keys that will be attested in the WUA.
+This flow is used to obtain a [**Key Attestation**](https://italia.github.io/eid-wallet-it-docs/releases/1.4.6/en/wallet-solution-requirements.html#key-attestation-requirements) (KA). The Key Attestation is bound to one or more cryptographic keys, that must be provided by the consumer application:
+- `keyAttestationCryptoContext` one or more objects that extend the `CryptoContext` with a function to generate a WSCD-stored key with an optional [Android key attestation](https://developer.android.com/privacy-and-security/security-key-attestation); these are the keys that will be attested in the KA.
 - `integrityContext` object that is used to verify the integrity of the device where the app is running. The key tag must be the same used when creating the Wallet Instance.
 
 #### Note
-Before invoking `WalletUnitAttestation`'s functions, it is necessary to check whether the feature is supported by the current IoWallet instance.
+Before invoking `KeyAttestation`'s functions, it is necessary to check whether the feature is supported by the current IoWallet instance.
 ```ts
-const wallet = new IoWallet({ version: "1.3.3" });
+const wallet = new IoWallet({ version: "1.4.6" });
 
-if (wallet.WalletUnitAttestation.isSupported) {
+if (wallet.KeyAttestation.isSupported) {
   // Get the WUA
 }
 ```
@@ -46,11 +46,11 @@ const keysToAttest: KeyAttestationCryptoContext[] = [
 ];
 
 /**
- * Obtain a new Wallet Unit Attestation.
+ * Obtain a new Key Attestation.
  * WARNING: The integrity context must be the same used when creating the Wallet Instance with the same keytag.
  */
-const wallet = new IoWallet({ version: "1.3.3" });
-const issuedAttestation = await wallet.WalletUnitAttestation.getAttestation(
+const wallet = new IoWallet({ version: "1.4.6" });
+const issuedAttestation = await wallet.KeyAttestation.getAttestation(
   {
     walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
     walletSolutionId: "exampleId",

package/src/{wallet-unit-attestation → key-attestation}/api/index.ts

@@ -1,38 +1,36 @@
 import type { KeyAttestationCryptoContext } from "../../utils/crypto";
 import type { IntegrityContext } from "../../utils/integrity";
 import type {
-  DecodedWalletUnitAttestation,
+  DecodedKeyAttestation,
   WalletAttestation,
   WalletAttestationRequestParams,
 } from "./types";
 
-export type WalletUnitAttestationApi =
-  | UnsupportedApi
-  | WalletUnitAttestationSupportedApi;
+export type KeyAttestationApi = KeyAttestationSupportedApi | UnsupportedApi;
 
-export interface WalletUnitAttestationSupportedApi {
+export interface KeyAttestationSupportedApi {
   /**
-   * Decode a given JWT to get the parsed Wallet Unit Attestation object they define.
+   * Decode a given JWT to get the parsed Key Attestation object they define.
    * It ensures provided data is in a valid shape.
    *
    * It DOES NOT verify token signature.
    *
-   * @param token The encoded token that represents a valid jwt for Wallet Unit Attestation
-   * @returns The validated Wallet Unit Attestation object
+   * @param token The encoded token that represents a valid jwt for Key Attestation
+   * @returns The validated Key Attestation object
    * @throws A decoding error if the token doesn't resolve in a valid JWT
-   * @throws A validation error if the provided data doesn't result in a valid Wallet Unit Attestation
+   * @throws A validation error if the provided data doesn't result in a valid Key Attestation
    */
-  decode(token: string): DecodedWalletUnitAttestation;
+  decode(token: string): DecodedKeyAttestation;
 
   /**
-   * Request a Wallet Unit Attestation (WUA) to the Wallet provider with one or more keys to attest.
+   * Request a Key Attestation (KA) to the Wallet provider with one or more keys to attest.
    * Each key must be provided as a {@link KeyAttestationCryptoContext}.
    *
    * @param requestParams Wallet Provider data for the Wallet Attestation request
    * @param ctx.keysToAttest The list of KeyAttestationCryptoContext's of the keys to attest
    * @param ctx.integrityContext The hardware key pair associated with the Wallet Instance
    * @param ctx.appFetch (optional) Http client
-   * @returns The generated Wallet Unit Attestation with the attested keys
+   * @returns The generated Key Attestation with the attested keys
    */
   getAttestation(
     requestParams: WalletAttestationRequestParams,

package/src/{wallet-unit-attestation → key-attestation}/api/types.ts

@@ -11,13 +11,11 @@ const Status = z.object({
 });
 
 /**
- * Common Wallet Unit Attestation shape. This object is
+ * Common Key Attestation shape. This object is
  * an abstraction over the version-specific JWTs.
  */
-export type DecodedWalletUnitAttestation = z.infer<
-  typeof DecodedWalletUnitAttestation
->;
-export const DecodedWalletUnitAttestation = z.object({
+export type DecodedKeyAttestation = z.infer<typeof DecodedKeyAttestation>;
+export const DecodedKeyAttestation = z.object({
   attested_keys: z.array(JWK),
   exp: UnixTime,
   iat: UnixTime,

package/src/key-attestation/index.ts

@@ -0,0 +1,3 @@
+export type * from "./api";
+export { KeyAttestation as V1_0_0 } from "./v1.0.0";
+export { KeyAttestation as V1_4_6 } from "./v1.4.6";

package/src/key-attestation/v1.0.0/index.ts

@@ -0,0 +1,5 @@
+import type { KeyAttestationApi } from "../api";
+
+export const KeyAttestation: KeyAttestationApi = {
+  isSupported: false,
+};

package/src/key-attestation/v1.4.6/index.ts

@@ -0,0 +1,12 @@
+import type { KeyAttestationApi } from "../api";
+
+import { withMapper } from "../../utils/mappers";
+import { getAttestation } from "./issuing";
+import { mapToDecodedKeyAttestation } from "./mappers";
+import { decode } from "./utils";
+
+export const KeyAttestation: KeyAttestationApi = {
+  decode: withMapper(mapToDecodedKeyAttestation, decode),
+  getAttestation,
+  isSupported: true,
+};

package/src/{wallet-unit-attestation/v1.3.3 → key-attestation/v1.4.6}/issuing.ts

@@ -2,13 +2,13 @@ import { SignJWT, thumbprint } from "@pagopa/io-react-native-jwt";
 import { Platform } from "react-native";
 
 import type { KeyAttestationCryptoContext } from "../../utils/crypto";
-import type { WalletUnitAttestationSupportedApi } from "../api";
+import type { KeyAttestationSupportedApi } from "../api";
 
 import { getWalletProviderClient } from "../../client";
 import { IoWalletError } from "../../utils/errors";
 import { fixBase64EncodingOnKey, JWK } from "../../utils/jwk";
 import { Logger, LogLevel } from "../../utils/logging";
-import { WalletUnitAttestationResponse } from "./types";
+import { KeyAttestationResponse } from "./types";
 
 /**
  * Create a Key Attestation Request in JWT format for the provided key.
@@ -25,13 +25,13 @@ const createKeyAttestationRequest = async (
 
   if (!success) {
     throw new IoWalletError(
-      "generateKeyWithAttestation failed to generate a cryptographic key for the Wallet Unit Attestation request",
+      "generateKeyWithAttestation failed to generate a cryptographic key for the Key Attestation request",
     );
   }
 
   if (Platform.OS === "android" && !attestation) {
     throw new IoWalletError(
-      "Missing key attestation: on Android the generated key must have a key attestation to request a Wallet Unit Attestation",
+      "Missing Android key attestation: the generated key pair must be hardware-backed",
     );
   }
 
@@ -58,7 +58,7 @@ const createKeyAttestationRequest = async (
   return { cryptoContext, keyAttestationRequestJwt: requestJwt, publicKey };
 };
 
-export const getAttestation: WalletUnitAttestationSupportedApi["getAttestation"] =
+export const getAttestation: KeyAttestationSupportedApi["getAttestation"] =
   async (
     { walletProviderBaseUrl, walletSolutionId, walletSolutionVersion },
     { appFetch = fetch, integrityContext, keysToAttest: keysToAttestContexts },
@@ -141,11 +141,11 @@ export const getAttestation: WalletUnitAttestationSupportedApi["getAttestation"]
           "Content-Type": "text/plain",
         },
       })
-      .then(WalletUnitAttestationResponse.parse);
+      .then(KeyAttestationResponse.parse);
 
     Logger.log(
       LogLevel.DEBUG,
-      `Obtained Wallet Unit Attestation: ${response.key_attestation}`,
+      `Obtained Key Attestation: ${response.key_attestation}`,
     );
 
     return {

package/src/key-attestation/v1.4.6/mappers.ts

@@ -0,0 +1,10 @@
+import { createMapper } from "../../utils/mappers";
+import { DecodedKeyAttestation } from "../api/types";
+import { KeyAttestationJwt } from "./types";
+
+export const mapToDecodedKeyAttestation = createMapper<
+  KeyAttestationJwt,
+  DecodedKeyAttestation
+>((x) => x.payload, {
+  outputSchema: DecodedKeyAttestation,
+});

package/src/key-attestation/v1.4.6/types.ts

@@ -0,0 +1,20 @@
+import * as z from "zod";
+
+import { Jwt } from "../../wallet-instance-attestation/common/types";
+import { DecodedKeyAttestation } from "../api/types";
+
+export type KeyAttestationJwt = z.infer<typeof KeyAttestationJwt>;
+export const KeyAttestationJwt = z.object({
+  header: z.intersection(
+    Jwt.shape.header,
+    z.object({
+      typ: z.literal("key-attestation+jwt"),
+    }),
+  ),
+  payload: DecodedKeyAttestation, // The payload type matches the public API
+});
+
+export type KeyAttestationResponse = z.infer<typeof KeyAttestationResponse>;
+export const KeyAttestationResponse = z.object({
+  key_attestation: z.string(),
+});

package/src/{wallet-unit-attestation/v1.3.3 → key-attestation/v1.4.6}/utils.ts

@@ -1,14 +1,14 @@
 import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
 
-import { WalletUnitAttestationJwt } from "./types";
+import { KeyAttestationJwt } from "./types";
 
 /**
- * Decode a given JWT to get the parsed Wallet Unit Attestation object they define.
+ * Decode a given JWT to get the parsed Key Attestation object they define.
  * It ensures the provided data is in a valid shape, but it DOES NOT verify the signature.
  */
-export function decode(token: string): WalletUnitAttestationJwt {
+export function decode(token: string): KeyAttestationJwt {
   const decodedJwt = decodeJwt(token);
-  return WalletUnitAttestationJwt.parse({
+  return KeyAttestationJwt.parse({
     header: decodedJwt.protectedHeader,
     payload: decodedJwt.payload,
   });

package/src/sd-jwt/types.ts

@@ -77,8 +77,8 @@ export const TypeMetadata = z.object({
   data_source: z.object({
     authentic_source: z.object({
       contacts: z.array(z.string()),
-      homepage_uri: z.string().url(),
-      logo_uri: z.string().url(),
+      homepage_uri: z.url(),
+      logo_uri: z.url(),
       organization_code: z.string(),
       organization_name: z.string(),
     }),