@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/credential/presentation/v1.0.0/07-send-authorization-response.ts

@@ -1,7 +1,11 @@
 import { EncryptJwe } from "@pagopa/io-react-native-jwt";
-import { NoSuitableKeysFoundInEntityConfiguration } from "../common/errors";
-import { hasStatusOrThrow } from "../../../utils/misc";
+
 import type { JWK } from "../../../utils/jwk";
+import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
+import type { RequestObject } from "../api/types";
+
+import { prepareVpToken } from "../../../sd-jwt";
+import { createCryptoContextFor } from "../../../utils/crypto";
 import {
   IoWalletError,
   RelyingPartyResponseError,
@@ -9,13 +13,11 @@ import {
   ResponseErrorBuilder,
   UnexpectedStatusCodeError,
 } from "../../../utils/errors";
-import { prepareVpToken } from "../../../sd-jwt";
-import type { RequestObject } from "../api/types";
-import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
+import { hasStatusOrThrow } from "../../../utils/misc";
+import { NoSuitableKeysFoundInEntityConfiguration } from "../common/errors";
+import { buildDirectPostBody } from "../common/utils/http";
 import { AuthorizationResponse, DirectAuthorizationBodyPayload } from "./types";
 import { getJwksFromRpConfig } from "./utils.jwks";
-import { buildDirectPostBody } from "../common/utils/http";
-import { createCryptoContextFor } from "../../../utils/crypto";
 
 /**
  * Selects a public key (with `use = enc`) from the set of JWK keys
@@ -34,7 +36,7 @@ export const choosePublicKeyToEncrypt = (rpJwkKeys: JWK[]): JWK => {
 
   // No suitable key found
   throw new NoSuitableKeysFoundInEntityConfiguration(
-    "No suitable public key found for encryption."
+    "No suitable public key found for encryption.",
   );
 };
 
@@ -49,7 +51,7 @@ export const choosePublicKeyToEncrypt = (rpJwkKeys: JWK[]): JWK => {
 export const buildDirectPostJwtBody = async (
   requestObject: RequestObject,
   rpConf: RelyingPartyConfig,
-  payload: DirectAuthorizationBodyPayload
+  payload: DirectAuthorizationBodyPayload,
 ): Promise<string> => {
   type Jwe = ConstructorParameters<typeof EncryptJwe>[1];
 
@@ -97,16 +99,16 @@ export const prepareRemotePresentations: RemotePresentationApi["prepareRemotePre
             item.credential,
             item.presentationFrame,
             createCryptoContextFor(item.keyTag),
-          ]
+          ],
         );
 
         return {
-          requestedClaims: item.requiredDisclosures.map(({ name }) => name),
           credentialId: item.id,
-          vpToken: vp_token,
           format: item.format,
+          requestedClaims: item.requiredDisclosures.map(({ name }) => name),
+          vpToken: vp_token,
         };
-      })
+      }),
     );
 
     return { presentations };
@@ -117,11 +119,11 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
     requestObject,
     remotePresentation,
     rpConf,
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     if (!rpConf) {
       throw new IoWalletError(
-        "Relying Party Configuration is required for OpenID Federation clients"
+        "Relying Party Configuration is required for OpenID Federation clients",
       );
     }
 
@@ -133,17 +135,17 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
           ...acc,
           [presentation.credentialId]: presentation.vpToken,
         }),
-        {} as Record<string, string>
+        {} as Record<string, string>,
       ),
     });
 
     // 2. Send the authorization response via HTTP POST and validate the response
     return await appFetch(requestObject.response_uri, {
-      method: "POST",
+      body: requestBody,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
       },
-      body: requestBody,
+      method: "POST",
     })
       .then(hasStatusOrThrow(200))
       .then((res) => res.json())
@@ -155,7 +157,7 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
   async (
     requestObject,
     { error, errorDescription },
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     const requestBody = await buildDirectPostBody(requestObject, {
       error,
@@ -163,11 +165,11 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
     });
 
     return await appFetch(requestObject.response_uri, {
-      method: "POST",
+      body: requestBody,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
       },
-      body: requestBody,
+      method: "POST",
     })
       .then(hasStatusOrThrow(200, RelyingPartyResponseError))
       .then((res) => res.json())

package/src/credential/presentation/v1.0.0/index.ts

@@ -1,4 +1,5 @@
 import type { RemotePresentationApi } from "../api";
+
 import { startFlowFromQR } from "./01-start-flow";
 import { evaluateRelyingPartyTrust } from "./02-evaluate-rp-trust";
 import { getRequestObject } from "./03-get-request-object";
@@ -6,17 +7,17 @@ import { verifyRequestObject } from "./05-verify-request-object";
 import { evaluateDcqlQuery } from "./06-evaluate-dcql-query";
 import {
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
 } from "./07-send-authorization-response";
 
 export const RemotePresentation: RemotePresentationApi = {
-  startFlowFromQR,
+  evaluateDcqlQuery,
   evaluateRelyingPartyTrust,
   getRequestObject,
-  verifyRequestObject,
-  evaluateDcqlQuery,
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
+  startFlowFromQR,
+  verifyRequestObject,
 };

package/src/credential/presentation/v1.0.0/mappers.ts

@@ -1,7 +1,8 @@
-import { createMapper } from "../../../utils/mappers";
-import { RelyingPartyEntityConfiguration } from "../../../trust/v1.0.0/types";
 import type { RelyingPartyConfig } from "../api";
 import type { RequestObject } from "../api/types";
+
+import { RelyingPartyEntityConfiguration } from "../../../trust/v1.0.0/types";
+import { createMapper } from "../../../utils/mappers";
 import { RawRequestObject } from "./types";
 
 export const mapToRelyingPartyConfig = createMapper<
@@ -10,26 +11,26 @@ export const mapToRelyingPartyConfig = createMapper<
 >(({ payload }) => {
   const { federation_entity, openid_credential_verifier } = payload.metadata;
   return {
-    subject: payload.sub,
-    jwks: openid_credential_verifier.jwks,
     authorization_encrypted_response_alg:
       openid_credential_verifier.authorization_encrypted_response_alg,
     authorization_encrypted_response_enc:
       openid_credential_verifier.authorization_encrypted_response_enc,
     federation_entity,
+    jwks: openid_credential_verifier.jwks,
+    subject: payload.sub,
   };
 });
 
 export const mapToRequestObject = createMapper<RawRequestObject, RequestObject>(
   ({ header, payload }) => ({
-    iss: payload.iss,
     client_id: payload.client_id,
     dcql_query: payload.dcql_query,
+    iss: payload.iss,
     nonce: payload.nonce,
-    response_uri: payload.response_uri,
-    state: payload.state,
     response_mode: payload.response_mode,
     response_type: payload.response_type,
+    response_uri: payload.response_uri,
+    state: payload.state,
     trust_chain: header.trust_chain,
-  })
+  }),
 );

package/src/credential/presentation/v1.0.0/types.ts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+
 import { UnixTime } from "../../../utils/zod";
 import { ErrorResponse } from "../api/types";
 
@@ -7,22 +8,22 @@ export const RawRequestObject = z.object({
   header: z.object({
     alg: z.string(),
     kid: z.string(),
-    typ: z.literal("oauth-authz-req+jwt"),
     trust_chain: z.array(z.string()).optional(),
+    typ: z.literal("oauth-authz-req+jwt"),
   }),
   payload: z.object({
-    iss: z.string(),
-    iat: UnixTime,
+    client_id: z.string(),
+    dcql_query: z.record(z.string(), z.any()), // Validation happens within the `dcql` library, no need to duplicate it here
     exp: UnixTime,
-    state: z.string(),
+    iat: UnixTime,
+    iss: z.string(),
     nonce: z.string(),
-    response_uri: z.string(),
     request_uri_method: z.string().optional(),
-    response_type: z.literal("vp_token"),
     response_mode: z.literal("direct_post.jwt"),
-    client_id: z.string(),
-    dcql_query: z.record(z.string(), z.any()), // Validation happens within the `dcql` library, no need to duplicate it here
+    response_type: z.literal("vp_token"),
+    response_uri: z.string(),
     scope: z.string().optional(),
+    state: z.string(),
     wallet_nonce: z.string().optional(),
   }),
 });
@@ -42,7 +43,7 @@ export const DirectAuthorizationBodyPayload = z.union([
 
 export type AuthorizationResponse = z.infer<typeof AuthorizationResponse>;
 export const AuthorizationResponse = z.object({
-  status: z.string().optional(),
-  response_code: z.string().optional(),
   redirect_uri: z.string().optional(),
+  response_code: z.string().optional(),
+  status: z.string().optional(),
 });

package/src/credential/presentation/v1.0.0/utils.jwks.ts

@@ -1,13 +1,14 @@
-import { JWKS, type JWK } from "../../../utils/jwk";
 import type { RelyingPartyConfig } from "../api";
 
+import { type JWK, JWKS } from "../../../utils/jwk";
+
 /**
  * Fetches the JSON Web Key Set (JWKS) from the Relying Party's Entity Configuration.
  * @param rpConfig - The Relying Party's common configuration,
  * @returns An object containing an array of JSON Web Keys (JWKs).
  */
 export const getJwksFromRpConfig = (
-  rpConfig: RelyingPartyConfig
+  rpConfig: RelyingPartyConfig,
 ): { keys: JWK[] } => {
   const jwks = rpConfig.jwks.keys;
 
@@ -18,7 +19,7 @@ export const getJwksFromRpConfig = (
   const parsed = JWKS.safeParse({ keys: jwks });
   if (!parsed.success) {
     throw new Error(
-      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)"
+      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)",
     );
   }
 

package/src/credential/presentation/v1.0.0/utils.ts

@@ -1,13 +1,14 @@
-import { JWKS, type JWK } from "../../../utils/jwk";
 import type { RelyingPartyConfig } from "../api";
 
+import { type JWK, JWKS } from "../../../utils/jwk";
+
 /**
  * Fetches the JSON Web Key Set (JWKS) from the Relying Party's Entity Configuration.
  * @param rpConfig - The Relying Party's common configuration,
  * @returns An object containing an array of JSON Web Keys (JWKs).
  */
 export const getJwksFromRpConfig = (
-  rpConfig: RelyingPartyConfig
+  rpConfig: RelyingPartyConfig,
 ): { keys: JWK[] } => {
   const jwks = rpConfig.jwks.keys;
 
@@ -18,7 +19,7 @@ export const getJwksFromRpConfig = (
   const parsed = JWKS.safeParse({ keys: jwks });
   if (!parsed.success) {
     throw new Error(
-      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)"
+      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)",
     );
   }
 

package/src/credential/presentation/{v1.3.3 → v1.4.6}/01-start-flow.ts

@@ -1,21 +1,27 @@
-import { InvalidQRCodeError } from "../common/errors";
+import { validateAuthorizationRequestParams } from "@pagopa/io-wallet-oid4vp";
+
 import type { RemotePresentationApi } from "../api";
+
 import { PresentationParams } from "../api/types";
-import { validateAuthorizationRequestParams } from "@pagopa/io-wallet-oid4vp";
+import { InvalidQRCodeError } from "../common/errors";
 
 export const startFlowFromQR: RemotePresentationApi["startFlowFromQR"] = (
-  params
+  params,
 ) => {
-  const parsed = PresentationParams.safeParse(params);
+  const nonNullParams = Object.fromEntries(
+    Object.entries(params).filter(([_, value]) => value !== null),
+  );
+  const parsed = PresentationParams.safeParse({
+    ...nonNullParams,
+    request_uri_method: nonNullParams.request_uri_method ?? "get",
+  });
 
   if (!parsed.success) {
     throw new InvalidQRCodeError(parsed.error.message);
   }
 
   try {
-    const validatedParams = validateAuthorizationRequestParams(parsed.data);
-
-    return validatedParams;
+    return validateAuthorizationRequestParams(parsed.data);
   } catch (e) {
     throw new InvalidQRCodeError(e instanceof Error ? e.message : String(e));
   }

package/src/credential/presentation/{v1.3.3 → v1.4.6}/02-evaluate-rp-trust.ts

@@ -1,12 +1,13 @@
-import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/entities";
 import type { RemotePresentationApi } from "../api";
+
+import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.4.6/entities";
 import { mapToRelyingPartyConfig } from "./mappers";
 
 export const evaluateRelyingPartyTrust: RemotePresentationApi["evaluateRelyingPartyTrust"] =
   async (rpUrl, { appFetch = fetch } = {}) => {
     const rpEntityConfiguration = await getRelyingPartyEntityConfiguration(
       rpUrl,
-      { appFetch }
+      { appFetch },
     );
 
     const rpConf = mapToRelyingPartyConfig(rpEntityConfiguration);

package/src/credential/presentation/{v1.3.3 → v1.4.6}/03-get-request-object.ts

@@ -1,12 +1,14 @@
+import { fetchAuthorizationRequest as sdkFetchAuthorizationRequest } from "@pagopa/io-wallet-oid4vp";
+
 import type { RemotePresentationApi } from "../api";
+
 import { RequestObjectWalletCapabilities } from "../api/types";
-import { fetchAuthorizationRequest as sdkFetchAuthorizationRequest } from "@pagopa/io-wallet-oid4vp";
 import { mapSdkFetchAuthRequestError } from "./sdkErrorMapper";
 
 export const getRequestObject: RemotePresentationApi["getRequestObject"] =
   async (
     authorizationRequestUrl,
-    { appFetch = fetch, walletCapabilities } = {}
+    { appFetch = fetch, walletCapabilities } = {},
   ) => {
     const walletParams = walletCapabilities
       ? (() => {

package/src/credential/presentation/{v1.3.3 → v1.4.6}/04-verify-certificate-chain.ts

@@ -1,9 +1,11 @@
-import type { RemotePresentationApi } from "../api";
-import { decode } from "@pagopa/io-react-native-jwt";
 import {
   verifyCertificateChain,
   type X509CertificateOptions,
 } from "@pagopa/io-react-native-crypto";
+import { decode } from "@pagopa/io-react-native-jwt";
+
+import type { RemotePresentationApi } from "../api";
+
 import {
   MissingX509CertsError,
   X509ValidationError,
@@ -13,9 +15,9 @@ import { Logger, LogLevel } from "../../../utils/logging";
 export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAuthRequestCertificateChain"] =
   async (requestObjectJwt, { caRootCert }) => {
     const x509Options: X509CertificateOptions = {
-      requireCrl: false,
       connectTimeout: 10_000,
       readTimeout: 10_000,
+      requireCrl: false,
     };
 
     const requestObject = decode(requestObjectJwt);
@@ -24,7 +26,7 @@ export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAut
 
     if (!x5c) {
       throw new MissingX509CertsError(
-        "No certificate chain (x5c) found in the Request Object"
+        "No certificate chain (x5c) found in the Request Object",
       );
     }
 
@@ -39,17 +41,17 @@ export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAut
     const validationResult = await verifyCertificateChain(
       certChain,
       caRootCert,
-      x509Options
+      x509Options,
     );
 
     if (!validationResult.isValid) {
       Logger.log(
         LogLevel.ERROR,
-        `Certificate chain failure: ${validationResult.validationStatus} - ${validationResult.errorMessage}`
+        `Certificate chain failure: ${validationResult.validationStatus} - ${validationResult.errorMessage}`,
       );
 
       throw new X509ValidationError(
-        `X.509 certificate chain validation failed. Status: ${validationResult.validationStatus}. Error: ${validationResult.errorMessage}`
+        `X.509 certificate chain validation failed. Status: ${validationResult.validationStatus}. Error: ${validationResult.errorMessage}`,
       );
     }
 

package/src/credential/presentation/{v1.3.3 → v1.4.6}/05-verify-request-object.ts

@@ -1,34 +1,36 @@
-import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
 import {
-  parseAuthorizeRequest as sdkParseAuthorizeRequest,
   ClientIdPrefix,
+  createX509HashClientId,
   extractClientIdPrefix,
+  parseAuthorizeRequest as sdkParseAuthorizeRequest,
 } from "@pagopa/io-wallet-oid4vp";
-import QuickCrypto from "react-native-quick-crypto";
+
+import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
+import type { RawRequestObject } from "./types";
+
 import { partialCallbacks } from "../../../utils/callbacks";
-import { sdkConfigV1_3 } from "../../../utils/config";
+import { sdkConfigV1_4 } from "../../../utils/config";
 import { IoWalletError } from "../../../utils/errors";
 import { InvalidRequestObjectError } from "../common/errors";
-import { mapSdkRequestObjectError } from "./sdkErrorMapper";
 import { mapToRequestObject } from "./mappers";
-import type { RawRequestObject } from "./types";
+import { mapSdkRequestObjectError } from "./sdkErrorMapper";
 
 export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
   async (requestObjectEncodedJwt, { clientId: fullClientId, rpConf }) => {
     const parsedRequestObject = await sdkParseAuthorizeRequest({
-      config: sdkConfigV1_3,
-      requestObjectJwt: requestObjectEncodedJwt,
       callbacks: {
         verifyJwt: partialCallbacks.verifyJwt,
       },
+      config: sdkConfigV1_4,
+      requestObjectJwt: requestObjectEncodedJwt,
     }).catch(mapSdkRequestObjectError);
 
     const rawRequestObject = parsedRequestObject as RawRequestObject;
 
-    const { prefix, clientId } = extractClientIdPrefix(fullClientId);
+    const { clientId, prefix } = extractClientIdPrefix(fullClientId);
 
     if (prefix === ClientIdPrefix.X509_HASH) {
-      validateX509HashClient(rawRequestObject.header.x5c, clientId);
+      await validateX509HashClient(fullClientId, rawRequestObject.header.x5c);
     }
 
     if (
@@ -39,7 +41,7 @@ export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
         rawRequestObject,
         fullClientId,
         clientId,
-        rpConf
+        rpConf,
       );
     }
 
@@ -52,11 +54,11 @@ const validateOpenIDFederationClient = (
   requestObject: RawRequestObject,
   fullClientId: string,
   clientId: string,
-  rpConf: RelyingPartyConfig | undefined
+  rpConf: RelyingPartyConfig | undefined,
 ) => {
   if (!rpConf) {
     throw new IoWalletError(
-      "Relying Party Configuration is required for OpenID Federation clients"
+      "Relying Party Configuration is required for OpenID Federation clients",
     );
   }
 
@@ -66,22 +68,23 @@ const validateOpenIDFederationClient = (
 
   if (!isClientIdMatch) {
     throw new InvalidRequestObjectError(
-      "Client ID does not match Request Object or Entity Configuration"
+      "Client ID does not match Request Object or Entity Configuration",
     );
   }
 };
 
-const validateX509HashClient = (
-  certificateChain: string[],
-  x509Hash: string
+const validateX509HashClient = async (
+  fullClientId: string,
+  certificateChain: string[] = [],
 ) => {
-  const calculatedHash = QuickCrypto.createHash("sha-256")
-    .update(certificateChain[0]!, "base64")
-    .digest("base64url");
+  const calculatedHash = await createX509HashClientId({
+    certificateChain,
+    hash: partialCallbacks.hash,
+  });
 
-  if (x509Hash !== calculatedHash) {
+  if (fullClientId !== calculatedHash) {
     throw new InvalidRequestObjectError(
-      "x509_hash does not match the hash of the x5c leaf certificate"
+      "x509_hash does not match the hash of the x5c leaf certificate",
     );
   }
 };

package/src/credential/presentation/{v1.3.3 → v1.4.6}/06-evaluate-dcql-query.ts

@@ -1,16 +1,18 @@
-import { DcqlQuery, DcqlError } from "dcql";
+import { DcqlError, DcqlQuery } from "dcql";
 import { isValiError } from "valibot";
-import { CredentialsNotFoundError } from "../common/errors";
-import type { CredentialPurpose } from "../api/06-evaluate-dcql-query";
-import * as sdJwtUtils from "../common/utils/sd-jwt";
-import * as mdocUtils from "../common/utils/mdoc";
+
 import type { Credential4Dcql, RemotePresentationApi } from "../api";
+import type { CredentialPurpose } from "../api/06-evaluate-dcql-query";
+
+import { CredentialsNotFoundError } from "../common/errors";
 import {
   extractFailedCredentialsDetails,
-  getDcqlQueryMatches,
   getClaimsFromDcqlMatch,
+  getDcqlQueryMatches,
   getPresentationFrameFromDcqlMatch,
 } from "../common/utils/dcql";
+import * as mdocUtils from "../common/utils/mdoc";
+import * as sdJwtUtils from "../common/utils/sd-jwt";
 
 export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
   async (query, credentialsSdJwt, credentialsMdoc = []) => {
@@ -27,7 +29,7 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
         ...acc,
         ["vct" in c ? c.vct : c.doctype]: c.original_credential,
       }),
-      {} as Record<string, Credential4Dcql>
+      {} as Record<string, Credential4Dcql>,
     );
 
     try {
@@ -39,7 +41,7 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
 
       if (!queryResult.can_be_satisfied) {
         throw new CredentialsNotFoundError(
-          extractFailedCredentialsDetails(queryResult)
+          extractFailedCredentialsDetails(queryResult),
         );
       }
 
@@ -55,61 +57,73 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
 
         if (matchOutput?.credential_format === "dc+sd-jwt") {
           const { vct } = matchOutput;
-          const [keyTag, credential] = credentialsById[vct]!;
+          const sdjwtCredential = credentialsById[vct];
+          if (!sdjwtCredential) {
+            throw new Error(
+              `Credential with vct ${vct} not found in the provided credentials.`,
+            );
+          }
+          const [keyTag, credential] = sdjwtCredential;
 
           const requiredDisclosures = getClaimsFromDcqlMatch(match);
           const presentationFrame = getPresentationFrameFromDcqlMatch(
             match,
-            parsedQuery
+            parsedQuery,
           );
 
           return {
+            credential,
+            format: matchOutput.credential_format,
             id,
-            vct,
             keyTag,
-            format: matchOutput.credential_format,
-            credential,
-            requiredDisclosures,
             presentationFrame,
             // When it is a match but no credential_sets are found, the credential is required by default
             // See https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.4.2
             purposes: purposes ?? [{ required: true }],
+            requiredDisclosures,
+            vct,
           };
         }
 
         if (matchOutput?.credential_format === "mso_mdoc") {
           const { doctype } = matchOutput;
-          const [keyTag, credential] = credentialsById[doctype]!;
+          const mdocCredential = credentialsById[doctype];
+          if (!mdocCredential) {
+            throw new Error(
+              `Credential with doctype ${doctype} not found in the provided credentials.`,
+            );
+          }
+          const [keyTag, credential] = mdocCredential;
 
           const requiredDisclosures = mdocUtils.getClaimsFromDcqlMatch(match);
           const presentationFrame = mdocUtils.getPresentationFrameFromClaims(
             requiredDisclosures,
-            doctype
+            doctype,
           );
 
           return {
-            id,
+            credential,
             doctype,
-            keyTag,
             format: matchOutput.credential_format,
-            credential,
-            requiredDisclosures,
+            id,
+            keyTag,
             presentationFrame,
             purposes: purposes ?? [{ required: true }],
+            requiredDisclosures,
           };
         }
 
         throw new Error(
-          `Unsupported credential format: ${matchOutput?.credential_format}`
+          `Unsupported credential format: ${matchOutput?.credential_format}`,
         );
       });
     } catch (error) {
       // Invalid DCQL query structure. Remap to `DcqlError` for consistency.
       if (isValiError(error)) {
         throw new DcqlError({
-          message: "Failed to parse the provided DCQL query",
-          code: "PARSE_ERROR",
           cause: error.issues,
+          code: "PARSE_ERROR",
+          message: "Failed to parse the provided DCQL query",
         });
       }