@pagopa/io-wallet-oid4vci 1.2.0 → 1.3.0

package/dist/index.js

@@ -91,83 +91,80 @@ var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
 
 // src/errors.ts
 var Oid4vciError = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "Oid4vciError";
+    this.statusCode = options?.statusCode;
   }
 };
 var WalletProviderError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "WalletProviderError";
-    this.cause = cause;
   }
 };
 var NonceRequestError = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "NonceRequestError";
+    this.statusCode = options?.statusCode;
   }
 };
 var FetchCredentialResponseError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "FetchCredentialResponseError";
-    this.cause = cause;
   }
 };
 var ParseCredentialRequestError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "ParseCredentialRequestError";
-    this.cause = cause;
   }
 };
 var FetchMetadataError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
-    this.cause = cause;
+  constructor(message, options) {
+    super(message, options);
     this.name = "FetchMetadataError";
   }
 };
 var CreateCredentialResponseError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateCredentialResponseError";
-    this.cause = cause;
   }
 };
 var VerifyCredentialRequestJwtProofError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "VerifyCredentialRequestJwtProofError";
-    this.cause = cause;
   }
 };
 var VerifyKeyAttestationJwtError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "VerifyKeyAttestationJwtError";
-    this.cause = cause;
   }
 };
 var CredentialOfferError = class extends Oid4vciError {
-  constructor(message, statusCode) {
-    super(message, statusCode);
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "CredentialOfferError";
+    this.statusCode = options?.statusCode;
   }
 };
 var MissingDpopProofError = class extends Oid4vciError {
-  constructor(message = "Credential request is missing required 'DPoP' proof header") {
-    super(message);
+  constructor(message = "Credential request is missing required 'DPoP' proof header", options) {
+    super(message, options);
     this.name = "MissingDpopProofError";
   }
 };
 var CredentialAuthorizationHeaderError = class extends Oid4vciError {
-  constructor(message = "Credential request is missing required 'Authorization' header with DPoP scheme") {
-    super(message);
+  constructor(message = "Credential request is missing required 'Authorization' header with DPoP scheme", options) {
+    super(message, options);
     this.name = "CredentialAuthorizationHeaderError";
   }
 };
@@ -559,8 +556,9 @@ var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/v1.3/z-credential.ts
 var import_zod5 = require("zod");
+var zCredentialRequestProofJwt = import_zod5.z.string().min(1, "JWT must not be empty in credential request proofs array");
 var zCredentialRequestProofs = import_zod5.z.object({
-  jwt: import_zod5.z.array(import_zod5.z.string().min(1, "JWT must not be empty")).min(1, "At least one JWT proof is required")
+  jwt: import_zod5.z.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
 });
 var zCredentialRequestV1_3 = zBaseCredentialRequest.extend({
   proofs: zCredentialRequestProofs.describe(
@@ -574,7 +572,8 @@ var zCredentialRequestV1_3 = zBaseCredentialRequest.extend({
 var createCredentialRequest2 = async (options) => {
   try {
     const { maxBatchSize, signers } = options;
-    if (signers.length === 0) {
+    const [firstSigner, ...otherSigners] = signers;
+    if (!firstSigner) {
       throw new import_io_wallet_utils4.ValidationError("At least one signer is required");
     }
     if (maxBatchSize !== void 0) {
@@ -607,29 +606,28 @@ var createCredentialRequest2 = async (options) => {
         );
       }
     }
-    const proofJwts = await Promise.all(
-      signers.map(
-        (signer) => signJwt(signer, {
-          header: {
-            alg: signer.alg,
-            jwk: signer.publicJwk,
-            key_attestation: options.keyAttestation,
-            typ: "openid4vci-proof+jwt"
-          },
-          payload: {
-            aud: options.issuerIdentifier,
-            iat: (0, import_io_wallet_utils4.dateToSeconds)(/* @__PURE__ */ new Date()),
-            iss: options.clientId,
-            nonce: options.nonce
-          }
-        })
-      )
-    );
+    const createProofJwt = async (signer) => (await signJwt(signer, {
+      header: {
+        alg: signer.alg,
+        jwk: signer.publicJwk,
+        key_attestation: options.keyAttestation,
+        typ: "openid4vci-proof+jwt"
+      },
+      payload: {
+        aud: options.issuerIdentifier,
+        iat: (0, import_io_wallet_utils4.dateToSeconds)(/* @__PURE__ */ new Date()),
+        iss: options.clientId,
+        nonce: options.nonce
+      }
+    })).jwt;
+    const proofJwts = await Promise.all([
+      createProofJwt(firstSigner),
+      ...otherSigners.map(createProofJwt)
+    ]);
     return (0, import_io_wallet_utils4.parseWithErrorHandling)(zCredentialRequestV1_3, {
       credential_identifier: options.credential_identifier,
       proofs: {
-        jwt: proofJwts.map((proofJwt) => proofJwt.jwt)
-        // Array for batch support
+        jwt: proofJwts
       }
     });
   } catch (error) {
@@ -717,7 +715,10 @@ function validateTransactionContext(options) {
   }
 }
 function parseProofJwt(options) {
-  const decoded = (0, import_io_wallet_oauth23.decodeJwt)({ jwt: options.jwt });
+  const decoded = (0, import_io_wallet_oauth23.decodeJwt)({
+    errorMessagePrefix: "Error decoding credential request proof JWT:",
+    jwt: options.jwt
+  });
   const headerValidation = options.itWalletSpecsVersion === import_io_wallet_utils6.ItWalletSpecsVersion.V1_3 ? zProofJwtHeaderV1_3.safeParse(decoded.header) : zProofJwtHeaderV1_0.safeParse(decoded.header);
   if (!headerValidation.success) {
     throw new import_io_wallet_utils6.ValidationError(
@@ -889,7 +890,7 @@ function parseCredentialRequest(options) {
     }
     throw new ParseCredentialRequestError(
       `Unexpected error during credential request parsing: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
@@ -897,16 +898,17 @@ function parseCredentialRequest(options) {
 // src/credential-request/verify-credential-request-jwt-proof.ts
 var import_oauth24 = require("@openid4vc/oauth2");
 var import_io_wallet_oauth26 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/verify-key-attestation-jwt.ts
 var import_oauth23 = require("@openid4vc/oauth2");
 var import_io_wallet_oauth25 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
 
 // src/wallet-provider/z-key-attestation.ts
 var import_io_wallet_oauth24 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid_federation = require("@pagopa/io-wallet-oid-federation");
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
 var import_zod7 = require("zod");
 var zStatusList = import_zod7.z.object({
   idx: import_zod7.z.number(),
@@ -915,14 +917,7 @@ var zStatusList = import_zod7.z.object({
 var zKeyAttestationStatus = import_zod7.z.object({
   status_list: zStatusList
 });
-var zKeyAttestationAlg = import_zod7.z.enum([
-  "ES256",
-  "ES384",
-  "ES512",
-  "PS256",
-  "PS384",
-  "PS512"
-]);
+var zKeyAttestationAlg = import_io_wallet_utils7.zItwSupportedSignatureAlg;
 var zKeyAttestationHeader = import_zod7.z.object({
   alg: zKeyAttestationAlg,
   kid: import_zod7.z.string(),
@@ -947,6 +942,7 @@ var keyAttestationTypeHeader = zKeyAttestationTypeHeader.value;
 async function verifyKeyAttestationJwt(options) {
   try {
     const { header, payload } = (0, import_io_wallet_oauth25.decodeJwt)({
+      errorMessagePrefix: "Error decoding key attestation JWT:",
       headerSchema: zKeyAttestationHeader,
       jwt: options.keyAttestationJwt,
       payloadSchema: zKeyAttestationPayload
@@ -974,12 +970,12 @@ async function verifyKeyAttestationJwt(options) {
     }
     return { header, payload, signer };
   } catch (error) {
-    if (error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils7.ValidationError || error instanceof import_oauth23.Oauth2JwtParseError) {
+    if (error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils8.ValidationError || error instanceof import_oauth23.Oauth2JwtParseError) {
       throw error;
     }
     throw new VerifyKeyAttestationJwtError(
       `Unexpected error during key attestation jwt verification: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
@@ -1004,7 +1000,7 @@ async function isJwkInSet(options) {
 }
 function verifyProofJwtIatOrThrow(options) {
   try {
-    (0, import_io_wallet_utils8.verifyJwtIatOrThrow)({
+    (0, import_io_wallet_utils9.verifyJwtIatOrThrow)({
       iat: options.payload.iat,
       now: options.now
     });
@@ -1012,7 +1008,7 @@ function verifyProofJwtIatOrThrow(options) {
     if (error instanceof Error) {
       throw new VerifyCredentialRequestJwtProofError(
         `Invalid iat claim in credential request proof JWT: ${error.message}`,
-        error
+        { cause: error }
       );
     }
   }
@@ -1026,8 +1022,9 @@ async function verifyCredentialRequestJwtProof(options) {
         "Nonce used for credential request proof expired"
       );
     }
-    if ((0, import_io_wallet_utils8.hasConfigVersion)(options, import_io_wallet_utils8.ItWalletSpecsVersion.V1_0)) {
+    if ((0, import_io_wallet_utils9.hasConfigVersion)(options, import_io_wallet_utils9.ItWalletSpecsVersion.V1_0)) {
       const { header, payload } = (0, import_io_wallet_oauth26.decodeJwt)({
+        errorMessagePrefix: "Error decoding credential request proof JWT:",
         headerSchema: zProofJwtHeaderV1_0,
         jwt: options.jwt,
         payloadSchema: zProofJwtPayload
@@ -1051,8 +1048,9 @@ async function verifyCredentialRequestJwtProof(options) {
         signer
       };
     }
-    if ((0, import_io_wallet_utils8.hasConfigVersion)(options, import_io_wallet_utils8.ItWalletSpecsVersion.V1_3)) {
+    if ((0, import_io_wallet_utils9.hasConfigVersion)(options, import_io_wallet_utils9.ItWalletSpecsVersion.V1_3)) {
       const { header, payload } = (0, import_io_wallet_oauth26.decodeJwt)({
+        errorMessagePrefix: "Error decoding credential request proof JWT:",
         headerSchema: zProofJwtHeaderV1_3,
         jwt: options.jwt,
         payloadSchema: zProofJwtPayload
@@ -1105,27 +1103,27 @@ async function verifyCredentialRequestJwtProof(options) {
         signer
       };
     }
-    throw new import_io_wallet_utils8.ItWalletSpecsVersionError(
+    throw new import_io_wallet_utils9.ItWalletSpecsVersionError(
       "verifyCredentialRequestJwtProof",
       configVersion,
-      [import_io_wallet_utils8.ItWalletSpecsVersion.V1_0, import_io_wallet_utils8.ItWalletSpecsVersion.V1_3]
+      [import_io_wallet_utils9.ItWalletSpecsVersion.V1_0, import_io_wallet_utils9.ItWalletSpecsVersion.V1_3]
     );
   } catch (error) {
-    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils8.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils8.ValidationError || error instanceof import_io_wallet_oauth26.Oauth2JwtParseError) {
+    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils9.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils9.ValidationError || error instanceof import_io_wallet_oauth26.Oauth2JwtParseError) {
       throw error;
     }
     throw new VerifyCredentialRequestJwtProofError(
       `Unexpected error during credential request proof verification: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
 
 // src/credential-response/create-credential-response.ts
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.0/create-credential-response.ts
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.0/z-credential-response.ts
 var import_zod9 = require("zod");
@@ -1159,7 +1157,7 @@ var zCredentialResponseV1_0 = import_zod9.z.union([
 // src/credential-response/v1.0/create-credential-response.ts
 function createCredentialResponseV1_0(flow) {
   if ("credentials" in flow) {
-    return (0, import_io_wallet_utils9.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils10.parseWithErrorHandling)(
       zCredentialResponseV1_0,
       {
         credentials: flow.credentials,
@@ -1170,7 +1168,7 @@ function createCredentialResponseV1_0(flow) {
       "Invalid credential response for ItWalletSpecsVersion 1.0"
     );
   }
-  return (0, import_io_wallet_utils9.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils10.parseWithErrorHandling)(
     zCredentialResponseV1_0,
     {
       lead_time: flow.leadTime,
@@ -1181,7 +1179,7 @@ function createCredentialResponseV1_0(flow) {
 }
 
 // src/credential-response/v1.3/create-credential-response.ts
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.3/z-credential-response.ts
 var import_zod10 = require("zod");
@@ -1199,7 +1197,7 @@ var zCredentialResponseV1_3 = import_zod10.z.union([
 // src/credential-response/v1.3/create-credential-response.ts
 function createCredentialResponseV1_3(flow) {
   if ("credentials" in flow) {
-    return (0, import_io_wallet_utils10.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils11.parseWithErrorHandling)(
       zCredentialResponseV1_3,
       {
         credentials: flow.credentials,
@@ -1210,7 +1208,7 @@ function createCredentialResponseV1_3(flow) {
       "Invalid credential response for ItWalletSpecsVersion 1.3"
     );
   }
-  return (0, import_io_wallet_utils10.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils11.parseWithErrorHandling)(
     zCredentialResponseV1_3,
     {
       interval: flow.interval,
@@ -1240,26 +1238,26 @@ async function createCredentialResponse(options) {
     }
     return { credentialResponse, credentialResponseJwt };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils11.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils11.ValidationError || error instanceof Oid4vciError) {
+    if (error instanceof import_io_wallet_utils12.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils12.ValidationError || error instanceof Oid4vciError) {
       throw error;
     }
     throw new CreateCredentialResponseError(
       `Unexpected error during create credential response: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
 function buildVersionedResponse(options) {
   const version = options.config.itWalletSpecsVersion;
-  if ((0, import_io_wallet_utils11.hasConfigVersion)(options, import_io_wallet_utils11.ItWalletSpecsVersion.V1_0)) {
+  if ((0, import_io_wallet_utils12.hasConfigVersion)(options, import_io_wallet_utils12.ItWalletSpecsVersion.V1_0)) {
     return createCredentialResponseV1_0(options.flow);
   }
-  if ((0, import_io_wallet_utils11.hasConfigVersion)(options, import_io_wallet_utils11.ItWalletSpecsVersion.V1_3)) {
+  if ((0, import_io_wallet_utils12.hasConfigVersion)(options, import_io_wallet_utils12.ItWalletSpecsVersion.V1_3)) {
     return createCredentialResponseV1_3(options.flow);
   }
-  throw new import_io_wallet_utils11.ItWalletSpecsVersionError("createCredentialResponse", version, [
-    import_io_wallet_utils11.ItWalletSpecsVersion.V1_0,
-    import_io_wallet_utils11.ItWalletSpecsVersion.V1_3
+  throw new import_io_wallet_utils12.ItWalletSpecsVersionError("createCredentialResponse", version, [
+    import_io_wallet_utils12.ItWalletSpecsVersion.V1_0,
+    import_io_wallet_utils12.ItWalletSpecsVersion.V1_3
   ]);
 }
 async function encryptResponse(credentialResponse, credentialResponseEncryption, encryptJwe) {
@@ -1277,7 +1275,7 @@ async function encryptResponse(credentialResponse, credentialResponseEncryption,
 }
 
 // src/credential-response/fetch-credential-response.ts
-var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/z-credential-response.ts
 var import_io_wallet_oauth27 = require("@pagopa/io-wallet-oauth2");
@@ -1291,35 +1289,35 @@ var zCredentialResponseEncryption = import_zod11.z.looseObject({
 // src/credential-response/fetch-credential-response.ts
 async function fetchCredentialResponse(options) {
   try {
-    const fetch = (0, import_io_wallet_utils12.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils13.createFetcher)(options.callbacks.fetch);
     const credentialResponse = await fetch(options.credentialEndpoint, {
       body: JSON.stringify(options.credentialRequest),
       headers: {
-        [import_io_wallet_utils12.HEADERS.AUTHORIZATION]: `DPoP ${options.accessToken}`,
-        [import_io_wallet_utils12.HEADERS.CONTENT_TYPE]: import_io_wallet_utils12.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils12.HEADERS.DPOP]: options.dPoP
+        [import_io_wallet_utils13.HEADERS.AUTHORIZATION]: `DPoP ${options.accessToken}`,
+        [import_io_wallet_utils13.HEADERS.CONTENT_TYPE]: import_io_wallet_utils13.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils13.HEADERS.DPOP]: options.dPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils12.hasStatusOrThrow)(
+    await (0, import_io_wallet_utils13.hasStatusOrThrow)(
       [200, 202],
-      import_io_wallet_utils12.UnexpectedStatusCodeError
+      import_io_wallet_utils13.UnexpectedStatusCodeError
     )(credentialResponse);
     const credentialResponseJson = await credentialResponse.json();
     if ("proof" in options.credentialRequest) {
-      return (0, import_io_wallet_utils12.parseWithErrorHandling)(
+      return (0, import_io_wallet_utils13.parseWithErrorHandling)(
         zCredentialResponseV1_0,
         credentialResponseJson,
         `Failed to parse credential response (v1.0)`
       );
     }
-    return (0, import_io_wallet_utils12.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils13.parseWithErrorHandling)(
       zCredentialResponseV1_3,
       credentialResponseJson,
       `Failed to parse credential response (v1.3)`
     );
   } catch (error) {
-    if (error instanceof import_io_wallet_utils12.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils12.ValidationError) {
+    if (error instanceof import_io_wallet_utils13.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils13.ValidationError) {
       throw error;
     }
     throw new FetchCredentialResponseError(
@@ -1331,7 +1329,7 @@ async function fetchCredentialResponse(options) {
 // src/metadata/fetch-metadata.ts
 var import_io_wallet_oauth28 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid_federation3 = require("@pagopa/io-wallet-oid-federation");
-var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 var import_zod13 = __toESM(require("zod"));
 
 // src/metadata/z-metadata-response.ts
@@ -1371,6 +1369,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
     }
     const entityStatement = await response.text();
     const { header, payload } = (0, import_io_wallet_oauth28.decodeJwt)({
+      errorMessagePrefix: "Error decoding entity statement JWT:",
       jwt: entityStatement,
       payloadSchema: import_io_wallet_oid_federation3.itWalletEntityStatementClaimsSchema
     });
@@ -1386,7 +1385,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
         payload
       });
       if (!result.verified) {
-        throw new import_io_wallet_utils13.ValidationError(
+        throw new import_io_wallet_utils14.ValidationError(
           "Entity statement signature verification failed"
         );
       }
@@ -1397,7 +1396,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
       openid_federation_claims: payload
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils13.ValidationError) {
+    if (error instanceof import_io_wallet_utils14.ValidationError) {
       throw error;
     }
     return void 0;
@@ -1409,8 +1408,8 @@ async function fallbackDiscovery(fetch, baseUrl) {
     ensureTrailingSlash(baseUrl)
   ).toString();
   const issuerResponse = await fetch(issuerUrl);
-  await (0, import_io_wallet_utils13.hasStatusOrThrow)(200, import_io_wallet_utils13.UnexpectedStatusCodeError)(issuerResponse);
-  const issuerJson = (0, import_io_wallet_utils13.parseWithErrorHandling)(
+  await (0, import_io_wallet_utils14.hasStatusOrThrow)(200, import_io_wallet_utils14.UnexpectedStatusCodeError)(issuerResponse);
+  const issuerJson = (0, import_io_wallet_utils14.parseWithErrorHandling)(
     zPartialIssuerMetadata,
     await issuerResponse.json(),
     "Failed to parse credential issuer metadata"
@@ -1420,7 +1419,7 @@ async function fallbackDiscovery(fetch, baseUrl) {
   if (authorizationServers && authorizationServers.length > 0) {
     const parsedUrl = import_zod13.default.url().safeParse(authorizationServers[0]);
     if (!parsedUrl.success || !parsedUrl.data.startsWith("https://")) {
-      throw new import_io_wallet_utils13.ValidationError(
+      throw new import_io_wallet_utils14.ValidationError(
         "authorization_servers[0] is not a valid HTTPS URL"
       );
     }
@@ -1429,7 +1428,7 @@ async function fallbackDiscovery(fetch, baseUrl) {
       ensureTrailingSlash(parsedUrl.data)
     ).toString();
     const authServerResponse = await fetch(authServerUrl);
-    await (0, import_io_wallet_utils13.hasStatusOrThrow)(200, import_io_wallet_utils13.UnexpectedStatusCodeError)(authServerResponse);
+    await (0, import_io_wallet_utils14.hasStatusOrThrow)(200, import_io_wallet_utils14.UnexpectedStatusCodeError)(authServerResponse);
     oauthAuthorizationServer = await authServerResponse.json();
   } else {
     oauthAuthorizationServer = issuerJson;
@@ -1447,12 +1446,12 @@ async function fetchMetadata(options) {
   try {
     const urlValidation = import_zod13.default.url().safeParse(options.credentialIssuerUrl);
     if (!urlValidation.success || !urlValidation.data.startsWith("https://")) {
-      throw new import_io_wallet_utils13.ValidationError(
+      throw new import_io_wallet_utils14.ValidationError(
         "credentialIssuerUrl must be a valid HTTPS URL"
       );
     }
-    const fetch = (0, import_io_wallet_utils13.createFetcher)(options.callbacks.fetch);
-    if (config.isVersion(import_io_wallet_utils13.ItWalletSpecsVersion.V1_0)) {
+    const fetch = (0, import_io_wallet_utils14.createFetcher)(options.callbacks.fetch);
+    if (config.isVersion(import_io_wallet_utils14.ItWalletSpecsVersion.V1_0)) {
       const federationResult = await tryFederationDiscovery(
         fetch,
         options.credentialIssuerUrl,
@@ -1463,44 +1462,43 @@ async function fetchMetadata(options) {
           `Federation discovery failed for IT Wallet v1.0; no fallback available for credentialIssuerUrl ${options.credentialIssuerUrl}`
         );
       }
-      return (0, import_io_wallet_utils13.parseWithErrorHandling)(
+      return (0, import_io_wallet_utils14.parseWithErrorHandling)(
         zMetadataResponseV1_0,
         federationResult,
         "Failed to parse v1.0 metadata response"
       );
     }
-    if (config.isVersion(import_io_wallet_utils13.ItWalletSpecsVersion.V1_3)) {
+    if (config.isVersion(import_io_wallet_utils14.ItWalletSpecsVersion.V1_3)) {
       const federationResult = await tryFederationDiscovery(
         fetch,
         options.credentialIssuerUrl,
         options.callbacks.verifyJwt
       );
       const raw = federationResult ?? await fallbackDiscovery(fetch, options.credentialIssuerUrl);
-      return (0, import_io_wallet_utils13.parseWithErrorHandling)(
+      return (0, import_io_wallet_utils14.parseWithErrorHandling)(
         zMetadataResponseV1_3,
         raw,
         "Failed to parse v1.3 metadata response"
       );
     }
-    throw new import_io_wallet_utils13.ItWalletSpecsVersionError(
+    throw new import_io_wallet_utils14.ItWalletSpecsVersionError(
       "fetchMetadata",
       config.itWalletSpecsVersion,
-      [import_io_wallet_utils13.ItWalletSpecsVersion.V1_0, import_io_wallet_utils13.ItWalletSpecsVersion.V1_3]
+      [import_io_wallet_utils14.ItWalletSpecsVersion.V1_0, import_io_wallet_utils14.ItWalletSpecsVersion.V1_3]
     );
   } catch (error) {
-    if (error instanceof import_io_wallet_utils13.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils13.ValidationError || error instanceof import_io_wallet_utils13.ItWalletSpecsVersionError || error instanceof FetchMetadataError) {
+    if (error instanceof import_io_wallet_utils14.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils14.ValidationError || error instanceof import_io_wallet_utils14.ItWalletSpecsVersionError || error instanceof FetchMetadataError) {
       throw error;
     }
-    throw new FetchMetadataError(
-      "Unexpected error during metadata fetch",
-      error
-    );
+    throw new FetchMetadataError("Unexpected error during metadata fetch", {
+      cause: error
+    });
   }
 }
 
 // src/wallet-provider/WalletProvider.ts
 var import_io_wallet_oauth29 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
 function assertV1_0Options(options) {
   if (options.signer.method !== "federation") {
     throw new WalletProviderError(
@@ -1515,6 +1513,28 @@ function assertV1_3Options(options) {
     );
   }
 }
+function assertV1_4Options(options) {
+  if (options.signer.method !== "x5c") {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 (x5c) but received options with signer method "${options.signer.method}"`
+    );
+  }
+  if (!options.walletLink) {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 but 'walletLink' is required and missing`
+    );
+  }
+  if (!options.walletName) {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 but 'walletName' is required and missing`
+    );
+  }
+  if (!("status" in options) || !options.status) {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 but 'status' is required and missing`
+    );
+  }
+}
 var WalletProvider = class {
   specVersion;
   constructor(options) {
@@ -1536,7 +1556,7 @@ var WalletProvider = class {
     const { signJwt } = options.callbacks;
     const now = /* @__PURE__ */ new Date();
     const issuedAt = options.issuedAt ?? now;
-    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils14.addSecondsToDate)(now, 3600 * 24 * 360);
+    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils15.addSecondsToDate)(now, 3600 * 24 * 360);
     const header = {
       alg: options.signer.alg,
       kid: options.signer.kid,
@@ -1546,8 +1566,8 @@ var WalletProvider = class {
     };
     const payload = {
       attested_keys: options.attestedKeys,
-      exp: (0, import_io_wallet_utils14.dateToSeconds)(expiresAt),
-      iat: (0, import_io_wallet_utils14.dateToSeconds)(issuedAt),
+      exp: (0, import_io_wallet_utils15.dateToSeconds)(expiresAt),
+      iat: (0, import_io_wallet_utils15.dateToSeconds)(issuedAt),
       iss: options.issuer,
       key_storage: options.keyStorage,
       status: options.status,
@@ -1570,8 +1590,10 @@ var WalletProvider = class {
    * Creates a wallet attestation JWT according to the configured Italian Wallet specification version.
    *
    * Version Differences:
-   * - v1.0: Uses only `trust_chain` in header (federation method)
-   * - v1.3: Requires `x5c` in header, optional `trust_chain`, supports `nbf` and `status` claims
+   * - v1.0: Uses only `trust_chain` in header (federation method); no `status` claim
+   * - v1.3: Requires `x5c` in header, optional `trust_chain`; supports optional `nbf` and `status` claims
+   * - v1.4: Requires `x5c` in header, optional `trust_chain`; `status`, `wallet_link`, and `wallet_name`
+   *   are all **required**; optional `eudi_wallet_info` claim; sets `sub` to `dpopJwkPublic.kid`
    *
    * @public
    * @async
@@ -1606,14 +1628,39 @@ var WalletProvider = class {
    *   nbf: new Date('2025-01-01'), // Optional
    *   status: { status_list: { idx: 2, uri: "https://status.example.com" } } // Optional
    * });
+   *
+   * @example v1.4 - Wallet attestation with required status and optional eudi_wallet_info
+   * const jwt = await provider.createItWalletAttestationJwt({
+   *   callbacks: { signJwt: mySignJwtCallback },
+   *   dpopJwkPublic: myJwk,
+   *   issuer: "https://wallet-provider.example.com",
+   *   signer: {
+   *     alg: "ES256",
+   *     kid: "provider-key-id",
+   *     method: "x5c",
+   *     x5c: ["cert1-base64", "cert2-base64"],
+   *     trustChain: ["trust-anchor-jwt"] // Optional
+   *   },
+   *   status: { status_list: { idx: 2, uri: "https://status.example.com" } }, // Required
+   *   walletLink: "https://wallet.example.com", // Required
+   *   walletName: "My Wallet", // Required
+   *   eudiWalletInfo: { // Optional
+   *     general_info: {
+   *       wallet_provider_name: "PagoPA",
+   *       wallet_solution_certification_information: "certification-ref",
+   *       wallet_solution_id: "wallet-solution-id",
+   *       wallet_solution_version: "1.0.0"
+   *     }
+   *   }
+   * });
    */
   async createItWalletAttestationJwt(options) {
     if (!options.dpopJwkPublic.kid) {
       throw new WalletProviderError("The DPoP JWK must have a 'kid' property");
     }
-    if (this.specVersion === import_io_wallet_utils14.ItWalletSpecsVersion.V1_0) {
+    if (this.specVersion === import_io_wallet_utils15.ItWalletSpecsVersion.V1_0) {
       assertV1_0Options(options);
-      return import_io_wallet_oauth29.V1_0.createWalletAttestationJwt({
+      return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_0)({
         authenticatorAssuranceLevel: options.authenticatorAssuranceLevel,
         callbacks: options.callbacks,
         dpopJwkPublic: options.dpopJwkPublic,
@@ -1624,9 +1671,9 @@ var WalletProvider = class {
         walletName: options.walletName
       });
     }
-    if (this.specVersion === import_io_wallet_utils14.ItWalletSpecsVersion.V1_3) {
+    if (this.specVersion === import_io_wallet_utils15.ItWalletSpecsVersion.V1_3) {
       assertV1_3Options(options);
-      return import_io_wallet_oauth29.V1_3.createWalletAttestationJwt({
+      return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_3)({
         callbacks: options.callbacks,
         dpopJwkPublic: options.dpopJwkPublic,
         expiresAt: options.expiresAt,
@@ -1638,10 +1685,24 @@ var WalletProvider = class {
         walletName: options.walletName
       });
     }
-    throw new import_io_wallet_utils14.ItWalletSpecsVersionError(
+    if (this.specVersion === import_io_wallet_utils15.ItWalletSpecsVersion.V1_4) {
+      assertV1_4Options(options);
+      return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_4)({
+        callbacks: options.callbacks,
+        dpopJwkPublic: options.dpopJwkPublic,
+        eudiWalletInfo: options.eudiWalletInfo,
+        expiresAt: options.expiresAt,
+        issuer: options.issuer,
+        signer: options.signer,
+        status: options.status,
+        walletLink: options.walletLink,
+        walletName: options.walletName
+      });
+    }
+    throw new import_io_wallet_utils15.ItWalletSpecsVersionError(
       "createItWalletAttestationJwt",
       this.specVersion,
-      [import_io_wallet_utils14.ItWalletSpecsVersion.V1_0, import_io_wallet_utils14.ItWalletSpecsVersion.V1_3]
+      Object.values(import_io_wallet_utils15.ItWalletSpecsVersion)
     );
   }
 };