@pagopa/io-wallet-oid4vci 1.2.1 → 1.3.0

package/dist/index.mjs

@@ -12,83 +12,80 @@ import {
 
 // src/errors.ts
 var Oid4vciError = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "Oid4vciError";
+    this.statusCode = options?.statusCode;
   }
 };
 var WalletProviderError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "WalletProviderError";
-    this.cause = cause;
   }
 };
 var NonceRequestError = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "NonceRequestError";
+    this.statusCode = options?.statusCode;
   }
 };
 var FetchCredentialResponseError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "FetchCredentialResponseError";
-    this.cause = cause;
   }
 };
 var ParseCredentialRequestError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "ParseCredentialRequestError";
-    this.cause = cause;
   }
 };
 var FetchMetadataError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
-    this.cause = cause;
+  constructor(message, options) {
+    super(message, options);
     this.name = "FetchMetadataError";
   }
 };
 var CreateCredentialResponseError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateCredentialResponseError";
-    this.cause = cause;
   }
 };
 var VerifyCredentialRequestJwtProofError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "VerifyCredentialRequestJwtProofError";
-    this.cause = cause;
   }
 };
 var VerifyKeyAttestationJwtError = class extends Oid4vciError {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "VerifyKeyAttestationJwtError";
-    this.cause = cause;
   }
 };
 var CredentialOfferError = class extends Oid4vciError {
-  constructor(message, statusCode) {
-    super(message, statusCode);
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "CredentialOfferError";
+    this.statusCode = options?.statusCode;
   }
 };
 var MissingDpopProofError = class extends Oid4vciError {
-  constructor(message = "Credential request is missing required 'DPoP' proof header") {
-    super(message);
+  constructor(message = "Credential request is missing required 'DPoP' proof header", options) {
+    super(message, options);
     this.name = "MissingDpopProofError";
   }
 };
 var CredentialAuthorizationHeaderError = class extends Oid4vciError {
-  constructor(message = "Credential request is missing required 'Authorization' header with DPoP scheme") {
-    super(message);
+  constructor(message = "Credential request is missing required 'Authorization' header with DPoP scheme", options) {
+    super(message, options);
     this.name = "CredentialAuthorizationHeaderError";
   }
 };
@@ -501,8 +498,9 @@ import {
 
 // src/credential-request/v1.3/z-credential.ts
 import { z as z5 } from "zod";
+var zCredentialRequestProofJwt = z5.string().min(1, "JWT must not be empty in credential request proofs array");
 var zCredentialRequestProofs = z5.object({
-  jwt: z5.array(z5.string().min(1, "JWT must not be empty")).min(1, "At least one JWT proof is required")
+  jwt: z5.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
 });
 var zCredentialRequestV1_3 = zBaseCredentialRequest.extend({
   proofs: zCredentialRequestProofs.describe(
@@ -516,7 +514,8 @@ var zCredentialRequestV1_3 = zBaseCredentialRequest.extend({
 var createCredentialRequest2 = async (options) => {
   try {
     const { maxBatchSize, signers } = options;
-    if (signers.length === 0) {
+    const [firstSigner, ...otherSigners] = signers;
+    if (!firstSigner) {
       throw new ValidationError3("At least one signer is required");
     }
     if (maxBatchSize !== void 0) {
@@ -549,29 +548,28 @@ var createCredentialRequest2 = async (options) => {
         );
       }
     }
-    const proofJwts = await Promise.all(
-      signers.map(
-        (signer) => signJwt(signer, {
-          header: {
-            alg: signer.alg,
-            jwk: signer.publicJwk,
-            key_attestation: options.keyAttestation,
-            typ: "openid4vci-proof+jwt"
-          },
-          payload: {
-            aud: options.issuerIdentifier,
-            iat: dateToSeconds2(/* @__PURE__ */ new Date()),
-            iss: options.clientId,
-            nonce: options.nonce
-          }
-        })
-      )
-    );
+    const createProofJwt = async (signer) => (await signJwt(signer, {
+      header: {
+        alg: signer.alg,
+        jwk: signer.publicJwk,
+        key_attestation: options.keyAttestation,
+        typ: "openid4vci-proof+jwt"
+      },
+      payload: {
+        aud: options.issuerIdentifier,
+        iat: dateToSeconds2(/* @__PURE__ */ new Date()),
+        iss: options.clientId,
+        nonce: options.nonce
+      }
+    })).jwt;
+    const proofJwts = await Promise.all([
+      createProofJwt(firstSigner),
+      ...otherSigners.map(createProofJwt)
+    ]);
     return parseWithErrorHandling2(zCredentialRequestV1_3, {
       credential_identifier: options.credential_identifier,
       proofs: {
-        jwt: proofJwts.map((proofJwt) => proofJwt.jwt)
-        // Array for batch support
+        jwt: proofJwts
       }
     });
   } catch (error) {
@@ -669,7 +667,10 @@ function validateTransactionContext(options) {
   }
 }
 function parseProofJwt(options) {
-  const decoded = decodeJwt({ jwt: options.jwt });
+  const decoded = decodeJwt({
+    errorMessagePrefix: "Error decoding credential request proof JWT:",
+    jwt: options.jwt
+  });
   const headerValidation = options.itWalletSpecsVersion === ItWalletSpecsVersion4.V1_3 ? zProofJwtHeaderV1_3.safeParse(decoded.header) : zProofJwtHeaderV1_0.safeParse(decoded.header);
   if (!headerValidation.success) {
     throw new ValidationError4(
@@ -841,7 +842,7 @@ function parseCredentialRequest(options) {
     }
     throw new ParseCredentialRequestError(
       `Unexpected error during credential request parsing: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
@@ -874,6 +875,7 @@ import { ValidationError as ValidationError5 } from "@pagopa/io-wallet-utils";
 // src/wallet-provider/z-key-attestation.ts
 import { zCertificateChain, zJwk as zJwk2, zTrustChain } from "@pagopa/io-wallet-oauth2";
 import { zKeyStorageLevelV1_3 } from "@pagopa/io-wallet-oid-federation";
+import { zItwSupportedSignatureAlg } from "@pagopa/io-wallet-utils";
 import { z as z7 } from "zod";
 var zStatusList = z7.object({
   idx: z7.number(),
@@ -882,14 +884,7 @@ var zStatusList = z7.object({
 var zKeyAttestationStatus = z7.object({
   status_list: zStatusList
 });
-var zKeyAttestationAlg = z7.enum([
-  "ES256",
-  "ES384",
-  "ES512",
-  "PS256",
-  "PS384",
-  "PS512"
-]);
+var zKeyAttestationAlg = zItwSupportedSignatureAlg;
 var zKeyAttestationHeader = z7.object({
   alg: zKeyAttestationAlg,
   kid: z7.string(),
@@ -914,6 +909,7 @@ var keyAttestationTypeHeader = zKeyAttestationTypeHeader.value;
 async function verifyKeyAttestationJwt(options) {
   try {
     const { header, payload } = decodeJwt2({
+      errorMessagePrefix: "Error decoding key attestation JWT:",
       headerSchema: zKeyAttestationHeader,
       jwt: options.keyAttestationJwt,
       payloadSchema: zKeyAttestationPayload
@@ -946,7 +942,7 @@ async function verifyKeyAttestationJwt(options) {
     }
     throw new VerifyKeyAttestationJwtError(
       `Unexpected error during key attestation jwt verification: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
@@ -979,7 +975,7 @@ function verifyProofJwtIatOrThrow(options) {
     if (error instanceof Error) {
       throw new VerifyCredentialRequestJwtProofError(
         `Invalid iat claim in credential request proof JWT: ${error.message}`,
-        error
+        { cause: error }
       );
     }
   }
@@ -995,6 +991,7 @@ async function verifyCredentialRequestJwtProof(options) {
     }
     if (hasConfigVersion(options, ItWalletSpecsVersion5.V1_0)) {
       const { header, payload } = decodeJwt3({
+        errorMessagePrefix: "Error decoding credential request proof JWT:",
         headerSchema: zProofJwtHeaderV1_0,
         jwt: options.jwt,
         payloadSchema: zProofJwtPayload
@@ -1020,6 +1017,7 @@ async function verifyCredentialRequestJwtProof(options) {
     }
     if (hasConfigVersion(options, ItWalletSpecsVersion5.V1_3)) {
       const { header, payload } = decodeJwt3({
+        errorMessagePrefix: "Error decoding credential request proof JWT:",
         headerSchema: zProofJwtHeaderV1_3,
         jwt: options.jwt,
         payloadSchema: zProofJwtPayload
@@ -1083,7 +1081,7 @@ async function verifyCredentialRequestJwtProof(options) {
     }
     throw new VerifyCredentialRequestJwtProofError(
       `Unexpected error during credential request proof verification: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
@@ -1217,7 +1215,7 @@ async function createCredentialResponse(options) {
     }
     throw new CreateCredentialResponseError(
       `Unexpected error during create credential response: ${error instanceof Error ? error.message : String(error)}`,
-      error
+      { cause: error }
     );
   }
 }
@@ -1363,6 +1361,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
     }
     const entityStatement = await response.text();
     const { header, payload } = decodeJwt4({
+      errorMessagePrefix: "Error decoding entity statement JWT:",
       jwt: entityStatement,
       payloadSchema: itWalletEntityStatementClaimsSchema2
     });
@@ -1483,15 +1482,18 @@ async function fetchMetadata(options) {
     if (error instanceof UnexpectedStatusCodeError4 || error instanceof ValidationError9 || error instanceof ItWalletSpecsVersionError5 || error instanceof FetchMetadataError) {
       throw error;
     }
-    throw new FetchMetadataError(
-      "Unexpected error during metadata fetch",
-      error
-    );
+    throw new FetchMetadataError("Unexpected error during metadata fetch", {
+      cause: error
+    });
   }
 }
 
 // src/wallet-provider/WalletProvider.ts
-import { V1_0, V1_3 } from "@pagopa/io-wallet-oauth2";
+import {
+  createWalletAttestationJwtV1_0,
+  createWalletAttestationJwtV1_3,
+  createWalletAttestationJwtV1_4
+} from "@pagopa/io-wallet-oauth2";
 import {
   ItWalletSpecsVersion as ItWalletSpecsVersion8,
   ItWalletSpecsVersionError as ItWalletSpecsVersionError6,
@@ -1512,6 +1514,28 @@ function assertV1_3Options(options) {
     );
   }
 }
+function assertV1_4Options(options) {
+  if (options.signer.method !== "x5c") {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 (x5c) but received options with signer method "${options.signer.method}"`
+    );
+  }
+  if (!options.walletLink) {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 but 'walletLink' is required and missing`
+    );
+  }
+  if (!options.walletName) {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 but 'walletName' is required and missing`
+    );
+  }
+  if (!("status" in options) || !options.status) {
+    throw new WalletProviderError(
+      `Version mismatch: provider is configured for v1.4 but 'status' is required and missing`
+    );
+  }
+}
 var WalletProvider = class {
   specVersion;
   constructor(options) {
@@ -1567,8 +1591,10 @@ var WalletProvider = class {
    * Creates a wallet attestation JWT according to the configured Italian Wallet specification version.
    *
    * Version Differences:
-   * - v1.0: Uses only `trust_chain` in header (federation method)
-   * - v1.3: Requires `x5c` in header, optional `trust_chain`, supports `nbf` and `status` claims
+   * - v1.0: Uses only `trust_chain` in header (federation method); no `status` claim
+   * - v1.3: Requires `x5c` in header, optional `trust_chain`; supports optional `nbf` and `status` claims
+   * - v1.4: Requires `x5c` in header, optional `trust_chain`; `status`, `wallet_link`, and `wallet_name`
+   *   are all **required**; optional `eudi_wallet_info` claim; sets `sub` to `dpopJwkPublic.kid`
    *
    * @public
    * @async
@@ -1603,6 +1629,31 @@ var WalletProvider = class {
    *   nbf: new Date('2025-01-01'), // Optional
    *   status: { status_list: { idx: 2, uri: "https://status.example.com" } } // Optional
    * });
+   *
+   * @example v1.4 - Wallet attestation with required status and optional eudi_wallet_info
+   * const jwt = await provider.createItWalletAttestationJwt({
+   *   callbacks: { signJwt: mySignJwtCallback },
+   *   dpopJwkPublic: myJwk,
+   *   issuer: "https://wallet-provider.example.com",
+   *   signer: {
+   *     alg: "ES256",
+   *     kid: "provider-key-id",
+   *     method: "x5c",
+   *     x5c: ["cert1-base64", "cert2-base64"],
+   *     trustChain: ["trust-anchor-jwt"] // Optional
+   *   },
+   *   status: { status_list: { idx: 2, uri: "https://status.example.com" } }, // Required
+   *   walletLink: "https://wallet.example.com", // Required
+   *   walletName: "My Wallet", // Required
+   *   eudiWalletInfo: { // Optional
+   *     general_info: {
+   *       wallet_provider_name: "PagoPA",
+   *       wallet_solution_certification_information: "certification-ref",
+   *       wallet_solution_id: "wallet-solution-id",
+   *       wallet_solution_version: "1.0.0"
+   *     }
+   *   }
+   * });
    */
   async createItWalletAttestationJwt(options) {
     if (!options.dpopJwkPublic.kid) {
@@ -1610,7 +1661,7 @@ var WalletProvider = class {
     }
     if (this.specVersion === ItWalletSpecsVersion8.V1_0) {
       assertV1_0Options(options);
-      return V1_0.createWalletAttestationJwt({
+      return createWalletAttestationJwtV1_0({
         authenticatorAssuranceLevel: options.authenticatorAssuranceLevel,
         callbacks: options.callbacks,
         dpopJwkPublic: options.dpopJwkPublic,
@@ -1623,7 +1674,7 @@ var WalletProvider = class {
     }
     if (this.specVersion === ItWalletSpecsVersion8.V1_3) {
       assertV1_3Options(options);
-      return V1_3.createWalletAttestationJwt({
+      return createWalletAttestationJwtV1_3({
         callbacks: options.callbacks,
         dpopJwkPublic: options.dpopJwkPublic,
         expiresAt: options.expiresAt,
@@ -1635,10 +1686,24 @@ var WalletProvider = class {
         walletName: options.walletName
       });
     }
+    if (this.specVersion === ItWalletSpecsVersion8.V1_4) {
+      assertV1_4Options(options);
+      return createWalletAttestationJwtV1_4({
+        callbacks: options.callbacks,
+        dpopJwkPublic: options.dpopJwkPublic,
+        eudiWalletInfo: options.eudiWalletInfo,
+        expiresAt: options.expiresAt,
+        issuer: options.issuer,
+        signer: options.signer,
+        status: options.status,
+        walletLink: options.walletLink,
+        walletName: options.walletName
+      });
+    }
     throw new ItWalletSpecsVersionError6(
       "createItWalletAttestationJwt",
       this.specVersion,
-      [ItWalletSpecsVersion8.V1_0, ItWalletSpecsVersion8.V1_3]
+      Object.values(ItWalletSpecsVersion8)
     );
   }
 };