Article 5a(3) is what actually counts:
> The source code of the application software components of European Digital Identity Wallets shall be open-source licensed. Member States may provide that, for duly justified reasons, the source code of specific components other than those installed on user devices shall not be disclosed.
The EU is nice enough to publish a consolidated text, i.e. the 2024 patch applied to the 2014 Directive. The authoritative legal source is the patch. It's also where the recitals live, which is like a ten page commit message.
https://eur-lex.europa.eu/eli/reg/2014/910/2024-10-18
