@pagopa/io-wallet-oauth2 1.2.0 → 1.3.0

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 import * as _openid4vc_oauth2 from '@openid4vc/oauth2';
-import { CallbackContext, JwtSigner as JwtSigner$1, JwtSignerJwk as JwtSignerJwk$1, AuthorizationServerMetadata, ClientAttestationJwtPayload, RequestDpopOptions, decodeJwt as decodeJwt$1, JwtSignerWithJwk as JwtSignerWithJwk$1, HttpMethod as HttpMethod$1 } from '@openid4vc/oauth2';
+import { CallbackContext, JwtSigner as JwtSigner$1, JwtSignerJwk as JwtSignerJwk$1, ClientAttestationJwtPayload, RequestDpopOptions, JwtSignerWithJwk as JwtSignerWithJwk$1, HttpMethod as HttpMethod$1 } from '@openid4vc/oauth2';
 export { CallbackContext, ClientAttestationPopJwtHeader, ClientAttestationPopJwtPayload, DecryptJweCallback, EncryptJweCallback, GenerateRandomCallback, HashAlgorithm, JweEncryptor, JwtSigner, JwtSignerJwk, Oauth2JwtParseError, RequestDpopOptions, SignJwtCallback, VerifyJwtCallback, verifyJwt } from '@openid4vc/oauth2';
 import z, { z as z$1 } from 'zod';
-import { RequestLike as RequestLike$1, ContentType, FetchHeaders, HttpMethod, IoWalletSdkConfig, ItWalletSpecsVersion, Fetch, BaseSchema } from '@pagopa/io-wallet-utils';
+import { RequestLike as RequestLike$1, IoWalletSdkConfig, ItWalletSpecsVersion, FetchHeaders, HttpMethod, BaseSchema, ContentType, Fetch } from '@pagopa/io-wallet-utils';
+import { ItWalletAuthorizationServerMetadata } from '@pagopa/io-wallet-oid-federation';
 
 interface RetrieveAuthorizationCodeAccessTokenOptions {
     /**
@@ -544,245 +545,271 @@ interface CreateClientAttestationPopJwtOptions {
 }
 declare function createClientAttestationPopJwt(options: CreateClientAttestationPopJwtOptions): Promise<string>;
 
-/**
- * Supported OAuth 2.0 client authentication methods.
- */
-declare const SupportedClientAuthenticationMethod: {
-    readonly ClientSecretBasic: "client_secret_basic";
-    readonly ClientSecretPost: "client_secret_post";
-    readonly None: "none";
-    readonly WalletAttestationJwt: "attest_jwt_client_auth";
-};
-/**
- * Union type of supported client authentication methods.
- */
-type SupportedClientAuthenticationMethod = (typeof SupportedClientAuthenticationMethod)[keyof typeof SupportedClientAuthenticationMethod];
-/**
- * Options for checking client attestation support.
- */
-interface IsClientAttestationSupportedOptions {
-    /** Authorization server metadata containing supported authentication methods. */
-    authorizationServerMetadata: AuthorizationServerMetadata;
-}
-/**
- * Checks whether the authorization server supports client attestation authentication.
- *
- * @param options - Configuration including authorization server metadata
- * @returns Object with `supported` boolean indicating if client attestation is available
- */
-declare function isClientAttestationSupported(options: IsClientAttestationSupportedOptions): {
-    supported: boolean;
-};
-/**
- * Options for client authentication
- */
-interface ClientAuthenticationCallbackOptions {
+interface ClientAttestationOptions {
     /**
-     * Metadata of the authorization server
+     * The client attestation DPoP JWT provided in the request.
      */
-    authorizationServerMetadata: AuthorizationServerMetadata;
+    clientAttestationPopJwt: string;
     /**
-     * The body as a JSON object. If content type `x-www-form-urlencoded`
-     * is used, it will be encoded after this call.
+     * Whether to ensure that the key used in client attestation confirmation
+     * is the same key used for DPoP. This only has effect if both DPoP and client
+     * attestations are present.
      *
-     * You can modify this object
+     * @default false
      */
-    body: Record<string, unknown>;
-    contentType: ContentType;
+    ensureConfirmationKeyMatchesDpopKey?: boolean;
     /**
-     * Headers for the request. You can modify this object
+     * The wallet attestation JWT provided in the request.
      */
-    headers: FetchHeaders;
+    walletAttestationJwt: string;
+}
+interface VerifyClientAttestationOptions {
     /**
-     * http method that will be used
+     * The authorization server metadata.
      */
-    method: HttpMethod;
+    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
     /**
-     * URL to which the request will be made
+     * Callbacks for hashing and JWT verification.
+     */
+    callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
+    /**
+     * The client attestation options.
+     */
+    clientAttestation: ClientAttestationOptions;
+    /**
+     * The IT-Wallet SDK configuration, used to select the correct version-specific
+     * validation schema for the wallet attestation JWT.
+     */
+    config: IoWalletSdkConfig;
+    /**
+     * The DPoP JWK thumbprint value, if DPoP is being used in the request.
+     */
+    dpopJwkThumbprint?: string;
+    /**
+     * The current time to use when verifying the JWTs.
+     * If not provided current time will be used.
+     *
+     * @default new Date()
      */
-    url: string;
-}
-/**
- * Callback method to determine the client authentication for a request.
- */
-type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
-/**
- * Anonymous client authentication
- */
-declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
-interface ClientAuthenticationWalletAttestationJwtOptions {
-    callbacks: Pick<CallbackContext, "generateRandom" | "signJwt">;
-    walletAttestationJwt: string;
-}
-/**
- * Client authentication using wallet attestation JWT.
- * This method adds the wallet attestation JWT and a proof-of-possession JWT to the request headers.
- */
-declare function clientAuthenticationWalletAttestationJwt(options: ClientAuthenticationWalletAttestationJwtOptions): ClientAuthenticationCallback;
-
-interface BaseVerifyWalletAttestationJwtOptions {
-    callbacks: Pick<CallbackContext, "verifyJwt">;
     now?: Date;
-    walletAttestationJwt: string;
-}
-/**
- * Base options shared across all wallet attestation versions
- */
-interface BaseWalletAttestationOptions {
-    callbacks: Pick<CallbackContext, "signJwt">;
-    dpopJwkPublic: ClientAttestationJwtPayload["cnf"]["jwk"];
-    expiresAt?: Date;
-    issuer: string;
-    walletLink?: string;
-    walletName?: string;
-}
-declare const zOauthClientAttestationHeader: z.ZodLiteral<"OAuth-Client-Attestation">;
-declare const oauthClientAttestationHeader: "OAuth-Client-Attestation";
-declare const zOauthClientAttestationPopHeader: z.ZodLiteral<"OAuth-Client-Attestation-PoP">;
-declare const oauthClientAttestationPopHeader: "OAuth-Client-Attestation-PoP";
-
-/**
- * JWT Header schema for IT-Wallet v1.0 Wallet Attestation
- *
- * Version 1.0 specifics:
- * - trust_chain is REQUIRED
- * - x5c is NOT supported
- */
-declare const zWalletAttestationJwtHeaderV1_0: z$1.ZodObject<{
-    trust_chain: z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>;
-    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
-    alg: z$1.ZodString;
-    jwk: z$1.ZodOptional<z$1.ZodObject<{
-        alg: z$1.ZodOptional<z$1.ZodString>;
-        crv: z$1.ZodOptional<z$1.ZodString>;
-        d: z$1.ZodOptional<z$1.ZodString>;
-        dp: z$1.ZodOptional<z$1.ZodString>;
-        dq: z$1.ZodOptional<z$1.ZodString>;
-        e: z$1.ZodOptional<z$1.ZodString>;
-        ext: z$1.ZodOptional<z$1.ZodBoolean>;
-        k: z$1.ZodOptional<z$1.ZodString>;
-        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        kid: z$1.ZodOptional<z$1.ZodString>;
-        kty: z$1.ZodString;
-        n: z$1.ZodOptional<z$1.ZodString>;
-        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-            d: z$1.ZodOptional<z$1.ZodString>;
-            r: z$1.ZodOptional<z$1.ZodString>;
-            t: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>>>;
-        p: z$1.ZodOptional<z$1.ZodString>;
-        q: z$1.ZodOptional<z$1.ZodString>;
-        qi: z$1.ZodOptional<z$1.ZodString>;
-        use: z$1.ZodOptional<z$1.ZodString>;
-        x: z$1.ZodOptional<z$1.ZodString>;
-        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        x5t: z$1.ZodOptional<z$1.ZodString>;
-        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-        x5u: z$1.ZodOptional<z$1.ZodString>;
-        y: z$1.ZodOptional<z$1.ZodString>;
-    }, z$1.core.$loose>>;
-    kid: z$1.ZodOptional<z$1.ZodString>;
-    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-}, z$1.core.$loose>;
-/**
- * JWT Payload schema for IT-Wallet v1.0 Wallet Attestation
- *
- * Version 1.0 specifics:
- * - Standard claims only
- * - No nbf or status support
- */
-declare const zWalletAttestationJwtPayloadV1_0: z$1.ZodObject<{
-    aal: z$1.ZodString;
-    cnf: z$1.ZodObject<{
-        jwk: z$1.ZodObject<{
-            alg: z$1.ZodOptional<z$1.ZodString>;
-            crv: z$1.ZodOptional<z$1.ZodString>;
-            d: z$1.ZodOptional<z$1.ZodString>;
-            dp: z$1.ZodOptional<z$1.ZodString>;
-            dq: z$1.ZodOptional<z$1.ZodString>;
-            e: z$1.ZodOptional<z$1.ZodString>;
-            ext: z$1.ZodOptional<z$1.ZodBoolean>;
-            k: z$1.ZodOptional<z$1.ZodString>;
-            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            kid: z$1.ZodOptional<z$1.ZodString>;
-            kty: z$1.ZodString;
-            n: z$1.ZodOptional<z$1.ZodString>;
-            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-                d: z$1.ZodOptional<z$1.ZodString>;
-                r: z$1.ZodOptional<z$1.ZodString>;
-                t: z$1.ZodOptional<z$1.ZodString>;
-            }, z$1.core.$loose>>>;
-            p: z$1.ZodOptional<z$1.ZodString>;
-            q: z$1.ZodOptional<z$1.ZodString>;
-            qi: z$1.ZodOptional<z$1.ZodString>;
-            use: z$1.ZodOptional<z$1.ZodString>;
-            x: z$1.ZodOptional<z$1.ZodString>;
-            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            x5t: z$1.ZodOptional<z$1.ZodString>;
-            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-            x5u: z$1.ZodOptional<z$1.ZodString>;
-            y: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>;
-    }, z$1.core.$strip>;
-    exp: z$1.ZodNumber;
-    iat: z$1.ZodNumber;
-    iss: z$1.ZodString;
-    sub: z$1.ZodString;
-    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
-    wallet_name: z$1.ZodOptional<z$1.ZodString>;
-    aud: z$1.ZodOptional<z$1.ZodString>;
-    jti: z$1.ZodOptional<z$1.ZodString>;
-    nbf: z$1.ZodOptional<z$1.ZodNumber>;
-    nonce: z$1.ZodOptional<z$1.ZodString>;
-    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-}, z$1.core.$loose>;
-/**
- * Wallet Attestation JWT type for v1.0
- * The JWT is returned as a compact string
- */
-type WalletAttestationJwtV1_0 = string;
-/**
- * Zod schema for wallet attestation JWT validation (v1.0)
- * Validates that the result is a non-empty string
- */
-declare const zWalletAttestationJwtV1_0: z$1.ZodString;
-
-/**
- * Options for creating a wallet attestation with v1.0
- * Uses only trust_chain (federation method)
- */
-interface WalletAttestationOptionsV1_0 extends BaseWalletAttestationOptions {
     /**
-     * It expresses the strength of the authentication mechanism backing the Wallet instance when interacting with a Relying Party.
+     * The client id provided in the authorization request, if any.
+     *
+     * Pass this when the authorization request includes a `client_id` parameter.
+     * The function will verify that it matches the `sub` claim in the client attestation JWT.
+     * If not provided, no client_id validation is performed.
      */
-    authenticatorAssuranceLevel: string;
-    signer: {
-        alg: string;
-        kid: string;
-        method: "federation";
-        trustChain: [string, ...string[]];
-    };
+    requestClientId?: string;
 }
-/**
- * Create a Wallet Attestation JWT for IT-Wallet v1.0
- *
- * Version 1.0 specifics:
- * - Uses only `trust_chain` in header (federation method)
- *
- * @param options - Wallet attestation options for v1.0
- * @returns Signed wallet attestation JWT string
- * @throws {ValidationError} When validation of the JWT structure fails
- * @throws {ClientAttestationError} For other unexpected errors during creation
- * @internal This function is called by the WalletProvider router
- */
-declare const createWalletAttestationJwt$1: (options: WalletAttestationOptionsV1_0) => Promise<WalletAttestationJwtV1_0>;
-
+declare function verifyClientAttestation(options: VerifyClientAttestationOptions): Promise<{
+    clientAttestation: {
+        header: {
+            [x: string]: unknown;
+            trust_chain: [string, ...string[]];
+            typ: "oauth-client-attestation+jwt";
+            alg: string;
+            jwk?: {
+                [x: string]: unknown;
+                kty: string;
+                alg?: string | undefined;
+                crv?: string | undefined;
+                d?: string | undefined;
+                dp?: string | undefined;
+                dq?: string | undefined;
+                e?: string | undefined;
+                ext?: boolean | undefined;
+                k?: string | undefined;
+                key_ops?: string[] | undefined;
+                kid?: string | undefined;
+                n?: string | undefined;
+                oth?: {
+                    [x: string]: unknown;
+                    d?: string | undefined;
+                    r?: string | undefined;
+                    t?: string | undefined;
+                }[] | undefined;
+                p?: string | undefined;
+                q?: string | undefined;
+                qi?: string | undefined;
+                use?: string | undefined;
+                x?: string | undefined;
+                x5c?: string[] | undefined;
+                x5t?: string | undefined;
+                "x5t#S256"?: string | undefined;
+                x5u?: string | undefined;
+                y?: string | undefined;
+            } | undefined;
+            kid?: string | undefined;
+            x5c?: string[] | undefined;
+        };
+        payload: {
+            [x: string]: unknown;
+            aal: string;
+            cnf: {
+                jwk: {
+                    [x: string]: unknown;
+                    kty: string;
+                    alg?: string | undefined;
+                    crv?: string | undefined;
+                    d?: string | undefined;
+                    dp?: string | undefined;
+                    dq?: string | undefined;
+                    e?: string | undefined;
+                    ext?: boolean | undefined;
+                    k?: string | undefined;
+                    key_ops?: string[] | undefined;
+                    kid?: string | undefined;
+                    n?: string | undefined;
+                    oth?: {
+                        [x: string]: unknown;
+                        d?: string | undefined;
+                        r?: string | undefined;
+                        t?: string | undefined;
+                    }[] | undefined;
+                    p?: string | undefined;
+                    q?: string | undefined;
+                    qi?: string | undefined;
+                    use?: string | undefined;
+                    x?: string | undefined;
+                    x5c?: string[] | undefined;
+                    x5t?: string | undefined;
+                    "x5t#S256"?: string | undefined;
+                    x5u?: string | undefined;
+                    y?: string | undefined;
+                };
+            };
+            exp: number;
+            iat: number;
+            iss: string;
+            sub: string;
+            wallet_link?: string | undefined;
+            wallet_name?: string | undefined;
+            aud?: string | undefined;
+            jti?: string | undefined;
+            nbf?: number | undefined;
+            nonce?: string | undefined;
+            status?: Record<string, any> | undefined;
+            trust_chain?: [string, ...string[]] | undefined;
+        };
+        signer: _openid4vc_oauth2.JwtSignerWithJwk;
+    };
+    clientAttestationPop: {
+        header: {
+            [x: string]: unknown;
+            alg: string;
+            jwk?: {
+                [x: string]: unknown;
+                kty: string;
+                alg?: string | undefined;
+                crv?: string | undefined;
+                d?: string | undefined;
+                dp?: string | undefined;
+                dq?: string | undefined;
+                e?: string | undefined;
+                ext?: boolean | undefined;
+                k?: string | undefined;
+                key_ops?: string[] | undefined;
+                kid?: string | undefined;
+                n?: string | undefined;
+                oth?: {
+                    [x: string]: unknown;
+                    d?: string | undefined;
+                    r?: string | undefined;
+                    t?: string | undefined;
+                }[] | undefined;
+                p?: string | undefined;
+                q?: string | undefined;
+                qi?: string | undefined;
+                use?: string | undefined;
+                x?: string | undefined;
+                x5c?: string[] | undefined;
+                x5t?: string | undefined;
+                "x5t#S256"?: string | undefined;
+                x5u?: string | undefined;
+                y?: string | undefined;
+            } | undefined;
+            kid?: string | undefined;
+            trust_chain?: [string, ...string[]] | undefined;
+            typ?: string | undefined;
+            x5c?: string[] | undefined;
+        };
+        payload: {
+            [x: string]: unknown;
+            aud?: string | undefined;
+            cnf?: {
+                [x: string]: unknown;
+                jkt?: string | undefined;
+                jwk?: {
+                    [x: string]: unknown;
+                    kty: string;
+                    alg?: string | undefined;
+                    crv?: string | undefined;
+                    d?: string | undefined;
+                    dp?: string | undefined;
+                    dq?: string | undefined;
+                    e?: string | undefined;
+                    ext?: boolean | undefined;
+                    k?: string | undefined;
+                    key_ops?: string[] | undefined;
+                    kid?: string | undefined;
+                    n?: string | undefined;
+                    oth?: {
+                        [x: string]: unknown;
+                        d?: string | undefined;
+                        r?: string | undefined;
+                        t?: string | undefined;
+                    }[] | undefined;
+                    p?: string | undefined;
+                    q?: string | undefined;
+                    qi?: string | undefined;
+                    use?: string | undefined;
+                    x?: string | undefined;
+                    x5c?: string[] | undefined;
+                    x5t?: string | undefined;
+                    "x5t#S256"?: string | undefined;
+                    x5u?: string | undefined;
+                    y?: string | undefined;
+                } | undefined;
+            } | undefined;
+            exp?: number | undefined;
+            iat?: number | undefined;
+            iss?: string | undefined;
+            jti?: string | undefined;
+            nbf?: number | undefined;
+            nonce?: string | undefined;
+            status?: Record<string, any> | undefined;
+            trust_chain?: [string, ...string[]] | undefined;
+        };
+        signer: _openid4vc_oauth2.JwtSignerWithJwk;
+    };
+}>;
+
+interface BaseVerifyWalletAttestationJwtOptions {
+    callbacks: Pick<CallbackContext, "verifyJwt">;
+    now?: Date;
+    walletAttestationJwt: string;
+}
+/**
+ * Base options shared across all wallet attestation versions
+ */
+interface BaseWalletAttestationOptions {
+    callbacks: Pick<CallbackContext, "signJwt">;
+    dpopJwkPublic: ClientAttestationJwtPayload["cnf"]["jwk"];
+    expiresAt?: Date;
+    issuer: string;
+    walletLink?: string;
+    walletName?: string;
+}
+declare const zOauthClientAttestationHeader: z.ZodLiteral<"OAuth-Client-Attestation">;
+declare const oauthClientAttestationHeader: "OAuth-Client-Attestation";
+declare const zOauthClientAttestationPopHeader: z.ZodLiteral<"OAuth-Client-Attestation-PoP">;
+declare const oauthClientAttestationPopHeader: "OAuth-Client-Attestation-PoP";
+
 interface VerifyWalletAttestationJwtOptionsV1_0 extends BaseVerifyWalletAttestationJwtOptions {
     config: IoWalletSdkConfig<ItWalletSpecsVersion.V1_0>;
 }
-type VerifiedWalletAttestationJwtV1_0 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$2>>;
-declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJwtOptionsV1_0): Promise<{
+type VerifiedWalletAttestationJwtV1_0 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$3>>;
+declare function verifyWalletAttestationJwt$3(options: VerifyWalletAttestationJwtOptionsV1_0): Promise<{
     header: {
         [x: string]: unknown;
         trust_chain: [string, ...string[]];
@@ -874,169 +901,11 @@ declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJw
     signer: _openid4vc_oauth2.JwtSignerWithJwk;
 }>;
 
-type index$1_VerifiedWalletAttestationJwtV1_0 = VerifiedWalletAttestationJwtV1_0;
-type index$1_VerifyWalletAttestationJwtOptionsV1_0 = VerifyWalletAttestationJwtOptionsV1_0;
-type index$1_WalletAttestationJwtV1_0 = WalletAttestationJwtV1_0;
-type index$1_WalletAttestationOptionsV1_0 = WalletAttestationOptionsV1_0;
-declare const index$1_zWalletAttestationJwtHeaderV1_0: typeof zWalletAttestationJwtHeaderV1_0;
-declare const index$1_zWalletAttestationJwtPayloadV1_0: typeof zWalletAttestationJwtPayloadV1_0;
-declare const index$1_zWalletAttestationJwtV1_0: typeof zWalletAttestationJwtV1_0;
-declare namespace index$1 {
-  export { type index$1_VerifiedWalletAttestationJwtV1_0 as VerifiedWalletAttestationJwtV1_0, type index$1_VerifyWalletAttestationJwtOptionsV1_0 as VerifyWalletAttestationJwtOptionsV1_0, type index$1_WalletAttestationJwtV1_0 as WalletAttestationJwtV1_0, type index$1_WalletAttestationOptionsV1_0 as WalletAttestationOptionsV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwt, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwt, index$1_zWalletAttestationJwtHeaderV1_0 as zWalletAttestationJwtHeaderV1_0, index$1_zWalletAttestationJwtPayloadV1_0 as zWalletAttestationJwtPayloadV1_0, index$1_zWalletAttestationJwtV1_0 as zWalletAttestationJwtV1_0 };
+interface VerifyWalletAttestationJwtOptionsV1_3 extends BaseVerifyWalletAttestationJwtOptions {
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.V1_3>;
 }
-
-/**
- * JWT Header schema for IT-Wallet v1.3 Wallet Attestation
- *
- * Version 1.3 specifics:
- * - x5c is REQUIRED
- * - trust_chain is OPTIONAL
- */
-declare const zWalletAttestationJwtHeaderV1_3: z$1.ZodObject<{
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
-    x5c: z$1.ZodArray<z$1.ZodString>;
-    alg: z$1.ZodString;
-    jwk: z$1.ZodOptional<z$1.ZodObject<{
-        alg: z$1.ZodOptional<z$1.ZodString>;
-        crv: z$1.ZodOptional<z$1.ZodString>;
-        d: z$1.ZodOptional<z$1.ZodString>;
-        dp: z$1.ZodOptional<z$1.ZodString>;
-        dq: z$1.ZodOptional<z$1.ZodString>;
-        e: z$1.ZodOptional<z$1.ZodString>;
-        ext: z$1.ZodOptional<z$1.ZodBoolean>;
-        k: z$1.ZodOptional<z$1.ZodString>;
-        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        kid: z$1.ZodOptional<z$1.ZodString>;
-        kty: z$1.ZodString;
-        n: z$1.ZodOptional<z$1.ZodString>;
-        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-            d: z$1.ZodOptional<z$1.ZodString>;
-            r: z$1.ZodOptional<z$1.ZodString>;
-            t: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>>>;
-        p: z$1.ZodOptional<z$1.ZodString>;
-        q: z$1.ZodOptional<z$1.ZodString>;
-        qi: z$1.ZodOptional<z$1.ZodString>;
-        use: z$1.ZodOptional<z$1.ZodString>;
-        x: z$1.ZodOptional<z$1.ZodString>;
-        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        x5t: z$1.ZodOptional<z$1.ZodString>;
-        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-        x5u: z$1.ZodOptional<z$1.ZodString>;
-        y: z$1.ZodOptional<z$1.ZodString>;
-    }, z$1.core.$loose>>;
-    kid: z$1.ZodOptional<z$1.ZodString>;
-}, z$1.core.$loose>;
-/**
- * JWT Payload schema for IT-Wallet v1.3 Wallet Attestation
- *
- * Version 1.3 specifics:
- * - Supports nbf (not before) claim
- * - Supports status claim for revocation mechanisms
- */
-declare const zWalletAttestationJwtPayloadV1_3: z$1.ZodObject<{
-    cnf: z$1.ZodObject<{
-        jwk: z$1.ZodObject<{
-            alg: z$1.ZodOptional<z$1.ZodString>;
-            crv: z$1.ZodOptional<z$1.ZodString>;
-            d: z$1.ZodOptional<z$1.ZodString>;
-            dp: z$1.ZodOptional<z$1.ZodString>;
-            dq: z$1.ZodOptional<z$1.ZodString>;
-            e: z$1.ZodOptional<z$1.ZodString>;
-            ext: z$1.ZodOptional<z$1.ZodBoolean>;
-            k: z$1.ZodOptional<z$1.ZodString>;
-            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            kid: z$1.ZodOptional<z$1.ZodString>;
-            kty: z$1.ZodString;
-            n: z$1.ZodOptional<z$1.ZodString>;
-            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-                d: z$1.ZodOptional<z$1.ZodString>;
-                r: z$1.ZodOptional<z$1.ZodString>;
-                t: z$1.ZodOptional<z$1.ZodString>;
-            }, z$1.core.$loose>>>;
-            p: z$1.ZodOptional<z$1.ZodString>;
-            q: z$1.ZodOptional<z$1.ZodString>;
-            qi: z$1.ZodOptional<z$1.ZodString>;
-            use: z$1.ZodOptional<z$1.ZodString>;
-            x: z$1.ZodOptional<z$1.ZodString>;
-            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            x5t: z$1.ZodOptional<z$1.ZodString>;
-            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-            x5u: z$1.ZodOptional<z$1.ZodString>;
-            y: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>;
-    }, z$1.core.$strip>;
-    exp: z$1.ZodNumber;
-    iat: z$1.ZodNumber;
-    iss: z$1.ZodString;
-    nbf: z$1.ZodOptional<z$1.ZodNumber>;
-    status: z$1.ZodOptional<z$1.ZodObject<{
-        status_list: z$1.ZodObject<{
-            idx: z$1.ZodNumber;
-            uri: z$1.ZodString;
-        }, z$1.core.$strip>;
-    }, z$1.core.$strip>>;
-    sub: z$1.ZodString;
-    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
-    wallet_name: z$1.ZodOptional<z$1.ZodString>;
-    aud: z$1.ZodOptional<z$1.ZodString>;
-    jti: z$1.ZodOptional<z$1.ZodString>;
-    nonce: z$1.ZodOptional<z$1.ZodString>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-}, z$1.core.$loose>;
-/**
- * Wallet Attestation JWT type for v1.3
- * The JWT is returned as a compact string
- */
-type WalletAttestationJwtV1_3 = string;
-/**
- * Zod schema for wallet attestation JWT validation (v1.3)
- * Validates that the result is a non-empty string
- */
-declare const zWalletAttestationJwtV1_3: z$1.ZodString;
-
-/**
- * Options for creating a wallet attestation with v1.3
- * Requires x5c, optional trust_chain, nbf, and status
- */
-interface WalletAttestationOptionsV1_3 extends BaseWalletAttestationOptions {
-    nbf?: Date;
-    signer: {
-        alg: string;
-        kid: string;
-        method: "x5c";
-        trustChain?: [string, ...string[]];
-        x5c: [string, ...string[]];
-    };
-    status?: {
-        status_list: {
-            idx: number;
-            uri: string;
-        };
-    };
-}
-/**
- * Create a Wallet Attestation JWT for IT-Wallet v1.3
- *
- * Version 1.3 specifics:
- * - x5c in header is REQUIRED
- * - trust_chain in header is OPTIONAL
- * - Supports nbf and status claims in payload
- *
- * @param options - Wallet attestation options for v1.3
- * @returns Signed wallet attestation JWT string
- * @throws {ValidationError} When validation fails (including nbf >= exp)
- * @throws {ClientAttestationError} For other unexpected errors during creation
- * @internal This function is called by the WalletProvider router
- */
-declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_3) => Promise<WalletAttestationJwtV1_3>;
-
-interface VerifyWalletAttestationJwtOptionsV1_3 extends BaseVerifyWalletAttestationJwtOptions {
-    config: IoWalletSdkConfig<ItWalletSpecsVersion.V1_3>;
-}
-type VerifiedWalletAttestationJwtV1_3 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$1>>;
-declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJwtOptionsV1_3): Promise<{
+type VerifiedWalletAttestationJwtV1_3 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$2>>;
+declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJwtOptionsV1_3): Promise<{
     header: {
         [x: string]: unknown;
         typ: "oauth-client-attestation+jwt";
@@ -1132,82 +1001,54 @@ declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJw
     signer: _openid4vc_oauth2.JwtSignerWithJwk;
 }>;
 
-type index_VerifiedWalletAttestationJwtV1_3 = VerifiedWalletAttestationJwtV1_3;
-type index_VerifyWalletAttestationJwtOptionsV1_3 = VerifyWalletAttestationJwtOptionsV1_3;
-type index_WalletAttestationJwtV1_3 = WalletAttestationJwtV1_3;
-type index_WalletAttestationOptionsV1_3 = WalletAttestationOptionsV1_3;
-declare const index_createWalletAttestationJwt: typeof createWalletAttestationJwt;
-declare const index_zWalletAttestationJwtHeaderV1_3: typeof zWalletAttestationJwtHeaderV1_3;
-declare const index_zWalletAttestationJwtPayloadV1_3: typeof zWalletAttestationJwtPayloadV1_3;
-declare const index_zWalletAttestationJwtV1_3: typeof zWalletAttestationJwtV1_3;
-declare namespace index {
-  export { type index_VerifiedWalletAttestationJwtV1_3 as VerifiedWalletAttestationJwtV1_3, type index_VerifyWalletAttestationJwtOptionsV1_3 as VerifyWalletAttestationJwtOptionsV1_3, type index_WalletAttestationJwtV1_3 as WalletAttestationJwtV1_3, type index_WalletAttestationOptionsV1_3 as WalletAttestationOptionsV1_3, index_createWalletAttestationJwt as createWalletAttestationJwt, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwt, index_zWalletAttestationJwtHeaderV1_3 as zWalletAttestationJwtHeaderV1_3, index_zWalletAttestationJwtPayloadV1_3 as zWalletAttestationJwtPayloadV1_3, index_zWalletAttestationJwtV1_3 as zWalletAttestationJwtV1_3 };
-}
-
-interface ClientAttestationOptions {
-    /**
-     * The client attestation DPoP JWT provided in the request.
-     */
-    clientAttestationPopJwt: string;
-    /**
-     * Whether to ensure that the key used in client attestation confirmation
-     * is the same key used for DPoP. This only has effect if both DPoP and client
-     * attestations are present.
-     *
-     * @default false
-     */
-    ensureConfirmationKeyMatchesDpopKey?: boolean;
-    /**
-     * The wallet attestation JWT provided in the request.
-     */
-    walletAttestationJwt: string;
-}
-interface VerifyClientAttestationOptions {
-    /**
-     * The authorization server metadata.
-     */
-    authorizationServerMetadata: AuthorizationServerMetadata;
-    /**
-     * Callbacks for hashing and JWT verification.
-     */
-    callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
-    /**
-     * The client attestation options.
-     */
-    clientAttestation: ClientAttestationOptions;
-    /**
-     * The IT-Wallet SDK configuration, used to select the correct version-specific
-     * validation schema for the wallet attestation JWT.
-     */
-    config: IoWalletSdkConfig;
-    /**
-     * The DPoP JWK thumbprint value, if DPoP is being used in the request.
-     */
-    dpopJwkThumbprint?: string;
-    /**
-     * The current time to use when verifying the JWTs.
-     * If not provided current time will be used.
-     *
-     * @default new Date()
-     */
-    now?: Date;
-    /**
-     * The client id provided in the authorization request, if any.
-     *
-     * Pass this when the authorization request includes a `client_id` parameter.
-     * The function will verify that it matches the `sub` claim in the client attestation JWT.
-     * If not provided, no client_id validation is performed.
-     */
-    requestClientId?: string;
+interface VerifyWalletAttestationJwtOptionsV1_4 extends BaseVerifyWalletAttestationJwtOptions {
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.V1_4>;
 }
-declare function verifyClientAttestation(options: VerifyClientAttestationOptions): Promise<{
-    clientAttestation: {
-        header: {
+type VerifiedWalletAttestationJwtV1_4 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$1>>;
+declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJwtOptionsV1_4): Promise<{
+    header: {
+        [x: string]: unknown;
+        typ: "oauth-client-attestation+jwt";
+        x5c: string[];
+        alg: string;
+        trust_chain?: [string, ...string[]] | undefined;
+        jwk?: {
             [x: string]: unknown;
-            trust_chain: [string, ...string[]];
-            typ: "oauth-client-attestation+jwt";
-            alg: string;
-            jwk?: {
+            kty: string;
+            alg?: string | undefined;
+            crv?: string | undefined;
+            d?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            e?: string | undefined;
+            ext?: boolean | undefined;
+            k?: string | undefined;
+            key_ops?: string[] | undefined;
+            kid?: string | undefined;
+            n?: string | undefined;
+            oth?: {
+                [x: string]: unknown;
+                d?: string | undefined;
+                r?: string | undefined;
+                t?: string | undefined;
+            }[] | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            qi?: string | undefined;
+            use?: string | undefined;
+            x?: string | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            y?: string | undefined;
+        } | undefined;
+        kid?: string | undefined;
+    };
+    payload: {
+        [x: string]: unknown;
+        cnf: {
+            jwk: {
                 [x: string]: unknown;
                 kty: string;
                 alg?: string | undefined;
@@ -1237,156 +1078,42 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
                 "x5t#S256"?: string | undefined;
                 x5u?: string | undefined;
                 y?: string | undefined;
-            } | undefined;
-            kid?: string | undefined;
-            x5c?: string[] | undefined;
-        };
-        payload: {
-            [x: string]: unknown;
-            aal: string;
-            cnf: {
-                jwk: {
-                    [x: string]: unknown;
-                    kty: string;
-                    alg?: string | undefined;
-                    crv?: string | undefined;
-                    d?: string | undefined;
-                    dp?: string | undefined;
-                    dq?: string | undefined;
-                    e?: string | undefined;
-                    ext?: boolean | undefined;
-                    k?: string | undefined;
-                    key_ops?: string[] | undefined;
-                    kid?: string | undefined;
-                    n?: string | undefined;
-                    oth?: {
-                        [x: string]: unknown;
-                        d?: string | undefined;
-                        r?: string | undefined;
-                        t?: string | undefined;
-                    }[] | undefined;
-                    p?: string | undefined;
-                    q?: string | undefined;
-                    qi?: string | undefined;
-                    use?: string | undefined;
-                    x?: string | undefined;
-                    x5c?: string[] | undefined;
-                    x5t?: string | undefined;
-                    "x5t#S256"?: string | undefined;
-                    x5u?: string | undefined;
-                    y?: string | undefined;
-                };
             };
-            exp: number;
-            iat: number;
-            iss: string;
-            sub: string;
-            wallet_link?: string | undefined;
-            wallet_name?: string | undefined;
-            aud?: string | undefined;
-            jti?: string | undefined;
-            nbf?: number | undefined;
-            nonce?: string | undefined;
-            status?: Record<string, any> | undefined;
-            trust_chain?: [string, ...string[]] | undefined;
         };
-        signer: _openid4vc_oauth2.JwtSignerWithJwk;
-    };
-    clientAttestationPop: {
-        header: {
-            [x: string]: unknown;
-            alg: string;
-            jwk?: {
-                [x: string]: unknown;
-                kty: string;
-                alg?: string | undefined;
-                crv?: string | undefined;
-                d?: string | undefined;
-                dp?: string | undefined;
-                dq?: string | undefined;
-                e?: string | undefined;
-                ext?: boolean | undefined;
-                k?: string | undefined;
-                key_ops?: string[] | undefined;
-                kid?: string | undefined;
-                n?: string | undefined;
-                oth?: {
-                    [x: string]: unknown;
-                    d?: string | undefined;
-                    r?: string | undefined;
-                    t?: string | undefined;
-                }[] | undefined;
-                p?: string | undefined;
-                q?: string | undefined;
-                qi?: string | undefined;
-                use?: string | undefined;
-                x?: string | undefined;
-                x5c?: string[] | undefined;
-                x5t?: string | undefined;
-                "x5t#S256"?: string | undefined;
-                x5u?: string | undefined;
-                y?: string | undefined;
-            } | undefined;
-            kid?: string | undefined;
-            trust_chain?: [string, ...string[]] | undefined;
-            typ?: string | undefined;
-            x5c?: string[] | undefined;
-        };
-        payload: {
-            [x: string]: unknown;
-            aud?: string | undefined;
-            cnf?: {
-                [x: string]: unknown;
-                jkt?: string | undefined;
-                jwk?: {
-                    [x: string]: unknown;
-                    kty: string;
-                    alg?: string | undefined;
-                    crv?: string | undefined;
-                    d?: string | undefined;
-                    dp?: string | undefined;
-                    dq?: string | undefined;
-                    e?: string | undefined;
-                    ext?: boolean | undefined;
-                    k?: string | undefined;
-                    key_ops?: string[] | undefined;
-                    kid?: string | undefined;
-                    n?: string | undefined;
-                    oth?: {
-                        [x: string]: unknown;
-                        d?: string | undefined;
-                        r?: string | undefined;
-                        t?: string | undefined;
-                    }[] | undefined;
-                    p?: string | undefined;
-                    q?: string | undefined;
-                    qi?: string | undefined;
-                    use?: string | undefined;
-                    x?: string | undefined;
-                    x5c?: string[] | undefined;
-                    x5t?: string | undefined;
-                    "x5t#S256"?: string | undefined;
-                    x5u?: string | undefined;
-                    y?: string | undefined;
-                } | undefined;
-            } | undefined;
-            exp?: number | undefined;
-            iat?: number | undefined;
-            iss?: string | undefined;
-            jti?: string | undefined;
-            nbf?: number | undefined;
-            nonce?: string | undefined;
-            status?: Record<string, any> | undefined;
-            trust_chain?: [string, ...string[]] | undefined;
+        exp: number;
+        iat: number;
+        iss: string;
+        status: {
+            status_list: {
+                idx: number;
+                uri: string;
+            };
         };
-        signer: _openid4vc_oauth2.JwtSignerWithJwk;
+        sub: string;
+        wallet_link: string;
+        wallet_name: string;
+        eudi_wallet_info?: {
+            general_info: {
+                wallet_provider_name: string;
+                wallet_solution_certification_information: string;
+                wallet_solution_id: string;
+                wallet_solution_version: string;
+            };
+        } | undefined;
+        nbf?: number | undefined;
+        aud?: string | undefined;
+        jti?: string | undefined;
+        nonce?: string | undefined;
+        trust_chain?: [string, ...string[]] | undefined;
     };
+    signer: _openid4vc_oauth2.JwtSignerWithJwk;
 }>;
 
-type VerifiedWalletAttestationJwt = VerifiedWalletAttestationJwtV1_0 | VerifiedWalletAttestationJwtV1_3;
-type VerifyWalletAttestationJwtOptions = VerifyWalletAttestationJwtOptionsV1_0 | VerifyWalletAttestationJwtOptionsV1_3;
+type VerifiedWalletAttestationJwt = VerifiedWalletAttestationJwtV1_0 | VerifiedWalletAttestationJwtV1_3 | VerifiedWalletAttestationJwtV1_4;
+type VerifyWalletAttestationJwtOptions = VerifyWalletAttestationJwtOptionsV1_0 | VerifyWalletAttestationJwtOptionsV1_3 | VerifyWalletAttestationJwtOptionsV1_4;
 declare function verifyWalletAttestationJwt(options: VerifyWalletAttestationJwtOptionsV1_0): Promise<VerifiedWalletAttestationJwtV1_0>;
 declare function verifyWalletAttestationJwt(options: VerifyWalletAttestationJwtOptionsV1_3): Promise<VerifiedWalletAttestationJwtV1_3>;
+declare function verifyWalletAttestationJwt(options: VerifyWalletAttestationJwtOptionsV1_4): Promise<VerifiedWalletAttestationJwtV1_4>;
 declare function extractClientAttestationJwtsFromHeaders(headers: FetchHeaders): {
     clientAttestationPopHeader: string;
     valid: true;
@@ -1445,6 +1172,16 @@ interface VerifyAccessTokenRequestDpop {
      * to handle the alg.
      */
     allowedSigningAlgs?: string[];
+    /**
+     * The expected DPoP nonce value that must appear in the `nonce` claim of the DPoP proof JWT.
+     *
+     * AS implementations **SHOULD** issue server-provided nonces (via the `DPoP-Nonce` response
+     * header) and pass the expected value here to prevent pre-generated DPoP proofs from being
+     * reused across requests within the `iat` window.
+     *
+     * See RFC 9449 §8 for the full nonce issuance flow.
+     */
+    expectedNonce?: string;
     /**
      * The dpop jwt from the access token request
      */
@@ -1458,7 +1195,7 @@ interface VerifyAccessTokenRequestOptions {
     /**
      * The authorization server metadata
      */
-    authorizationServerMetadata: AuthorizationServerMetadata;
+    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
     /**
      * Callbacks used during verification
      */
@@ -1539,7 +1276,11 @@ interface VerifyAccessTokenRequestResult {
  *   callbacks: { hash, verifyJwt },
  *   clientAttestation: { jwt: "...", popJwt: "..." },
  *   codeExpiresAt: new Date(Date.now() + 600000),
- *   dpop: { jwt: dpopJwt, allowedSigningAlgs: ["ES256"] },
+ *   dpop: {
+ *     allowedSigningAlgs: ["ES256"],
+ *     expectedNonce: "server-issued-nonce",
+ *     jwt: dpopJwt,
+ *   },
  *   expectedCode: "auth_code_123",
  *   grant: parsedGrant,
  *   pkce: { codeChallenge, codeChallengeMethod: "S256", codeVerifier },
@@ -1644,7 +1385,7 @@ interface CreatePushedAuthorizationRequestOptions {
      * MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation.
      */
     clientId: string;
-    codeChallengeMethodsSupported: AuthorizationServerMetadata["code_challenge_methods_supported"];
+    codeChallengeMethodsSupported: ItWalletAuthorizationServerMetadata["code_challenge_methods_supported"];
     /**
      * DPoP options. Required when `require_signed_request_object` is `true`
      * (enforced at the type level via function overloads). Not used in the
@@ -1954,7 +1695,7 @@ interface VerifyAuthorizationRequestOptions {
     authorizationRequest: {
         client_id?: string;
     };
-    authorizationServerMetadata: AuthorizationServerMetadata;
+    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
     callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
     clientAttestation: ClientAttestationOptions;
     config: IoWalletSdkConfig;
@@ -2041,6 +1782,7 @@ interface RequestLike {
     url: string;
 }
 
+declare const MAX_JTI_LENGTH = 256;
 interface JwtSignerDid {
     alg: string;
     didUrl: string;
@@ -2223,6 +1965,35 @@ declare const zJwtHeader: z.ZodObject<{
 }, z.core.$loose>;
 type JwtHeader = z.infer<typeof zJwtHeader>;
 
+interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
+    /**
+     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
+     */
+    errorMessagePrefix?: string;
+    /**
+     * Schema to use for validating the header. If not provided the
+     * default `zJwtHeader` schema will be used
+     */
+    headerSchema?: HeaderSchema;
+    /**
+     * The compact encoded jwt
+     */
+    jwt: string;
+    /**
+     * Schema to use for validating the payload. If not provided the
+     * default `zJwtPayload` schema will be used
+     */
+    payloadSchema?: PayloadSchema;
+}
+interface DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> {
+    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
+    payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;
+    signature: string;
+}
+declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
+type IsSchemaProvided<T> = T extends undefined ? false : true;
+type InferSchemaOrDefaultOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? z.infer<ProvidedSchema> : never : z.infer<DefaultSchema>;
+
 declare const zJarAuthorizationRequest: z.ZodObject<{
     client_id: z.ZodOptional<z.ZodString>;
     request: z.ZodOptional<z.ZodString>;
@@ -2315,185 +2086,66 @@ type JarRequestObjectHeader = z.infer<typeof zJarRequestObjectHeader>;
 declare const signedAuthorizationRequestJwtHeaderTyp: "oauth-authz-req+jwt";
 declare const jwtAuthorizationRequestJwtHeaderTyp: "jwt";
 
-interface CreateJarRequestOptions {
-    /**
-     * Additional claims merged into the request object payload before
-     * `authorizationRequestPayload`.
-     */
-    additionalJwtPayload?: Record<string, unknown>;
-    /**
-     * Authorization request claims used as JWT header parameters.
-     */
-    authorizationRequestHeader: JarRequestObjectHeader;
-    /**
-     * Authorization request claims used as JWT payload.
-     */
-    authorizationRequestPayload: JarRequestObjectPayload;
-    /**
-     * Cryptographic callbacks used to sign and optionally encrypt the JAR.
-     */
-    callbacks: Partial<Pick<CallbackContext, "encryptJwe">> & Pick<CallbackContext, "signJwt">;
-    /**
-     * Request object lifetime in seconds from `now`.
-     */
-    expiresInSeconds: number;
-    /**
-     * Encryptor configuration. When provided, the signed request object is wrapped
-     * as JWE and returned as encrypted `request` value.
-     */
-    jweEncryptor?: JweEncryptor;
-    /**
-     * Signer configuration used to produce the request object JWT.
-     */
-    jwtSigner: JwtSigner;
-    /**
-     * Date that should be used as now. If not provided current date will be used.
-     */
+interface VerifyJarRequestOptions {
+    authorizationRequestJwt: string;
+    callbacks: Pick<CallbackContext, "verifyJwt">;
+    jarRequestParams: {
+        client_id?: string;
+    };
+    jwtSigner: JwtSigner$1;
     now?: Date;
-    /**
-     * Optional request URI for by-reference JAR transmission.
-     * When provided, `jarAuthorizationRequest` will include `request_uri` instead of `request`.
-     */
-    requestUri?: string;
 }
-interface CreateJarRequestResult {
-    /**
-     * The signed (and optionally encrypted) JWT string representing the authorization request.
-     * This value is included in `jarAuthorizationRequest` when `requestUri` is not provided.
-     */
-    authorizationRequestJwt: string;
+interface VerifiedJarRequest {
+    authorizationRequestPayload: JarRequestObjectPayload;
+    jwt: {
+        payload: JarRequestObjectPayload;
+    } & Omit<ReturnType<typeof decodeJwt>, "payload">;
+    signer: JwtSignerWithJwk$1;
+}
+/**
+ * Verifies a JAR (JWT Secured Authorization Request) request by validating and verifying signatures.
+ *
+ * @param options - The input parameters
+ * @param options.jarRequestParams - The JAR authorization request parameters
+ * @param options.callbacks - Context containing the relevant Jose crypto operations
+ * @returns The verified authorization request parameters and metadata
+ */
+declare function verifyJarRequest(options: VerifyJarRequestOptions): Promise<VerifiedJarRequest>;
+
+interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestResult {
     /**
-     * The JWK used for encryption when `jweEncryptor` is provided, otherwise undefined.
+     * The verified JAR request, if `authorizationRequestJwt` was provided
      */
-    encryptionJwk?: Jwk;
+    jar?: VerifiedJarRequest;
+}
+interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizationRequestOptions, "authorizationServerMetadata"> {
     /**
-     * The JAR authorization request parameters to be sent to the authorization endpoint.
-     * Contains either `request` or `request_uri` depending on the presence of `requestUri` in options.
+     * The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
+     * you MUST provide this value to ensure the JWT is verified.
      */
-    jarAuthorizationRequest: JarAuthorizationRequest;
+    authorizationRequestJwt?: {
+        jwt: string;
+        signer: JwtSigner$1;
+    };
     /**
-     * The JWK used for signing the request object JWT.
+     * Authorization Server metadata for enforcing JAR signing policy.
+     * Includes standard Authorization Server metadata plus require_signed_request_object.
+     * When require_signed_request_object is true, the server will reject unsigned requests.
+     * Defaults to false (permissive) if not provided.
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5}
      */
-    signerJwk: Jwk;
+    authorizationServerMetadata: {
+        require_signed_request_object?: boolean;
+    } & VerifyAuthorizationRequestOptions["authorizationServerMetadata"];
 }
 /**
- * Creates a JWT Secured Authorization Request (JAR) request payload.
- *
- * The request object is always signed, and optionally encrypted when `jweEncryptor`
- * is provided. The returned `jarAuthorizationRequest` is created in one of two forms:
- * - by-value, with `request`
- * - by-reference, with `request_uri`
+ * Verifies a pushed authorization request (PAR) including JAR, DPoP, and client attestation.
  *
- * @param options - Parameters used to create the JAR request
- * @param options.additionalJwtPayload - Additional JWT claims merged before authorization claims
- * @param options.authorizationRequestPayload - Base authorization request JWT payload
- * @param options.authorizationRequestHeader - JWT header parameters for the request object
- * @param options.callbacks - Callback context with required `signJwt` and optional `encryptJwe`
- * @param options.expiresInSeconds - JWT expiration offset in seconds
- * @param options.jweEncryptor - Optional JWE encryptor to wrap the signed JWT
- * @param options.jwtSigner - JWT signer used for request object signing
- * @param options.now - Optional reference time used for `iat` and `exp`
- * @param options.requestUri - Optional request URI for by-reference transmission
- *
- * @returns Signed (and optionally encrypted) authorization request data, signer key material,
- * and JAR request parameters for transmission.
- */
-declare function createJarRequest(options: CreateJarRequestOptions): Promise<CreateJarRequestResult>;
-
-declare function fetchJarRequestObject(options: {
-    fetch?: Fetch;
-    requestUri: string;
-}): Promise<string>;
-
-interface ParsedJarRequestOptions {
-    callbacks: Pick<CallbackContext, "fetch">;
-    jarRequestParams: JarAuthorizationRequest;
-}
-interface ParsedJarRequest {
-    authorizationRequestJwt: string;
-    sendBy: "reference" | "value";
-}
-declare function isJarAuthorizationRequest(request: JarAuthorizationRequest): request is JarAuthorizationRequest;
-/**
- * Parse a JAR (JWT Secured Authorization Request) request by validating and optionally fetch from uri.
- *
- * @param options - The input parameters
- * @param options.jarRequestParams - The JAR authorization request parameters
- * @param options.callbacks - Context containing the relevant Jose crypto operations
- * @returns An object containing the transmission method ('value' or 'reference') and the JWT request object.
- */
-declare function parseJarRequest(options: ParsedJarRequestOptions): Promise<ParsedJarRequest>;
-
-declare function validateJarRequestParams(options: {
-    jarRequestParams: JarAuthorizationRequest;
-}): ({
-    request: string;
-    request_uri?: never;
-} | {
-    request?: never;
-    request_uri: string;
-}) & JarAuthorizationRequest;
-
-interface VerifyJarRequestOptions {
-    authorizationRequestJwt: string;
-    callbacks: Pick<CallbackContext, "verifyJwt">;
-    jarRequestParams: {
-        client_id?: string;
-    };
-    jwtSigner: JwtSigner$1;
-    now?: Date;
-}
-interface VerifiedJarRequest {
-    authorizationRequestPayload: JarRequestObjectPayload;
-    jwt: {
-        payload: JarRequestObjectPayload;
-    } & Omit<ReturnType<typeof decodeJwt$1>, "payload">;
-    signer: JwtSignerWithJwk$1;
-}
-/**
- * Verifies a JAR (JWT Secured Authorization Request) request by validating and verifying signatures.
- *
- * @param options - The input parameters
- * @param options.jarRequestParams - The JAR authorization request parameters
- * @param options.callbacks - Context containing the relevant Jose crypto operations
- * @returns The verified authorization request parameters and metadata
- */
-declare function verifyJarRequest(options: VerifyJarRequestOptions): Promise<VerifiedJarRequest>;
-
-interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestResult {
-    /**
-     * The verified JAR request, if `authorizationRequestJwt` was provided
-     */
-    jar?: VerifiedJarRequest;
-}
-interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizationRequestOptions, "authorizationServerMetadata"> {
-    /**
-     * The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
-     * you MUST provide this value to ensure the JWT is verified.
-     */
-    authorizationRequestJwt?: {
-        jwt: string;
-        signer: JwtSigner$1;
-    };
-    /**
-     * Authorization Server metadata for enforcing JAR signing policy.
-     * Includes standard Authorization Server metadata plus require_signed_request_object.
-     * When require_signed_request_object is true, the server will reject unsigned requests.
-     * Defaults to false (permissive) if not provided.
-     *
-     * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5}
-     */
-    authorizationServerMetadata: {
-        require_signed_request_object?: boolean;
-    } & VerifyAuthorizationRequestOptions["authorizationServerMetadata"];
-}
-/**
- * Verifies a pushed authorization request (PAR) including JAR, DPoP, and client attestation.
- *
- * This function extends `verifyAuthorizationRequest` by adding support for JWT-secured
- * Authorization Requests (JAR). It performs comprehensive verification of all security
- * mechanisms used in pushed authorization requests according to RFC 9126 (PAR) and
- * RFC 9101 (JAR).
+ * This function extends `verifyAuthorizationRequest` by adding support for JWT-secured
+ * Authorization Requests (JAR). It performs comprehensive verification of all security
+ * mechanisms used in pushed authorization requests according to RFC 9126 (PAR) and
+ * RFC 9101 (JAR).
  *
  * The verification process includes:
  * 1. JAR signing policy enforcement (per RFC 9101 Section 10.5) - validates require_signed_request_object
@@ -2589,36 +2241,502 @@ interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizati
  * });
  * ```
  *
- * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5 - require_signed_request_object}
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5 - require_signed_request_object}
+ */
+declare function verifyPushedAuthorizationRequest(options: VerifyPushedAuthorizationRequestOptions): Promise<VerifyPushedAuthorizationRequestReturn>;
+
+/**
+ * Supported OAuth 2.0 client authentication methods.
+ */
+declare const SupportedClientAuthenticationMethod: {
+    readonly ClientSecretBasic: "client_secret_basic";
+    readonly ClientSecretPost: "client_secret_post";
+    readonly None: "none";
+    readonly WalletAttestationJwt: "attest_jwt_client_auth";
+};
+/**
+ * Union type of supported client authentication methods.
+ */
+type SupportedClientAuthenticationMethod = (typeof SupportedClientAuthenticationMethod)[keyof typeof SupportedClientAuthenticationMethod];
+/**
+ * Options for checking client attestation support.
+ */
+interface IsClientAttestationSupportedOptions {
+    /** Authorization server metadata containing supported authentication methods. */
+    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
+}
+/**
+ * Checks whether the authorization server supports client attestation authentication.
+ *
+ * @param options - Configuration including authorization server metadata
+ * @returns Object with `supported` boolean indicating if client attestation is available
+ */
+declare function isClientAttestationSupported(options: IsClientAttestationSupportedOptions): {
+    supported: boolean;
+};
+/**
+ * Options for client authentication
+ */
+interface ClientAuthenticationCallbackOptions {
+    /**
+     * Metadata of the authorization server
+     */
+    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
+    /**
+     * The body as a JSON object. If content type `x-www-form-urlencoded`
+     * is used, it will be encoded after this call.
+     *
+     * You can modify this object
+     */
+    body: Record<string, unknown>;
+    contentType: ContentType;
+    /**
+     * Headers for the request. You can modify this object
+     */
+    headers: FetchHeaders;
+    /**
+     * http method that will be used
+     */
+    method: HttpMethod;
+    /**
+     * URL to which the request will be made
+     */
+    url: string;
+}
+/**
+ * Callback method to determine the client authentication for a request.
+ */
+type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
+/**
+ * Anonymous client authentication
+ */
+declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
+interface ClientAuthenticationWalletAttestationJwtOptions {
+    callbacks: Pick<CallbackContext, "generateRandom" | "signJwt">;
+    walletAttestationJwt: string;
+}
+/**
+ * Client authentication using wallet attestation JWT.
+ * This method adds the wallet attestation JWT and a proof-of-possession JWT to the request headers.
+ */
+declare function clientAuthenticationWalletAttestationJwt(options: ClientAuthenticationWalletAttestationJwtOptions): ClientAuthenticationCallback;
+
+/**
+ * JWT Header schema for IT-Wallet v1.0 Wallet Attestation
+ *
+ * Version 1.0 specifics:
+ * - trust_chain is REQUIRED
+ * - x5c is NOT supported
+ */
+declare const zWalletAttestationJwtHeaderV1_0: z$1.ZodObject<{
+    trust_chain: z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>;
+    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
+    alg: z$1.ZodString;
+    jwk: z$1.ZodOptional<z$1.ZodObject<{
+        alg: z$1.ZodOptional<z$1.ZodString>;
+        crv: z$1.ZodOptional<z$1.ZodString>;
+        d: z$1.ZodOptional<z$1.ZodString>;
+        dp: z$1.ZodOptional<z$1.ZodString>;
+        dq: z$1.ZodOptional<z$1.ZodString>;
+        e: z$1.ZodOptional<z$1.ZodString>;
+        ext: z$1.ZodOptional<z$1.ZodBoolean>;
+        k: z$1.ZodOptional<z$1.ZodString>;
+        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        kid: z$1.ZodOptional<z$1.ZodString>;
+        kty: z$1.ZodString;
+        n: z$1.ZodOptional<z$1.ZodString>;
+        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            d: z$1.ZodOptional<z$1.ZodString>;
+            r: z$1.ZodOptional<z$1.ZodString>;
+            t: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>>;
+        p: z$1.ZodOptional<z$1.ZodString>;
+        q: z$1.ZodOptional<z$1.ZodString>;
+        qi: z$1.ZodOptional<z$1.ZodString>;
+        use: z$1.ZodOptional<z$1.ZodString>;
+        x: z$1.ZodOptional<z$1.ZodString>;
+        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        x5t: z$1.ZodOptional<z$1.ZodString>;
+        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+        x5u: z$1.ZodOptional<z$1.ZodString>;
+        y: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$loose>>;
+    kid: z$1.ZodOptional<z$1.ZodString>;
+    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+}, z$1.core.$loose>;
+/**
+ * JWT Payload schema for IT-Wallet v1.0 Wallet Attestation
+ *
+ * Version 1.0 specifics:
+ * - Standard claims only
+ * - No nbf or status support
+ */
+declare const zWalletAttestationJwtPayloadV1_0: z$1.ZodObject<{
+    aal: z$1.ZodString;
+    cnf: z$1.ZodObject<{
+        jwk: z$1.ZodObject<{
+            alg: z$1.ZodOptional<z$1.ZodString>;
+            crv: z$1.ZodOptional<z$1.ZodString>;
+            d: z$1.ZodOptional<z$1.ZodString>;
+            dp: z$1.ZodOptional<z$1.ZodString>;
+            dq: z$1.ZodOptional<z$1.ZodString>;
+            e: z$1.ZodOptional<z$1.ZodString>;
+            ext: z$1.ZodOptional<z$1.ZodBoolean>;
+            k: z$1.ZodOptional<z$1.ZodString>;
+            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            kid: z$1.ZodOptional<z$1.ZodString>;
+            kty: z$1.ZodString;
+            n: z$1.ZodOptional<z$1.ZodString>;
+            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+                d: z$1.ZodOptional<z$1.ZodString>;
+                r: z$1.ZodOptional<z$1.ZodString>;
+                t: z$1.ZodOptional<z$1.ZodString>;
+            }, z$1.core.$loose>>>;
+            p: z$1.ZodOptional<z$1.ZodString>;
+            q: z$1.ZodOptional<z$1.ZodString>;
+            qi: z$1.ZodOptional<z$1.ZodString>;
+            use: z$1.ZodOptional<z$1.ZodString>;
+            x: z$1.ZodOptional<z$1.ZodString>;
+            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            x5t: z$1.ZodOptional<z$1.ZodString>;
+            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+            x5u: z$1.ZodOptional<z$1.ZodString>;
+            y: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>;
+    }, z$1.core.$strip>;
+    exp: z$1.ZodNumber;
+    iat: z$1.ZodNumber;
+    iss: z$1.ZodString;
+    sub: z$1.ZodString;
+    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
+    wallet_name: z$1.ZodOptional<z$1.ZodString>;
+    aud: z$1.ZodOptional<z$1.ZodString>;
+    jti: z$1.ZodOptional<z$1.ZodString>;
+    nbf: z$1.ZodOptional<z$1.ZodNumber>;
+    nonce: z$1.ZodOptional<z$1.ZodString>;
+    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+}, z$1.core.$loose>;
+/**
+ * Wallet Attestation JWT type for v1.0
+ * The JWT is returned as a compact string
+ */
+type WalletAttestationJwtV1_0 = string;
+/**
+ * Zod schema for wallet attestation JWT validation (v1.0)
+ * Validates that the result is a non-empty string
+ */
+declare const zWalletAttestationJwtV1_0: z$1.ZodString;
+
+/**
+ * Options for creating a wallet attestation with v1.0
+ * Uses only trust_chain (federation method)
+ */
+interface WalletAttestationOptionsV1_0 extends BaseWalletAttestationOptions {
+    /**
+     * It expresses the strength of the authentication mechanism backing the Wallet instance when interacting with a Relying Party.
+     */
+    authenticatorAssuranceLevel: string;
+    signer: {
+        alg: string;
+        kid: string;
+        method: "federation";
+        trustChain: [string, ...string[]];
+    };
+}
+/**
+ * Create a Wallet Attestation JWT for IT-Wallet v1.0
+ *
+ * Version 1.0 specifics:
+ * - Uses only `trust_chain` in header (federation method)
+ *
+ * @param options - Wallet attestation options for v1.0
+ * @returns Signed wallet attestation JWT string
+ * @throws {ValidationError} When validation of the JWT structure fails
+ * @throws {ClientAttestationError} For other unexpected errors during creation
+ * @internal This function is called by the WalletProvider router
+ */
+declare const createWalletAttestationJwt$2: (options: WalletAttestationOptionsV1_0) => Promise<WalletAttestationJwtV1_0>;
+
+/**
+ * JWT Header schema for IT-Wallet v1.3 Wallet Attestation
+ *
+ * Version 1.3 specifics:
+ * - x5c is REQUIRED
+ * - trust_chain is OPTIONAL
+ */
+declare const zWalletAttestationJwtHeaderV1_3: z$1.ZodObject<{
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
+    x5c: z$1.ZodArray<z$1.ZodString>;
+    alg: z$1.ZodString;
+    jwk: z$1.ZodOptional<z$1.ZodObject<{
+        alg: z$1.ZodOptional<z$1.ZodString>;
+        crv: z$1.ZodOptional<z$1.ZodString>;
+        d: z$1.ZodOptional<z$1.ZodString>;
+        dp: z$1.ZodOptional<z$1.ZodString>;
+        dq: z$1.ZodOptional<z$1.ZodString>;
+        e: z$1.ZodOptional<z$1.ZodString>;
+        ext: z$1.ZodOptional<z$1.ZodBoolean>;
+        k: z$1.ZodOptional<z$1.ZodString>;
+        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        kid: z$1.ZodOptional<z$1.ZodString>;
+        kty: z$1.ZodString;
+        n: z$1.ZodOptional<z$1.ZodString>;
+        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            d: z$1.ZodOptional<z$1.ZodString>;
+            r: z$1.ZodOptional<z$1.ZodString>;
+            t: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>>;
+        p: z$1.ZodOptional<z$1.ZodString>;
+        q: z$1.ZodOptional<z$1.ZodString>;
+        qi: z$1.ZodOptional<z$1.ZodString>;
+        use: z$1.ZodOptional<z$1.ZodString>;
+        x: z$1.ZodOptional<z$1.ZodString>;
+        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        x5t: z$1.ZodOptional<z$1.ZodString>;
+        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+        x5u: z$1.ZodOptional<z$1.ZodString>;
+        y: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$loose>>;
+    kid: z$1.ZodOptional<z$1.ZodString>;
+}, z$1.core.$loose>;
+/**
+ * JWT Payload schema for IT-Wallet v1.3 Wallet Attestation
+ *
+ * Version 1.3 specifics:
+ * - Supports nbf (not before) claim
+ * - Supports status claim for revocation mechanisms
+ */
+declare const zWalletAttestationJwtPayloadV1_3: z$1.ZodObject<{
+    cnf: z$1.ZodObject<{
+        jwk: z$1.ZodObject<{
+            alg: z$1.ZodOptional<z$1.ZodString>;
+            crv: z$1.ZodOptional<z$1.ZodString>;
+            d: z$1.ZodOptional<z$1.ZodString>;
+            dp: z$1.ZodOptional<z$1.ZodString>;
+            dq: z$1.ZodOptional<z$1.ZodString>;
+            e: z$1.ZodOptional<z$1.ZodString>;
+            ext: z$1.ZodOptional<z$1.ZodBoolean>;
+            k: z$1.ZodOptional<z$1.ZodString>;
+            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            kid: z$1.ZodOptional<z$1.ZodString>;
+            kty: z$1.ZodString;
+            n: z$1.ZodOptional<z$1.ZodString>;
+            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+                d: z$1.ZodOptional<z$1.ZodString>;
+                r: z$1.ZodOptional<z$1.ZodString>;
+                t: z$1.ZodOptional<z$1.ZodString>;
+            }, z$1.core.$loose>>>;
+            p: z$1.ZodOptional<z$1.ZodString>;
+            q: z$1.ZodOptional<z$1.ZodString>;
+            qi: z$1.ZodOptional<z$1.ZodString>;
+            use: z$1.ZodOptional<z$1.ZodString>;
+            x: z$1.ZodOptional<z$1.ZodString>;
+            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            x5t: z$1.ZodOptional<z$1.ZodString>;
+            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+            x5u: z$1.ZodOptional<z$1.ZodString>;
+            y: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>;
+    }, z$1.core.$strip>;
+    exp: z$1.ZodNumber;
+    iat: z$1.ZodNumber;
+    iss: z$1.ZodString;
+    nbf: z$1.ZodOptional<z$1.ZodNumber>;
+    status: z$1.ZodOptional<z$1.ZodObject<{
+        status_list: z$1.ZodObject<{
+            idx: z$1.ZodNumber;
+            uri: z$1.ZodString;
+        }, z$1.core.$strip>;
+    }, z$1.core.$strip>>;
+    sub: z$1.ZodString;
+    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
+    wallet_name: z$1.ZodOptional<z$1.ZodString>;
+    aud: z$1.ZodOptional<z$1.ZodString>;
+    jti: z$1.ZodOptional<z$1.ZodString>;
+    nonce: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+}, z$1.core.$loose>;
+/**
+ * Wallet Attestation JWT type for v1.3
+ * The JWT is returned as a compact string
+ */
+type WalletAttestationJwtV1_3 = string;
+/**
+ * Zod schema for wallet attestation JWT validation (v1.3)
+ * Validates that the result is a non-empty string
+ */
+declare const zWalletAttestationJwtV1_3: z$1.ZodString;
+
+/**
+ * Options for creating a wallet attestation with v1.3
+ * Requires x5c, optional trust_chain, nbf, and status
+ */
+interface WalletAttestationOptionsV1_3 extends BaseWalletAttestationOptions {
+    nbf?: Date;
+    signer: {
+        alg: string;
+        kid: string;
+        method: "x5c";
+        trustChain?: [string, ...string[]];
+        x5c: [string, ...string[]];
+    };
+    status?: {
+        status_list: {
+            idx: number;
+            uri: string;
+        };
+    };
+}
+/**
+ * Create a Wallet Attestation JWT for IT-Wallet v1.3
+ *
+ * Version 1.3 specifics:
+ * - x5c in header is REQUIRED
+ * - trust_chain in header is OPTIONAL
+ * - Supports nbf and status claims in payload
+ *
+ * @param options - Wallet attestation options for v1.3
+ * @returns Signed wallet attestation JWT string
+ * @throws {ValidationError} When validation fails (including nbf >= exp)
+ * @throws {ClientAttestationError} For other unexpected errors during creation
+ * @internal This function is called by the WalletProvider router
  */
-declare function verifyPushedAuthorizationRequest(options: VerifyPushedAuthorizationRequestOptions): Promise<VerifyPushedAuthorizationRequestReturn>;
+declare const createWalletAttestationJwt$1: (options: WalletAttestationOptionsV1_3) => Promise<WalletAttestationJwtV1_3>;
 
-interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
-    /**
-     * Schema to use for validating the header. If not provided the
-     * default `zJwtHeader` schema will be used
-     */
-    headerSchema?: HeaderSchema;
-    /**
-     * The compact encoded jwt
-     */
-    jwt: string;
-    /**
-     * Schema to use for validating the payload. If not provided the
-     * default `zJwtPayload` schema will be used
-     */
-    payloadSchema?: PayloadSchema;
-}
-interface DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> {
-    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
-    payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;
-    signature: string;
+declare const zWalletAttestationStatusV1_4: z$1.ZodObject<{
+    status_list: z$1.ZodObject<{
+        idx: z$1.ZodNumber;
+        uri: z$1.ZodString;
+    }, z$1.core.$strip>;
+}, z$1.core.$strip>;
+declare const zEudiWalletInfoV1_4: z$1.ZodObject<{
+    general_info: z$1.ZodObject<{
+        wallet_provider_name: z$1.ZodString;
+        wallet_solution_certification_information: z$1.ZodURL;
+        wallet_solution_id: z$1.ZodString;
+        wallet_solution_version: z$1.ZodString;
+    }, z$1.core.$strip>;
+}, z$1.core.$strip>;
+declare const zWalletAttestationJwtHeaderV1_4: z$1.ZodObject<{
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
+    x5c: z$1.ZodArray<z$1.ZodString>;
+    alg: z$1.ZodString;
+    jwk: z$1.ZodOptional<z$1.ZodObject<{
+        alg: z$1.ZodOptional<z$1.ZodString>;
+        crv: z$1.ZodOptional<z$1.ZodString>;
+        d: z$1.ZodOptional<z$1.ZodString>;
+        dp: z$1.ZodOptional<z$1.ZodString>;
+        dq: z$1.ZodOptional<z$1.ZodString>;
+        e: z$1.ZodOptional<z$1.ZodString>;
+        ext: z$1.ZodOptional<z$1.ZodBoolean>;
+        k: z$1.ZodOptional<z$1.ZodString>;
+        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        kid: z$1.ZodOptional<z$1.ZodString>;
+        kty: z$1.ZodString;
+        n: z$1.ZodOptional<z$1.ZodString>;
+        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            d: z$1.ZodOptional<z$1.ZodString>;
+            r: z$1.ZodOptional<z$1.ZodString>;
+            t: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>>;
+        p: z$1.ZodOptional<z$1.ZodString>;
+        q: z$1.ZodOptional<z$1.ZodString>;
+        qi: z$1.ZodOptional<z$1.ZodString>;
+        use: z$1.ZodOptional<z$1.ZodString>;
+        x: z$1.ZodOptional<z$1.ZodString>;
+        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        x5t: z$1.ZodOptional<z$1.ZodString>;
+        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+        x5u: z$1.ZodOptional<z$1.ZodString>;
+        y: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$loose>>;
+    kid: z$1.ZodOptional<z$1.ZodString>;
+}, z$1.core.$loose>;
+declare const zWalletAttestationJwtPayloadV1_4: z$1.ZodObject<{
+    cnf: z$1.ZodObject<{
+        jwk: z$1.ZodObject<{
+            alg: z$1.ZodOptional<z$1.ZodString>;
+            crv: z$1.ZodOptional<z$1.ZodString>;
+            d: z$1.ZodOptional<z$1.ZodString>;
+            dp: z$1.ZodOptional<z$1.ZodString>;
+            dq: z$1.ZodOptional<z$1.ZodString>;
+            e: z$1.ZodOptional<z$1.ZodString>;
+            ext: z$1.ZodOptional<z$1.ZodBoolean>;
+            k: z$1.ZodOptional<z$1.ZodString>;
+            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            kid: z$1.ZodOptional<z$1.ZodString>;
+            kty: z$1.ZodString;
+            n: z$1.ZodOptional<z$1.ZodString>;
+            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+                d: z$1.ZodOptional<z$1.ZodString>;
+                r: z$1.ZodOptional<z$1.ZodString>;
+                t: z$1.ZodOptional<z$1.ZodString>;
+            }, z$1.core.$loose>>>;
+            p: z$1.ZodOptional<z$1.ZodString>;
+            q: z$1.ZodOptional<z$1.ZodString>;
+            qi: z$1.ZodOptional<z$1.ZodString>;
+            use: z$1.ZodOptional<z$1.ZodString>;
+            x: z$1.ZodOptional<z$1.ZodString>;
+            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            x5t: z$1.ZodOptional<z$1.ZodString>;
+            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+            x5u: z$1.ZodOptional<z$1.ZodString>;
+            y: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>;
+    }, z$1.core.$strip>;
+    eudi_wallet_info: z$1.ZodOptional<z$1.ZodObject<{
+        general_info: z$1.ZodObject<{
+            wallet_provider_name: z$1.ZodString;
+            wallet_solution_certification_information: z$1.ZodURL;
+            wallet_solution_id: z$1.ZodString;
+            wallet_solution_version: z$1.ZodString;
+        }, z$1.core.$strip>;
+    }, z$1.core.$strip>>;
+    exp: z$1.ZodNumber;
+    iat: z$1.ZodNumber;
+    iss: z$1.ZodString;
+    nbf: z$1.ZodOptional<z$1.ZodNumber>;
+    status: z$1.ZodObject<{
+        status_list: z$1.ZodObject<{
+            idx: z$1.ZodNumber;
+            uri: z$1.ZodString;
+        }, z$1.core.$strip>;
+    }, z$1.core.$strip>;
+    sub: z$1.ZodString;
+    wallet_link: z$1.ZodURL;
+    wallet_name: z$1.ZodString;
+    aud: z$1.ZodOptional<z$1.ZodString>;
+    jti: z$1.ZodOptional<z$1.ZodString>;
+    nonce: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+}, z$1.core.$loose>;
+type WalletAttestationJwtV1_4 = string;
+declare const zWalletAttestationJwtV1_4: z$1.ZodString;
+
+interface WalletAttestationOptionsV1_4 extends Omit<BaseWalletAttestationOptions, "walletLink" | "walletName"> {
+    eudiWalletInfo?: z$1.infer<typeof zEudiWalletInfoV1_4>;
+    nbf?: Date;
+    signer: {
+        alg: string;
+        kid: string;
+        method: "x5c";
+        trustChain?: [string, ...string[]];
+        x5c: [string, ...string[]];
+    };
+    status: z$1.infer<typeof zWalletAttestationStatusV1_4>;
+    walletLink: string;
+    walletName: string;
 }
-declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
-type IsSchemaProvided<T> = T extends undefined ? false : true;
-type InferSchemaOrDefaultOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? z.infer<ProvidedSchema> : never : z.infer<DefaultSchema>;
+declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_4) => Promise<WalletAttestationJwtV1_4>;
 
 interface DecodeJwtHeaderOptions<HeaderSchema extends BaseSchema | undefined> {
+    /**
+     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
+     */
+    errorMessagePrefix?: string;
     /**
      * Schema to use for validating the header. If not provided the
      * default `zJwtHeader` schema will be used
@@ -2701,48 +2819,177 @@ declare const zCompactJwe: z$1.ZodString;
  * Generic error thrown on OAuth2 operations
  */
 declare class Oauth2Error extends Error {
-    readonly statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    readonly statusCode?: number;
+    constructor(message: string, options?: {
+        statusCode?: number;
+    } & ErrorOptions);
 }
 /**
  * Custom error thrown when pushed authorization request operations fail
  */
 declare class PushedAuthorizationRequestError extends Oauth2Error {
-    readonly statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    readonly statusCode?: number;
+    constructor(message: string, options?: {
+        statusCode?: number;
+    } & ErrorOptions);
 }
 /**
  * Error thrown in case {@link createTokenDPoP} is called without neither a custom jti
  * nor a generateRandom callback or when the signJwt callback throws
  */
 declare class CreateTokenDPoPError extends Oauth2Error {
-    constructor(message: string);
+    constructor(message: string, options?: ErrorOptions);
 }
 /**
  * Error thrown during MRTD (Machine Readable Travel Document) Proof of Possession operations.
  * Used in eID Substantial Authentication with MRTD Verification flow (IT-Wallet L2+ specification).
  */
 declare class MrtdPopError extends Oauth2Error {
-    readonly statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    readonly statusCode?: number;
+    constructor(message: string, options?: {
+        statusCode?: number;
+    } & ErrorOptions);
 }
 /**
  * Custom error thrown when pushed authorization request operations fail
  */
 declare class FetchTokenResponseError extends Oauth2Error {
-    readonly statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    readonly statusCode?: number;
+    constructor(message: string, options?: {
+        statusCode?: number;
+    } & ErrorOptions);
 }
 declare class CreateTokenResponseError extends Oauth2Error {
-    readonly statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    readonly statusCode?: number;
+    constructor(message: string, options?: {
+        statusCode?: number;
+    } & ErrorOptions);
 }
 /**
  * Error thrown when an unexpected error occurs during client attestation (wallet attestation) creation.
  */
 declare class ClientAttestationError extends Oauth2Error {
-    constructor(message: string, cause?: unknown);
+    constructor(message: string, options?: ErrorOptions);
+}
+
+interface CreateJarRequestOptions {
+    /**
+     * Additional claims merged into the request object payload before
+     * `authorizationRequestPayload`.
+     */
+    additionalJwtPayload?: Record<string, unknown>;
+    /**
+     * Authorization request claims used as JWT header parameters.
+     */
+    authorizationRequestHeader: JarRequestObjectHeader;
+    /**
+     * Authorization request claims used as JWT payload.
+     */
+    authorizationRequestPayload: JarRequestObjectPayload;
+    /**
+     * Cryptographic callbacks used to sign and optionally encrypt the JAR.
+     */
+    callbacks: Partial<Pick<CallbackContext, "encryptJwe">> & Pick<CallbackContext, "signJwt">;
+    /**
+     * Request object lifetime in seconds from `now`.
+     */
+    expiresInSeconds: number;
+    /**
+     * Encryptor configuration. When provided, the signed request object is wrapped
+     * as JWE and returned as encrypted `request` value.
+     */
+    jweEncryptor?: JweEncryptor;
+    /**
+     * Signer configuration used to produce the request object JWT.
+     */
+    jwtSigner: JwtSigner;
+    /**
+     * Date that should be used as now. If not provided current date will be used.
+     */
+    now?: Date;
+    /**
+     * Optional request URI for by-reference JAR transmission.
+     * When provided, `jarAuthorizationRequest` will include `request_uri` instead of `request`.
+     */
+    requestUri?: string;
+}
+interface CreateJarRequestResult {
+    /**
+     * The signed (and optionally encrypted) JWT string representing the authorization request.
+     * This value is included in `jarAuthorizationRequest` when `requestUri` is not provided.
+     */
+    authorizationRequestJwt: string;
+    /**
+     * The JWK used for encryption when `jweEncryptor` is provided, otherwise undefined.
+     */
+    encryptionJwk?: Jwk;
+    /**
+     * The JAR authorization request parameters to be sent to the authorization endpoint.
+     * Contains either `request` or `request_uri` depending on the presence of `requestUri` in options.
+     */
+    jarAuthorizationRequest: JarAuthorizationRequest;
+    /**
+     * The JWK used for signing the request object JWT.
+     */
+    signerJwk: Jwk;
+}
+/**
+ * Creates a JWT Secured Authorization Request (JAR) request payload.
+ *
+ * The request object is always signed, and optionally encrypted when `jweEncryptor`
+ * is provided. The returned `jarAuthorizationRequest` is created in one of two forms:
+ * - by-value, with `request`
+ * - by-reference, with `request_uri`
+ *
+ * @param options - Parameters used to create the JAR request
+ * @param options.additionalJwtPayload - Additional JWT claims merged before authorization claims
+ * @param options.authorizationRequestPayload - Base authorization request JWT payload
+ * @param options.authorizationRequestHeader - JWT header parameters for the request object
+ * @param options.callbacks - Callback context with required `signJwt` and optional `encryptJwe`
+ * @param options.expiresInSeconds - JWT expiration offset in seconds
+ * @param options.jweEncryptor - Optional JWE encryptor to wrap the signed JWT
+ * @param options.jwtSigner - JWT signer used for request object signing
+ * @param options.now - Optional reference time used for `iat` and `exp`
+ * @param options.requestUri - Optional request URI for by-reference transmission
+ *
+ * @returns Signed (and optionally encrypted) authorization request data, signer key material,
+ * and JAR request parameters for transmission.
+ */
+declare function createJarRequest(options: CreateJarRequestOptions): Promise<CreateJarRequestResult>;
+
+declare function fetchJarRequestObject(options: {
+    fetch?: Fetch;
+    requestUri: string;
+}): Promise<string>;
+
+interface ParsedJarRequestOptions {
+    callbacks: Pick<CallbackContext, "fetch">;
+    jarRequestParams: JarAuthorizationRequest;
 }
+interface ParsedJarRequest {
+    authorizationRequestJwt: string;
+    sendBy: "reference" | "value";
+}
+declare function isJarAuthorizationRequest(request: JarAuthorizationRequest): request is JarAuthorizationRequest;
+/**
+ * Parse a JAR (JWT Secured Authorization Request) request by validating and optionally fetch from uri.
+ *
+ * @param options - The input parameters
+ * @param options.jarRequestParams - The JAR authorization request parameters
+ * @param options.callbacks - Context containing the relevant Jose crypto operations
+ * @returns An object containing the transmission method ('value' or 'reference') and the JWT request object.
+ */
+declare function parseJarRequest(options: ParsedJarRequestOptions): Promise<ParsedJarRequest>;
+
+declare function validateJarRequestParams(options: {
+    jarRequestParams: JarAuthorizationRequest;
+}): ({
+    request: string;
+    request_uri?: never;
+} | {
+    request?: never;
+    request_uri: string;
+}) & JarAuthorizationRequest;
 
 /**
  * Options for extracting and decoding the JWT from a form_post.jwt response
@@ -3315,4 +3562,4 @@ declare const zDpopJwtHeader: z.ZodObject<{
 }, z.core.$loose>;
 type DpopJwtHeader = z.infer<typeof zDpopJwtHeader>;
 
-export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequest, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, type CertificateChain, ClientAttestationError, type ClientAttestationOptions, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, type InferSchemaOrDefaultOutput, type IsClientAttestationSupportedOptions, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerWithJwk, type JwtSignerX5c, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsigned, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RequestLike, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type TrustChain, index$1 as V1_0, index as V1_3, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, decodeJwt, decodeJwtHeader, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationRequest, zCertificateChain, zCompactJwe, zCompactJwt, zDpopJwtHeader, zDpopJwtPayload, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsigned, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zSignedAuthorizationRequestJwtHeaderTyp, zTrustChain };
+export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequest, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, type CertificateChain, ClientAttestationError, type ClientAttestationOptions, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, type InferSchemaOrDefaultOutput, type IsClientAttestationSupportedOptions, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerWithJwk, type JwtSignerX5c, MAX_JTI_LENGTH, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsigned, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RequestLike, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type TrustChain, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, decodeJwt, decodeJwtHeader, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationRequest, zCertificateChain, zCompactJwe, zCompactJwt, zDpopJwtHeader, zDpopJwtPayload, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsigned, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zSignedAuthorizationRequestJwtHeaderTyp, zTrustChain, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };