@pagopa/io-wallet-oauth2 1.2.0 → 1.3.0

package/dist/index.js

@@ -35,14 +35,13 @@ __export(index_exports, {
   CreateTokenResponseError: () => CreateTokenResponseError,
   FetchTokenResponseError: () => FetchTokenResponseError,
   HashAlgorithm: () => import_oauth215.HashAlgorithm,
+  MAX_JTI_LENGTH: () => MAX_JTI_LENGTH,
   MrtdPopError: () => MrtdPopError,
   Oauth2Error: () => Oauth2Error,
   Oauth2JwtParseError: () => import_oauth215.Oauth2JwtParseError,
   PkceCodeChallengeMethod: () => PkceCodeChallengeMethod,
   PushedAuthorizationRequestError: () => PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod: () => SupportedClientAuthenticationMethod,
-  V1_0: () => v1_exports,
-  V1_3: () => v1_exports2,
   authorizationCodeGrantIdentifier: () => authorizationCodeGrantIdentifier,
   clientAuthenticationAnonymous: () => clientAuthenticationAnonymous,
   clientAuthenticationWalletAttestationJwt: () => clientAuthenticationWalletAttestationJwt,
@@ -54,6 +53,9 @@ __export(index_exports, {
   createPushedAuthorizationRequest: () => createPushedAuthorizationRequest,
   createTokenDPoP: () => createTokenDPoP,
   createTokenRequest: () => createTokenRequest,
+  createWalletAttestationJwtV1_0: () => createWalletAttestationJwt,
+  createWalletAttestationJwtV1_3: () => createWalletAttestationJwt2,
+  createWalletAttestationJwtV1_4: () => createWalletAttestationJwt3,
   decodeJwt: () => decodeJwt,
   decodeJwtHeader: () => decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders: () => extractClientAttestationJwtsFromHeaders,
@@ -90,7 +92,10 @@ __export(index_exports, {
   verifyPkce: () => verifyPkce,
   verifyPushedAuthorizationRequest: () => verifyPushedAuthorizationRequest,
   verifyTokenDPoP: () => verifyTokenDPoP,
-  verifyWalletAttestationJwt: () => verifyWalletAttestationJwt3,
+  verifyWalletAttestationJwt: () => verifyWalletAttestationJwt4,
+  verifyWalletAttestationJwtV1_0: () => verifyWalletAttestationJwt,
+  verifyWalletAttestationJwtV1_3: () => verifyWalletAttestationJwt2,
+  verifyWalletAttestationJwtV1_4: () => verifyWalletAttestationJwt3,
   zAccessTokenProfileJwtHeader: () => zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload: () => zAccessTokenProfileJwtPayload,
   zAccessTokenRequest: () => zAccessTokenRequest,
@@ -123,17 +128,26 @@ __export(index_exports, {
   zPushedAuthorizationResponse: () => zPushedAuthorizationResponse,
   zRefreshTokenGrantIdentifier: () => zRefreshTokenGrantIdentifier,
   zSignedAuthorizationRequestJwtHeaderTyp: () => zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain: () => zTrustChain
+  zTrustChain: () => zTrustChain,
+  zWalletAttestationJwtHeaderV1_0: () => zWalletAttestationJwtHeaderV1_0,
+  zWalletAttestationJwtHeaderV1_3: () => zWalletAttestationJwtHeaderV1_3,
+  zWalletAttestationJwtHeaderV1_4: () => zWalletAttestationJwtHeaderV1_4,
+  zWalletAttestationJwtPayloadV1_0: () => zWalletAttestationJwtPayloadV1_0,
+  zWalletAttestationJwtPayloadV1_3: () => zWalletAttestationJwtPayloadV1_3,
+  zWalletAttestationJwtPayloadV1_4: () => zWalletAttestationJwtPayloadV1_4,
+  zWalletAttestationJwtV1_0: () => zWalletAttestationJwtV1_0,
+  zWalletAttestationJwtV1_3: () => zWalletAttestationJwtV1_3,
+  zWalletAttestationJwtV1_4: () => zWalletAttestationJwtV1_4
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/access-token/create-token-request.ts
 var createTokenRequest = async (options) => ({
+  ...options.additionalRequestPayload,
   code: options.authorizationCode,
   code_verifier: options.pkceCodeVerifier,
   grant_type: "authorization_code",
-  redirect_uri: options.redirectUri,
-  ...options.additionalRequestPayload
+  redirect_uri: options.redirectUri
 });
 
 // src/access-token/create-token-response.ts
@@ -193,6 +207,7 @@ var zJwk = import_zod2.default.looseObject({
 var zJwkSet = import_zod2.default.looseObject({ keys: import_zod2.default.array(zJwk) });
 
 // src/common/jwt/z-jwt.ts
+var MAX_JTI_LENGTH = 256;
 var zCompactJwt = import_zod3.default.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
   message: "Not a valid compact jwt"
 });
@@ -207,7 +222,7 @@ var zJwtPayload = import_zod3.default.looseObject({
   exp: import_zod3.default.number().int().optional(),
   iat: import_zod3.default.number().int().optional(),
   iss: import_zod3.default.string().optional(),
-  jti: import_zod3.default.string().optional(),
+  jti: import_zod3.default.string().max(MAX_JTI_LENGTH).optional(),
   nbf: import_zod3.default.number().int().optional(),
   nonce: import_zod3.default.string().optional(),
   // Reserved for status parameters
@@ -229,23 +244,35 @@ var zJwtHeader = import_zod3.default.looseObject({
 function decodeJwtHeader(options) {
   const jwtParts = options.jwt.split(".");
   if (jwtParts.length <= 2) {
-    throw new import_oauth2.Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+    throw new import_oauth2.Oauth2JwtParseError(
+      (0, import_io_wallet_utils.formatError)(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
   }
   const [headerPart] = jwtParts;
   let headerJson;
   try {
     headerJson = (0, import_io_wallet_utils.stringToJsonWithErrorHandling)(
       (0, import_io_wallet_utils.encodeToUtf8String)((0, import_io_wallet_utils.decodeBase64)(headerPart)),
-      "Unable to parse jwt header to JSON"
+      (0, import_io_wallet_utils.formatError)(
+        "Unable to parse jwt header to JSON",
+        options.errorMessagePrefix
+      )
     );
   } catch (error) {
     throw new import_oauth2.Oauth2JwtParseError(
-      `Error parsing JWT. ${error instanceof Error ? error.message : ""}`
+      (0, import_io_wallet_utils.formatError)(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
     );
   }
   const header = (0, import_io_wallet_utils.parseWithErrorHandling)(
     options.headerSchema ?? zJwtHeader,
-    headerJson
+    headerJson,
+    (0, import_io_wallet_utils.formatError)("Invalid JWT header", options.errorMessagePrefix)
   );
   return {
     header
@@ -284,51 +311,55 @@ function jwtHeaderFromJwtSigner(signer) {
 
 // src/errors.ts
 var Oauth2Error = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "Oauth2Error";
+    this.statusCode = options?.statusCode;
   }
 };
 var PushedAuthorizationRequestError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "PushedAuthorizationRequestError";
+    this.statusCode = options?.statusCode;
   }
 };
 var CreateTokenDPoPError = class extends Oauth2Error {
-  constructor(message) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateTokenDPoPError";
   }
 };
 var MrtdPopError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "MrtdPopError";
+    this.statusCode = options?.statusCode;
   }
 };
 var FetchTokenResponseError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
-    this.name = "fetchTokenResponseError";
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
+    this.name = "FetchTokenResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var CreateTokenResponseError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateTokenResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var ClientAttestationError = class extends Oauth2Error {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "ClientAttestationError";
-    this.cause = cause;
   }
 };
 
@@ -374,7 +405,7 @@ var zAccessTokenProfileJwtPayload = import_zod4.z.looseObject({
   exp: import_zod4.z.number(),
   iat: import_zod4.z.number(),
   iss: import_zod4.z.string(),
-  jti: import_zod4.z.string(),
+  jti: import_zod4.z.string().max(MAX_JTI_LENGTH),
   nbf: import_zod4.z.number().optional(),
   scope: import_zod4.z.string().optional(),
   sub: import_zod4.z.string()
@@ -394,6 +425,7 @@ async function createAccessTokenResponse(options) {
       typ: "at+jwt"
     });
     const payload = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
+      ...options.additionalPayload,
       aud: options.audience,
       client_id: options.clientId,
       cnf: options.dpop ? {
@@ -409,19 +441,18 @@ async function createAccessTokenResponse(options) {
       jti: (0, import_io_wallet_utils2.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
       nbf: options.nbf,
       scope: options.scope,
-      sub: options.subject,
-      ...options.additionalPayload
+      sub: options.subject
     });
     const { jwt } = await options.callbacks.signJwt(options.signer, {
       header,
       payload
     });
     const accessTokenResponse = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenResponse, {
+      ...options.additionalPayload,
       access_token: jwt,
       expires_in: options.expiresInSeconds,
       refresh_token: options.refreshToken,
-      token_type: options.tokenType,
-      ...options.additionalPayload
+      token_type: options.tokenType
     });
     return accessTokenResponse;
   } catch (error) {
@@ -477,46 +508,83 @@ function toURLSearchParams(data) {
 }
 
 // src/access-token/parse-token-request.ts
-var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
 
-// src/client-attestation/client-attestation-pop.ts
-var import_oauth24 = require("@openid4vc/oauth2");
+// src/client-attestation/wallet-attestation.ts
+var import_oauth25 = require("@openid4vc/oauth2");
 var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
 
+// src/client-attestation/types.ts
+var import_zod5 = __toESM(require("zod"));
+var zOauthClientAttestationHeader = import_zod5.default.literal(
+  "OAuth-Client-Attestation"
+);
+var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
+var zOauthClientAttestationPopHeader = import_zod5.default.literal(
+  "OAuth-Client-Attestation-PoP"
+);
+var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
+
+// src/client-attestation/verify-wallet-attestation-jwt-base.ts
+var import_oauth24 = require("@openid4vc/oauth2");
+
 // src/common/jwt/decode-jwt.ts
 var import_oauth23 = require("@openid4vc/oauth2");
 var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
 function decodeJwt(options) {
   const jwtParts = options.jwt.split(".");
   if (jwtParts.length !== 3) {
-    throw new import_oauth23.Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+    throw new import_oauth23.Oauth2JwtParseError(
+      (0, import_io_wallet_utils4.formatError)(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
   }
   let payloadJson;
   try {
     const payloadPart = jwtParts[1];
     if (payloadPart === void 0) {
-      throw new import_oauth23.Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+      throw new import_oauth23.Oauth2JwtParseError(
+        (0, import_io_wallet_utils4.formatError)(
+          "Unable to decode because Jwt is not a valid!",
+          options.errorMessagePrefix
+        )
+      );
     }
     payloadJson = (0, import_io_wallet_utils4.stringToJsonWithErrorHandling)(
       (0, import_io_wallet_utils4.encodeToUtf8String)((0, import_io_wallet_utils4.decodeBase64)(payloadPart)),
-      "Unable to parse jwt payload to JSON"
+      (0, import_io_wallet_utils4.formatError)(
+        "Unable to parse jwt payload to JSON",
+        options.errorMessagePrefix
+      )
     );
   } catch (error) {
     throw new import_oauth23.Oauth2JwtParseError(
-      `Error parsing JWT. ${error instanceof Error ? error.message : ""}`
+      (0, import_io_wallet_utils4.formatError)(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
     );
   }
   const signaturePart = jwtParts[2];
   if (signaturePart === void 0) {
-    throw new import_oauth23.Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+    throw new import_oauth23.Oauth2JwtParseError(
+      (0, import_io_wallet_utils4.formatError)(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
   }
   const { header } = decodeJwtHeader({
+    errorMessagePrefix: options.errorMessagePrefix,
     headerSchema: options.headerSchema,
     jwt: options.jwt
   });
   const payload = (0, import_io_wallet_utils4.parseWithErrorHandling)(
     options.payloadSchema ?? zJwtPayload,
-    payloadJson
+    payloadJson,
+    (0, import_io_wallet_utils4.formatError)("Invalid JWT payload", options.errorMessagePrefix)
   );
   return {
     header,
@@ -525,156 +593,26 @@ function decodeJwt(options) {
   };
 }
 
-// src/client-attestation/client-attestation-pop.ts
-async function verifyClientAttestationPopJwt(options) {
-  try {
-    const { header, payload } = decodeJwt({
-      jwt: options.clientAttestationPopJwt
-    });
-    if (payload.aud !== options.authorizationServer) {
-      throw new Oauth2Error(
-        `Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`
-      );
-    }
-    const { signer } = await (0, import_oauth24.verifyJwt)({
-      compact: options.clientAttestationPopJwt,
-      errorMessage: "client attestation pop jwt verification failed",
-      expectedNonce: options.expectedNonce,
-      header,
-      now: options.now,
-      payload,
-      signer: {
-        alg: header.alg,
-        method: "jwk",
-        publicJwk: options.clientAttestationPublicJwk
-      },
-      verifyJwtCallback: options.callbacks.verifyJwt
-    });
-    return {
-      header,
-      payload,
-      signer
-    };
-  } catch (error) {
-    if (error instanceof Oauth2Error) throw error;
-    throw new Oauth2Error(
-      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-async function createClientAttestationPopJwt(options) {
-  try {
-    const clientAttestation = decodeJwt({
-      jwt: options.clientAttestation
-    });
-    const jwk = clientAttestation.payload.cnf?.jwk;
-    if (!jwk) {
-      throw new Oauth2Error(
-        "Client attestation does not contain 'cnf.jwk', cannot create client attestation pop jwt"
-      );
-    }
-    const sub = clientAttestation.payload.sub;
-    if (!sub || typeof sub !== "string") {
-      throw new Oauth2Error(
-        "Client attestation does not contain 'sub', cannot create client attestation pop jwt"
-      );
-    }
-    const signer = options.signer ?? {
-      alg: clientAttestation.header.alg,
-      method: "jwk",
-      publicJwk: jwk
-    };
-    const header = {
-      alg: signer.alg,
-      typ: "oauth-client-attestation-pop+jwt"
-    };
-    const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils5.addSecondsToDate)(issuedAt, 1 * 60);
-    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils5.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
-    if (!jti) {
-      throw new Oauth2Error(
-        "Error: neither a default jti nor a generateRandom callback have been provided"
-      );
-    }
-    const payload = {
-      aud: options.authorizationServer,
-      exp: (0, import_io_wallet_utils5.dateToSeconds)(expiresAt),
-      iat: (0, import_io_wallet_utils5.dateToSeconds)(issuedAt),
-      iss: sub,
-      jti
-    };
-    const { jwt } = await options.callbacks.signJwt(signer, {
-      header,
-      payload
-    });
-    return jwt;
-  } catch (error) {
-    if (error instanceof Oauth2Error) throw error;
-    throw new Oauth2Error(
-      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
-// src/client-attestation/types.ts
-var import_zod5 = __toESM(require("zod"));
-var zOauthClientAttestationHeader = import_zod5.default.literal(
-  "OAuth-Client-Attestation"
-);
-var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = import_zod5.default.literal(
-  "OAuth-Client-Attestation-PoP"
-);
-var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
-
-// src/client-attestation/client-authentication.ts
-var SupportedClientAuthenticationMethod = {
-  ClientSecretBasic: "client_secret_basic",
-  ClientSecretPost: "client_secret_post",
-  None: "none",
-  WalletAttestationJwt: "attest_jwt_client_auth"
-};
-function isClientAttestationSupported(options) {
-  if (!options.authorizationServerMetadata.token_endpoint_auth_methods_supported || !options.authorizationServerMetadata.token_endpoint_auth_methods_supported.includes(
-    SupportedClientAuthenticationMethod.WalletAttestationJwt
-  )) {
-    return {
-      supported: false
-    };
-  }
-  return {
-    supported: true
-  };
-}
-function clientAuthenticationAnonymous() {
-  return () => {
-  };
-}
-function clientAuthenticationWalletAttestationJwt(options) {
-  return async ({ authorizationServerMetadata, headers }) => {
-    const clientAttestationPop = await createClientAttestationPopJwt({
-      authorizationServer: authorizationServerMetadata.issuer,
-      callbacks: options.callbacks,
-      clientAttestation: options.walletAttestationJwt
-    });
-    headers.set(oauthClientAttestationHeader, options.walletAttestationJwt);
-    headers.set(oauthClientAttestationPopHeader, clientAttestationPop);
-  };
+// src/client-attestation/verify-wallet-attestation-jwt-base.ts
+async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
+  const { header, payload } = decodeJwt({
+    errorMessagePrefix: "Error decoding wallet attestation JWT:",
+    headerSchema,
+    jwt: options.walletAttestationJwt,
+    payloadSchema
+  });
+  const { signer } = await (0, import_oauth24.verifyJwt)({
+    compact: options.walletAttestationJwt,
+    errorMessage: "wallet attestation verification failed.",
+    header,
+    now: options.now,
+    payload,
+    signer: (0, import_oauth24.jwtSignerFromJwt)({ header, payload }),
+    verifyJwtCallback: options.callbacks.verifyJwt
+  });
+  return { header, payload, signer };
 }
 
-// src/client-attestation/v1.0/index.ts
-var v1_exports = {};
-__export(v1_exports, {
-  createWalletAttestationJwt: () => createWalletAttestationJwt,
-  verifyWalletAttestationJwt: () => verifyWalletAttestationJwt,
-  zWalletAttestationJwtHeaderV1_0: () => zWalletAttestationJwtHeaderV1_0,
-  zWalletAttestationJwtPayloadV1_0: () => zWalletAttestationJwtPayloadV1_0,
-  zWalletAttestationJwtV1_0: () => zWalletAttestationJwtV1_0
-});
-
-// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
-
 // src/client-attestation/v1.0/z-wallet-attestation.ts
 var import_zod6 = require("zod");
 var zWalletAttestationJwtHeaderV1_0 = import_zod6.z.looseObject({
@@ -698,67 +636,6 @@ var zWalletAttestationJwtPayloadV1_0 = import_zod6.z.looseObject({
 });
 var zWalletAttestationJwtV1_0 = import_zod6.z.string().min(1);
 
-// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
-var createWalletAttestationJwt = async (options) => {
-  try {
-    const { signJwt } = options.callbacks;
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils6.addSecondsToDate)(/* @__PURE__ */ new Date(), 3600 * 24 * 60);
-    const payload = {
-      cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils6.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils6.dateToSeconds)(/* @__PURE__ */ new Date()),
-      iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
-      ...options.walletLink && { wallet_link: options.walletLink },
-      ...options.walletName && { wallet_name: options.walletName },
-      aal: options.authenticatorAssuranceLevel
-    };
-    const header = {
-      alg: options.signer.alg,
-      kid: options.signer.kid,
-      trust_chain: options.signer.trustChain,
-      typ: "oauth-client-attestation+jwt"
-    };
-    const result = await signJwt(options.signer, {
-      header,
-      payload
-    });
-    decodeJwt({
-      headerSchema: zWalletAttestationJwtHeaderV1_0,
-      jwt: result.jwt,
-      payloadSchema: zWalletAttestationJwtPayloadV1_0
-    });
-    return result.jwt;
-  } catch (error) {
-    if (error instanceof import_io_wallet_utils6.ValidationError) {
-      throw error;
-    }
-    throw new ClientAttestationError(
-      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-};
-
-// src/client-attestation/verify-wallet-attestation-jwt-base.ts
-var import_oauth25 = require("@openid4vc/oauth2");
-async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
-  const { header, payload } = decodeJwt({
-    headerSchema,
-    jwt: options.walletAttestationJwt,
-    payloadSchema
-  });
-  const { signer } = await (0, import_oauth25.verifyJwt)({
-    compact: options.walletAttestationJwt,
-    errorMessage: "wallet attestation verification failed.",
-    header,
-    now: options.now,
-    payload,
-    signer: (0, import_oauth25.jwtSignerFromJwt)({ header, payload }),
-    verifyJwtCallback: options.callbacks.verifyJwt
-  });
-  return { header, payload, signer };
-}
-
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
   return verifyWalletAttestationBase(
@@ -768,19 +645,6 @@ async function verifyWalletAttestationJwt(options) {
   );
 }
 
-// src/client-attestation/v1.3/index.ts
-var v1_exports2 = {};
-__export(v1_exports2, {
-  createWalletAttestationJwt: () => createWalletAttestationJwt2,
-  verifyWalletAttestationJwt: () => verifyWalletAttestationJwt2,
-  zWalletAttestationJwtHeaderV1_3: () => zWalletAttestationJwtHeaderV1_3,
-  zWalletAttestationJwtPayloadV1_3: () => zWalletAttestationJwtPayloadV1_3,
-  zWalletAttestationJwtV1_3: () => zWalletAttestationJwtV1_3
-});
-
-// src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
-
 // src/client-attestation/v1.3/z-wallet-attestation.ts
 var import_zod7 = require("zod");
 var zWalletAttestationJwtHeaderV1_3 = import_zod7.z.looseObject({
@@ -814,55 +678,6 @@ var zWalletAttestationJwtPayloadV1_3 = import_zod7.z.looseObject({
 });
 var zWalletAttestationJwtV1_3 = import_zod7.z.string().min(1);
 
-// src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
-var createWalletAttestationJwt2 = async (options) => {
-  try {
-    const { signJwt } = options.callbacks;
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils7.addSecondsToDate)(/* @__PURE__ */ new Date(), 3600 * 24 * 60);
-    if (options.nbf && options.nbf >= exp) {
-      throw new import_io_wallet_utils7.ValidationError("nbf must be before exp");
-    }
-    const payload = {
-      cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils7.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils7.dateToSeconds)(/* @__PURE__ */ new Date()),
-      iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
-      ...options.nbf && { nbf: (0, import_io_wallet_utils7.dateToSeconds)(options.nbf) },
-      ...options.status && { status: options.status },
-      ...options.walletLink && { wallet_link: options.walletLink },
-      ...options.walletName && { wallet_name: options.walletName }
-    };
-    const header = {
-      alg: options.signer.alg,
-      kid: options.signer.kid,
-      typ: "oauth-client-attestation+jwt",
-      x5c: options.signer.x5c,
-      // REQUIRED
-      ...options.signer.trustChain && {
-        trust_chain: options.signer.trustChain
-      }
-    };
-    const result = await signJwt(options.signer, {
-      header,
-      payload
-    });
-    decodeJwt({
-      headerSchema: zWalletAttestationJwtHeaderV1_3,
-      jwt: result.jwt,
-      payloadSchema: zWalletAttestationJwtPayloadV1_3
-    });
-    return result.jwt;
-  } catch (error) {
-    if (error instanceof import_io_wallet_utils7.ValidationError) {
-      throw error;
-    }
-    throw new ClientAttestationError(
-      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-};
-
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
   return verifyWalletAttestationBase(
@@ -872,19 +687,65 @@ async function verifyWalletAttestationJwt2(options) {
   );
 }
 
-// src/client-attestation/verify-client-attestation.ts
-var import_oauth27 = require("@openid4vc/oauth2");
+// src/client-attestation/v1.4/z-wallet-attestation.ts
+var import_zod8 = require("zod");
+var zWalletAttestationStatusV1_4 = import_zod8.z.object({
+  status_list: import_zod8.z.object({
+    idx: import_zod8.z.number().int(),
+    uri: import_zod8.z.string()
+  })
+});
+var zEudiWalletInfoV1_4 = import_zod8.z.object({
+  general_info: import_zod8.z.object({
+    wallet_provider_name: import_zod8.z.string(),
+    wallet_solution_certification_information: import_zod8.z.url(),
+    wallet_solution_id: import_zod8.z.string(),
+    wallet_solution_version: import_zod8.z.string()
+  })
+});
+var zWalletAttestationJwtHeaderV1_4 = import_zod8.z.looseObject({
+  ...zJwtHeader.shape,
+  trust_chain: zTrustChain.optional(),
+  typ: import_zod8.z.literal("oauth-client-attestation+jwt"),
+  x5c: zCertificateChain
+});
+var zWalletAttestationJwtPayloadV1_4 = import_zod8.z.looseObject({
+  ...zJwtPayload.shape,
+  cnf: import_zod8.z.object({
+    jwk: zJwk
+  }),
+  eudi_wallet_info: zEudiWalletInfoV1_4.optional(),
+  exp: import_zod8.z.number().int(),
+  iat: import_zod8.z.number().int(),
+  iss: import_zod8.z.string(),
+  nbf: import_zod8.z.number().optional(),
+  status: zWalletAttestationStatusV1_4,
+  sub: import_zod8.z.string(),
+  wallet_link: import_zod8.z.url(),
+  wallet_name: import_zod8.z.string()
+});
+var zWalletAttestationJwtV1_4 = import_zod8.z.string().min(1);
+
+// src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
+async function verifyWalletAttestationJwt3(options) {
+  return verifyWalletAttestationBase(
+    options,
+    zWalletAttestationJwtHeaderV1_4,
+    zWalletAttestationJwtPayloadV1_4
+  );
+}
 
 // src/client-attestation/wallet-attestation.ts
-var import_oauth26 = require("@openid4vc/oauth2");
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
 function isV1_0Options(options) {
-  return options.config.itWalletSpecsVersion === import_io_wallet_utils8.ItWalletSpecsVersion.V1_0;
+  return options.config.itWalletSpecsVersion === import_io_wallet_utils5.ItWalletSpecsVersion.V1_0;
 }
 function isV1_3Options(options) {
-  return options.config.itWalletSpecsVersion === import_io_wallet_utils8.ItWalletSpecsVersion.V1_3;
+  return options.config.itWalletSpecsVersion === import_io_wallet_utils5.ItWalletSpecsVersion.V1_3;
 }
-async function verifyWalletAttestationJwt3(options) {
+function isV1_4Options(options) {
+  return options.config.itWalletSpecsVersion === import_io_wallet_utils5.ItWalletSpecsVersion.V1_4;
+}
+async function verifyWalletAttestationJwt4(options) {
   const version = options.config.itWalletSpecsVersion;
   if (isV1_0Options(options)) {
     return verifyWalletAttestationJwt(options);
@@ -892,10 +753,14 @@ async function verifyWalletAttestationJwt3(options) {
   if (isV1_3Options(options)) {
     return verifyWalletAttestationJwt2(options);
   }
-  throw new import_io_wallet_utils8.ItWalletSpecsVersionError("verifyWalletAttestationJwt", version, [
-    import_io_wallet_utils8.ItWalletSpecsVersion.V1_0,
-    import_io_wallet_utils8.ItWalletSpecsVersion.V1_3
-  ]);
+  if (isV1_4Options(options)) {
+    return verifyWalletAttestationJwt3(options);
+  }
+  throw new import_io_wallet_utils5.ItWalletSpecsVersionError(
+    "verifyWalletAttestationJwt",
+    version,
+    Object.values(import_io_wallet_utils5.ItWalletSpecsVersion)
+  );
 }
 function extractClientAttestationJwtsFromHeaders(headers) {
   const walletAttestationHeader = headers.get(oauthClientAttestationHeader);
@@ -908,7 +773,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   if (!walletAttestationHeader || !clientAttestationPopHeader) {
     return { valid: false };
   }
-  if (!import_oauth26.zCompactJwt.safeParse(walletAttestationHeader).success || !import_oauth26.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
+  if (!import_oauth25.zCompactJwt.safeParse(walletAttestationHeader).success || !import_oauth25.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
     return { valid: false };
   }
   return {
@@ -918,53 +783,9 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   };
 }
 
-// src/client-attestation/verify-client-attestation.ts
-async function verifyClientAttestation(options) {
-  if (!options.clientAttestation.walletAttestationJwt || !options.clientAttestation.clientAttestationPopJwt) {
-    throw new Oauth2Error(
-      `Missing required client attestation parameters in the request. Make sure to provide the '${oauthClientAttestationHeader}' and '${oauthClientAttestationPopHeader}' header values.`
-    );
-  }
-  const clientAttestation = await verifyWalletAttestationJwt3({
-    callbacks: options.callbacks,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    config: options.config,
-    now: options.now,
-    walletAttestationJwt: options.clientAttestation.walletAttestationJwt
-  });
-  const clientAttestationPop = await verifyClientAttestationPopJwt({
-    authorizationServer: options.authorizationServerMetadata.issuer,
-    callbacks: options.callbacks,
-    clientAttestationPopJwt: options.clientAttestation.clientAttestationPopJwt,
-    clientAttestationPublicJwk: clientAttestation.payload.cnf.jwk,
-    now: options.now
-  });
-  if (options.requestClientId && options.requestClientId !== clientAttestation.payload.sub) {
-    throw new Oauth2Error(
-      `The client_id '${options.requestClientId}' in the request does not match the client id '${clientAttestation.payload.sub}' in the client attestation`
-    );
-  }
-  if (options.clientAttestation.ensureConfirmationKeyMatchesDpopKey && options.dpopJwkThumbprint) {
-    const clientAttestationJkt = await (0, import_oauth27.calculateJwkThumbprint)({
-      hashAlgorithm: import_oauth27.HashAlgorithm.Sha256,
-      hashCallback: options.callbacks.hash,
-      jwk: clientAttestation.payload.cnf.jwk
-    });
-    if (clientAttestationJkt !== options.dpopJwkThumbprint) {
-      throw new Oauth2Error(
-        "Expected the DPoP JWK thumbprint value to match the JWK thumbprint of the client attestation confirmation JWK. Ensure both DPoP and client attestation use the same key."
-      );
-    }
-  }
-  return {
-    clientAttestation,
-    clientAttestationPop
-  };
-}
-
 // src/token-dpop/create-token-dpop.ts
-var import_oauth28 = require("@openid4vc/oauth2");
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_oauth26 = require("@openid4vc/oauth2");
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
 var import_js_base64 = require("js-base64");
 
 // src/token-dpop/dpop-utils.ts
@@ -976,29 +797,29 @@ var htuFromRequestUrl = (requestUrl) => {
 };
 
 // src/token-dpop/z-dpop.ts
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
-var import_zod8 = __toESM(require("zod"));
-var zDpopJwtPayload = import_zod8.default.looseObject({
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
+var import_zod9 = __toESM(require("zod"));
+var zDpopJwtPayload = import_zod9.default.looseObject({
   ...zJwtPayload.shape,
-  ath: import_zod8.default.optional(import_zod8.default.string()),
-  htm: import_io_wallet_utils9.zHttpMethod,
-  htu: import_zod8.default.url(),
-  iat: import_zod8.default.number().int().nonnegative(),
-  jti: import_zod8.default.string()
+  ath: import_zod9.default.optional(import_zod9.default.string()),
+  htm: import_io_wallet_utils6.zHttpMethod,
+  htu: import_zod9.default.url(),
+  iat: import_zod9.default.number().int().nonnegative(),
+  jti: import_zod9.default.string().max(MAX_JTI_LENGTH)
 });
-var zDpopJwtHeader = import_zod8.default.looseObject({
+var zDpopJwtHeader = import_zod9.default.looseObject({
   ...zJwtHeader.shape,
   jwk: zJwk,
-  typ: import_zod8.default.literal("dpop+jwt")
+  typ: import_zod9.default.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
 async function createTokenDPoP(options) {
   try {
-    const ath = options.accessToken ? (0, import_io_wallet_utils10.encodeToBase64Url)(
+    const ath = options.accessToken ? (0, import_io_wallet_utils7.encodeToBase64Url)(
       await options.callbacks.hash(
-        (0, import_io_wallet_utils10.decodeUtf8String)(options.accessToken),
-        import_oauth28.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils7.decodeUtf8String)(options.accessToken),
+        import_oauth26.HashAlgorithm.Sha256
       )
     ) : void 0;
     const jti = options.jti ?? (options.callbacks.generateRandom ? import_js_base64.Base64.fromUint8Array(
@@ -1010,16 +831,16 @@ async function createTokenDPoP(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const header = (0, import_io_wallet_utils10.parseWithErrorHandling)(zDpopJwtHeader, {
+    const header = (0, import_io_wallet_utils7.parseWithErrorHandling)(zDpopJwtHeader, {
       alg: options.signer.alg,
       jwk: options.signer.publicJwk,
       typ: "dpop+jwt"
     });
-    const payload = (0, import_io_wallet_utils10.parseWithErrorHandling)(zDpopJwtPayload, {
+    const payload = (0, import_io_wallet_utils7.parseWithErrorHandling)(zDpopJwtPayload, {
       ath,
       htm: options.tokenRequest.method,
       htu: htuFromRequestUrl(options.tokenRequest.url),
-      iat: (0, import_io_wallet_utils10.dateToSeconds)(options.issuedAt),
+      iat: (0, import_io_wallet_utils7.dateToSeconds)(options.issuedAt),
       jti
     });
     return options.callbacks.signJwt(options.signer, {
@@ -1027,7 +848,7 @@ async function createTokenDPoP(options) {
       payload
     });
   } catch (error) {
-    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils10.ValidationError) {
+    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils7.ValidationError) {
       throw error;
     }
     throw new CreateTokenDPoPError(
@@ -1040,112 +861,17 @@ function extractDpopJwtFromHeaders(headers) {
   if (!dpopJwt) {
     return { valid: true };
   }
-  if (!import_oauth28.zCompactJwt.safeParse(dpopJwt).success) {
+  if (!import_oauth26.zCompactJwt.safeParse(dpopJwt).success) {
     return { valid: false };
   }
   return { dpopJwt, valid: true };
 }
 
-// src/token-dpop/verify-token-dpop.ts
-var import_oauth29 = require("@openid4vc/oauth2");
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
-async function verifyTokenDPoP(options) {
-  const { header, payload } = decodeJwt({
-    headerSchema: zDpopJwtHeader,
-    jwt: options.dpopJwt,
-    payloadSchema: zDpopJwtPayload
-  });
-  if (options.allowedSigningAlgs && !options.allowedSigningAlgs.includes(header.alg)) {
-    throw new Oauth2Error(
-      `dpop jwt uses alg value '${header.alg}' but allowed dpop signing alg values are ${options.allowedSigningAlgs.join(", ")}.`
-    );
-  }
-  if (options.expectedNonce) {
-    if (!payload.nonce) {
-      throw new Oauth2Error(
-        `Dpop jwt does not have a nonce value, but expected nonce value '${options.expectedNonce}'`
-      );
-    }
-    if (payload.nonce !== options.expectedNonce) {
-      throw new Oauth2Error(
-        `Dpop jwt contains nonce value '${payload.nonce}', but expected nonce value '${options.expectedNonce}'`
-      );
-    }
-  }
-  if (options.request.method !== payload.htm) {
-    throw new Oauth2Error(
-      `Dpop jwt contains htm value '${payload.htm}', but expected htm value '${options.request.method}'`
-    );
-  }
-  const expectedHtu = htuFromRequestUrl(options.request.url);
-  if (expectedHtu !== payload.htu) {
-    throw new Oauth2Error(
-      `Dpop jwt contains htu value '${payload.htu}', but expected htu value '${expectedHtu}'.`
-    );
-  }
-  if (options.accessToken) {
-    const expectedAth = (0, import_io_wallet_utils11.encodeToBase64Url)(
-      await options.callbacks.hash(
-        (0, import_io_wallet_utils11.decodeUtf8String)(options.accessToken),
-        import_oauth29.HashAlgorithm.Sha256
-      )
-    );
-    if (!payload.ath) {
-      throw new Oauth2Error(
-        `Dpop jwt does not have a ath value, but expected ath value '${expectedAth}'.`
-      );
-    }
-    if (payload.ath !== expectedAth) {
-      throw new Oauth2Error(
-        `Dpop jwt contains ath value '${payload.ath}', but expected ath value '${expectedAth}'.`
-      );
-    }
-  }
-  const jwkThumbprint = await (0, import_oauth29.calculateJwkThumbprint)({
-    hashAlgorithm: import_oauth29.HashAlgorithm.Sha256,
-    hashCallback: options.callbacks.hash,
-    jwk: header.jwk
-  });
-  if (options.expectedJwkThumbprint && options.expectedJwkThumbprint !== jwkThumbprint) {
-    throw new Oauth2Error(
-      `Dpop is signed with jwk with thumbprint value '${jwkThumbprint}', but expect jwk thumbprint value '${options.expectedJwkThumbprint}'`
-    );
-  }
-  try {
-    (0, import_io_wallet_utils11.verifyJwtIatOrThrow)({
-      iat: payload.iat,
-      now: options.now
-    });
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new Oauth2Error(`Invalid iat claim in dpop JWT: ${error.message}`);
-    }
-  }
-  await (0, import_oauth29.verifyJwt)({
-    compact: options.dpopJwt,
-    errorMessage: "dpop jwt verification failed",
-    header,
-    now: options.now,
-    payload,
-    signer: {
-      alg: header.alg,
-      method: "jwk",
-      publicJwk: header.jwk
-    },
-    verifyJwtCallback: options.callbacks.verifyJwt
-  });
-  return {
-    header,
-    jwkThumbprint,
-    payload
-  };
-}
-
 // src/access-token/z-grant-type.ts
-var import_zod9 = require("zod");
-var zAuthorizationCodeGrantIdentifier = import_zod9.z.literal("authorization_code");
+var import_zod10 = require("zod");
+var zAuthorizationCodeGrantIdentifier = import_zod10.z.literal("authorization_code");
 var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = import_zod9.z.literal("refresh_token");
+var zRefreshTokenGrantIdentifier = import_zod10.z.literal("refresh_token");
 var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
 // src/access-token/parse-token-request.ts
@@ -1156,7 +882,7 @@ function parseAccessTokenRequest(options) {
   if (!validationResult.success) {
     throw new Oauth2Error(
       `Access token request validation failed:
-${(0, import_io_wallet_utils12.formatZodError)(validationResult.error)}`
+${(0, import_io_wallet_utils8.formatZodError)(validationResult.error)}`
     );
   }
   const accessTokenRequest = validationResult.data;
@@ -1222,9 +948,151 @@ function parseSecurityHeaders(headers) {
   };
 }
 
+// src/client-attestation/verify-client-attestation.ts
+var import_oauth28 = require("@openid4vc/oauth2");
+
+// src/client-attestation/client-attestation-pop.ts
+var import_oauth27 = require("@openid4vc/oauth2");
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+async function verifyClientAttestationPopJwt(options) {
+  try {
+    const { header, payload } = decodeJwt({
+      errorMessagePrefix: "Error decoding client attestation PoP JWT:",
+      jwt: options.clientAttestationPopJwt
+    });
+    if (payload.aud !== options.authorizationServer) {
+      throw new Oauth2Error(
+        `Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`
+      );
+    }
+    const { signer } = await (0, import_oauth27.verifyJwt)({
+      compact: options.clientAttestationPopJwt,
+      errorMessage: "client attestation pop jwt verification failed",
+      expectedNonce: options.expectedNonce,
+      header,
+      now: options.now,
+      payload,
+      signer: {
+        alg: header.alg,
+        method: "jwk",
+        publicJwk: options.clientAttestationPublicJwk
+      },
+      verifyJwtCallback: options.callbacks.verifyJwt
+    });
+    return {
+      header,
+      payload,
+      signer
+    };
+  } catch (error) {
+    if (error instanceof Oauth2Error) throw error;
+    throw new Oauth2Error(
+      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+async function createClientAttestationPopJwt(options) {
+  try {
+    const clientAttestation = decodeJwt({
+      errorMessagePrefix: "Error decoding client attestation JWT:",
+      jwt: options.clientAttestation
+    });
+    const jwk = clientAttestation.payload.cnf?.jwk;
+    if (!jwk) {
+      throw new Oauth2Error(
+        "Client attestation does not contain 'cnf.jwk', cannot create client attestation pop jwt"
+      );
+    }
+    const sub = clientAttestation.payload.sub;
+    if (!sub || typeof sub !== "string") {
+      throw new Oauth2Error(
+        "Client attestation does not contain 'sub', cannot create client attestation pop jwt"
+      );
+    }
+    const signer = options.signer ?? {
+      alg: clientAttestation.header.alg,
+      method: "jwk",
+      publicJwk: jwk
+    };
+    const header = {
+      alg: signer.alg,
+      typ: "oauth-client-attestation-pop+jwt"
+    };
+    const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
+    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils9.addSecondsToDate)(issuedAt, 1 * 60);
+    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils9.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
+    if (!jti) {
+      throw new Oauth2Error(
+        "Error: neither a default jti nor a generateRandom callback have been provided"
+      );
+    }
+    const payload = {
+      aud: options.authorizationServer,
+      exp: (0, import_io_wallet_utils9.dateToSeconds)(expiresAt),
+      iat: (0, import_io_wallet_utils9.dateToSeconds)(issuedAt),
+      iss: sub,
+      jti
+    };
+    const { jwt } = await options.callbacks.signJwt(signer, {
+      header,
+      payload
+    });
+    return jwt;
+  } catch (error) {
+    if (error instanceof Oauth2Error) throw error;
+    throw new Oauth2Error(
+      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+// src/client-attestation/verify-client-attestation.ts
+async function verifyClientAttestation(options) {
+  if (!options.clientAttestation.walletAttestationJwt || !options.clientAttestation.clientAttestationPopJwt) {
+    throw new Oauth2Error(
+      `Missing required client attestation parameters in the request. Make sure to provide the '${oauthClientAttestationHeader}' and '${oauthClientAttestationPopHeader}' header values.`
+    );
+  }
+  const clientAttestation = await verifyWalletAttestationJwt4({
+    callbacks: options.callbacks,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    config: options.config,
+    now: options.now,
+    walletAttestationJwt: options.clientAttestation.walletAttestationJwt
+  });
+  const clientAttestationPop = await verifyClientAttestationPopJwt({
+    authorizationServer: options.authorizationServerMetadata.issuer,
+    callbacks: options.callbacks,
+    clientAttestationPopJwt: options.clientAttestation.clientAttestationPopJwt,
+    clientAttestationPublicJwk: clientAttestation.payload.cnf.jwk,
+    now: options.now
+  });
+  if (options.requestClientId && options.requestClientId !== clientAttestation.payload.sub) {
+    throw new Oauth2Error(
+      `The client_id '${options.requestClientId}' in the request does not match the client id '${clientAttestation.payload.sub}' in the client attestation`
+    );
+  }
+  if (options.clientAttestation.ensureConfirmationKeyMatchesDpopKey && options.dpopJwkThumbprint) {
+    const clientAttestationJkt = await (0, import_oauth28.calculateJwkThumbprint)({
+      hashAlgorithm: import_oauth28.HashAlgorithm.Sha256,
+      hashCallback: options.callbacks.hash,
+      jwk: clientAttestation.payload.cnf.jwk
+    });
+    if (clientAttestationJkt !== options.dpopJwkThumbprint) {
+      throw new Oauth2Error(
+        "Expected the DPoP JWK thumbprint value to match the JWK thumbprint of the client attestation confirmation JWK. Ensure both DPoP and client attestation use the same key."
+      );
+    }
+  }
+  return {
+    clientAttestation,
+    clientAttestationPop
+  };
+}
+
 // src/pkce.ts
-var import_oauth210 = require("@openid4vc/oauth2");
-var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_oauth29 = require("@openid4vc/oauth2");
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
 var PkceCodeChallengeMethod = {
   Plain: "plain",
   S256: "S256"
@@ -1242,7 +1110,7 @@ async function createPkce(options) {
   const codeChallengeMethod = allowedCodeChallengeMethods.includes(
     PkceCodeChallengeMethod.S256
   ) ? PkceCodeChallengeMethod.S256 : PkceCodeChallengeMethod.Plain;
-  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils13.encodeToBase64Url)(await options.callbacks.generateRandom(64));
+  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils10.encodeToBase64Url)(await options.callbacks.generateRandom(64));
   return {
     codeChallenge: await calculateCodeChallenge({
       codeChallengeMethod,
@@ -1261,7 +1129,7 @@ async function verifyPkce(options) {
   });
   if (options.codeChallenge !== calculatedCodeChallenge) {
     throw new Oauth2Error(
-      `Derived code challenge '${calculatedCodeChallenge}' from code_verifier '${options.codeVerifier}' using code challenge method '${options.codeChallengeMethod}' does not match the expected code challenge.`
+      `PKCE verification failed: code_verifier does not match the stored code_challenge`
     );
   }
 }
@@ -1270,20 +1138,122 @@ async function calculateCodeChallenge(options) {
     return options.codeVerifier;
   }
   if (options.codeChallengeMethod === PkceCodeChallengeMethod.S256) {
-    return (0, import_io_wallet_utils13.encodeToBase64Url)(
+    return (0, import_io_wallet_utils10.encodeToBase64Url)(
       await options.hashCallback(
-        (0, import_io_wallet_utils13.decodeUtf8String)(options.codeVerifier),
+        (0, import_io_wallet_utils10.decodeUtf8String)(options.codeVerifier),
+        import_oauth29.HashAlgorithm.Sha256
+      )
+    );
+  }
+  throw new Oauth2Error(
+    `Unsupported code challenge method ${options.codeChallengeMethod}`
+  );
+}
+
+// src/token-dpop/verify-token-dpop.ts
+var import_oauth210 = require("@openid4vc/oauth2");
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+async function verifyTokenDPoP(options) {
+  const { header, payload } = decodeJwt({
+    errorMessagePrefix: "Error decoding access token DPoP JWT:",
+    headerSchema: zDpopJwtHeader,
+    jwt: options.dpopJwt,
+    payloadSchema: zDpopJwtPayload
+  });
+  if (options.allowedSigningAlgs && !options.allowedSigningAlgs.includes(header.alg)) {
+    throw new Oauth2Error(
+      `dpop jwt uses alg value '${header.alg}' but allowed dpop signing alg values are ${options.allowedSigningAlgs.join(", ")}.`
+    );
+  }
+  if (options.expectedNonce !== void 0) {
+    if (options.expectedNonce === "") {
+      throw new Oauth2Error(`Invalid 'expectedNonce' provided`);
+    }
+    if (!payload.nonce) {
+      throw new Oauth2Error(
+        `Dpop jwt does not have a nonce value, but expected nonce value '${options.expectedNonce}'`
+      );
+    }
+    if (payload.nonce !== options.expectedNonce) {
+      throw new Oauth2Error(
+        `Dpop jwt contains nonce value '${payload.nonce}', but expected nonce value '${options.expectedNonce}'`
+      );
+    }
+  }
+  if (options.request.method !== payload.htm) {
+    throw new Oauth2Error(
+      `Dpop jwt contains htm value '${payload.htm}', but expected htm value '${options.request.method}'`
+    );
+  }
+  const expectedHtu = htuFromRequestUrl(options.request.url);
+  if (expectedHtu !== payload.htu) {
+    throw new Oauth2Error(
+      `Dpop jwt contains htu value '${payload.htu}', but expected htu value '${expectedHtu}'.`
+    );
+  }
+  if (options.accessToken) {
+    const expectedAth = (0, import_io_wallet_utils11.encodeToBase64Url)(
+      await options.callbacks.hash(
+        (0, import_io_wallet_utils11.decodeUtf8String)(options.accessToken),
         import_oauth210.HashAlgorithm.Sha256
       )
     );
+    if (!payload.ath) {
+      throw new Oauth2Error(
+        `Dpop jwt does not have a ath value, but expected ath value '${expectedAth}'.`
+      );
+    }
+    if (payload.ath !== expectedAth) {
+      throw new Oauth2Error(
+        `Dpop jwt contains ath value '${payload.ath}', but expected ath value '${expectedAth}'.`
+      );
+    }
+  }
+  const jwkThumbprint = await (0, import_oauth210.calculateJwkThumbprint)({
+    hashAlgorithm: import_oauth210.HashAlgorithm.Sha256,
+    hashCallback: options.callbacks.hash,
+    jwk: header.jwk
+  });
+  if (options.expectedJwkThumbprint && options.expectedJwkThumbprint !== jwkThumbprint) {
+    throw new Oauth2Error(
+      `Dpop is signed with jwk with thumbprint value '${jwkThumbprint}', but expect jwk thumbprint value '${options.expectedJwkThumbprint}'`
+    );
   }
-  throw new Oauth2Error(
-    `Unsupported code challenge method ${options.codeChallengeMethod}`
-  );
+  try {
+    (0, import_io_wallet_utils11.verifyJwtIatOrThrow)({
+      iat: payload.iat,
+      now: options.now
+    });
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new Oauth2Error(`Invalid iat claim in dpop JWT: ${error.message}`);
+    }
+  }
+  await (0, import_oauth210.verifyJwt)({
+    compact: options.dpopJwt,
+    errorMessage: "dpop jwt verification failed",
+    header,
+    now: options.now,
+    payload,
+    signer: {
+      alg: header.alg,
+      method: "jwk",
+      publicJwk: header.jwk
+    },
+    verifyJwtCallback: options.callbacks.verifyJwt
+  });
+  return {
+    header,
+    jwkThumbprint,
+    payload
+  };
 }
 
 // src/access-token/verify-access-token-request.ts
 async function verifyAccessTokenRequest(options) {
+  if (options.dpop.expectedNonce === "") {
+    throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
+  }
   await verifyPkce({
     callbacks: options.callbacks,
     codeChallenge: options.pkce.codeChallenge,
@@ -1294,6 +1264,7 @@ async function verifyAccessTokenRequest(options) {
     allowedSigningAlgs: options.dpop.allowedSigningAlgs,
     callbacks: options.callbacks,
     dpopJwt: options.dpop.jwt,
+    expectedNonce: options.dpop.expectedNonce,
     now: options.now,
     request: options.request
   });
@@ -1324,37 +1295,37 @@ async function verifyAccessTokenRequest(options) {
 }
 
 // src/authorization-request/create-authorization-request.ts
-var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-request/z-authorization-request.ts
-var import_zod10 = __toESM(require("zod"));
-var zOpenidCredentialAuthorizationDetails = import_zod10.default.object({
-  credential_configuration_id: import_zod10.default.string(),
-  type: import_zod10.default.literal("openid_credential")
+var import_zod11 = __toESM(require("zod"));
+var zOpenidCredentialAuthorizationDetails = import_zod11.default.object({
+  credential_configuration_id: import_zod11.default.string(),
+  type: import_zod11.default.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = import_zod10.default.object({
-  challenge_method: import_zod10.default.literal("mrtd+ias"),
-  challenge_redirect_uri: import_zod10.default.url(),
-  idphinting: import_zod10.default.url(),
-  type: import_zod10.default.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = import_zod11.default.object({
+  challenge_method: import_zod11.default.literal("mrtd+ias"),
+  challenge_redirect_uri: import_zod11.default.url(),
+  idphinting: import_zod11.default.url(),
+  type: import_zod11.default.literal("it_l2+document_proof")
 });
-var zAuthorizationRequest = import_zod10.default.looseObject({
-  authorization_details: import_zod10.default.array(
-    import_zod10.default.discriminatedUnion("type", [
+var zAuthorizationRequest = import_zod11.default.looseObject({
+  authorization_details: import_zod11.default.array(
+    import_zod11.default.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: import_zod10.default.string(),
-  code_challenge: import_zod10.default.string(),
-  code_challenge_method: import_zod10.default.string(),
-  issuer_state: import_zod10.default.optional(import_zod10.default.string()),
-  jti: import_zod10.default.string(),
-  redirect_uri: import_zod10.default.url(),
-  response_mode: import_zod10.default.string(),
-  response_type: import_zod10.default.string(),
-  scope: import_zod10.default.string().optional(),
-  state: import_zod10.default.string()
+  client_id: import_zod11.default.string(),
+  code_challenge: import_zod11.default.string(),
+  code_challenge_method: import_zod11.default.string(),
+  issuer_state: import_zod11.default.optional(import_zod11.default.string()),
+  jti: import_zod11.default.string().max(MAX_JTI_LENGTH),
+  redirect_uri: import_zod11.default.url(),
+  response_mode: import_zod11.default.string(),
+  response_type: import_zod11.default.string(),
+  scope: import_zod11.default.string().optional(),
+  state: import_zod11.default.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1362,25 +1333,25 @@ var zAuthorizationRequest = import_zod10.default.looseObject({
     path: ["authorization_details"]
   }
 );
-var zPushedAuthorizationRequestSigned = import_zod10.default.looseObject({
-  client_id: import_zod10.default.string().describe(
+var zPushedAuthorizationRequestSigned = import_zod11.default.looseObject({
+  client_id: import_zod11.default.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod10.default.string().describe(
+  pkceCodeVerifier: import_zod11.default.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: import_zod10.default.string().describe(
+  request: import_zod11.default.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsigned = import_zod10.default.looseObject({
+var zPushedAuthorizationRequestUnsigned = import_zod11.default.looseObject({
   authorizationRequest: zAuthorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: import_zod10.default.string().describe(
+  client_id: import_zod11.default.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod10.default.string().describe("PKCE code verifier. Auto-generated if not provided in options.")
+  pkceCodeVerifier: import_zod11.default.string().describe("PKCE code verifier. Auto-generated if not provided in options.")
 });
 function isPushedAuthorizationRequestSigned(par) {
   return "request" in par && typeof par.request === "string";
@@ -1388,9 +1359,9 @@ function isPushedAuthorizationRequestSigned(par) {
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = import_zod10.default.looseObject({
-  expires_in: import_zod10.default.number().int(),
-  request_uri: import_zod10.default.string()
+var zPushedAuthorizationResponse = import_zod11.default.looseObject({
+  expires_in: import_zod11.default.number().int(),
+  request_uri: import_zod11.default.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1407,14 +1378,14 @@ async function createPushedAuthorizationRequest(options) {
     client_id: options.clientId,
     code_challenge: pkce.codeChallenge,
     code_challenge_method: pkce.codeChallengeMethod,
-    jti: options.jti ?? (0, import_io_wallet_utils14.encodeToBase64Url)(
+    jti: options.jti ?? (0, import_io_wallet_utils12.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     ),
     redirect_uri: options.redirectUri,
     response_mode: options.responseMode,
     response_type: "code",
     scope: options.scope,
-    state: options.state ?? (0, import_io_wallet_utils14.encodeToBase64Url)(
+    state: options.state ?? (0, import_io_wallet_utils12.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     )
   });
@@ -1427,7 +1398,7 @@ async function createPushedAuthorizationRequest(options) {
       );
     }
     const iat = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils14.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils12.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
     const requestJwt = await options.callbacks.signJwt(dpop.signer, {
       header: {
         alg: dpop.signer.alg,
@@ -1436,8 +1407,8 @@ async function createPushedAuthorizationRequest(options) {
       },
       payload: {
         aud: options.audience,
-        exp: (0, import_io_wallet_utils14.dateToSeconds)(exp),
-        iat: (0, import_io_wallet_utils14.dateToSeconds)(iat),
+        exp: (0, import_io_wallet_utils12.dateToSeconds)(exp),
+        iat: (0, import_io_wallet_utils12.dateToSeconds)(iat),
         iss: dpop.signer.publicJwk.kid,
         ...authorizationRequest
       }
@@ -1457,10 +1428,10 @@ async function createPushedAuthorizationRequest(options) {
 }
 
 // src/authorization-request/fetch-authorization-response.ts
-var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
 async function fetchPushedAuthorizationResponse(options) {
   try {
-    const fetch = (0, import_io_wallet_utils15.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils13.createFetcher)(options.callbacks.fetch);
     const body = isPushedAuthorizationRequestSigned(
       options.pushedAuthorizationRequest
     ) ? new URLSearchParams({
@@ -1474,25 +1445,25 @@ async function fetchPushedAuthorizationResponse(options) {
       {
         body,
         headers: {
-          [import_io_wallet_utils15.HEADERS.CONTENT_TYPE]: import_io_wallet_utils15.CONTENT_TYPES.FORM_URLENCODED,
-          [import_io_wallet_utils15.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-          [import_io_wallet_utils15.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+          [import_io_wallet_utils13.HEADERS.CONTENT_TYPE]: import_io_wallet_utils13.CONTENT_TYPES.FORM_URLENCODED,
+          [import_io_wallet_utils13.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+          [import_io_wallet_utils13.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
         },
         method: "POST"
       }
     );
-    await (0, import_io_wallet_utils15.hasStatusOrThrow)(201, import_io_wallet_utils15.UnexpectedStatusCodeError)(parResponse);
+    await (0, import_io_wallet_utils13.hasStatusOrThrow)(201, import_io_wallet_utils13.UnexpectedStatusCodeError)(parResponse);
     const parResponseJson = await parResponse.json();
     const parsedParResponse = zPushedAuthorizationResponse.safeParse(parResponseJson);
     if (!parsedParResponse.success) {
-      throw new import_io_wallet_utils15.ValidationError(
+      throw new import_io_wallet_utils13.ValidationError(
         `Failed to parse pushed authorization response`,
         parsedParResponse.error
       );
     }
     return parsedParResponse.data;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils15.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils15.ValidationError) {
+    if (error instanceof import_io_wallet_utils13.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils13.ValidationError) {
       throw error;
     }
     throw new PushedAuthorizationRequestError(
@@ -1538,69 +1509,22 @@ function parseAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-pushed-authorization-request.ts
-var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
-var import_zod12 = __toESM(require("zod"));
-
-// src/jar/create-jar-request.ts
-var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
-async function createJarRequest(options) {
-  const {
-    authorizationRequestHeader,
-    authorizationRequestPayload,
-    callbacks,
-    jweEncryptor,
-    jwtSigner,
-    requestUri
-  } = options;
-  let authorizationRequestJwt;
-  let encryptionJwk;
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
-    header: authorizationRequestHeader,
-    payload: {
-      ...options.additionalJwtPayload,
-      ...authorizationRequestPayload,
-      exp: (0, import_io_wallet_utils16.dateToSeconds)((0, import_io_wallet_utils16.addSecondsToDate)(now, options.expiresInSeconds)),
-      iat: (0, import_io_wallet_utils16.dateToSeconds)(now)
-    }
-  });
-  authorizationRequestJwt = jwt;
-  if (jweEncryptor) {
-    if (!callbacks.encryptJwe) {
-      throw new Oauth2Error(
-        "callbacks.encryptJwe is required when jweEncryptor is provided"
-      );
-    }
-    const encryptionResult = await callbacks.encryptJwe(
-      jweEncryptor,
-      authorizationRequestJwt
-    );
-    authorizationRequestJwt = encryptionResult.jwe;
-    encryptionJwk = encryptionResult.encryptionJwk;
-  }
-  const client_id = authorizationRequestPayload.client_id;
-  const jarAuthorizationRequest = requestUri ? { client_id, request_uri: requestUri } : { client_id, request: authorizationRequestJwt };
-  return {
-    authorizationRequestJwt,
-    encryptionJwk,
-    jarAuthorizationRequest,
-    signerJwk
-  };
-}
+var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
+var import_zod13 = __toESM(require("zod"));
 
 // src/jar/fetch-jar-request-object.ts
-var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 async function fetchJarRequestObject(options) {
   const { fetch, requestUri } = options;
   const JAR_ACCEPT_HEADER = [
-    import_io_wallet_utils17.ContentType.OAuthAuthorizationRequestJwt,
+    import_io_wallet_utils14.ContentType.OAuthAuthorizationRequestJwt,
     // Preferred: application/oauth-authz-req+jwt
-    `${import_io_wallet_utils17.ContentType.Jwt};q=0.9`,
+    `${import_io_wallet_utils14.ContentType.Jwt};q=0.9`,
     // Fallback: application/jwt
     "text/plain"
     // Final fallback: text/plain
   ].join(", ");
-  const response = await (0, import_io_wallet_utils17.createFetcher)(fetch)(requestUri, {
+  const response = await (0, import_io_wallet_utils14.createFetcher)(fetch)(requestUri, {
     headers: {
       Accept: JAR_ACCEPT_HEADER
     },
@@ -1610,7 +1534,7 @@ async function fetchJarRequestObject(options) {
       `Fetching request_object from request_uri '${requestUri}' failed`
     );
   });
-  await (0, import_io_wallet_utils17.hasStatusOrThrow)(200, import_io_wallet_utils17.UnexpectedStatusCodeError)(response);
+  await (0, import_io_wallet_utils14.hasStatusOrThrow)(200, import_io_wallet_utils14.UnexpectedStatusCodeError)(response);
   return await response.text();
 }
 
@@ -1646,125 +1570,32 @@ async function parseJarRequest(options) {
   return { authorizationRequestJwt, sendBy };
 }
 
-// src/jar/verify-jar-request.ts
-var import_oauth211 = require("@openid4vc/oauth2");
-var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
-
 // src/jar/z-jar.ts
-var import_zod11 = __toESM(require("zod"));
-var zJarAuthorizationRequest = import_zod11.default.looseObject({
-  client_id: import_zod11.default.optional(import_zod11.default.string()),
-  request: import_zod11.default.optional(import_zod11.default.string()),
-  request_uri: import_zod11.default.url().optional()
+var import_zod12 = __toESM(require("zod"));
+var zJarAuthorizationRequest = import_zod12.default.looseObject({
+  client_id: import_zod12.default.optional(import_zod12.default.string()),
+  request: import_zod12.default.optional(import_zod12.default.string()),
+  request_uri: import_zod12.default.url().optional()
 });
-var zJarRequestObjectPayload = import_zod11.default.looseObject({
+var zJarRequestObjectPayload = import_zod12.default.looseObject({
   ...zJwtPayload.shape,
-  client_id: import_zod11.default.string()
+  client_id: import_zod12.default.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = import_zod11.default.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = import_zod12.default.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = import_zod11.default.looseObject({
+var zJarRequestObjectHeader = import_zod12.default.looseObject({
   ...zJwtHeader.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = import_zod11.default.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = import_zod12.default.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
-// src/jar/verify-jar-request.ts
-async function verifyJarRequest(options) {
-  const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
-  const requestObjectIsEncrypted = import_oauth211.zCompactJwe.safeParse(
-    authorizationRequestJwt
-  ).success;
-  if (requestObjectIsEncrypted) {
-    throw new Oauth2Error("Encrypted JWE request objects are not supported.");
-  }
-  const requestIsSigned = import_oauth211.zCompactJwt.safeParse(
-    authorizationRequestJwt
-  ).success;
-  if (!requestIsSigned) {
-    throw new Oauth2Error("JAR request object is not a valid JWT.");
-  }
-  const { authorizationRequestPayload, jwt, signer } = await verifyJarRequestObject({
-    authorizationRequestJwt,
-    callbacks,
-    jwtSigner
-  });
-  if (!authorizationRequestPayload.client_id) {
-    throw new Oauth2Error(
-      'Jar Request Object is missing the required "client_id" field.'
-    );
-  }
-  if (jarRequestParams.client_id !== authorizationRequestPayload.client_id) {
-    throw new Oauth2Error(
-      "client_id does not match the request object client_id."
-    );
-  }
-  if (jwt.payload.iss !== authorizationRequestPayload.client_id) {
-    throw new Oauth2Error("iss claim in request JWT does not match client_id");
-  }
-  if (jwt.payload.exp === void 0) {
-    throw new Oauth2Error("exp claim in request JWT is missing");
-  }
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const nowSeconds = Math.floor(now.getTime() / 1e3);
-  if (nowSeconds > jwt.payload.exp) {
-    throw new Oauth2Error("exp claim in request JWT is expired");
-  }
-  if (jwt.payload.iat === void 0) {
-    throw new Oauth2Error("iat claim in request JWT is missing");
-  }
-  const MAX_IAT_AGE_SECONDS = 5 * 60;
-  if (nowSeconds - jwt.payload.iat > MAX_IAT_AGE_SECONDS) {
-    throw new Oauth2Error(
-      "iat claim in request JWT is too old (must be within 5 minutes)"
-    );
-  }
-  const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
-  if (jwt.payload.iat - nowSeconds > CLOCK_SKEW_TOLERANCE_SECONDS) {
-    throw new Oauth2Error("iat claim in request JWT is too far in the future");
-  }
-  return {
-    authorizationRequestPayload,
-    jwt,
-    signer
-  };
-}
-async function verifyJarRequestObject(options) {
-  const { authorizationRequestJwt, callbacks, jwtSigner } = options;
-  const jwt = (0, import_oauth211.decodeJwt)({ jwt: authorizationRequestJwt });
-  const authorizationRequestPayload = (0, import_io_wallet_utils18.parseWithErrorHandling)(
-    zJarRequestObjectPayload,
-    jwt.payload
-  );
-  const { signer } = await (0, import_oauth211.verifyJwt)({
-    compact: authorizationRequestJwt,
-    header: jwt.header,
-    payload: authorizationRequestPayload,
-    signer: jwtSigner,
-    verifyJwtCallback: callbacks.verifyJwt
-  });
-  if (jwt.header.typ !== signedAuthorizationRequestJwtHeaderTyp && jwt.header.typ !== jwtAuthorizationRequestJwtHeaderTyp) {
-    throw new Oauth2Error(
-      `Invalid Jar Request Object typ header. Expected "oauth-authz-req+jwt" or "jwt", received "${jwt.header.typ}".`
-    );
-  }
-  return {
-    authorizationRequestPayload,
-    jwt: {
-      ...jwt,
-      payload: authorizationRequestPayload
-    },
-    signer
-  };
-}
-
 // src/authorization-request/parse-pushed-authorization-request.ts
 async function parsePushedAuthorizationRequest(options) {
-  const parsed = (0, import_io_wallet_utils19.parseWithErrorHandling)(
-    import_zod12.default.union([zAuthorizationRequest, zJarAuthorizationRequest]),
+  const parsed = (0, import_io_wallet_utils15.parseWithErrorHandling)(
+    import_zod13.default.union([zAuthorizationRequest, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1775,12 +1606,15 @@ async function parsePushedAuthorizationRequest(options) {
       callbacks: options.callbacks,
       jarRequestParams: parsed
     });
-    const jwt = decodeJwt({ jwt: parsedJar.authorizationRequestJwt });
+    const jwt = decodeJwt({
+      errorMessagePrefix: "Error decoding pushed authorization request JWT:",
+      jwt: parsedJar.authorizationRequestJwt
+    });
     parsedAuthorizationRequest = zAuthorizationRequest.safeParse(jwt.payload);
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Invalid authorization request. Could not parse jar request payload.
-${(0, import_io_wallet_utils19.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
     authorizationRequestJwt = parsedJar.authorizationRequestJwt;
@@ -1791,7 +1625,7 @@ ${(0, import_io_wallet_utils19.formatZodError)(parsedAuthorizationRequest.error)
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Error occurred during validation of pushed authorization request.
-${(0, import_io_wallet_utils19.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
   }
@@ -1832,22 +1666,116 @@ async function verifyAuthorizationRequest(options) {
     } : void 0
   };
 }
-async function verifyAuthorizationRequestDpop(options, request, callbacks, now) {
-  if (options.required && !options.jwt) {
+async function verifyAuthorizationRequestDpop(options, request, callbacks, now) {
+  if (options.required && !options.jwt) {
+    throw new Oauth2Error(
+      `Missing required DPoP parameters in authorization request. DPoP header is required.`
+    );
+  }
+  const verifyDpopResult = options.jwt ? await verifyTokenDPoP({
+    allowedSigningAlgs: options.allowedSigningAlgs,
+    callbacks,
+    dpopJwt: options.jwt,
+    now,
+    request
+  }) : void 0;
+  return {
+    jwk: verifyDpopResult?.header.jwk,
+    jwkThumbprint: verifyDpopResult?.jwkThumbprint
+  };
+}
+
+// src/jar/verify-jar-request.ts
+var import_oauth211 = require("@openid4vc/oauth2");
+var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
+async function verifyJarRequest(options) {
+  const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
+  const requestObjectIsEncrypted = import_oauth211.zCompactJwe.safeParse(
+    authorizationRequestJwt
+  ).success;
+  if (requestObjectIsEncrypted) {
+    throw new Oauth2Error("Encrypted JWE request objects are not supported.");
+  }
+  const requestIsSigned = import_oauth211.zCompactJwt.safeParse(
+    authorizationRequestJwt
+  ).success;
+  if (!requestIsSigned) {
+    throw new Oauth2Error("JAR request object is not a valid JWT.");
+  }
+  const { authorizationRequestPayload, jwt, signer } = await verifyJarRequestObject({
+    authorizationRequestJwt,
+    callbacks,
+    jwtSigner
+  });
+  if (!authorizationRequestPayload.client_id) {
+    throw new Oauth2Error(
+      'Jar Request Object is missing the required "client_id" field.'
+    );
+  }
+  if (jarRequestParams.client_id !== authorizationRequestPayload.client_id) {
+    throw new Oauth2Error(
+      "client_id does not match the request object client_id."
+    );
+  }
+  if (jwt.payload.iss !== authorizationRequestPayload.client_id) {
+    throw new Oauth2Error("iss claim in request JWT does not match client_id");
+  }
+  if (jwt.payload.exp === void 0) {
+    throw new Oauth2Error("exp claim in request JWT is missing");
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const nowSeconds = Math.floor(now.getTime() / 1e3);
+  if (nowSeconds > jwt.payload.exp) {
+    throw new Oauth2Error("exp claim in request JWT is expired");
+  }
+  if (jwt.payload.iat === void 0) {
+    throw new Oauth2Error("iat claim in request JWT is missing");
+  }
+  const MAX_IAT_AGE_SECONDS = 5 * 60;
+  if (nowSeconds - jwt.payload.iat > MAX_IAT_AGE_SECONDS) {
+    throw new Oauth2Error(
+      "iat claim in request JWT is too old (must be within 5 minutes)"
+    );
+  }
+  const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
+  if (jwt.payload.iat - nowSeconds > CLOCK_SKEW_TOLERANCE_SECONDS) {
+    throw new Oauth2Error("iat claim in request JWT is too far in the future");
+  }
+  return {
+    authorizationRequestPayload,
+    jwt,
+    signer
+  };
+}
+async function verifyJarRequestObject(options) {
+  const { authorizationRequestJwt, callbacks, jwtSigner } = options;
+  const jwt = decodeJwt({
+    errorMessagePrefix: "Error decoding JAR authorization request JWT:",
+    jwt: authorizationRequestJwt
+  });
+  const authorizationRequestPayload = (0, import_io_wallet_utils16.parseWithErrorHandling)(
+    zJarRequestObjectPayload,
+    jwt.payload
+  );
+  const { signer } = await (0, import_oauth211.verifyJwt)({
+    compact: authorizationRequestJwt,
+    header: jwt.header,
+    payload: authorizationRequestPayload,
+    signer: jwtSigner,
+    verifyJwtCallback: callbacks.verifyJwt
+  });
+  if (jwt.header.typ !== signedAuthorizationRequestJwtHeaderTyp && jwt.header.typ !== jwtAuthorizationRequestJwtHeaderTyp) {
     throw new Oauth2Error(
-      `Missing required DPoP parameters in authorization request. DPoP header is required.`
+      `Invalid Jar Request Object typ header. Expected "oauth-authz-req+jwt" or "jwt", received "${jwt.header.typ}".`
     );
   }
-  const verifyDpopResult = options.jwt ? await verifyTokenDPoP({
-    allowedSigningAlgs: options.allowedSigningAlgs,
-    callbacks,
-    dpopJwt: options.jwt,
-    now,
-    request
-  }) : void 0;
   return {
-    jwk: verifyDpopResult?.header.jwk,
-    jwkThumbprint: verifyDpopResult?.jwkThumbprint
+    authorizationRequestPayload,
+    jwt: {
+      ...jwt,
+      payload: authorizationRequestPayload
+    },
+    signer
   };
 }
 
@@ -1862,7 +1790,10 @@ async function verifyPushedAuthorizationRequest(options) {
   let jar;
   if (options.authorizationRequestJwt) {
     if (requireSigned) {
-      const decoded = decodeJwt({ jwt: options.authorizationRequestJwt.jwt });
+      const decoded = decodeJwt({
+        errorMessagePrefix: "Error decoding pushed authorization request JWT:",
+        jwt: options.authorizationRequestJwt.jwt
+      });
       if (decoded.header.alg === "none") {
         throw new PushedAuthorizationRequestError(
           'Authorization Server requires signed request objects, but JAR has algorithm "none"'
@@ -1911,15 +1842,247 @@ async function verifyPushedAuthorizationRequest(options) {
   };
 }
 
+// src/client-attestation/client-authentication.ts
+var SupportedClientAuthenticationMethod = {
+  ClientSecretBasic: "client_secret_basic",
+  ClientSecretPost: "client_secret_post",
+  None: "none",
+  WalletAttestationJwt: "attest_jwt_client_auth"
+};
+function isClientAttestationSupported(options) {
+  if (!options.authorizationServerMetadata.token_endpoint_auth_methods_supported || !options.authorizationServerMetadata.token_endpoint_auth_methods_supported.includes(
+    SupportedClientAuthenticationMethod.WalletAttestationJwt
+  )) {
+    return {
+      supported: false
+    };
+  }
+  return {
+    supported: true
+  };
+}
+function clientAuthenticationAnonymous() {
+  return () => {
+  };
+}
+function clientAuthenticationWalletAttestationJwt(options) {
+  return async ({ authorizationServerMetadata, headers }) => {
+    const clientAttestationPop = await createClientAttestationPopJwt({
+      authorizationServer: authorizationServerMetadata.issuer,
+      callbacks: options.callbacks,
+      clientAttestation: options.walletAttestationJwt
+    });
+    headers.set(oauthClientAttestationHeader, options.walletAttestationJwt);
+    headers.set(oauthClientAttestationPopHeader, clientAttestationPop);
+  };
+}
+
+// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
+var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var createWalletAttestationJwt = async (options) => {
+  try {
+    const { signJwt } = options.callbacks;
+    const iat = /* @__PURE__ */ new Date();
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils17.addSecondsToDate)(iat, 3600);
+    const payload = {
+      cnf: { jwk: options.dpopJwkPublic },
+      exp: (0, import_io_wallet_utils17.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils17.dateToSeconds)(iat),
+      iss: options.issuer,
+      sub: options.dpopJwkPublic.kid,
+      ...options.walletLink && { wallet_link: options.walletLink },
+      ...options.walletName && { wallet_name: options.walletName },
+      aal: options.authenticatorAssuranceLevel
+    };
+    const header = {
+      alg: options.signer.alg,
+      kid: options.signer.kid,
+      trust_chain: options.signer.trustChain,
+      typ: "oauth-client-attestation+jwt"
+    };
+    const result = await signJwt(options.signer, {
+      header,
+      payload
+    });
+    decodeJwt({
+      errorMessagePrefix: "Error decoding wallet attestation JWT:",
+      headerSchema: zWalletAttestationJwtHeaderV1_0,
+      jwt: result.jwt,
+      payloadSchema: zWalletAttestationJwtPayloadV1_0
+    });
+    return result.jwt;
+  } catch (error) {
+    if (error instanceof import_io_wallet_utils17.ValidationError) {
+      throw error;
+    }
+    throw new ClientAttestationError(
+      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
+// src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
+var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
+var createWalletAttestationJwt2 = async (options) => {
+  try {
+    const { signJwt } = options.callbacks;
+    const iat = /* @__PURE__ */ new Date();
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils18.addSecondsToDate)(iat, 3600);
+    if (options.nbf && options.nbf >= exp) {
+      throw new import_io_wallet_utils18.ValidationError("nbf must be before exp");
+    }
+    const payload = {
+      cnf: { jwk: options.dpopJwkPublic },
+      exp: (0, import_io_wallet_utils18.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils18.dateToSeconds)(iat),
+      iss: options.issuer,
+      sub: options.dpopJwkPublic.kid,
+      ...options.nbf && { nbf: (0, import_io_wallet_utils18.dateToSeconds)(options.nbf) },
+      ...options.status && { status: options.status },
+      ...options.walletLink && { wallet_link: options.walletLink },
+      ...options.walletName && { wallet_name: options.walletName }
+    };
+    const header = {
+      alg: options.signer.alg,
+      kid: options.signer.kid,
+      typ: "oauth-client-attestation+jwt",
+      x5c: options.signer.x5c,
+      // REQUIRED
+      ...options.signer.trustChain && {
+        trust_chain: options.signer.trustChain
+      }
+    };
+    const result = await signJwt(options.signer, {
+      header,
+      payload
+    });
+    decodeJwt({
+      errorMessagePrefix: "Error decoding wallet attestation JWT:",
+      headerSchema: zWalletAttestationJwtHeaderV1_3,
+      jwt: result.jwt,
+      payloadSchema: zWalletAttestationJwtPayloadV1_3
+    });
+    return result.jwt;
+  } catch (error) {
+    if (error instanceof import_io_wallet_utils18.ValidationError) {
+      throw error;
+    }
+    throw new ClientAttestationError(
+      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
+// src/client-attestation/v1.4/create-wallet-attestation-jwt.ts
+var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
+var createWalletAttestationJwt3 = async (options) => {
+  try {
+    const { signJwt } = options.callbacks;
+    const iat = /* @__PURE__ */ new Date();
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils19.addSecondsToDate)(iat, 3600);
+    if (options.nbf && options.nbf >= exp) {
+      throw new import_io_wallet_utils19.ValidationError("nbf must be before exp");
+    }
+    const payload = {
+      cnf: { jwk: options.dpopJwkPublic },
+      exp: (0, import_io_wallet_utils19.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils19.dateToSeconds)(iat),
+      iss: options.issuer,
+      status: options.status,
+      sub: options.dpopJwkPublic.kid,
+      wallet_link: options.walletLink,
+      wallet_name: options.walletName,
+      ...options.nbf && { nbf: (0, import_io_wallet_utils19.dateToSeconds)(options.nbf) },
+      ...options.eudiWalletInfo && {
+        eudi_wallet_info: options.eudiWalletInfo
+      }
+    };
+    const header = {
+      alg: options.signer.alg,
+      kid: options.signer.kid,
+      typ: "oauth-client-attestation+jwt",
+      x5c: options.signer.x5c,
+      ...options.signer.trustChain && {
+        trust_chain: options.signer.trustChain
+      }
+    };
+    const result = await signJwt(options.signer, {
+      header,
+      payload
+    });
+    decodeJwt({
+      errorMessagePrefix: "Error decoding wallet attestation JWT:",
+      headerSchema: zWalletAttestationJwtHeaderV1_4,
+      jwt: result.jwt,
+      payloadSchema: zWalletAttestationJwtPayloadV1_4
+    });
+    return result.jwt;
+  } catch (error) {
+    if (error instanceof import_io_wallet_utils19.ValidationError) {
+      throw error;
+    }
+    throw new ClientAttestationError(
+      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
 // src/common/jwt/z-jwe.ts
-var import_zod13 = require("zod");
-var zCompactJwe2 = import_zod13.z.string().regex(
+var import_zod14 = require("zod");
+var zCompactJwe2 = import_zod14.z.string().regex(
   /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
   {
     message: "Not a valid compact jwe"
   }
 );
 
+// src/jar/create-jar-request.ts
+var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
+async function createJarRequest(options) {
+  const {
+    authorizationRequestHeader,
+    authorizationRequestPayload,
+    callbacks,
+    jweEncryptor,
+    jwtSigner,
+    requestUri
+  } = options;
+  let authorizationRequestJwt;
+  let encryptionJwk;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
+    header: authorizationRequestHeader,
+    payload: {
+      ...options.additionalJwtPayload,
+      ...authorizationRequestPayload,
+      exp: (0, import_io_wallet_utils20.dateToSeconds)((0, import_io_wallet_utils20.addSecondsToDate)(now, options.expiresInSeconds)),
+      iat: (0, import_io_wallet_utils20.dateToSeconds)(now)
+    }
+  });
+  authorizationRequestJwt = jwt;
+  if (jweEncryptor) {
+    if (!callbacks.encryptJwe) {
+      throw new Oauth2Error(
+        "callbacks.encryptJwe is required when jweEncryptor is provided"
+      );
+    }
+    const encryptionResult = await callbacks.encryptJwe(
+      jweEncryptor,
+      authorizationRequestJwt
+    );
+    authorizationRequestJwt = encryptionResult.jwe;
+    encryptionJwk = encryptionResult.encryptionJwk;
+  }
+  const client_id = authorizationRequestPayload.client_id;
+  const jarAuthorizationRequest = requestUri ? { client_id, request_uri: requestUri } : { client_id, request: authorizationRequestJwt };
+  return {
+    authorizationRequestJwt,
+    encryptionJwk,
+    jarAuthorizationRequest,
+    signerJwk
+  };
+}
+
 // src/jarm-form-post-jwt.ts
 var getJwtFromFormPost = async (options) => {
   const inputRegex = /<input[^<>]*>/gi;
@@ -1936,6 +2099,7 @@ var getJwtFromFormPost = async (options) => {
         if (responseJwt) {
           const jwt = responseJwt.replace(lineExpressionRegex, "");
           const decodedJwt = decodeJwt({
+            errorMessagePrefix: "Error decoding JARM form post JWT:",
             jwt,
             payloadSchema: options.schema
           });
@@ -1956,73 +2120,73 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
 
 // src/mrtd-pop/z-mrtd-pop.ts
-var import_zod14 = __toESM(require("zod"));
-var zMrtdChallengeJwtHeader = import_zod14.default.looseObject({
-  alg: import_zod14.default.string(),
-  kid: import_zod14.default.string(),
-  typ: import_zod14.default.literal("mrtd-ias+jwt")
+var import_zod15 = __toESM(require("zod"));
+var zMrtdChallengeJwtHeader = import_zod15.default.looseObject({
+  alg: import_zod15.default.string(),
+  kid: import_zod15.default.string(),
+  typ: import_zod15.default.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = import_zod14.default.looseObject({
-  aud: import_zod14.default.string(),
-  exp: import_zod14.default.number(),
-  htm: import_zod14.default.literal("POST"),
-  htu: import_zod14.default.url(),
-  iat: import_zod14.default.number(),
-  iss: import_zod14.default.string(),
-  mrtd_auth_session: import_zod14.default.string(),
-  mrtd_pop_jwt_nonce: import_zod14.default.string(),
-  state: import_zod14.default.string(),
-  status: import_zod14.default.literal("require_interaction"),
-  type: import_zod14.default.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = import_zod15.default.looseObject({
+  aud: import_zod15.default.string(),
+  exp: import_zod15.default.number(),
+  htm: import_zod15.default.literal("POST"),
+  htu: import_zod15.default.url(),
+  iat: import_zod15.default.number(),
+  iss: import_zod15.default.string(),
+  mrtd_auth_session: import_zod15.default.string(),
+  mrtd_pop_jwt_nonce: import_zod15.default.string(),
+  state: import_zod15.default.string(),
+  status: import_zod15.default.literal("require_interaction"),
+  type: import_zod15.default.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = import_zod14.default.looseObject({
-  alg: import_zod14.default.string(),
-  kid: import_zod14.default.string(),
-  typ: import_zod14.default.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = import_zod15.default.looseObject({
+  alg: import_zod15.default.string(),
+  kid: import_zod15.default.string(),
+  typ: import_zod15.default.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = import_zod14.default.looseObject({
-  aud: import_zod14.default.string(),
-  challenge: import_zod14.default.string(),
-  exp: import_zod14.default.number(),
-  htm: import_zod14.default.literal("POST"),
-  htu: import_zod14.default.url(),
-  iat: import_zod14.default.number(),
-  iss: import_zod14.default.string(),
-  mrtd_pop_nonce: import_zod14.default.string(),
-  mrz: import_zod14.default.string().optional()
+var zMrtdPopInitResponseJwtPayload = import_zod15.default.looseObject({
+  aud: import_zod15.default.string(),
+  challenge: import_zod15.default.string(),
+  exp: import_zod15.default.number(),
+  htm: import_zod15.default.literal("POST"),
+  htu: import_zod15.default.url(),
+  iat: import_zod15.default.number(),
+  iss: import_zod15.default.string(),
+  mrtd_pop_nonce: import_zod15.default.string(),
+  mrz: import_zod15.default.string().optional()
 });
-var zMrtdData = import_zod14.default.looseObject({
-  dg1: import_zod14.default.string(),
-  dg11: import_zod14.default.string(),
-  sod_mrtd: import_zod14.default.string()
+var zMrtdData = import_zod15.default.looseObject({
+  dg1: import_zod15.default.string(),
+  dg11: import_zod15.default.string(),
+  sod_mrtd: import_zod15.default.string()
 });
-var zIasData = import_zod14.default.looseObject({
-  challenge_signed: import_zod14.default.string(),
-  ias_pk: import_zod14.default.string(),
-  sod_ias: import_zod14.default.string()
+var zIasData = import_zod15.default.looseObject({
+  challenge_signed: import_zod15.default.string(),
+  ias_pk: import_zod15.default.string(),
+  sod_ias: import_zod15.default.string()
 });
-var zMrtdValidationJwtHeader = import_zod14.default.looseObject({
-  alg: import_zod14.default.string(),
-  kid: import_zod14.default.string(),
-  typ: import_zod14.default.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = import_zod15.default.looseObject({
+  alg: import_zod15.default.string(),
+  kid: import_zod15.default.string(),
+  typ: import_zod15.default.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = import_zod14.default.looseObject({
-  aud: import_zod14.default.string(),
-  document_type: import_zod14.default.literal("cie"),
-  exp: import_zod14.default.number(),
+var zMrtdValidationJwtPayload = import_zod15.default.looseObject({
+  aud: import_zod15.default.string(),
+  document_type: import_zod15.default.literal("cie"),
+  exp: import_zod15.default.number(),
   ias: zIasData,
-  iat: import_zod14.default.number(),
-  iss: import_zod14.default.string(),
+  iat: import_zod15.default.number(),
+  iss: import_zod15.default.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = import_zod14.default.looseObject({
-  mrtd_val_pop_nonce: import_zod14.default.string(),
-  redirect_uri: import_zod14.default.url(),
-  status: import_zod14.default.literal("require_interaction"),
-  type: import_zod14.default.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = import_zod15.default.looseObject({
+  mrtd_val_pop_nonce: import_zod15.default.string(),
+  redirect_uri: import_zod15.default.url(),
+  status: import_zod15.default.literal("require_interaction"),
+  type: import_zod15.default.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2033,13 +2197,13 @@ async function createMrtdValidationJwt(options) {
     if (!kid) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
-    const iat = (0, import_io_wallet_utils20.dateToSeconds)(options.issuedAt);
-    const header = (0, import_io_wallet_utils20.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
+    const iat = (0, import_io_wallet_utils21.dateToSeconds)(options.issuedAt);
+    const header = (0, import_io_wallet_utils21.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
       typ: "mrtd-ias+jwt"
     });
-    const payload = (0, import_io_wallet_utils20.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
+    const payload = (0, import_io_wallet_utils21.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
       aud: options.audience,
       document_type: "cie",
       exp: iat + JWT_EXPIRY_SECONDS2,
@@ -2073,25 +2237,26 @@ async function createMrtdValidationJwt(options) {
 
 // src/mrtd-pop/fetch-mrtd-pop-init.ts
 var import_oauth212 = require("@openid4vc/oauth2");
-var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopInit(options) {
   try {
-    const fetch = (0, import_io_wallet_utils21.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils22.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popInitEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
         mrtd_pop_jwt_nonce: options.mrtdPopJwtNonce
       }),
       headers: {
-        [import_io_wallet_utils21.HEADERS.CONTENT_TYPE]: import_io_wallet_utils21.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils21.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils21.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils22.HEADERS.CONTENT_TYPE]: import_io_wallet_utils22.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils21.hasStatusOrThrow)(202, import_io_wallet_utils21.UnexpectedStatusCodeError)(response);
+    await (0, import_io_wallet_utils22.hasStatusOrThrow)(202, import_io_wallet_utils22.UnexpectedStatusCodeError)(response);
     const responseJwt = await response.text();
     const jwt = decodeJwt({
+      errorMessagePrefix: "Error decoding MRTD PoP init response JWT:",
       headerSchema: zMrtdPopInitResponseJwtHeader,
       jwt: responseJwt,
       payloadSchema: zMrtdPopInitResponseJwtPayload
@@ -2112,7 +2277,7 @@ async function fetchMrtdPopInit(options) {
       signer
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils21.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils21.ValidationError) {
+    if (error instanceof import_io_wallet_utils22.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils22.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2122,10 +2287,10 @@ async function fetchMrtdPopInit(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-verify.ts
-var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils23 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopVerify(options) {
   try {
-    const fetch = (0, import_io_wallet_utils22.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils23.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popVerifyEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
@@ -2133,14 +2298,14 @@ async function fetchMrtdPopVerify(options) {
         mrtd_validation_jwt: options.mrtdValidationJwt
       }),
       headers: {
-        [import_io_wallet_utils22.HEADERS.CONTENT_TYPE]: import_io_wallet_utils22.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils23.HEADERS.CONTENT_TYPE]: import_io_wallet_utils23.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils23.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils23.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils22.hasStatusOrThrow)(202, import_io_wallet_utils22.UnexpectedStatusCodeError)(response);
-    const parsed = (0, import_io_wallet_utils22.parseWithErrorHandling)(
+    await (0, import_io_wallet_utils23.hasStatusOrThrow)(202, import_io_wallet_utils23.UnexpectedStatusCodeError)(response);
+    const parsed = (0, import_io_wallet_utils23.parseWithErrorHandling)(
       zMrtdPopVerifyResponse,
       await response.json(),
       "Failed to parse MRTD PoP verify response"
@@ -2150,7 +2315,7 @@ async function fetchMrtdPopVerify(options) {
       redirectUri: parsed.redirect_uri
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils22.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils22.ValidationError) {
+    if (error instanceof import_io_wallet_utils23.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils23.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2175,6 +2340,7 @@ function parseMrtdChallenge(options) {
     );
   }
   const { header, payload } = decodeJwt({
+    errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
     payloadSchema: zMrtdChallengeJwtPayload
@@ -2187,6 +2353,7 @@ var import_oauth214 = require("@openid4vc/oauth2");
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
   const jwt = decodeJwt({
+    errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
     payloadSchema: zMrtdChallengeJwtPayload
@@ -2217,14 +2384,13 @@ var import_oauth215 = require("@openid4vc/oauth2");
   CreateTokenResponseError,
   FetchTokenResponseError,
   HashAlgorithm,
+  MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
   Oauth2JwtParseError,
   PkceCodeChallengeMethod,
   PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod,
-  V1_0,
-  V1_3,
   authorizationCodeGrantIdentifier,
   clientAuthenticationAnonymous,
   clientAuthenticationWalletAttestationJwt,
@@ -2236,6 +2402,9 @@ var import_oauth215 = require("@openid4vc/oauth2");
   createPushedAuthorizationRequest,
   createTokenDPoP,
   createTokenRequest,
+  createWalletAttestationJwtV1_0,
+  createWalletAttestationJwtV1_3,
+  createWalletAttestationJwtV1_4,
   decodeJwt,
   decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders,
@@ -2273,6 +2442,9 @@ var import_oauth215 = require("@openid4vc/oauth2");
   verifyPushedAuthorizationRequest,
   verifyTokenDPoP,
   verifyWalletAttestationJwt,
+  verifyWalletAttestationJwtV1_0,
+  verifyWalletAttestationJwtV1_3,
+  verifyWalletAttestationJwtV1_4,
   zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
@@ -2305,6 +2477,15 @@ var import_oauth215 = require("@openid4vc/oauth2");
   zPushedAuthorizationResponse,
   zRefreshTokenGrantIdentifier,
   zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain
+  zTrustChain,
+  zWalletAttestationJwtHeaderV1_0,
+  zWalletAttestationJwtHeaderV1_3,
+  zWalletAttestationJwtHeaderV1_4,
+  zWalletAttestationJwtPayloadV1_0,
+  zWalletAttestationJwtPayloadV1_3,
+  zWalletAttestationJwtPayloadV1_4,
+  zWalletAttestationJwtV1_0,
+  zWalletAttestationJwtV1_3,
+  zWalletAttestationJwtV1_4
 });
 //# sourceMappingURL=index.js.map