@pagopa/io-wallet-oauth2 1.2.0 → 1.3.0

package/dist/index.mjs

@@ -1,16 +1,10 @@
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
 // src/access-token/create-token-request.ts
 var createTokenRequest = async (options) => ({
+  ...options.additionalRequestPayload,
   code: options.authorizationCode,
   code_verifier: options.pkceCodeVerifier,
   grant_type: "authorization_code",
-  redirect_uri: options.redirectUri,
-  ...options.additionalRequestPayload
+  redirect_uri: options.redirectUri
 });
 
 // src/access-token/create-token-response.ts
@@ -30,6 +24,7 @@ import { Oauth2JwtParseError } from "@openid4vc/oauth2";
 import {
   decodeBase64,
   encodeToUtf8String,
+  formatError,
   parseWithErrorHandling,
   stringToJsonWithErrorHandling
 } from "@pagopa/io-wallet-utils";
@@ -83,6 +78,7 @@ var zJwk = z2.looseObject({
 var zJwkSet = z2.looseObject({ keys: z2.array(zJwk) });
 
 // src/common/jwt/z-jwt.ts
+var MAX_JTI_LENGTH = 256;
 var zCompactJwt = z3.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
   message: "Not a valid compact jwt"
 });
@@ -97,7 +93,7 @@ var zJwtPayload = z3.looseObject({
   exp: z3.number().int().optional(),
   iat: z3.number().int().optional(),
   iss: z3.string().optional(),
-  jti: z3.string().optional(),
+  jti: z3.string().max(MAX_JTI_LENGTH).optional(),
   nbf: z3.number().int().optional(),
   nonce: z3.string().optional(),
   // Reserved for status parameters
@@ -119,23 +115,35 @@ var zJwtHeader = z3.looseObject({
 function decodeJwtHeader(options) {
   const jwtParts = options.jwt.split(".");
   if (jwtParts.length <= 2) {
-    throw new Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+    throw new Oauth2JwtParseError(
+      formatError(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
   }
   const [headerPart] = jwtParts;
   let headerJson;
   try {
     headerJson = stringToJsonWithErrorHandling(
       encodeToUtf8String(decodeBase64(headerPart)),
-      "Unable to parse jwt header to JSON"
+      formatError(
+        "Unable to parse jwt header to JSON",
+        options.errorMessagePrefix
+      )
     );
   } catch (error) {
     throw new Oauth2JwtParseError(
-      `Error parsing JWT. ${error instanceof Error ? error.message : ""}`
+      formatError(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
     );
   }
   const header = parseWithErrorHandling(
     options.headerSchema ?? zJwtHeader,
-    headerJson
+    headerJson,
+    formatError("Invalid JWT header", options.errorMessagePrefix)
   );
   return {
     header
@@ -174,51 +182,55 @@ function jwtHeaderFromJwtSigner(signer) {
 
 // src/errors.ts
 var Oauth2Error = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "Oauth2Error";
+    this.statusCode = options?.statusCode;
   }
 };
 var PushedAuthorizationRequestError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "PushedAuthorizationRequestError";
+    this.statusCode = options?.statusCode;
   }
 };
 var CreateTokenDPoPError = class extends Oauth2Error {
-  constructor(message) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateTokenDPoPError";
   }
 };
 var MrtdPopError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "MrtdPopError";
+    this.statusCode = options?.statusCode;
   }
 };
 var FetchTokenResponseError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
-    this.name = "fetchTokenResponseError";
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
+    this.name = "FetchTokenResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var CreateTokenResponseError = class extends Oauth2Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateTokenResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var ClientAttestationError = class extends Oauth2Error {
-  constructor(message, cause) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "ClientAttestationError";
-    this.cause = cause;
   }
 };
 
@@ -264,7 +276,7 @@ var zAccessTokenProfileJwtPayload = z4.looseObject({
   exp: z4.number(),
   iat: z4.number(),
   iss: z4.string(),
-  jti: z4.string(),
+  jti: z4.string().max(MAX_JTI_LENGTH),
   nbf: z4.number().optional(),
   scope: z4.string().optional(),
   sub: z4.string()
@@ -284,6 +296,7 @@ async function createAccessTokenResponse(options) {
       typ: "at+jwt"
     });
     const payload = parseWithErrorHandling2(zAccessTokenProfileJwtPayload, {
+      ...options.additionalPayload,
       aud: options.audience,
       client_id: options.clientId,
       cnf: options.dpop ? {
@@ -299,19 +312,18 @@ async function createAccessTokenResponse(options) {
       jti: encodeToBase64Url(await options.callbacks.generateRandom(32)),
       nbf: options.nbf,
       scope: options.scope,
-      sub: options.subject,
-      ...options.additionalPayload
+      sub: options.subject
     });
     const { jwt } = await options.callbacks.signJwt(options.signer, {
       header,
       payload
     });
     const accessTokenResponse = parseWithErrorHandling2(zAccessTokenResponse, {
+      ...options.additionalPayload,
       access_token: jwt,
       expires_in: options.expiresInSeconds,
       refresh_token: options.refreshToken,
-      token_type: options.tokenType,
-      ...options.additionalPayload
+      token_type: options.tokenType
     });
     return accessTokenResponse;
   } catch (error) {
@@ -379,55 +391,90 @@ import {
   formatZodError
 } from "@pagopa/io-wallet-utils";
 
-// src/client-attestation/client-attestation-pop.ts
-import {
-  verifyJwt
-} from "@openid4vc/oauth2";
+// src/client-attestation/wallet-attestation.ts
+import { zCompactJwt as zCompactJwt2 } from "@openid4vc/oauth2";
 import {
-  addSecondsToDate as addSecondsToDate2,
-  dateToSeconds as dateToSeconds2,
-  encodeToBase64Url as encodeToBase64Url2
+  ItWalletSpecsVersion,
+  ItWalletSpecsVersionError
 } from "@pagopa/io-wallet-utils";
 
+// src/client-attestation/types.ts
+import z5 from "zod";
+var zOauthClientAttestationHeader = z5.literal(
+  "OAuth-Client-Attestation"
+);
+var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
+var zOauthClientAttestationPopHeader = z5.literal(
+  "OAuth-Client-Attestation-PoP"
+);
+var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
+
+// src/client-attestation/verify-wallet-attestation-jwt-base.ts
+import { jwtSignerFromJwt, verifyJwt } from "@openid4vc/oauth2";
+
 // src/common/jwt/decode-jwt.ts
 import { Oauth2JwtParseError as Oauth2JwtParseError2 } from "@openid4vc/oauth2";
 import {
   decodeBase64 as decodeBase642,
   encodeToUtf8String as encodeToUtf8String2,
+  formatError as formatError2,
   parseWithErrorHandling as parseWithErrorHandling4,
   stringToJsonWithErrorHandling as stringToJsonWithErrorHandling2
 } from "@pagopa/io-wallet-utils";
 function decodeJwt(options) {
   const jwtParts = options.jwt.split(".");
   if (jwtParts.length !== 3) {
-    throw new Oauth2JwtParseError2("Jwt is not a valid jwt, unable to decode");
+    throw new Oauth2JwtParseError2(
+      formatError2(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
   }
   let payloadJson;
   try {
     const payloadPart = jwtParts[1];
     if (payloadPart === void 0) {
-      throw new Oauth2JwtParseError2("Jwt is not a valid jwt, unable to decode");
+      throw new Oauth2JwtParseError2(
+        formatError2(
+          "Unable to decode because Jwt is not a valid!",
+          options.errorMessagePrefix
+        )
+      );
     }
     payloadJson = stringToJsonWithErrorHandling2(
       encodeToUtf8String2(decodeBase642(payloadPart)),
-      "Unable to parse jwt payload to JSON"
+      formatError2(
+        "Unable to parse jwt payload to JSON",
+        options.errorMessagePrefix
+      )
     );
   } catch (error) {
     throw new Oauth2JwtParseError2(
-      `Error parsing JWT. ${error instanceof Error ? error.message : ""}`
+      formatError2(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
     );
   }
   const signaturePart = jwtParts[2];
   if (signaturePart === void 0) {
-    throw new Oauth2JwtParseError2("Jwt is not a valid jwt, unable to decode");
+    throw new Oauth2JwtParseError2(
+      formatError2(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
   }
   const { header } = decodeJwtHeader({
+    errorMessagePrefix: options.errorMessagePrefix,
     headerSchema: options.headerSchema,
     jwt: options.jwt
   });
   const payload = parseWithErrorHandling4(
     options.payloadSchema ?? zJwtPayload,
-    payloadJson
+    payloadJson,
+    formatError2("Invalid JWT payload", options.errorMessagePrefix)
   );
   return {
     header,
@@ -436,160 +483,26 @@ function decodeJwt(options) {
   };
 }
 
-// src/client-attestation/client-attestation-pop.ts
-async function verifyClientAttestationPopJwt(options) {
-  try {
-    const { header, payload } = decodeJwt({
-      jwt: options.clientAttestationPopJwt
-    });
-    if (payload.aud !== options.authorizationServer) {
-      throw new Oauth2Error(
-        `Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`
-      );
-    }
-    const { signer } = await verifyJwt({
-      compact: options.clientAttestationPopJwt,
-      errorMessage: "client attestation pop jwt verification failed",
-      expectedNonce: options.expectedNonce,
-      header,
-      now: options.now,
-      payload,
-      signer: {
-        alg: header.alg,
-        method: "jwk",
-        publicJwk: options.clientAttestationPublicJwk
-      },
-      verifyJwtCallback: options.callbacks.verifyJwt
-    });
-    return {
-      header,
-      payload,
-      signer
-    };
-  } catch (error) {
-    if (error instanceof Oauth2Error) throw error;
-    throw new Oauth2Error(
-      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-async function createClientAttestationPopJwt(options) {
-  try {
-    const clientAttestation = decodeJwt({
-      jwt: options.clientAttestation
-    });
-    const jwk = clientAttestation.payload.cnf?.jwk;
-    if (!jwk) {
-      throw new Oauth2Error(
-        "Client attestation does not contain 'cnf.jwk', cannot create client attestation pop jwt"
-      );
-    }
-    const sub = clientAttestation.payload.sub;
-    if (!sub || typeof sub !== "string") {
-      throw new Oauth2Error(
-        "Client attestation does not contain 'sub', cannot create client attestation pop jwt"
-      );
-    }
-    const signer = options.signer ?? {
-      alg: clientAttestation.header.alg,
-      method: "jwk",
-      publicJwk: jwk
-    };
-    const header = {
-      alg: signer.alg,
-      typ: "oauth-client-attestation-pop+jwt"
-    };
-    const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const expiresAt = options.expiresAt ?? addSecondsToDate2(issuedAt, 1 * 60);
-    const jti = options.jti ?? (options.callbacks.generateRandom ? encodeToBase64Url2(await options.callbacks.generateRandom(32)) : void 0);
-    if (!jti) {
-      throw new Oauth2Error(
-        "Error: neither a default jti nor a generateRandom callback have been provided"
-      );
-    }
-    const payload = {
-      aud: options.authorizationServer,
-      exp: dateToSeconds2(expiresAt),
-      iat: dateToSeconds2(issuedAt),
-      iss: sub,
-      jti
-    };
-    const { jwt } = await options.callbacks.signJwt(signer, {
-      header,
-      payload
-    });
-    return jwt;
-  } catch (error) {
-    if (error instanceof Oauth2Error) throw error;
-    throw new Oauth2Error(
-      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
-// src/client-attestation/types.ts
-import z5 from "zod";
-var zOauthClientAttestationHeader = z5.literal(
-  "OAuth-Client-Attestation"
-);
-var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = z5.literal(
-  "OAuth-Client-Attestation-PoP"
-);
-var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
-
-// src/client-attestation/client-authentication.ts
-var SupportedClientAuthenticationMethod = {
-  ClientSecretBasic: "client_secret_basic",
-  ClientSecretPost: "client_secret_post",
-  None: "none",
-  WalletAttestationJwt: "attest_jwt_client_auth"
-};
-function isClientAttestationSupported(options) {
-  if (!options.authorizationServerMetadata.token_endpoint_auth_methods_supported || !options.authorizationServerMetadata.token_endpoint_auth_methods_supported.includes(
-    SupportedClientAuthenticationMethod.WalletAttestationJwt
-  )) {
-    return {
-      supported: false
-    };
-  }
-  return {
-    supported: true
-  };
-}
-function clientAuthenticationAnonymous() {
-  return () => {
-  };
-}
-function clientAuthenticationWalletAttestationJwt(options) {
-  return async ({ authorizationServerMetadata, headers }) => {
-    const clientAttestationPop = await createClientAttestationPopJwt({
-      authorizationServer: authorizationServerMetadata.issuer,
-      callbacks: options.callbacks,
-      clientAttestation: options.walletAttestationJwt
-    });
-    headers.set(oauthClientAttestationHeader, options.walletAttestationJwt);
-    headers.set(oauthClientAttestationPopHeader, clientAttestationPop);
-  };
+// src/client-attestation/verify-wallet-attestation-jwt-base.ts
+async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
+  const { header, payload } = decodeJwt({
+    errorMessagePrefix: "Error decoding wallet attestation JWT:",
+    headerSchema,
+    jwt: options.walletAttestationJwt,
+    payloadSchema
+  });
+  const { signer } = await verifyJwt({
+    compact: options.walletAttestationJwt,
+    errorMessage: "wallet attestation verification failed.",
+    header,
+    now: options.now,
+    payload,
+    signer: jwtSignerFromJwt({ header, payload }),
+    verifyJwtCallback: options.callbacks.verifyJwt
+  });
+  return { header, payload, signer };
 }
 
-// src/client-attestation/v1.0/index.ts
-var v1_exports = {};
-__export(v1_exports, {
-  createWalletAttestationJwt: () => createWalletAttestationJwt,
-  verifyWalletAttestationJwt: () => verifyWalletAttestationJwt,
-  zWalletAttestationJwtHeaderV1_0: () => zWalletAttestationJwtHeaderV1_0,
-  zWalletAttestationJwtPayloadV1_0: () => zWalletAttestationJwtPayloadV1_0,
-  zWalletAttestationJwtV1_0: () => zWalletAttestationJwtV1_0
-});
-
-// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
-import {
-  ValidationError as ValidationError2,
-  addSecondsToDate as addSecondsToDate3,
-  dateToSeconds as dateToSeconds3
-} from "@pagopa/io-wallet-utils";
-
 // src/client-attestation/v1.0/z-wallet-attestation.ts
 import { z as z6 } from "zod";
 var zWalletAttestationJwtHeaderV1_0 = z6.looseObject({
@@ -613,67 +526,6 @@ var zWalletAttestationJwtPayloadV1_0 = z6.looseObject({
 });
 var zWalletAttestationJwtV1_0 = z6.string().min(1);
 
-// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
-var createWalletAttestationJwt = async (options) => {
-  try {
-    const { signJwt } = options.callbacks;
-    const exp = options.expiresAt ?? addSecondsToDate3(/* @__PURE__ */ new Date(), 3600 * 24 * 60);
-    const payload = {
-      cnf: { jwk: options.dpopJwkPublic },
-      exp: dateToSeconds3(exp),
-      iat: dateToSeconds3(/* @__PURE__ */ new Date()),
-      iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
-      ...options.walletLink && { wallet_link: options.walletLink },
-      ...options.walletName && { wallet_name: options.walletName },
-      aal: options.authenticatorAssuranceLevel
-    };
-    const header = {
-      alg: options.signer.alg,
-      kid: options.signer.kid,
-      trust_chain: options.signer.trustChain,
-      typ: "oauth-client-attestation+jwt"
-    };
-    const result = await signJwt(options.signer, {
-      header,
-      payload
-    });
-    decodeJwt({
-      headerSchema: zWalletAttestationJwtHeaderV1_0,
-      jwt: result.jwt,
-      payloadSchema: zWalletAttestationJwtPayloadV1_0
-    });
-    return result.jwt;
-  } catch (error) {
-    if (error instanceof ValidationError2) {
-      throw error;
-    }
-    throw new ClientAttestationError(
-      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-};
-
-// src/client-attestation/verify-wallet-attestation-jwt-base.ts
-import { jwtSignerFromJwt, verifyJwt as verifyJwt2 } from "@openid4vc/oauth2";
-async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
-  const { header, payload } = decodeJwt({
-    headerSchema,
-    jwt: options.walletAttestationJwt,
-    payloadSchema
-  });
-  const { signer } = await verifyJwt2({
-    compact: options.walletAttestationJwt,
-    errorMessage: "wallet attestation verification failed.",
-    header,
-    now: options.now,
-    payload,
-    signer: jwtSignerFromJwt({ header, payload }),
-    verifyJwtCallback: options.callbacks.verifyJwt
-  });
-  return { header, payload, signer };
-}
-
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
   return verifyWalletAttestationBase(
@@ -683,23 +535,6 @@ async function verifyWalletAttestationJwt(options) {
   );
 }
 
-// src/client-attestation/v1.3/index.ts
-var v1_exports2 = {};
-__export(v1_exports2, {
-  createWalletAttestationJwt: () => createWalletAttestationJwt2,
-  verifyWalletAttestationJwt: () => verifyWalletAttestationJwt2,
-  zWalletAttestationJwtHeaderV1_3: () => zWalletAttestationJwtHeaderV1_3,
-  zWalletAttestationJwtPayloadV1_3: () => zWalletAttestationJwtPayloadV1_3,
-  zWalletAttestationJwtV1_3: () => zWalletAttestationJwtV1_3
-});
-
-// src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
-import {
-  ValidationError as ValidationError3,
-  addSecondsToDate as addSecondsToDate4,
-  dateToSeconds as dateToSeconds4
-} from "@pagopa/io-wallet-utils";
-
 // src/client-attestation/v1.3/z-wallet-attestation.ts
 import { z as z7 } from "zod";
 var zWalletAttestationJwtHeaderV1_3 = z7.looseObject({
@@ -733,55 +568,6 @@ var zWalletAttestationJwtPayloadV1_3 = z7.looseObject({
 });
 var zWalletAttestationJwtV1_3 = z7.string().min(1);
 
-// src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
-var createWalletAttestationJwt2 = async (options) => {
-  try {
-    const { signJwt } = options.callbacks;
-    const exp = options.expiresAt ?? addSecondsToDate4(/* @__PURE__ */ new Date(), 3600 * 24 * 60);
-    if (options.nbf && options.nbf >= exp) {
-      throw new ValidationError3("nbf must be before exp");
-    }
-    const payload = {
-      cnf: { jwk: options.dpopJwkPublic },
-      exp: dateToSeconds4(exp),
-      iat: dateToSeconds4(/* @__PURE__ */ new Date()),
-      iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
-      ...options.nbf && { nbf: dateToSeconds4(options.nbf) },
-      ...options.status && { status: options.status },
-      ...options.walletLink && { wallet_link: options.walletLink },
-      ...options.walletName && { wallet_name: options.walletName }
-    };
-    const header = {
-      alg: options.signer.alg,
-      kid: options.signer.kid,
-      typ: "oauth-client-attestation+jwt",
-      x5c: options.signer.x5c,
-      // REQUIRED
-      ...options.signer.trustChain && {
-        trust_chain: options.signer.trustChain
-      }
-    };
-    const result = await signJwt(options.signer, {
-      header,
-      payload
-    });
-    decodeJwt({
-      headerSchema: zWalletAttestationJwtHeaderV1_3,
-      jwt: result.jwt,
-      payloadSchema: zWalletAttestationJwtPayloadV1_3
-    });
-    return result.jwt;
-  } catch (error) {
-    if (error instanceof ValidationError3) {
-      throw error;
-    }
-    throw new ClientAttestationError(
-      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-};
-
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
   return verifyWalletAttestationBase(
@@ -791,25 +577,65 @@ async function verifyWalletAttestationJwt2(options) {
   );
 }
 
-// src/client-attestation/verify-client-attestation.ts
-import {
-  HashAlgorithm as HashAlgorithm2,
-  calculateJwkThumbprint as calculateJwkThumbprint2
-} from "@openid4vc/oauth2";
+// src/client-attestation/v1.4/z-wallet-attestation.ts
+import { z as z8 } from "zod";
+var zWalletAttestationStatusV1_4 = z8.object({
+  status_list: z8.object({
+    idx: z8.number().int(),
+    uri: z8.string()
+  })
+});
+var zEudiWalletInfoV1_4 = z8.object({
+  general_info: z8.object({
+    wallet_provider_name: z8.string(),
+    wallet_solution_certification_information: z8.url(),
+    wallet_solution_id: z8.string(),
+    wallet_solution_version: z8.string()
+  })
+});
+var zWalletAttestationJwtHeaderV1_4 = z8.looseObject({
+  ...zJwtHeader.shape,
+  trust_chain: zTrustChain.optional(),
+  typ: z8.literal("oauth-client-attestation+jwt"),
+  x5c: zCertificateChain
+});
+var zWalletAttestationJwtPayloadV1_4 = z8.looseObject({
+  ...zJwtPayload.shape,
+  cnf: z8.object({
+    jwk: zJwk
+  }),
+  eudi_wallet_info: zEudiWalletInfoV1_4.optional(),
+  exp: z8.number().int(),
+  iat: z8.number().int(),
+  iss: z8.string(),
+  nbf: z8.number().optional(),
+  status: zWalletAttestationStatusV1_4,
+  sub: z8.string(),
+  wallet_link: z8.url(),
+  wallet_name: z8.string()
+});
+var zWalletAttestationJwtV1_4 = z8.string().min(1);
+
+// src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
+async function verifyWalletAttestationJwt3(options) {
+  return verifyWalletAttestationBase(
+    options,
+    zWalletAttestationJwtHeaderV1_4,
+    zWalletAttestationJwtPayloadV1_4
+  );
+}
 
 // src/client-attestation/wallet-attestation.ts
-import { zCompactJwt as zCompactJwt2 } from "@openid4vc/oauth2";
-import {
-  ItWalletSpecsVersion,
-  ItWalletSpecsVersionError
-} from "@pagopa/io-wallet-utils";
 function isV1_0Options(options) {
   return options.config.itWalletSpecsVersion === ItWalletSpecsVersion.V1_0;
 }
 function isV1_3Options(options) {
   return options.config.itWalletSpecsVersion === ItWalletSpecsVersion.V1_3;
 }
-async function verifyWalletAttestationJwt3(options) {
+function isV1_4Options(options) {
+  return options.config.itWalletSpecsVersion === ItWalletSpecsVersion.V1_4;
+}
+async function verifyWalletAttestationJwt4(options) {
   const version = options.config.itWalletSpecsVersion;
   if (isV1_0Options(options)) {
     return verifyWalletAttestationJwt(options);
@@ -817,10 +643,14 @@ async function verifyWalletAttestationJwt3(options) {
   if (isV1_3Options(options)) {
     return verifyWalletAttestationJwt2(options);
   }
-  throw new ItWalletSpecsVersionError("verifyWalletAttestationJwt", version, [
-    ItWalletSpecsVersion.V1_0,
-    ItWalletSpecsVersion.V1_3
-  ]);
+  if (isV1_4Options(options)) {
+    return verifyWalletAttestationJwt3(options);
+  }
+  throw new ItWalletSpecsVersionError(
+    "verifyWalletAttestationJwt",
+    version,
+    Object.values(ItWalletSpecsVersion)
+  );
 }
 function extractClientAttestationJwtsFromHeaders(headers) {
   const walletAttestationHeader = headers.get(oauthClientAttestationHeader);
@@ -843,60 +673,16 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   };
 }
 
-// src/client-attestation/verify-client-attestation.ts
-async function verifyClientAttestation(options) {
-  if (!options.clientAttestation.walletAttestationJwt || !options.clientAttestation.clientAttestationPopJwt) {
-    throw new Oauth2Error(
-      `Missing required client attestation parameters in the request. Make sure to provide the '${oauthClientAttestationHeader}' and '${oauthClientAttestationPopHeader}' header values.`
-    );
-  }
-  const clientAttestation = await verifyWalletAttestationJwt3({
-    callbacks: options.callbacks,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    config: options.config,
-    now: options.now,
-    walletAttestationJwt: options.clientAttestation.walletAttestationJwt
-  });
-  const clientAttestationPop = await verifyClientAttestationPopJwt({
-    authorizationServer: options.authorizationServerMetadata.issuer,
-    callbacks: options.callbacks,
-    clientAttestationPopJwt: options.clientAttestation.clientAttestationPopJwt,
-    clientAttestationPublicJwk: clientAttestation.payload.cnf.jwk,
-    now: options.now
-  });
-  if (options.requestClientId && options.requestClientId !== clientAttestation.payload.sub) {
-    throw new Oauth2Error(
-      `The client_id '${options.requestClientId}' in the request does not match the client id '${clientAttestation.payload.sub}' in the client attestation`
-    );
-  }
-  if (options.clientAttestation.ensureConfirmationKeyMatchesDpopKey && options.dpopJwkThumbprint) {
-    const clientAttestationJkt = await calculateJwkThumbprint2({
-      hashAlgorithm: HashAlgorithm2.Sha256,
-      hashCallback: options.callbacks.hash,
-      jwk: clientAttestation.payload.cnf.jwk
-    });
-    if (clientAttestationJkt !== options.dpopJwkThumbprint) {
-      throw new Oauth2Error(
-        "Expected the DPoP JWK thumbprint value to match the JWK thumbprint of the client attestation confirmation JWK. Ensure both DPoP and client attestation use the same key."
-      );
-    }
-  }
-  return {
-    clientAttestation,
-    clientAttestationPop
-  };
-}
-
 // src/token-dpop/create-token-dpop.ts
 import {
-  HashAlgorithm as HashAlgorithm3,
+  HashAlgorithm as HashAlgorithm2,
   zCompactJwt as zCompactJwt3
 } from "@openid4vc/oauth2";
 import {
-  ValidationError as ValidationError4,
-  dateToSeconds as dateToSeconds5,
+  ValidationError as ValidationError2,
+  dateToSeconds as dateToSeconds2,
   decodeUtf8String,
-  encodeToBase64Url as encodeToBase64Url3,
+  encodeToBase64Url as encodeToBase64Url2,
   parseWithErrorHandling as parseWithErrorHandling5
 } from "@pagopa/io-wallet-utils";
 import { Base64 } from "js-base64";
@@ -911,28 +697,28 @@ var htuFromRequestUrl = (requestUrl) => {
 
 // src/token-dpop/z-dpop.ts
 import { zHttpMethod } from "@pagopa/io-wallet-utils";
-import z8 from "zod";
-var zDpopJwtPayload = z8.looseObject({
+import z9 from "zod";
+var zDpopJwtPayload = z9.looseObject({
   ...zJwtPayload.shape,
-  ath: z8.optional(z8.string()),
+  ath: z9.optional(z9.string()),
   htm: zHttpMethod,
-  htu: z8.url(),
-  iat: z8.number().int().nonnegative(),
-  jti: z8.string()
+  htu: z9.url(),
+  iat: z9.number().int().nonnegative(),
+  jti: z9.string().max(MAX_JTI_LENGTH)
 });
-var zDpopJwtHeader = z8.looseObject({
+var zDpopJwtHeader = z9.looseObject({
   ...zJwtHeader.shape,
   jwk: zJwk,
-  typ: z8.literal("dpop+jwt")
+  typ: z9.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
 async function createTokenDPoP(options) {
   try {
-    const ath = options.accessToken ? encodeToBase64Url3(
+    const ath = options.accessToken ? encodeToBase64Url2(
       await options.callbacks.hash(
         decodeUtf8String(options.accessToken),
-        HashAlgorithm3.Sha256
+        HashAlgorithm2.Sha256
       )
     ) : void 0;
     const jti = options.jti ?? (options.callbacks.generateRandom ? Base64.fromUint8Array(
@@ -953,7 +739,7 @@ async function createTokenDPoP(options) {
       ath,
       htm: options.tokenRequest.method,
       htu: htuFromRequestUrl(options.tokenRequest.url),
-      iat: dateToSeconds5(options.issuedAt),
+      iat: dateToSeconds2(options.issuedAt),
       jti
     });
     return options.callbacks.signJwt(options.signer, {
@@ -961,7 +747,7 @@ async function createTokenDPoP(options) {
       payload
     });
   } catch (error) {
-    if (error instanceof CreateTokenDPoPError || error instanceof ValidationError4) {
+    if (error instanceof CreateTokenDPoPError || error instanceof ValidationError2) {
       throw error;
     }
     throw new CreateTokenDPoPError(
@@ -980,114 +766,11 @@ function extractDpopJwtFromHeaders(headers) {
   return { dpopJwt, valid: true };
 }
 
-// src/token-dpop/verify-token-dpop.ts
-import {
-  HashAlgorithm as HashAlgorithm4,
-  calculateJwkThumbprint as calculateJwkThumbprint3,
-  verifyJwt as verifyJwt3
-} from "@openid4vc/oauth2";
-import {
-  decodeUtf8String as decodeUtf8String2,
-  encodeToBase64Url as encodeToBase64Url4,
-  verifyJwtIatOrThrow
-} from "@pagopa/io-wallet-utils";
-async function verifyTokenDPoP(options) {
-  const { header, payload } = decodeJwt({
-    headerSchema: zDpopJwtHeader,
-    jwt: options.dpopJwt,
-    payloadSchema: zDpopJwtPayload
-  });
-  if (options.allowedSigningAlgs && !options.allowedSigningAlgs.includes(header.alg)) {
-    throw new Oauth2Error(
-      `dpop jwt uses alg value '${header.alg}' but allowed dpop signing alg values are ${options.allowedSigningAlgs.join(", ")}.`
-    );
-  }
-  if (options.expectedNonce) {
-    if (!payload.nonce) {
-      throw new Oauth2Error(
-        `Dpop jwt does not have a nonce value, but expected nonce value '${options.expectedNonce}'`
-      );
-    }
-    if (payload.nonce !== options.expectedNonce) {
-      throw new Oauth2Error(
-        `Dpop jwt contains nonce value '${payload.nonce}', but expected nonce value '${options.expectedNonce}'`
-      );
-    }
-  }
-  if (options.request.method !== payload.htm) {
-    throw new Oauth2Error(
-      `Dpop jwt contains htm value '${payload.htm}', but expected htm value '${options.request.method}'`
-    );
-  }
-  const expectedHtu = htuFromRequestUrl(options.request.url);
-  if (expectedHtu !== payload.htu) {
-    throw new Oauth2Error(
-      `Dpop jwt contains htu value '${payload.htu}', but expected htu value '${expectedHtu}'.`
-    );
-  }
-  if (options.accessToken) {
-    const expectedAth = encodeToBase64Url4(
-      await options.callbacks.hash(
-        decodeUtf8String2(options.accessToken),
-        HashAlgorithm4.Sha256
-      )
-    );
-    if (!payload.ath) {
-      throw new Oauth2Error(
-        `Dpop jwt does not have a ath value, but expected ath value '${expectedAth}'.`
-      );
-    }
-    if (payload.ath !== expectedAth) {
-      throw new Oauth2Error(
-        `Dpop jwt contains ath value '${payload.ath}', but expected ath value '${expectedAth}'.`
-      );
-    }
-  }
-  const jwkThumbprint = await calculateJwkThumbprint3({
-    hashAlgorithm: HashAlgorithm4.Sha256,
-    hashCallback: options.callbacks.hash,
-    jwk: header.jwk
-  });
-  if (options.expectedJwkThumbprint && options.expectedJwkThumbprint !== jwkThumbprint) {
-    throw new Oauth2Error(
-      `Dpop is signed with jwk with thumbprint value '${jwkThumbprint}', but expect jwk thumbprint value '${options.expectedJwkThumbprint}'`
-    );
-  }
-  try {
-    verifyJwtIatOrThrow({
-      iat: payload.iat,
-      now: options.now
-    });
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new Oauth2Error(`Invalid iat claim in dpop JWT: ${error.message}`);
-    }
-  }
-  await verifyJwt3({
-    compact: options.dpopJwt,
-    errorMessage: "dpop jwt verification failed",
-    header,
-    now: options.now,
-    payload,
-    signer: {
-      alg: header.alg,
-      method: "jwk",
-      publicJwk: header.jwk
-    },
-    verifyJwtCallback: options.callbacks.verifyJwt
-  });
-  return {
-    header,
-    jwkThumbprint,
-    payload
-  };
-}
-
 // src/access-token/z-grant-type.ts
-import { z as z9 } from "zod";
-var zAuthorizationCodeGrantIdentifier = z9.literal("authorization_code");
+import { z as z10 } from "zod";
+var zAuthorizationCodeGrantIdentifier = z10.literal("authorization_code");
 var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = z9.literal("refresh_token");
+var zRefreshTokenGrantIdentifier = z10.literal("refresh_token");
 var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
 // src/access-token/parse-token-request.ts
@@ -1164,11 +847,162 @@ function parseSecurityHeaders(headers) {
   };
 }
 
+// src/client-attestation/verify-client-attestation.ts
+import {
+  HashAlgorithm as HashAlgorithm3,
+  calculateJwkThumbprint as calculateJwkThumbprint2
+} from "@openid4vc/oauth2";
+
+// src/client-attestation/client-attestation-pop.ts
+import {
+  verifyJwt as verifyJwt2
+} from "@openid4vc/oauth2";
+import {
+  addSecondsToDate as addSecondsToDate2,
+  dateToSeconds as dateToSeconds3,
+  encodeToBase64Url as encodeToBase64Url3
+} from "@pagopa/io-wallet-utils";
+async function verifyClientAttestationPopJwt(options) {
+  try {
+    const { header, payload } = decodeJwt({
+      errorMessagePrefix: "Error decoding client attestation PoP JWT:",
+      jwt: options.clientAttestationPopJwt
+    });
+    if (payload.aud !== options.authorizationServer) {
+      throw new Oauth2Error(
+        `Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`
+      );
+    }
+    const { signer } = await verifyJwt2({
+      compact: options.clientAttestationPopJwt,
+      errorMessage: "client attestation pop jwt verification failed",
+      expectedNonce: options.expectedNonce,
+      header,
+      now: options.now,
+      payload,
+      signer: {
+        alg: header.alg,
+        method: "jwk",
+        publicJwk: options.clientAttestationPublicJwk
+      },
+      verifyJwtCallback: options.callbacks.verifyJwt
+    });
+    return {
+      header,
+      payload,
+      signer
+    };
+  } catch (error) {
+    if (error instanceof Oauth2Error) throw error;
+    throw new Oauth2Error(
+      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+async function createClientAttestationPopJwt(options) {
+  try {
+    const clientAttestation = decodeJwt({
+      errorMessagePrefix: "Error decoding client attestation JWT:",
+      jwt: options.clientAttestation
+    });
+    const jwk = clientAttestation.payload.cnf?.jwk;
+    if (!jwk) {
+      throw new Oauth2Error(
+        "Client attestation does not contain 'cnf.jwk', cannot create client attestation pop jwt"
+      );
+    }
+    const sub = clientAttestation.payload.sub;
+    if (!sub || typeof sub !== "string") {
+      throw new Oauth2Error(
+        "Client attestation does not contain 'sub', cannot create client attestation pop jwt"
+      );
+    }
+    const signer = options.signer ?? {
+      alg: clientAttestation.header.alg,
+      method: "jwk",
+      publicJwk: jwk
+    };
+    const header = {
+      alg: signer.alg,
+      typ: "oauth-client-attestation-pop+jwt"
+    };
+    const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
+    const expiresAt = options.expiresAt ?? addSecondsToDate2(issuedAt, 1 * 60);
+    const jti = options.jti ?? (options.callbacks.generateRandom ? encodeToBase64Url3(await options.callbacks.generateRandom(32)) : void 0);
+    if (!jti) {
+      throw new Oauth2Error(
+        "Error: neither a default jti nor a generateRandom callback have been provided"
+      );
+    }
+    const payload = {
+      aud: options.authorizationServer,
+      exp: dateToSeconds3(expiresAt),
+      iat: dateToSeconds3(issuedAt),
+      iss: sub,
+      jti
+    };
+    const { jwt } = await options.callbacks.signJwt(signer, {
+      header,
+      payload
+    });
+    return jwt;
+  } catch (error) {
+    if (error instanceof Oauth2Error) throw error;
+    throw new Oauth2Error(
+      `Error creating client attestation pop jwt : ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+// src/client-attestation/verify-client-attestation.ts
+async function verifyClientAttestation(options) {
+  if (!options.clientAttestation.walletAttestationJwt || !options.clientAttestation.clientAttestationPopJwt) {
+    throw new Oauth2Error(
+      `Missing required client attestation parameters in the request. Make sure to provide the '${oauthClientAttestationHeader}' and '${oauthClientAttestationPopHeader}' header values.`
+    );
+  }
+  const clientAttestation = await verifyWalletAttestationJwt4({
+    callbacks: options.callbacks,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    config: options.config,
+    now: options.now,
+    walletAttestationJwt: options.clientAttestation.walletAttestationJwt
+  });
+  const clientAttestationPop = await verifyClientAttestationPopJwt({
+    authorizationServer: options.authorizationServerMetadata.issuer,
+    callbacks: options.callbacks,
+    clientAttestationPopJwt: options.clientAttestation.clientAttestationPopJwt,
+    clientAttestationPublicJwk: clientAttestation.payload.cnf.jwk,
+    now: options.now
+  });
+  if (options.requestClientId && options.requestClientId !== clientAttestation.payload.sub) {
+    throw new Oauth2Error(
+      `The client_id '${options.requestClientId}' in the request does not match the client id '${clientAttestation.payload.sub}' in the client attestation`
+    );
+  }
+  if (options.clientAttestation.ensureConfirmationKeyMatchesDpopKey && options.dpopJwkThumbprint) {
+    const clientAttestationJkt = await calculateJwkThumbprint2({
+      hashAlgorithm: HashAlgorithm3.Sha256,
+      hashCallback: options.callbacks.hash,
+      jwk: clientAttestation.payload.cnf.jwk
+    });
+    if (clientAttestationJkt !== options.dpopJwkThumbprint) {
+      throw new Oauth2Error(
+        "Expected the DPoP JWK thumbprint value to match the JWK thumbprint of the client attestation confirmation JWK. Ensure both DPoP and client attestation use the same key."
+      );
+    }
+  }
+  return {
+    clientAttestation,
+    clientAttestationPop
+  };
+}
+
 // src/pkce.ts
 import {
-  HashAlgorithm as HashAlgorithm5
+  HashAlgorithm as HashAlgorithm4
 } from "@openid4vc/oauth2";
-import { decodeUtf8String as decodeUtf8String3, encodeToBase64Url as encodeToBase64Url5 } from "@pagopa/io-wallet-utils";
+import { decodeUtf8String as decodeUtf8String2, encodeToBase64Url as encodeToBase64Url4 } from "@pagopa/io-wallet-utils";
 var PkceCodeChallengeMethod = {
   Plain: "plain",
   S256: "S256"
@@ -1186,7 +1020,7 @@ async function createPkce(options) {
   const codeChallengeMethod = allowedCodeChallengeMethods.includes(
     PkceCodeChallengeMethod.S256
   ) ? PkceCodeChallengeMethod.S256 : PkceCodeChallengeMethod.Plain;
-  const codeVerifier = options.codeVerifier ?? encodeToBase64Url5(await options.callbacks.generateRandom(64));
+  const codeVerifier = options.codeVerifier ?? encodeToBase64Url4(await options.callbacks.generateRandom(64));
   return {
     codeChallenge: await calculateCodeChallenge({
       codeChallengeMethod,
@@ -1205,7 +1039,7 @@ async function verifyPkce(options) {
   });
   if (options.codeChallenge !== calculatedCodeChallenge) {
     throw new Oauth2Error(
-      `Derived code challenge '${calculatedCodeChallenge}' from code_verifier '${options.codeVerifier}' using code challenge method '${options.codeChallengeMethod}' does not match the expected code challenge.`
+      `PKCE verification failed: code_verifier does not match the stored code_challenge`
     );
   }
 }
@@ -1214,20 +1048,130 @@ async function calculateCodeChallenge(options) {
     return options.codeVerifier;
   }
   if (options.codeChallengeMethod === PkceCodeChallengeMethod.S256) {
-    return encodeToBase64Url5(
+    return encodeToBase64Url4(
       await options.hashCallback(
-        decodeUtf8String3(options.codeVerifier),
+        decodeUtf8String2(options.codeVerifier),
+        HashAlgorithm4.Sha256
+      )
+    );
+  }
+  throw new Oauth2Error(
+    `Unsupported code challenge method ${options.codeChallengeMethod}`
+  );
+}
+
+// src/token-dpop/verify-token-dpop.ts
+import {
+  HashAlgorithm as HashAlgorithm5,
+  calculateJwkThumbprint as calculateJwkThumbprint3,
+  verifyJwt as verifyJwt3
+} from "@openid4vc/oauth2";
+import {
+  decodeUtf8String as decodeUtf8String3,
+  encodeToBase64Url as encodeToBase64Url5,
+  verifyJwtIatOrThrow
+} from "@pagopa/io-wallet-utils";
+async function verifyTokenDPoP(options) {
+  const { header, payload } = decodeJwt({
+    errorMessagePrefix: "Error decoding access token DPoP JWT:",
+    headerSchema: zDpopJwtHeader,
+    jwt: options.dpopJwt,
+    payloadSchema: zDpopJwtPayload
+  });
+  if (options.allowedSigningAlgs && !options.allowedSigningAlgs.includes(header.alg)) {
+    throw new Oauth2Error(
+      `dpop jwt uses alg value '${header.alg}' but allowed dpop signing alg values are ${options.allowedSigningAlgs.join(", ")}.`
+    );
+  }
+  if (options.expectedNonce !== void 0) {
+    if (options.expectedNonce === "") {
+      throw new Oauth2Error(`Invalid 'expectedNonce' provided`);
+    }
+    if (!payload.nonce) {
+      throw new Oauth2Error(
+        `Dpop jwt does not have a nonce value, but expected nonce value '${options.expectedNonce}'`
+      );
+    }
+    if (payload.nonce !== options.expectedNonce) {
+      throw new Oauth2Error(
+        `Dpop jwt contains nonce value '${payload.nonce}', but expected nonce value '${options.expectedNonce}'`
+      );
+    }
+  }
+  if (options.request.method !== payload.htm) {
+    throw new Oauth2Error(
+      `Dpop jwt contains htm value '${payload.htm}', but expected htm value '${options.request.method}'`
+    );
+  }
+  const expectedHtu = htuFromRequestUrl(options.request.url);
+  if (expectedHtu !== payload.htu) {
+    throw new Oauth2Error(
+      `Dpop jwt contains htu value '${payload.htu}', but expected htu value '${expectedHtu}'.`
+    );
+  }
+  if (options.accessToken) {
+    const expectedAth = encodeToBase64Url5(
+      await options.callbacks.hash(
+        decodeUtf8String3(options.accessToken),
         HashAlgorithm5.Sha256
       )
     );
+    if (!payload.ath) {
+      throw new Oauth2Error(
+        `Dpop jwt does not have a ath value, but expected ath value '${expectedAth}'.`
+      );
+    }
+    if (payload.ath !== expectedAth) {
+      throw new Oauth2Error(
+        `Dpop jwt contains ath value '${payload.ath}', but expected ath value '${expectedAth}'.`
+      );
+    }
+  }
+  const jwkThumbprint = await calculateJwkThumbprint3({
+    hashAlgorithm: HashAlgorithm5.Sha256,
+    hashCallback: options.callbacks.hash,
+    jwk: header.jwk
+  });
+  if (options.expectedJwkThumbprint && options.expectedJwkThumbprint !== jwkThumbprint) {
+    throw new Oauth2Error(
+      `Dpop is signed with jwk with thumbprint value '${jwkThumbprint}', but expect jwk thumbprint value '${options.expectedJwkThumbprint}'`
+    );
+  }
+  try {
+    verifyJwtIatOrThrow({
+      iat: payload.iat,
+      now: options.now
+    });
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new Oauth2Error(`Invalid iat claim in dpop JWT: ${error.message}`);
+    }
   }
-  throw new Oauth2Error(
-    `Unsupported code challenge method ${options.codeChallengeMethod}`
-  );
+  await verifyJwt3({
+    compact: options.dpopJwt,
+    errorMessage: "dpop jwt verification failed",
+    header,
+    now: options.now,
+    payload,
+    signer: {
+      alg: header.alg,
+      method: "jwk",
+      publicJwk: header.jwk
+    },
+    verifyJwtCallback: options.callbacks.verifyJwt
+  });
+  return {
+    header,
+    jwkThumbprint,
+    payload
+  };
 }
 
 // src/access-token/verify-access-token-request.ts
 async function verifyAccessTokenRequest(options) {
+  if (options.dpop.expectedNonce === "") {
+    throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
+  }
   await verifyPkce({
     callbacks: options.callbacks,
     codeChallenge: options.pkce.codeChallenge,
@@ -1238,6 +1182,7 @@ async function verifyAccessTokenRequest(options) {
     allowedSigningAlgs: options.dpop.allowedSigningAlgs,
     callbacks: options.callbacks,
     dpopJwt: options.dpop.jwt,
+    expectedNonce: options.dpop.expectedNonce,
     now: options.now,
     request: options.request
   });
@@ -1269,40 +1214,40 @@ async function verifyAccessTokenRequest(options) {
 
 // src/authorization-request/create-authorization-request.ts
 import {
-  addSecondsToDate as addSecondsToDate5,
-  dateToSeconds as dateToSeconds6,
+  addSecondsToDate as addSecondsToDate3,
+  dateToSeconds as dateToSeconds4,
   encodeToBase64Url as encodeToBase64Url6
 } from "@pagopa/io-wallet-utils";
 
 // src/authorization-request/z-authorization-request.ts
-import z10 from "zod";
-var zOpenidCredentialAuthorizationDetails = z10.object({
-  credential_configuration_id: z10.string(),
-  type: z10.literal("openid_credential")
+import z11 from "zod";
+var zOpenidCredentialAuthorizationDetails = z11.object({
+  credential_configuration_id: z11.string(),
+  type: z11.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = z10.object({
-  challenge_method: z10.literal("mrtd+ias"),
-  challenge_redirect_uri: z10.url(),
-  idphinting: z10.url(),
-  type: z10.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = z11.object({
+  challenge_method: z11.literal("mrtd+ias"),
+  challenge_redirect_uri: z11.url(),
+  idphinting: z11.url(),
+  type: z11.literal("it_l2+document_proof")
 });
-var zAuthorizationRequest = z10.looseObject({
-  authorization_details: z10.array(
-    z10.discriminatedUnion("type", [
+var zAuthorizationRequest = z11.looseObject({
+  authorization_details: z11.array(
+    z11.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: z10.string(),
-  code_challenge: z10.string(),
-  code_challenge_method: z10.string(),
-  issuer_state: z10.optional(z10.string()),
-  jti: z10.string(),
-  redirect_uri: z10.url(),
-  response_mode: z10.string(),
-  response_type: z10.string(),
-  scope: z10.string().optional(),
-  state: z10.string()
+  client_id: z11.string(),
+  code_challenge: z11.string(),
+  code_challenge_method: z11.string(),
+  issuer_state: z11.optional(z11.string()),
+  jti: z11.string().max(MAX_JTI_LENGTH),
+  redirect_uri: z11.url(),
+  response_mode: z11.string(),
+  response_type: z11.string(),
+  scope: z11.string().optional(),
+  state: z11.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1310,25 +1255,25 @@ var zAuthorizationRequest = z10.looseObject({
     path: ["authorization_details"]
   }
 );
-var zPushedAuthorizationRequestSigned = z10.looseObject({
-  client_id: z10.string().describe(
+var zPushedAuthorizationRequestSigned = z11.looseObject({
+  client_id: z11.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: z10.string().describe(
+  pkceCodeVerifier: z11.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: z10.string().describe(
+  request: z11.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsigned = z10.looseObject({
+var zPushedAuthorizationRequestUnsigned = z11.looseObject({
   authorizationRequest: zAuthorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: z10.string().describe(
+  client_id: z11.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: z10.string().describe("PKCE code verifier. Auto-generated if not provided in options.")
+  pkceCodeVerifier: z11.string().describe("PKCE code verifier. Auto-generated if not provided in options.")
 });
 function isPushedAuthorizationRequestSigned(par) {
   return "request" in par && typeof par.request === "string";
@@ -1336,9 +1281,9 @@ function isPushedAuthorizationRequestSigned(par) {
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = z10.looseObject({
-  expires_in: z10.number().int(),
-  request_uri: z10.string()
+var zPushedAuthorizationResponse = z11.looseObject({
+  expires_in: z11.number().int(),
+  request_uri: z11.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1375,7 +1320,7 @@ async function createPushedAuthorizationRequest(options) {
       );
     }
     const iat = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? addSecondsToDate5(iat, JWT_EXPIRY_SECONDS);
+    const exp = options.expiresAt ?? addSecondsToDate3(iat, JWT_EXPIRY_SECONDS);
     const requestJwt = await options.callbacks.signJwt(dpop.signer, {
       header: {
         alg: dpop.signer.alg,
@@ -1384,8 +1329,8 @@ async function createPushedAuthorizationRequest(options) {
       },
       payload: {
         aud: options.audience,
-        exp: dateToSeconds6(exp),
-        iat: dateToSeconds6(iat),
+        exp: dateToSeconds4(exp),
+        iat: dateToSeconds4(iat),
         iss: dpop.signer.publicJwk.kid,
         ...authorizationRequest
       }
@@ -1409,7 +1354,7 @@ import {
   CONTENT_TYPES as CONTENT_TYPES2,
   HEADERS as HEADERS2,
   UnexpectedStatusCodeError as UnexpectedStatusCodeError2,
-  ValidationError as ValidationError5,
+  ValidationError as ValidationError3,
   createFetcher as createFetcher2,
   hasStatusOrThrow as hasStatusOrThrow2
 } from "@pagopa/io-wallet-utils";
@@ -1440,14 +1385,14 @@ async function fetchPushedAuthorizationResponse(options) {
     const parResponseJson = await parResponse.json();
     const parsedParResponse = zPushedAuthorizationResponse.safeParse(parResponseJson);
     if (!parsedParResponse.success) {
-      throw new ValidationError5(
+      throw new ValidationError3(
         `Failed to parse pushed authorization response`,
         parsedParResponse.error
       );
     }
     return parsedParResponse.data;
   } catch (error) {
-    if (error instanceof UnexpectedStatusCodeError2 || error instanceof ValidationError5) {
+    if (error instanceof UnexpectedStatusCodeError2 || error instanceof ValidationError3) {
       throw error;
     }
     throw new PushedAuthorizationRequestError(
@@ -1495,56 +1440,9 @@ function parseAuthorizationRequest(options) {
 // src/authorization-request/parse-pushed-authorization-request.ts
 import {
   formatZodError as formatZodError2,
-  parseWithErrorHandling as parseWithErrorHandling7
+  parseWithErrorHandling as parseWithErrorHandling6
 } from "@pagopa/io-wallet-utils";
-import z12 from "zod";
-
-// src/jar/create-jar-request.ts
-import { addSecondsToDate as addSecondsToDate6, dateToSeconds as dateToSeconds7 } from "@pagopa/io-wallet-utils";
-async function createJarRequest(options) {
-  const {
-    authorizationRequestHeader,
-    authorizationRequestPayload,
-    callbacks,
-    jweEncryptor,
-    jwtSigner,
-    requestUri
-  } = options;
-  let authorizationRequestJwt;
-  let encryptionJwk;
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
-    header: authorizationRequestHeader,
-    payload: {
-      ...options.additionalJwtPayload,
-      ...authorizationRequestPayload,
-      exp: dateToSeconds7(addSecondsToDate6(now, options.expiresInSeconds)),
-      iat: dateToSeconds7(now)
-    }
-  });
-  authorizationRequestJwt = jwt;
-  if (jweEncryptor) {
-    if (!callbacks.encryptJwe) {
-      throw new Oauth2Error(
-        "callbacks.encryptJwe is required when jweEncryptor is provided"
-      );
-    }
-    const encryptionResult = await callbacks.encryptJwe(
-      jweEncryptor,
-      authorizationRequestJwt
-    );
-    authorizationRequestJwt = encryptionResult.jwe;
-    encryptionJwk = encryptionResult.encryptionJwk;
-  }
-  const client_id = authorizationRequestPayload.client_id;
-  const jarAuthorizationRequest = requestUri ? { client_id, request_uri: requestUri } : { client_id, request: authorizationRequestJwt };
-  return {
-    authorizationRequestJwt,
-    encryptionJwk,
-    jarAuthorizationRequest,
-    signerJwk
-  };
-}
+import z13 from "zod";
 
 // src/jar/fetch-jar-request-object.ts
 import {
@@ -1609,130 +1507,32 @@ async function parseJarRequest(options) {
   return { authorizationRequestJwt, sendBy };
 }
 
-// src/jar/verify-jar-request.ts
-import {
-  decodeJwt as decodeJwt2,
-  verifyJwt as verifyJwt4,
-  zCompactJwe,
-  zCompactJwt as zCompactJwt4
-} from "@openid4vc/oauth2";
-import { parseWithErrorHandling as parseWithErrorHandling6 } from "@pagopa/io-wallet-utils";
-
 // src/jar/z-jar.ts
-import z11 from "zod";
-var zJarAuthorizationRequest = z11.looseObject({
-  client_id: z11.optional(z11.string()),
-  request: z11.optional(z11.string()),
-  request_uri: z11.url().optional()
+import z12 from "zod";
+var zJarAuthorizationRequest = z12.looseObject({
+  client_id: z12.optional(z12.string()),
+  request: z12.optional(z12.string()),
+  request_uri: z12.url().optional()
 });
-var zJarRequestObjectPayload = z11.looseObject({
+var zJarRequestObjectPayload = z12.looseObject({
   ...zJwtPayload.shape,
-  client_id: z11.string()
+  client_id: z12.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = z11.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = z12.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = z11.looseObject({
+var zJarRequestObjectHeader = z12.looseObject({
   ...zJwtHeader.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = z11.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = z12.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
-// src/jar/verify-jar-request.ts
-async function verifyJarRequest(options) {
-  const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
-  const requestObjectIsEncrypted = zCompactJwe.safeParse(
-    authorizationRequestJwt
-  ).success;
-  if (requestObjectIsEncrypted) {
-    throw new Oauth2Error("Encrypted JWE request objects are not supported.");
-  }
-  const requestIsSigned = zCompactJwt4.safeParse(
-    authorizationRequestJwt
-  ).success;
-  if (!requestIsSigned) {
-    throw new Oauth2Error("JAR request object is not a valid JWT.");
-  }
-  const { authorizationRequestPayload, jwt, signer } = await verifyJarRequestObject({
-    authorizationRequestJwt,
-    callbacks,
-    jwtSigner
-  });
-  if (!authorizationRequestPayload.client_id) {
-    throw new Oauth2Error(
-      'Jar Request Object is missing the required "client_id" field.'
-    );
-  }
-  if (jarRequestParams.client_id !== authorizationRequestPayload.client_id) {
-    throw new Oauth2Error(
-      "client_id does not match the request object client_id."
-    );
-  }
-  if (jwt.payload.iss !== authorizationRequestPayload.client_id) {
-    throw new Oauth2Error("iss claim in request JWT does not match client_id");
-  }
-  if (jwt.payload.exp === void 0) {
-    throw new Oauth2Error("exp claim in request JWT is missing");
-  }
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const nowSeconds = Math.floor(now.getTime() / 1e3);
-  if (nowSeconds > jwt.payload.exp) {
-    throw new Oauth2Error("exp claim in request JWT is expired");
-  }
-  if (jwt.payload.iat === void 0) {
-    throw new Oauth2Error("iat claim in request JWT is missing");
-  }
-  const MAX_IAT_AGE_SECONDS = 5 * 60;
-  if (nowSeconds - jwt.payload.iat > MAX_IAT_AGE_SECONDS) {
-    throw new Oauth2Error(
-      "iat claim in request JWT is too old (must be within 5 minutes)"
-    );
-  }
-  const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
-  if (jwt.payload.iat - nowSeconds > CLOCK_SKEW_TOLERANCE_SECONDS) {
-    throw new Oauth2Error("iat claim in request JWT is too far in the future");
-  }
-  return {
-    authorizationRequestPayload,
-    jwt,
-    signer
-  };
-}
-async function verifyJarRequestObject(options) {
-  const { authorizationRequestJwt, callbacks, jwtSigner } = options;
-  const jwt = decodeJwt2({ jwt: authorizationRequestJwt });
-  const authorizationRequestPayload = parseWithErrorHandling6(
-    zJarRequestObjectPayload,
-    jwt.payload
-  );
-  const { signer } = await verifyJwt4({
-    compact: authorizationRequestJwt,
-    header: jwt.header,
-    payload: authorizationRequestPayload,
-    signer: jwtSigner,
-    verifyJwtCallback: callbacks.verifyJwt
-  });
-  if (jwt.header.typ !== signedAuthorizationRequestJwtHeaderTyp && jwt.header.typ !== jwtAuthorizationRequestJwtHeaderTyp) {
-    throw new Oauth2Error(
-      `Invalid Jar Request Object typ header. Expected "oauth-authz-req+jwt" or "jwt", received "${jwt.header.typ}".`
-    );
-  }
-  return {
-    authorizationRequestPayload,
-    jwt: {
-      ...jwt,
-      payload: authorizationRequestPayload
-    },
-    signer
-  };
-}
-
 // src/authorization-request/parse-pushed-authorization-request.ts
 async function parsePushedAuthorizationRequest(options) {
-  const parsed = parseWithErrorHandling7(
-    z12.union([zAuthorizationRequest, zJarAuthorizationRequest]),
+  const parsed = parseWithErrorHandling6(
+    z13.union([zAuthorizationRequest, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1743,7 +1543,10 @@ async function parsePushedAuthorizationRequest(options) {
       callbacks: options.callbacks,
       jarRequestParams: parsed
     });
-    const jwt = decodeJwt({ jwt: parsedJar.authorizationRequestJwt });
+    const jwt = decodeJwt({
+      errorMessagePrefix: "Error decoding pushed authorization request JWT:",
+      jwt: parsedJar.authorizationRequestJwt
+    });
     parsedAuthorizationRequest = zAuthorizationRequest.safeParse(jwt.payload);
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
@@ -1793,29 +1596,127 @@ async function verifyAuthorizationRequest(options) {
     requestClientId: options.authorizationRequest.client_id
   });
   return {
-    clientAttestation: clientAttestationResult,
-    dpop: dpopResult?.jwkThumbprint ? {
-      jwk: dpopResult.jwk,
-      jwkThumbprint: dpopResult.jwkThumbprint
-    } : void 0
+    clientAttestation: clientAttestationResult,
+    dpop: dpopResult?.jwkThumbprint ? {
+      jwk: dpopResult.jwk,
+      jwkThumbprint: dpopResult.jwkThumbprint
+    } : void 0
+  };
+}
+async function verifyAuthorizationRequestDpop(options, request, callbacks, now) {
+  if (options.required && !options.jwt) {
+    throw new Oauth2Error(
+      `Missing required DPoP parameters in authorization request. DPoP header is required.`
+    );
+  }
+  const verifyDpopResult = options.jwt ? await verifyTokenDPoP({
+    allowedSigningAlgs: options.allowedSigningAlgs,
+    callbacks,
+    dpopJwt: options.jwt,
+    now,
+    request
+  }) : void 0;
+  return {
+    jwk: verifyDpopResult?.header.jwk,
+    jwkThumbprint: verifyDpopResult?.jwkThumbprint
+  };
+}
+
+// src/jar/verify-jar-request.ts
+import {
+  verifyJwt as verifyJwt4,
+  zCompactJwe,
+  zCompactJwt as zCompactJwt4
+} from "@openid4vc/oauth2";
+import { parseWithErrorHandling as parseWithErrorHandling7 } from "@pagopa/io-wallet-utils";
+async function verifyJarRequest(options) {
+  const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
+  const requestObjectIsEncrypted = zCompactJwe.safeParse(
+    authorizationRequestJwt
+  ).success;
+  if (requestObjectIsEncrypted) {
+    throw new Oauth2Error("Encrypted JWE request objects are not supported.");
+  }
+  const requestIsSigned = zCompactJwt4.safeParse(
+    authorizationRequestJwt
+  ).success;
+  if (!requestIsSigned) {
+    throw new Oauth2Error("JAR request object is not a valid JWT.");
+  }
+  const { authorizationRequestPayload, jwt, signer } = await verifyJarRequestObject({
+    authorizationRequestJwt,
+    callbacks,
+    jwtSigner
+  });
+  if (!authorizationRequestPayload.client_id) {
+    throw new Oauth2Error(
+      'Jar Request Object is missing the required "client_id" field.'
+    );
+  }
+  if (jarRequestParams.client_id !== authorizationRequestPayload.client_id) {
+    throw new Oauth2Error(
+      "client_id does not match the request object client_id."
+    );
+  }
+  if (jwt.payload.iss !== authorizationRequestPayload.client_id) {
+    throw new Oauth2Error("iss claim in request JWT does not match client_id");
+  }
+  if (jwt.payload.exp === void 0) {
+    throw new Oauth2Error("exp claim in request JWT is missing");
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const nowSeconds = Math.floor(now.getTime() / 1e3);
+  if (nowSeconds > jwt.payload.exp) {
+    throw new Oauth2Error("exp claim in request JWT is expired");
+  }
+  if (jwt.payload.iat === void 0) {
+    throw new Oauth2Error("iat claim in request JWT is missing");
+  }
+  const MAX_IAT_AGE_SECONDS = 5 * 60;
+  if (nowSeconds - jwt.payload.iat > MAX_IAT_AGE_SECONDS) {
+    throw new Oauth2Error(
+      "iat claim in request JWT is too old (must be within 5 minutes)"
+    );
+  }
+  const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
+  if (jwt.payload.iat - nowSeconds > CLOCK_SKEW_TOLERANCE_SECONDS) {
+    throw new Oauth2Error("iat claim in request JWT is too far in the future");
+  }
+  return {
+    authorizationRequestPayload,
+    jwt,
+    signer
   };
 }
-async function verifyAuthorizationRequestDpop(options, request, callbacks, now) {
-  if (options.required && !options.jwt) {
+async function verifyJarRequestObject(options) {
+  const { authorizationRequestJwt, callbacks, jwtSigner } = options;
+  const jwt = decodeJwt({
+    errorMessagePrefix: "Error decoding JAR authorization request JWT:",
+    jwt: authorizationRequestJwt
+  });
+  const authorizationRequestPayload = parseWithErrorHandling7(
+    zJarRequestObjectPayload,
+    jwt.payload
+  );
+  const { signer } = await verifyJwt4({
+    compact: authorizationRequestJwt,
+    header: jwt.header,
+    payload: authorizationRequestPayload,
+    signer: jwtSigner,
+    verifyJwtCallback: callbacks.verifyJwt
+  });
+  if (jwt.header.typ !== signedAuthorizationRequestJwtHeaderTyp && jwt.header.typ !== jwtAuthorizationRequestJwtHeaderTyp) {
     throw new Oauth2Error(
-      `Missing required DPoP parameters in authorization request. DPoP header is required.`
+      `Invalid Jar Request Object typ header. Expected "oauth-authz-req+jwt" or "jwt", received "${jwt.header.typ}".`
     );
   }
-  const verifyDpopResult = options.jwt ? await verifyTokenDPoP({
-    allowedSigningAlgs: options.allowedSigningAlgs,
-    callbacks,
-    dpopJwt: options.jwt,
-    now,
-    request
-  }) : void 0;
   return {
-    jwk: verifyDpopResult?.header.jwk,
-    jwkThumbprint: verifyDpopResult?.jwkThumbprint
+    authorizationRequestPayload,
+    jwt: {
+      ...jwt,
+      payload: authorizationRequestPayload
+    },
+    signer
   };
 }
 
@@ -1830,7 +1731,10 @@ async function verifyPushedAuthorizationRequest(options) {
   let jar;
   if (options.authorizationRequestJwt) {
     if (requireSigned) {
-      const decoded = decodeJwt({ jwt: options.authorizationRequestJwt.jwt });
+      const decoded = decodeJwt({
+        errorMessagePrefix: "Error decoding pushed authorization request JWT:",
+        jwt: options.authorizationRequestJwt.jwt
+      });
       if (decoded.header.alg === "none") {
         throw new PushedAuthorizationRequestError(
           'Authorization Server requires signed request objects, but JAR has algorithm "none"'
@@ -1879,15 +1783,259 @@ async function verifyPushedAuthorizationRequest(options) {
   };
 }
 
+// src/client-attestation/client-authentication.ts
+var SupportedClientAuthenticationMethod = {
+  ClientSecretBasic: "client_secret_basic",
+  ClientSecretPost: "client_secret_post",
+  None: "none",
+  WalletAttestationJwt: "attest_jwt_client_auth"
+};
+function isClientAttestationSupported(options) {
+  if (!options.authorizationServerMetadata.token_endpoint_auth_methods_supported || !options.authorizationServerMetadata.token_endpoint_auth_methods_supported.includes(
+    SupportedClientAuthenticationMethod.WalletAttestationJwt
+  )) {
+    return {
+      supported: false
+    };
+  }
+  return {
+    supported: true
+  };
+}
+function clientAuthenticationAnonymous() {
+  return () => {
+  };
+}
+function clientAuthenticationWalletAttestationJwt(options) {
+  return async ({ authorizationServerMetadata, headers }) => {
+    const clientAttestationPop = await createClientAttestationPopJwt({
+      authorizationServer: authorizationServerMetadata.issuer,
+      callbacks: options.callbacks,
+      clientAttestation: options.walletAttestationJwt
+    });
+    headers.set(oauthClientAttestationHeader, options.walletAttestationJwt);
+    headers.set(oauthClientAttestationPopHeader, clientAttestationPop);
+  };
+}
+
+// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
+import {
+  ValidationError as ValidationError4,
+  addSecondsToDate as addSecondsToDate4,
+  dateToSeconds as dateToSeconds5
+} from "@pagopa/io-wallet-utils";
+var createWalletAttestationJwt = async (options) => {
+  try {
+    const { signJwt } = options.callbacks;
+    const iat = /* @__PURE__ */ new Date();
+    const exp = options.expiresAt ?? addSecondsToDate4(iat, 3600);
+    const payload = {
+      cnf: { jwk: options.dpopJwkPublic },
+      exp: dateToSeconds5(exp),
+      iat: dateToSeconds5(iat),
+      iss: options.issuer,
+      sub: options.dpopJwkPublic.kid,
+      ...options.walletLink && { wallet_link: options.walletLink },
+      ...options.walletName && { wallet_name: options.walletName },
+      aal: options.authenticatorAssuranceLevel
+    };
+    const header = {
+      alg: options.signer.alg,
+      kid: options.signer.kid,
+      trust_chain: options.signer.trustChain,
+      typ: "oauth-client-attestation+jwt"
+    };
+    const result = await signJwt(options.signer, {
+      header,
+      payload
+    });
+    decodeJwt({
+      errorMessagePrefix: "Error decoding wallet attestation JWT:",
+      headerSchema: zWalletAttestationJwtHeaderV1_0,
+      jwt: result.jwt,
+      payloadSchema: zWalletAttestationJwtPayloadV1_0
+    });
+    return result.jwt;
+  } catch (error) {
+    if (error instanceof ValidationError4) {
+      throw error;
+    }
+    throw new ClientAttestationError(
+      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
+// src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
+import {
+  ValidationError as ValidationError5,
+  addSecondsToDate as addSecondsToDate5,
+  dateToSeconds as dateToSeconds6
+} from "@pagopa/io-wallet-utils";
+var createWalletAttestationJwt2 = async (options) => {
+  try {
+    const { signJwt } = options.callbacks;
+    const iat = /* @__PURE__ */ new Date();
+    const exp = options.expiresAt ?? addSecondsToDate5(iat, 3600);
+    if (options.nbf && options.nbf >= exp) {
+      throw new ValidationError5("nbf must be before exp");
+    }
+    const payload = {
+      cnf: { jwk: options.dpopJwkPublic },
+      exp: dateToSeconds6(exp),
+      iat: dateToSeconds6(iat),
+      iss: options.issuer,
+      sub: options.dpopJwkPublic.kid,
+      ...options.nbf && { nbf: dateToSeconds6(options.nbf) },
+      ...options.status && { status: options.status },
+      ...options.walletLink && { wallet_link: options.walletLink },
+      ...options.walletName && { wallet_name: options.walletName }
+    };
+    const header = {
+      alg: options.signer.alg,
+      kid: options.signer.kid,
+      typ: "oauth-client-attestation+jwt",
+      x5c: options.signer.x5c,
+      // REQUIRED
+      ...options.signer.trustChain && {
+        trust_chain: options.signer.trustChain
+      }
+    };
+    const result = await signJwt(options.signer, {
+      header,
+      payload
+    });
+    decodeJwt({
+      errorMessagePrefix: "Error decoding wallet attestation JWT:",
+      headerSchema: zWalletAttestationJwtHeaderV1_3,
+      jwt: result.jwt,
+      payloadSchema: zWalletAttestationJwtPayloadV1_3
+    });
+    return result.jwt;
+  } catch (error) {
+    if (error instanceof ValidationError5) {
+      throw error;
+    }
+    throw new ClientAttestationError(
+      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
+// src/client-attestation/v1.4/create-wallet-attestation-jwt.ts
+import {
+  ValidationError as ValidationError6,
+  addSecondsToDate as addSecondsToDate6,
+  dateToSeconds as dateToSeconds7
+} from "@pagopa/io-wallet-utils";
+var createWalletAttestationJwt3 = async (options) => {
+  try {
+    const { signJwt } = options.callbacks;
+    const iat = /* @__PURE__ */ new Date();
+    const exp = options.expiresAt ?? addSecondsToDate6(iat, 3600);
+    if (options.nbf && options.nbf >= exp) {
+      throw new ValidationError6("nbf must be before exp");
+    }
+    const payload = {
+      cnf: { jwk: options.dpopJwkPublic },
+      exp: dateToSeconds7(exp),
+      iat: dateToSeconds7(iat),
+      iss: options.issuer,
+      status: options.status,
+      sub: options.dpopJwkPublic.kid,
+      wallet_link: options.walletLink,
+      wallet_name: options.walletName,
+      ...options.nbf && { nbf: dateToSeconds7(options.nbf) },
+      ...options.eudiWalletInfo && {
+        eudi_wallet_info: options.eudiWalletInfo
+      }
+    };
+    const header = {
+      alg: options.signer.alg,
+      kid: options.signer.kid,
+      typ: "oauth-client-attestation+jwt",
+      x5c: options.signer.x5c,
+      ...options.signer.trustChain && {
+        trust_chain: options.signer.trustChain
+      }
+    };
+    const result = await signJwt(options.signer, {
+      header,
+      payload
+    });
+    decodeJwt({
+      errorMessagePrefix: "Error decoding wallet attestation JWT:",
+      headerSchema: zWalletAttestationJwtHeaderV1_4,
+      jwt: result.jwt,
+      payloadSchema: zWalletAttestationJwtPayloadV1_4
+    });
+    return result.jwt;
+  } catch (error) {
+    if (error instanceof ValidationError6) {
+      throw error;
+    }
+    throw new ClientAttestationError(
+      `Unexpected error during wallet attestation creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
 // src/common/jwt/z-jwe.ts
-import { z as z13 } from "zod";
-var zCompactJwe2 = z13.string().regex(
+import { z as z14 } from "zod";
+var zCompactJwe2 = z14.string().regex(
   /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
   {
     message: "Not a valid compact jwe"
   }
 );
 
+// src/jar/create-jar-request.ts
+import { addSecondsToDate as addSecondsToDate7, dateToSeconds as dateToSeconds8 } from "@pagopa/io-wallet-utils";
+async function createJarRequest(options) {
+  const {
+    authorizationRequestHeader,
+    authorizationRequestPayload,
+    callbacks,
+    jweEncryptor,
+    jwtSigner,
+    requestUri
+  } = options;
+  let authorizationRequestJwt;
+  let encryptionJwk;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
+    header: authorizationRequestHeader,
+    payload: {
+      ...options.additionalJwtPayload,
+      ...authorizationRequestPayload,
+      exp: dateToSeconds8(addSecondsToDate7(now, options.expiresInSeconds)),
+      iat: dateToSeconds8(now)
+    }
+  });
+  authorizationRequestJwt = jwt;
+  if (jweEncryptor) {
+    if (!callbacks.encryptJwe) {
+      throw new Oauth2Error(
+        "callbacks.encryptJwe is required when jweEncryptor is provided"
+      );
+    }
+    const encryptionResult = await callbacks.encryptJwe(
+      jweEncryptor,
+      authorizationRequestJwt
+    );
+    authorizationRequestJwt = encryptionResult.jwe;
+    encryptionJwk = encryptionResult.encryptionJwk;
+  }
+  const client_id = authorizationRequestPayload.client_id;
+  const jarAuthorizationRequest = requestUri ? { client_id, request_uri: requestUri } : { client_id, request: authorizationRequestJwt };
+  return {
+    authorizationRequestJwt,
+    encryptionJwk,
+    jarAuthorizationRequest,
+    signerJwk
+  };
+}
+
 // src/jarm-form-post-jwt.ts
 var getJwtFromFormPost = async (options) => {
   const inputRegex = /<input[^<>]*>/gi;
@@ -1904,6 +2052,7 @@ var getJwtFromFormPost = async (options) => {
         if (responseJwt) {
           const jwt = responseJwt.replace(lineExpressionRegex, "");
           const decodedJwt = decodeJwt({
+            errorMessagePrefix: "Error decoding JARM form post JWT:",
             jwt,
             payloadSchema: options.schema
           });
@@ -1924,73 +2073,73 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-import { dateToSeconds as dateToSeconds8, parseWithErrorHandling as parseWithErrorHandling8 } from "@pagopa/io-wallet-utils";
+import { dateToSeconds as dateToSeconds9, parseWithErrorHandling as parseWithErrorHandling8 } from "@pagopa/io-wallet-utils";
 
 // src/mrtd-pop/z-mrtd-pop.ts
-import z14 from "zod";
-var zMrtdChallengeJwtHeader = z14.looseObject({
-  alg: z14.string(),
-  kid: z14.string(),
-  typ: z14.literal("mrtd-ias+jwt")
+import z15 from "zod";
+var zMrtdChallengeJwtHeader = z15.looseObject({
+  alg: z15.string(),
+  kid: z15.string(),
+  typ: z15.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = z14.looseObject({
-  aud: z14.string(),
-  exp: z14.number(),
-  htm: z14.literal("POST"),
-  htu: z14.url(),
-  iat: z14.number(),
-  iss: z14.string(),
-  mrtd_auth_session: z14.string(),
-  mrtd_pop_jwt_nonce: z14.string(),
-  state: z14.string(),
-  status: z14.literal("require_interaction"),
-  type: z14.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = z15.looseObject({
+  aud: z15.string(),
+  exp: z15.number(),
+  htm: z15.literal("POST"),
+  htu: z15.url(),
+  iat: z15.number(),
+  iss: z15.string(),
+  mrtd_auth_session: z15.string(),
+  mrtd_pop_jwt_nonce: z15.string(),
+  state: z15.string(),
+  status: z15.literal("require_interaction"),
+  type: z15.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = z14.looseObject({
-  alg: z14.string(),
-  kid: z14.string(),
-  typ: z14.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = z15.looseObject({
+  alg: z15.string(),
+  kid: z15.string(),
+  typ: z15.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = z14.looseObject({
-  aud: z14.string(),
-  challenge: z14.string(),
-  exp: z14.number(),
-  htm: z14.literal("POST"),
-  htu: z14.url(),
-  iat: z14.number(),
-  iss: z14.string(),
-  mrtd_pop_nonce: z14.string(),
-  mrz: z14.string().optional()
+var zMrtdPopInitResponseJwtPayload = z15.looseObject({
+  aud: z15.string(),
+  challenge: z15.string(),
+  exp: z15.number(),
+  htm: z15.literal("POST"),
+  htu: z15.url(),
+  iat: z15.number(),
+  iss: z15.string(),
+  mrtd_pop_nonce: z15.string(),
+  mrz: z15.string().optional()
 });
-var zMrtdData = z14.looseObject({
-  dg1: z14.string(),
-  dg11: z14.string(),
-  sod_mrtd: z14.string()
+var zMrtdData = z15.looseObject({
+  dg1: z15.string(),
+  dg11: z15.string(),
+  sod_mrtd: z15.string()
 });
-var zIasData = z14.looseObject({
-  challenge_signed: z14.string(),
-  ias_pk: z14.string(),
-  sod_ias: z14.string()
+var zIasData = z15.looseObject({
+  challenge_signed: z15.string(),
+  ias_pk: z15.string(),
+  sod_ias: z15.string()
 });
-var zMrtdValidationJwtHeader = z14.looseObject({
-  alg: z14.string(),
-  kid: z14.string(),
-  typ: z14.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = z15.looseObject({
+  alg: z15.string(),
+  kid: z15.string(),
+  typ: z15.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = z14.looseObject({
-  aud: z14.string(),
-  document_type: z14.literal("cie"),
-  exp: z14.number(),
+var zMrtdValidationJwtPayload = z15.looseObject({
+  aud: z15.string(),
+  document_type: z15.literal("cie"),
+  exp: z15.number(),
   ias: zIasData,
-  iat: z14.number(),
-  iss: z14.string(),
+  iat: z15.number(),
+  iss: z15.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = z14.looseObject({
-  mrtd_val_pop_nonce: z14.string(),
-  redirect_uri: z14.url(),
-  status: z14.literal("require_interaction"),
-  type: z14.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = z15.looseObject({
+  mrtd_val_pop_nonce: z15.string(),
+  redirect_uri: z15.url(),
+  status: z15.literal("require_interaction"),
+  type: z15.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2001,7 +2150,7 @@ async function createMrtdValidationJwt(options) {
     if (!kid) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
-    const iat = dateToSeconds8(options.issuedAt);
+    const iat = dateToSeconds9(options.issuedAt);
     const header = parseWithErrorHandling8(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
@@ -2048,7 +2197,7 @@ import {
   CONTENT_TYPES as CONTENT_TYPES3,
   HEADERS as HEADERS3,
   UnexpectedStatusCodeError as UnexpectedStatusCodeError4,
-  ValidationError as ValidationError6,
+  ValidationError as ValidationError7,
   createFetcher as createFetcher4,
   hasStatusOrThrow as hasStatusOrThrow4
 } from "@pagopa/io-wallet-utils";
@@ -2070,6 +2219,7 @@ async function fetchMrtdPopInit(options) {
     await hasStatusOrThrow4(202, UnexpectedStatusCodeError4)(response);
     const responseJwt = await response.text();
     const jwt = decodeJwt({
+      errorMessagePrefix: "Error decoding MRTD PoP init response JWT:",
       headerSchema: zMrtdPopInitResponseJwtHeader,
       jwt: responseJwt,
       payloadSchema: zMrtdPopInitResponseJwtPayload
@@ -2090,7 +2240,7 @@ async function fetchMrtdPopInit(options) {
       signer
     };
   } catch (error) {
-    if (error instanceof UnexpectedStatusCodeError4 || error instanceof ValidationError6) {
+    if (error instanceof UnexpectedStatusCodeError4 || error instanceof ValidationError7) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2104,7 +2254,7 @@ import {
   CONTENT_TYPES as CONTENT_TYPES4,
   HEADERS as HEADERS4,
   UnexpectedStatusCodeError as UnexpectedStatusCodeError5,
-  ValidationError as ValidationError7,
+  ValidationError as ValidationError8,
   createFetcher as createFetcher5,
   hasStatusOrThrow as hasStatusOrThrow5,
   parseWithErrorHandling as parseWithErrorHandling9
@@ -2136,7 +2286,7 @@ async function fetchMrtdPopVerify(options) {
       redirectUri: parsed.redirect_uri
     };
   } catch (error) {
-    if (error instanceof UnexpectedStatusCodeError5 || error instanceof ValidationError7) {
+    if (error instanceof UnexpectedStatusCodeError5 || error instanceof ValidationError8) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2161,6 +2311,7 @@ function parseMrtdChallenge(options) {
     );
   }
   const { header, payload } = decodeJwt({
+    errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
     payloadSchema: zMrtdChallengeJwtPayload
@@ -2176,6 +2327,7 @@ import {
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
   const jwt = decodeJwt({
+    errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
     payloadSchema: zMrtdChallengeJwtPayload
@@ -2209,14 +2361,13 @@ export {
   CreateTokenResponseError,
   FetchTokenResponseError,
   HashAlgorithm6 as HashAlgorithm,
+  MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
   Oauth2JwtParseError3 as Oauth2JwtParseError,
   PkceCodeChallengeMethod,
   PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod,
-  v1_exports as V1_0,
-  v1_exports2 as V1_3,
   authorizationCodeGrantIdentifier,
   clientAuthenticationAnonymous,
   clientAuthenticationWalletAttestationJwt,
@@ -2228,6 +2379,9 @@ export {
   createPushedAuthorizationRequest,
   createTokenDPoP,
   createTokenRequest,
+  createWalletAttestationJwt as createWalletAttestationJwtV1_0,
+  createWalletAttestationJwt2 as createWalletAttestationJwtV1_3,
+  createWalletAttestationJwt3 as createWalletAttestationJwtV1_4,
   decodeJwt,
   decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders,
@@ -2264,7 +2418,10 @@ export {
   verifyPkce,
   verifyPushedAuthorizationRequest,
   verifyTokenDPoP,
-  verifyWalletAttestationJwt3 as verifyWalletAttestationJwt,
+  verifyWalletAttestationJwt4 as verifyWalletAttestationJwt,
+  verifyWalletAttestationJwt as verifyWalletAttestationJwtV1_0,
+  verifyWalletAttestationJwt2 as verifyWalletAttestationJwtV1_3,
+  verifyWalletAttestationJwt3 as verifyWalletAttestationJwtV1_4,
   zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
@@ -2297,6 +2454,15 @@ export {
   zPushedAuthorizationResponse,
   zRefreshTokenGrantIdentifier,
   zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain
+  zTrustChain,
+  zWalletAttestationJwtHeaderV1_0,
+  zWalletAttestationJwtHeaderV1_3,
+  zWalletAttestationJwtHeaderV1_4,
+  zWalletAttestationJwtPayloadV1_0,
+  zWalletAttestationJwtPayloadV1_3,
+  zWalletAttestationJwtPayloadV1_4,
+  zWalletAttestationJwtV1_0,
+  zWalletAttestationJwtV1_3,
+  zWalletAttestationJwtV1_4
 };
 //# sourceMappingURL=index.mjs.map