@pagopa/io-wallet-oauth2 1.3.0 → 1.4.0

package/dist/index.js

@@ -34,11 +34,12 @@ __export(index_exports, {
   CreateTokenDPoPError: () => CreateTokenDPoPError,
   CreateTokenResponseError: () => CreateTokenResponseError,
   FetchTokenResponseError: () => FetchTokenResponseError,
-  HashAlgorithm: () => import_oauth215.HashAlgorithm,
+  HashAlgorithm: () => import_oauth216.HashAlgorithm,
+  IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: () => IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
   MAX_JTI_LENGTH: () => MAX_JTI_LENGTH,
   MrtdPopError: () => MrtdPopError,
   Oauth2Error: () => Oauth2Error,
-  Oauth2JwtParseError: () => import_oauth215.Oauth2JwtParseError,
+  Oauth2JwtParseError: () => import_oauth216.Oauth2JwtParseError,
   PkceCodeChallengeMethod: () => PkceCodeChallengeMethod,
   PushedAuthorizationRequestError: () => PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod: () => SupportedClientAuthenticationMethod,
@@ -87,7 +88,7 @@ __export(index_exports, {
   verifyClientAttestation: () => verifyClientAttestation,
   verifyClientAttestationPopJwt: () => verifyClientAttestationPopJwt,
   verifyJarRequest: () => verifyJarRequest,
-  verifyJwt: () => import_oauth215.verifyJwt,
+  verifyJwt: () => import_oauth216.verifyJwt,
   verifyMrtdChallenge: () => verifyMrtdChallenge,
   verifyPkce: () => verifyPkce,
   verifyPushedAuthorizationRequest: () => verifyPushedAuthorizationRequest,
@@ -102,12 +103,17 @@ __export(index_exports, {
   zAccessTokenResponse: () => zAccessTokenResponse,
   zAlgValueNotNone: () => zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier: () => zAuthorizationCodeGrantIdentifier,
-  zAuthorizationRequest: () => zAuthorizationRequest,
+  zAuthorizationRequestV1_0: () => zAuthorizationRequestV1_0,
+  zAuthorizationRequestV1_3: () => zAuthorizationRequestV1_3,
   zCertificateChain: () => zCertificateChain,
   zCompactJwe: () => zCompactJwe2,
   zCompactJwt: () => zCompactJwt,
   zDpopJwtHeader: () => zDpopJwtHeader,
   zDpopJwtPayload: () => zDpopJwtPayload,
+  zItWalletClientAttestationPopJwtAlg: () => zItWalletClientAttestationPopJwtAlg,
+  zItWalletClientAttestationPopJwtHeader: () => zItWalletClientAttestationPopJwtHeader,
+  zItWalletClientAttestationPopJwtPayload: () => zItWalletClientAttestationPopJwtPayload,
+  zItWalletClientAttestationPopJwtTyp: () => zItWalletClientAttestationPopJwtTyp,
   zJarAuthorizationRequest: () => zJarAuthorizationRequest,
   zJarRequestObjectHeader: () => zJarRequestObjectHeader,
   zJarRequestObjectPayload: () => zJarRequestObjectPayload,
@@ -124,7 +130,8 @@ __export(index_exports, {
   zMrtdValidationJwtHeader: () => zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload: () => zMrtdValidationJwtPayload,
   zPushedAuthorizationRequestSigned: () => zPushedAuthorizationRequestSigned,
-  zPushedAuthorizationRequestUnsigned: () => zPushedAuthorizationRequestUnsigned,
+  zPushedAuthorizationRequestUnsignedV1_0: () => zPushedAuthorizationRequestUnsignedV1_0,
+  zPushedAuthorizationRequestUnsignedV1_3: () => zPushedAuthorizationRequestUnsignedV1_3,
   zPushedAuthorizationResponse: () => zPushedAuthorizationResponse,
   zRefreshTokenGrantIdentifier: () => zRefreshTokenGrantIdentifier,
   zSignedAuthorizationRequestJwtHeaderTyp: () => zSignedAuthorizationRequestJwtHeaderTyp,
@@ -954,20 +961,55 @@ var import_oauth28 = require("@openid4vc/oauth2");
 // src/client-attestation/client-attestation-pop.ts
 var import_oauth27 = require("@openid4vc/oauth2");
 var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+
+// src/client-attestation/z-client-attestation-pop.ts
+var import_zod11 = __toESM(require("zod"));
+var IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES = [
+  "ES256",
+  "ES384",
+  "ES512"
+];
+var zItWalletClientAttestationPopJwtAlg = import_zod11.default.enum(
+  IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES
+);
+var zItWalletClientAttestationPopJwtPayload = import_zod11.default.looseObject({
+  ...zJwtPayload.shape,
+  aud: import_zod11.default.string(),
+  exp: import_zod11.default.number().int().optional(),
+  iat: import_zod11.default.number().int(),
+  iss: import_zod11.default.string(),
+  jti: import_zod11.default.string().max(MAX_JTI_LENGTH),
+  nonce: import_zod11.default.string().optional()
+});
+var zItWalletClientAttestationPopJwtTyp = import_zod11.default.literal(
+  "oauth-client-attestation-pop+jwt"
+);
+var zItWalletClientAttestationPopJwtHeader = import_zod11.default.looseObject({
+  ...zJwtHeader.shape,
+  typ: zItWalletClientAttestationPopJwtTyp
+});
+
+// src/client-attestation/client-attestation-pop.ts
+function assertSupportedClientAttestationPopAlg(alg) {
+  if (!zItWalletClientAttestationPopJwtAlg.safeParse(alg).success) {
+    throw new Oauth2Error(
+      `Unsupported alg '${alg}' in client attestation PoP JWT: must be one of ${IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES.join(", ")}`
+    );
+  }
+}
 async function verifyClientAttestationPopJwt(options) {
   try {
     const { header, payload } = decodeJwt({
       errorMessagePrefix: "Error decoding client attestation PoP JWT:",
-      jwt: options.clientAttestationPopJwt
+      headerSchema: zItWalletClientAttestationPopJwtHeader,
+      jwt: options.clientAttestationPopJwt,
+      payloadSchema: zItWalletClientAttestationPopJwtPayload
     });
-    if (payload.aud !== options.authorizationServer) {
-      throw new Oauth2Error(
-        `Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`
-      );
-    }
+    assertSupportedClientAttestationPopAlg(header.alg);
     const { signer } = await (0, import_oauth27.verifyJwt)({
       compact: options.clientAttestationPopJwt,
       errorMessage: "client attestation pop jwt verification failed",
+      expectedAudience: options.authorizationServer,
       expectedNonce: options.expectedNonce,
       header,
       now: options.now,
@@ -1014,25 +1056,32 @@ async function createClientAttestationPopJwt(options) {
       method: "jwk",
       publicJwk: jwk
     };
+    assertSupportedClientAttestationPopAlg(signer.alg);
     const header = {
       alg: signer.alg,
-      typ: "oauth-client-attestation-pop+jwt"
+      typ: zItWalletClientAttestationPopJwtTyp.value
     };
     const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils9.addSecondsToDate)(issuedAt, 1 * 60);
     const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils9.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
     if (!jti) {
       throw new Oauth2Error(
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const payload = {
-      aud: options.authorizationServer,
-      exp: (0, import_io_wallet_utils9.dateToSeconds)(expiresAt),
-      iat: (0, import_io_wallet_utils9.dateToSeconds)(issuedAt),
-      iss: sub,
-      jti
-    };
+    const payload = (0, import_io_wallet_utils9.parseWithErrorHandling)(
+      zItWalletClientAttestationPopJwtPayload,
+      {
+        aud: options.authorizationServer,
+        iat: (0, import_io_wallet_utils9.dateToSeconds)(issuedAt),
+        iss: sub,
+        jti,
+        ...options.config.itWalletSpecsVersion === import_io_wallet_utils9.ItWalletSpecsVersion.V1_0 ? {
+          exp: (0, import_io_wallet_utils9.dateToSeconds)(
+            "expiresAt" in options && options.expiresAt ? options.expiresAt : (0, import_io_wallet_utils9.addSecondsToDate)(issuedAt, 1 * 60)
+          )
+        } : {}
+      }
+    );
     const { jwt } = await options.callbacks.signJwt(signer, {
       header,
       payload
@@ -1298,34 +1347,43 @@ async function verifyAccessTokenRequest(options) {
 var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-request/z-authorization-request.ts
-var import_zod11 = __toESM(require("zod"));
-var zOpenidCredentialAuthorizationDetails = import_zod11.default.object({
-  credential_configuration_id: import_zod11.default.string(),
-  type: import_zod11.default.literal("openid_credential")
+var import_zod12 = __toESM(require("zod"));
+var zOpenidCredentialAuthorizationDetails = import_zod12.default.object({
+  credential_configuration_id: import_zod12.default.string(),
+  type: import_zod12.default.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = import_zod11.default.object({
-  challenge_method: import_zod11.default.literal("mrtd+ias"),
-  challenge_redirect_uri: import_zod11.default.url(),
-  idphinting: import_zod11.default.url(),
-  type: import_zod11.default.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = import_zod12.default.object({
+  challenge_method: import_zod12.default.literal("mrtd+ias"),
+  challenge_redirect_uri: import_zod12.default.url(),
+  idphinting: import_zod12.default.url(),
+  type: import_zod12.default.literal("it_l2+document_proof")
 });
-var zAuthorizationRequest = import_zod11.default.looseObject({
-  authorization_details: import_zod11.default.array(
-    import_zod11.default.discriminatedUnion("type", [
+var zAuthorizationRequestBaseObject = import_zod12.default.looseObject({
+  authorization_details: import_zod12.default.array(
+    import_zod12.default.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: import_zod11.default.string(),
-  code_challenge: import_zod11.default.string(),
-  code_challenge_method: import_zod11.default.string(),
-  issuer_state: import_zod11.default.optional(import_zod11.default.string()),
-  jti: import_zod11.default.string().max(MAX_JTI_LENGTH),
-  redirect_uri: import_zod11.default.url(),
-  response_mode: import_zod11.default.string(),
-  response_type: import_zod11.default.string(),
-  scope: import_zod11.default.string().optional(),
-  state: import_zod11.default.string()
+  client_id: import_zod12.default.string(),
+  code_challenge: import_zod12.default.string(),
+  code_challenge_method: import_zod12.default.string(),
+  issuer_state: import_zod12.default.optional(import_zod12.default.string()),
+  jti: import_zod12.default.string().max(MAX_JTI_LENGTH),
+  redirect_uri: import_zod12.default.url(),
+  response_type: import_zod12.default.string(),
+  scope: import_zod12.default.string().optional(),
+  state: import_zod12.default.string()
+});
+var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
+  (data) => data.authorization_details !== void 0 || data.scope !== void 0,
+  {
+    message: "Either 'authorization_details' or 'scope' must be provided.",
+    path: ["authorization_details"]
+  }
+);
+var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
+  response_mode: import_zod12.default.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1333,35 +1391,40 @@ var zAuthorizationRequest = import_zod11.default.looseObject({
     path: ["authorization_details"]
   }
 );
-var zPushedAuthorizationRequestSigned = import_zod11.default.looseObject({
-  client_id: import_zod11.default.string().describe(
+var zAuthorizationRequestV1_3 = zAuthorizationRequestBase;
+var zPushedAuthorizationRequestSigned = import_zod12.default.looseObject({
+  client_id: import_zod12.default.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod11.default.string().describe(
+  pkceCodeVerifier: import_zod12.default.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: import_zod11.default.string().describe(
+  request: import_zod12.default.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsigned = import_zod11.default.looseObject({
-  authorizationRequest: zAuthorizationRequest.describe(
+var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => import_zod12.default.looseObject({
+  authorizationRequest: authorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: import_zod11.default.string().describe(
+  client_id: import_zod12.default.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod11.default.string().describe("PKCE code verifier. Auto-generated if not provided in options.")
+  pkceCodeVerifier: import_zod12.default.string().describe(
+    "PKCE code verifier. Auto-generated if not provided in options."
+  )
 });
+var zPushedAuthorizationRequestUnsignedV1_0 = zPushedAuthorizationRequestUnsignedBase(zAuthorizationRequestV1_0);
+var zPushedAuthorizationRequestUnsignedV1_3 = zPushedAuthorizationRequestUnsignedBase(zAuthorizationRequestV1_3);
 function isPushedAuthorizationRequestSigned(par) {
   return "request" in par && typeof par.request === "string";
 }
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = import_zod11.default.looseObject({
-  expires_in: import_zod11.default.number().int(),
-  request_uri: import_zod11.default.string()
+var zPushedAuthorizationResponse = import_zod12.default.looseObject({
+  expires_in: import_zod12.default.number().int(),
+  request_uri: import_zod12.default.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1373,7 +1436,7 @@ async function createPushedAuthorizationRequest(options) {
     callbacks: options.callbacks,
     codeVerifier: options.pkceCodeVerifier
   });
-  const authorizationRequest = zAuthorizationRequest.parse({
+  const baseAuthorizationRequest = {
     authorization_details: options.authorization_details,
     client_id: options.clientId,
     code_challenge: pkce.codeChallenge,
@@ -1382,13 +1445,16 @@ async function createPushedAuthorizationRequest(options) {
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     ),
     redirect_uri: options.redirectUri,
-    response_mode: options.responseMode,
     response_type: "code",
     scope: options.scope,
     state: options.state ?? (0, import_io_wallet_utils12.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     )
-  });
+  };
+  const authorizationRequest = parseAuthorizationRequestByVersion(
+    options,
+    baseAuthorizationRequest
+  );
   const requireSigned = options.authorizationServerMetadata?.require_signed_request_object ?? false;
   if (requireSigned) {
     const { dpop } = options;
@@ -1418,13 +1484,31 @@ async function createPushedAuthorizationRequest(options) {
       pkceCodeVerifier: pkce.codeVerifier,
       request: requestJwt.jwt
     };
-  } else {
-    return {
-      authorizationRequest,
-      client_id: options.clientId,
-      pkceCodeVerifier: pkce.codeVerifier
-    };
   }
+  return {
+    authorizationRequest,
+    client_id: options.clientId,
+    pkceCodeVerifier: pkce.codeVerifier
+  };
+}
+function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
+  const version = options.config.itWalletSpecsVersion;
+  if ((0, import_io_wallet_utils12.hasConfigVersion)(options, import_io_wallet_utils12.ItWalletSpecsVersion.V1_0)) {
+    return zAuthorizationRequestV1_0.parse({
+      ...baseAuthorizationRequest,
+      response_mode: options.responseMode
+    });
+  }
+  if ((0, import_io_wallet_utils12.hasConfigVersion)(options, import_io_wallet_utils12.ItWalletSpecsVersion.V1_3)) {
+    return zAuthorizationRequestV1_3.parse(
+      baseAuthorizationRequest
+    );
+  }
+  throw new import_io_wallet_utils12.ItWalletSpecsVersionError(
+    "createPushedAuthorizationRequest",
+    version,
+    [import_io_wallet_utils12.ItWalletSpecsVersion.V1_0, import_io_wallet_utils12.ItWalletSpecsVersion.V1_3]
+  );
 }
 
 // src/authorization-request/fetch-authorization-response.ts
@@ -1510,7 +1594,7 @@ function parseAuthorizationRequest(options) {
 
 // src/authorization-request/parse-pushed-authorization-request.ts
 var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
-var import_zod13 = __toESM(require("zod"));
+var import_zod14 = __toESM(require("zod"));
 
 // src/jar/fetch-jar-request-object.ts
 var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
@@ -1571,31 +1655,34 @@ async function parseJarRequest(options) {
 }
 
 // src/jar/z-jar.ts
-var import_zod12 = __toESM(require("zod"));
-var zJarAuthorizationRequest = import_zod12.default.looseObject({
-  client_id: import_zod12.default.optional(import_zod12.default.string()),
-  request: import_zod12.default.optional(import_zod12.default.string()),
-  request_uri: import_zod12.default.url().optional()
+var import_zod13 = __toESM(require("zod"));
+var zJarAuthorizationRequest = import_zod13.default.looseObject({
+  client_id: import_zod13.default.optional(import_zod13.default.string()),
+  request: import_zod13.default.optional(import_zod13.default.string()),
+  request_uri: import_zod13.default.url().optional()
 });
-var zJarRequestObjectPayload = import_zod12.default.looseObject({
+var zJarRequestObjectPayload = import_zod13.default.looseObject({
   ...zJwtPayload.shape,
-  client_id: import_zod12.default.string()
+  client_id: import_zod13.default.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = import_zod12.default.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = import_zod13.default.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = import_zod12.default.looseObject({
+var zJarRequestObjectHeader = import_zod13.default.looseObject({
   ...zJwtHeader.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = import_zod12.default.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = import_zod13.default.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
 // src/authorization-request/parse-pushed-authorization-request.ts
 async function parsePushedAuthorizationRequest(options) {
+  const authorizationRequestSchema = getAuthorizationRequestSchema(
+    options.config
+  );
   const parsed = (0, import_io_wallet_utils15.parseWithErrorHandling)(
-    import_zod13.default.union([zAuthorizationRequest, zJarAuthorizationRequest]),
+    import_zod14.default.union([authorizationRequestSchema, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1610,7 +1697,9 @@ async function parsePushedAuthorizationRequest(options) {
       errorMessagePrefix: "Error decoding pushed authorization request JWT:",
       jwt: parsedJar.authorizationRequestJwt
     });
-    parsedAuthorizationRequest = zAuthorizationRequest.safeParse(jwt.payload);
+    parsedAuthorizationRequest = authorizationRequestSchema.safeParse(
+      jwt.payload
+    );
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Invalid authorization request. Could not parse jar request payload.
@@ -1619,7 +1708,7 @@ ${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)
     }
     authorizationRequestJwt = parsedJar.authorizationRequestJwt;
   } else {
-    parsedAuthorizationRequest = zAuthorizationRequest.safeParse(
+    parsedAuthorizationRequest = authorizationRequestSchema.safeParse(
       options.authorizationRequest
     );
     if (!parsedAuthorizationRequest.success) {
@@ -1640,6 +1729,19 @@ ${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)
     dpop
   };
 }
+function getAuthorizationRequestSchema(config) {
+  if (config.isVersion(import_io_wallet_utils15.ItWalletSpecsVersion.V1_0)) {
+    return zAuthorizationRequestV1_0;
+  }
+  if (config.isVersion(import_io_wallet_utils15.ItWalletSpecsVersion.V1_3)) {
+    return zAuthorizationRequestV1_3;
+  }
+  throw new import_io_wallet_utils15.ItWalletSpecsVersionError(
+    "parsePushedAuthorizationRequest",
+    config.itWalletSpecsVersion,
+    [import_io_wallet_utils15.ItWalletSpecsVersion.V1_0, import_io_wallet_utils15.ItWalletSpecsVersion.V1_3]
+  );
+}
 
 // src/authorization-request/verify-authorization-request.ts
 async function verifyAuthorizationRequest(options) {
@@ -1870,7 +1972,8 @@ function clientAuthenticationWalletAttestationJwt(options) {
     const clientAttestationPop = await createClientAttestationPopJwt({
       authorizationServer: authorizationServerMetadata.issuer,
       callbacks: options.callbacks,
-      clientAttestation: options.walletAttestationJwt
+      clientAttestation: options.walletAttestationJwt,
+      config: options.config
     });
     headers.set(oauthClientAttestationHeader, options.walletAttestationJwt);
     headers.set(oauthClientAttestationPopHeader, clientAttestationPop);
@@ -1879,17 +1982,38 @@ function clientAuthenticationWalletAttestationJwt(options) {
 
 // src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
 var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+
+// src/client-attestation/jwk-thumbprint.ts
+var import_oauth212 = require("@openid4vc/oauth2");
+var SUPPORTED_KTY = ["RSA", "EC"];
+var calculateDpopJwkThumbprint = (options) => {
+  if (!SUPPORTED_KTY.includes(
+    options.dpopJwkPublic.kty
+  )) {
+    throw new ClientAttestationError(
+      `Unsupported JWK key type "${options.dpopJwkPublic.kty}" for thumbprint computation. Supported types: ${SUPPORTED_KTY.join(", ")}.`
+    );
+  }
+  return (0, import_oauth212.calculateJwkThumbprint)({
+    hashAlgorithm: import_oauth212.HashAlgorithm.Sha256,
+    hashCallback: options.callbacks.hash,
+    jwk: options.dpopJwkPublic
+  });
+};
+
+// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
 var createWalletAttestationJwt = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
     const exp = options.expiresAt ?? (0, import_io_wallet_utils17.addSecondsToDate)(iat, 3600);
+    const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
       exp: (0, import_io_wallet_utils17.dateToSeconds)(exp),
       iat: (0, import_io_wallet_utils17.dateToSeconds)(iat),
       iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
+      sub: dpopJwkThumbprint,
       ...options.walletLink && { wallet_link: options.walletLink },
       ...options.walletName && { wallet_name: options.walletName },
       aal: options.authenticatorAssuranceLevel
@@ -1931,12 +2055,13 @@ var createWalletAttestationJwt2 = async (options) => {
     if (options.nbf && options.nbf >= exp) {
       throw new import_io_wallet_utils18.ValidationError("nbf must be before exp");
     }
+    const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
       exp: (0, import_io_wallet_utils18.dateToSeconds)(exp),
       iat: (0, import_io_wallet_utils18.dateToSeconds)(iat),
       iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
+      sub: dpopJwkThumbprint,
       ...options.nbf && { nbf: (0, import_io_wallet_utils18.dateToSeconds)(options.nbf) },
       ...options.status && { status: options.status },
       ...options.walletLink && { wallet_link: options.walletLink },
@@ -1983,13 +2108,14 @@ var createWalletAttestationJwt3 = async (options) => {
     if (options.nbf && options.nbf >= exp) {
       throw new import_io_wallet_utils19.ValidationError("nbf must be before exp");
     }
+    const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
       exp: (0, import_io_wallet_utils19.dateToSeconds)(exp),
       iat: (0, import_io_wallet_utils19.dateToSeconds)(iat),
       iss: options.issuer,
       status: options.status,
-      sub: options.dpopJwkPublic.kid,
+      sub: dpopJwkThumbprint,
       wallet_link: options.walletLink,
       wallet_name: options.walletName,
       ...options.nbf && { nbf: (0, import_io_wallet_utils19.dateToSeconds)(options.nbf) },
@@ -2028,8 +2154,8 @@ var createWalletAttestationJwt3 = async (options) => {
 };
 
 // src/common/jwt/z-jwe.ts
-var import_zod14 = require("zod");
-var zCompactJwe2 = import_zod14.z.string().regex(
+var import_zod15 = require("zod");
+var zCompactJwe2 = import_zod15.z.string().regex(
   /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
   {
     message: "Not a valid compact jwe"
@@ -2123,70 +2249,70 @@ var getJwtFromFormPost = async (options) => {
 var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
 
 // src/mrtd-pop/z-mrtd-pop.ts
-var import_zod15 = __toESM(require("zod"));
-var zMrtdChallengeJwtHeader = import_zod15.default.looseObject({
-  alg: import_zod15.default.string(),
-  kid: import_zod15.default.string(),
-  typ: import_zod15.default.literal("mrtd-ias+jwt")
+var import_zod16 = __toESM(require("zod"));
+var zMrtdChallengeJwtHeader = import_zod16.default.looseObject({
+  alg: import_zod16.default.string(),
+  kid: import_zod16.default.string(),
+  typ: import_zod16.default.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = import_zod15.default.looseObject({
-  aud: import_zod15.default.string(),
-  exp: import_zod15.default.number(),
-  htm: import_zod15.default.literal("POST"),
-  htu: import_zod15.default.url(),
-  iat: import_zod15.default.number(),
-  iss: import_zod15.default.string(),
-  mrtd_auth_session: import_zod15.default.string(),
-  mrtd_pop_jwt_nonce: import_zod15.default.string(),
-  state: import_zod15.default.string(),
-  status: import_zod15.default.literal("require_interaction"),
-  type: import_zod15.default.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = import_zod16.default.looseObject({
+  aud: import_zod16.default.string(),
+  exp: import_zod16.default.number(),
+  htm: import_zod16.default.literal("POST"),
+  htu: import_zod16.default.url(),
+  iat: import_zod16.default.number(),
+  iss: import_zod16.default.string(),
+  mrtd_auth_session: import_zod16.default.string(),
+  mrtd_pop_jwt_nonce: import_zod16.default.string(),
+  state: import_zod16.default.string(),
+  status: import_zod16.default.literal("require_interaction"),
+  type: import_zod16.default.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = import_zod15.default.looseObject({
-  alg: import_zod15.default.string(),
-  kid: import_zod15.default.string(),
-  typ: import_zod15.default.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = import_zod16.default.looseObject({
+  alg: import_zod16.default.string(),
+  kid: import_zod16.default.string(),
+  typ: import_zod16.default.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = import_zod15.default.looseObject({
-  aud: import_zod15.default.string(),
-  challenge: import_zod15.default.string(),
-  exp: import_zod15.default.number(),
-  htm: import_zod15.default.literal("POST"),
-  htu: import_zod15.default.url(),
-  iat: import_zod15.default.number(),
-  iss: import_zod15.default.string(),
-  mrtd_pop_nonce: import_zod15.default.string(),
-  mrz: import_zod15.default.string().optional()
+var zMrtdPopInitResponseJwtPayload = import_zod16.default.looseObject({
+  aud: import_zod16.default.string(),
+  challenge: import_zod16.default.string(),
+  exp: import_zod16.default.number(),
+  htm: import_zod16.default.literal("POST"),
+  htu: import_zod16.default.url(),
+  iat: import_zod16.default.number(),
+  iss: import_zod16.default.string(),
+  mrtd_pop_nonce: import_zod16.default.string(),
+  mrz: import_zod16.default.string().optional()
 });
-var zMrtdData = import_zod15.default.looseObject({
-  dg1: import_zod15.default.string(),
-  dg11: import_zod15.default.string(),
-  sod_mrtd: import_zod15.default.string()
+var zMrtdData = import_zod16.default.looseObject({
+  dg1: import_zod16.default.string(),
+  dg11: import_zod16.default.string(),
+  sod_mrtd: import_zod16.default.string()
 });
-var zIasData = import_zod15.default.looseObject({
-  challenge_signed: import_zod15.default.string(),
-  ias_pk: import_zod15.default.string(),
-  sod_ias: import_zod15.default.string()
+var zIasData = import_zod16.default.looseObject({
+  challenge_signed: import_zod16.default.string(),
+  ias_pk: import_zod16.default.string(),
+  sod_ias: import_zod16.default.string()
 });
-var zMrtdValidationJwtHeader = import_zod15.default.looseObject({
-  alg: import_zod15.default.string(),
-  kid: import_zod15.default.string(),
-  typ: import_zod15.default.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = import_zod16.default.looseObject({
+  alg: import_zod16.default.string(),
+  kid: import_zod16.default.string(),
+  typ: import_zod16.default.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = import_zod15.default.looseObject({
-  aud: import_zod15.default.string(),
-  document_type: import_zod15.default.literal("cie"),
-  exp: import_zod15.default.number(),
+var zMrtdValidationJwtPayload = import_zod16.default.looseObject({
+  aud: import_zod16.default.string(),
+  document_type: import_zod16.default.literal("cie"),
+  exp: import_zod16.default.number(),
   ias: zIasData,
-  iat: import_zod15.default.number(),
-  iss: import_zod15.default.string(),
+  iat: import_zod16.default.number(),
+  iss: import_zod16.default.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = import_zod15.default.looseObject({
-  mrtd_val_pop_nonce: import_zod15.default.string(),
-  redirect_uri: import_zod15.default.url(),
-  status: import_zod15.default.literal("require_interaction"),
-  type: import_zod15.default.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = import_zod16.default.looseObject({
+  mrtd_val_pop_nonce: import_zod16.default.string(),
+  redirect_uri: import_zod16.default.url(),
+  status: import_zod16.default.literal("require_interaction"),
+  type: import_zod16.default.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2236,7 +2362,7 @@ async function createMrtdValidationJwt(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-init.ts
-var import_oauth212 = require("@openid4vc/oauth2");
+var import_oauth213 = require("@openid4vc/oauth2");
 var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopInit(options) {
   try {
@@ -2261,12 +2387,12 @@ async function fetchMrtdPopInit(options) {
       jwt: responseJwt,
       payloadSchema: zMrtdPopInitResponseJwtPayload
     });
-    const { signer } = await (0, import_oauth212.verifyJwt)({
+    const { signer } = await (0, import_oauth213.verifyJwt)({
       compact: responseJwt,
       errorMessage: "Error verifying MRTD PoP init response JWT",
       header: jwt.header,
       payload: jwt.payload,
-      signer: options.signer ?? (0, import_oauth212.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
+      signer: options.signer ?? (0, import_oauth213.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
       verifyJwtCallback: options.callbacks.verifyJwt
     });
     return {
@@ -2325,7 +2451,7 @@ async function fetchMrtdPopVerify(options) {
 }
 
 // src/mrtd-pop/parse-mrtd-challenge.ts
-var import_oauth213 = require("@openid4vc/oauth2");
+var import_oauth214 = require("@openid4vc/oauth2");
 function parseMrtdChallenge(options) {
   const url = new URL(options.redirectUrl);
   const challengeJwt = url.searchParams.get("challenge_info");
@@ -2334,7 +2460,7 @@ function parseMrtdChallenge(options) {
       "Missing 'challenge_info' query parameter in redirect URL"
     );
   }
-  if (!import_oauth213.zCompactJwt.safeParse(challengeJwt).success) {
+  if (!import_oauth214.zCompactJwt.safeParse(challengeJwt).success) {
     throw new MrtdPopError(
       "Invalid JWT format in 'challenge_info' query parameter"
     );
@@ -2349,7 +2475,7 @@ function parseMrtdChallenge(options) {
 }
 
 // src/mrtd-pop/verify-mrtd-challenge.ts
-var import_oauth214 = require("@openid4vc/oauth2");
+var import_oauth215 = require("@openid4vc/oauth2");
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
   const jwt = decodeJwt({
@@ -2364,19 +2490,19 @@ async function verifyMrtdChallenge(options) {
     );
   }
   const payload = jwt.payload;
-  const { signer } = await (0, import_oauth214.verifyJwt)({
+  const { signer } = await (0, import_oauth215.verifyJwt)({
     compact: challengeJwt,
     errorMessage: "Error verifying MRTD challenge JWT",
     header: jwt.header,
     payload,
-    signer: options.signer ?? (0, import_oauth214.jwtSignerFromJwt)({ header: jwt.header, payload }),
+    signer: options.signer ?? (0, import_oauth215.jwtSignerFromJwt)({ header: jwt.header, payload }),
     verifyJwtCallback: callbacks.verifyJwt
   });
   return { header: jwt.header, payload: jwt.payload, signer };
 }
 
 // src/index.ts
-var import_oauth215 = require("@openid4vc/oauth2");
+var import_oauth216 = require("@openid4vc/oauth2");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ClientAttestationError,
@@ -2384,6 +2510,7 @@ var import_oauth215 = require("@openid4vc/oauth2");
   CreateTokenResponseError,
   FetchTokenResponseError,
   HashAlgorithm,
+  IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
   MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
@@ -2451,12 +2578,17 @@ var import_oauth215 = require("@openid4vc/oauth2");
   zAccessTokenResponse,
   zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
-  zAuthorizationRequest,
+  zAuthorizationRequestV1_0,
+  zAuthorizationRequestV1_3,
   zCertificateChain,
   zCompactJwe,
   zCompactJwt,
   zDpopJwtHeader,
   zDpopJwtPayload,
+  zItWalletClientAttestationPopJwtAlg,
+  zItWalletClientAttestationPopJwtHeader,
+  zItWalletClientAttestationPopJwtPayload,
+  zItWalletClientAttestationPopJwtTyp,
   zJarAuthorizationRequest,
   zJarRequestObjectHeader,
   zJarRequestObjectPayload,
@@ -2473,7 +2605,8 @@ var import_oauth215 = require("@openid4vc/oauth2");
   zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload,
   zPushedAuthorizationRequestSigned,
-  zPushedAuthorizationRequestUnsigned,
+  zPushedAuthorizationRequestUnsignedV1_0,
+  zPushedAuthorizationRequestUnsignedV1_3,
   zPushedAuthorizationResponse,
   zRefreshTokenGrantIdentifier,
   zSignedAuthorizationRequestJwtHeaderTyp,