@pagopa/io-wallet-oauth2 1.3.0 → 1.4.0

package/dist/index.mjs

@@ -854,28 +854,63 @@ import {
 } from "@openid4vc/oauth2";
 
 // src/client-attestation/client-attestation-pop.ts
+import { verifyJwt as verifyJwt2 } from "@openid4vc/oauth2";
 import {
-  verifyJwt as verifyJwt2
-} from "@openid4vc/oauth2";
-import {
+  ItWalletSpecsVersion as ItWalletSpecsVersion2,
   addSecondsToDate as addSecondsToDate2,
   dateToSeconds as dateToSeconds3,
-  encodeToBase64Url as encodeToBase64Url3
+  encodeToBase64Url as encodeToBase64Url3,
+  parseWithErrorHandling as parseWithErrorHandling6
 } from "@pagopa/io-wallet-utils";
+
+// src/client-attestation/z-client-attestation-pop.ts
+import z11 from "zod";
+var IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES = [
+  "ES256",
+  "ES384",
+  "ES512"
+];
+var zItWalletClientAttestationPopJwtAlg = z11.enum(
+  IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES
+);
+var zItWalletClientAttestationPopJwtPayload = z11.looseObject({
+  ...zJwtPayload.shape,
+  aud: z11.string(),
+  exp: z11.number().int().optional(),
+  iat: z11.number().int(),
+  iss: z11.string(),
+  jti: z11.string().max(MAX_JTI_LENGTH),
+  nonce: z11.string().optional()
+});
+var zItWalletClientAttestationPopJwtTyp = z11.literal(
+  "oauth-client-attestation-pop+jwt"
+);
+var zItWalletClientAttestationPopJwtHeader = z11.looseObject({
+  ...zJwtHeader.shape,
+  typ: zItWalletClientAttestationPopJwtTyp
+});
+
+// src/client-attestation/client-attestation-pop.ts
+function assertSupportedClientAttestationPopAlg(alg) {
+  if (!zItWalletClientAttestationPopJwtAlg.safeParse(alg).success) {
+    throw new Oauth2Error(
+      `Unsupported alg '${alg}' in client attestation PoP JWT: must be one of ${IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES.join(", ")}`
+    );
+  }
+}
 async function verifyClientAttestationPopJwt(options) {
   try {
     const { header, payload } = decodeJwt({
       errorMessagePrefix: "Error decoding client attestation PoP JWT:",
-      jwt: options.clientAttestationPopJwt
+      headerSchema: zItWalletClientAttestationPopJwtHeader,
+      jwt: options.clientAttestationPopJwt,
+      payloadSchema: zItWalletClientAttestationPopJwtPayload
     });
-    if (payload.aud !== options.authorizationServer) {
-      throw new Oauth2Error(
-        `Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`
-      );
-    }
+    assertSupportedClientAttestationPopAlg(header.alg);
     const { signer } = await verifyJwt2({
       compact: options.clientAttestationPopJwt,
       errorMessage: "client attestation pop jwt verification failed",
+      expectedAudience: options.authorizationServer,
       expectedNonce: options.expectedNonce,
       header,
       now: options.now,
@@ -922,25 +957,32 @@ async function createClientAttestationPopJwt(options) {
       method: "jwk",
       publicJwk: jwk
     };
+    assertSupportedClientAttestationPopAlg(signer.alg);
     const header = {
       alg: signer.alg,
-      typ: "oauth-client-attestation-pop+jwt"
+      typ: zItWalletClientAttestationPopJwtTyp.value
     };
     const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const expiresAt = options.expiresAt ?? addSecondsToDate2(issuedAt, 1 * 60);
     const jti = options.jti ?? (options.callbacks.generateRandom ? encodeToBase64Url3(await options.callbacks.generateRandom(32)) : void 0);
     if (!jti) {
       throw new Oauth2Error(
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const payload = {
-      aud: options.authorizationServer,
-      exp: dateToSeconds3(expiresAt),
-      iat: dateToSeconds3(issuedAt),
-      iss: sub,
-      jti
-    };
+    const payload = parseWithErrorHandling6(
+      zItWalletClientAttestationPopJwtPayload,
+      {
+        aud: options.authorizationServer,
+        iat: dateToSeconds3(issuedAt),
+        iss: sub,
+        jti,
+        ...options.config.itWalletSpecsVersion === ItWalletSpecsVersion2.V1_0 ? {
+          exp: dateToSeconds3(
+            "expiresAt" in options && options.expiresAt ? options.expiresAt : addSecondsToDate2(issuedAt, 1 * 60)
+          )
+        } : {}
+      }
+    );
     const { jwt } = await options.callbacks.signJwt(signer, {
       header,
       payload
@@ -1214,40 +1256,52 @@ async function verifyAccessTokenRequest(options) {
 
 // src/authorization-request/create-authorization-request.ts
 import {
+  ItWalletSpecsVersion as ItWalletSpecsVersion3,
+  ItWalletSpecsVersionError as ItWalletSpecsVersionError2,
   addSecondsToDate as addSecondsToDate3,
   dateToSeconds as dateToSeconds4,
-  encodeToBase64Url as encodeToBase64Url6
+  encodeToBase64Url as encodeToBase64Url6,
+  hasConfigVersion
 } from "@pagopa/io-wallet-utils";
 
 // src/authorization-request/z-authorization-request.ts
-import z11 from "zod";
-var zOpenidCredentialAuthorizationDetails = z11.object({
-  credential_configuration_id: z11.string(),
-  type: z11.literal("openid_credential")
+import z12 from "zod";
+var zOpenidCredentialAuthorizationDetails = z12.object({
+  credential_configuration_id: z12.string(),
+  type: z12.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = z11.object({
-  challenge_method: z11.literal("mrtd+ias"),
-  challenge_redirect_uri: z11.url(),
-  idphinting: z11.url(),
-  type: z11.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = z12.object({
+  challenge_method: z12.literal("mrtd+ias"),
+  challenge_redirect_uri: z12.url(),
+  idphinting: z12.url(),
+  type: z12.literal("it_l2+document_proof")
 });
-var zAuthorizationRequest = z11.looseObject({
-  authorization_details: z11.array(
-    z11.discriminatedUnion("type", [
+var zAuthorizationRequestBaseObject = z12.looseObject({
+  authorization_details: z12.array(
+    z12.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: z11.string(),
-  code_challenge: z11.string(),
-  code_challenge_method: z11.string(),
-  issuer_state: z11.optional(z11.string()),
-  jti: z11.string().max(MAX_JTI_LENGTH),
-  redirect_uri: z11.url(),
-  response_mode: z11.string(),
-  response_type: z11.string(),
-  scope: z11.string().optional(),
-  state: z11.string()
+  client_id: z12.string(),
+  code_challenge: z12.string(),
+  code_challenge_method: z12.string(),
+  issuer_state: z12.optional(z12.string()),
+  jti: z12.string().max(MAX_JTI_LENGTH),
+  redirect_uri: z12.url(),
+  response_type: z12.string(),
+  scope: z12.string().optional(),
+  state: z12.string()
+});
+var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
+  (data) => data.authorization_details !== void 0 || data.scope !== void 0,
+  {
+    message: "Either 'authorization_details' or 'scope' must be provided.",
+    path: ["authorization_details"]
+  }
+);
+var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
+  response_mode: z12.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1255,35 +1309,40 @@ var zAuthorizationRequest = z11.looseObject({
     path: ["authorization_details"]
   }
 );
-var zPushedAuthorizationRequestSigned = z11.looseObject({
-  client_id: z11.string().describe(
+var zAuthorizationRequestV1_3 = zAuthorizationRequestBase;
+var zPushedAuthorizationRequestSigned = z12.looseObject({
+  client_id: z12.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: z11.string().describe(
+  pkceCodeVerifier: z12.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: z11.string().describe(
+  request: z12.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsigned = z11.looseObject({
-  authorizationRequest: zAuthorizationRequest.describe(
+var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => z12.looseObject({
+  authorizationRequest: authorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: z11.string().describe(
+  client_id: z12.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: z11.string().describe("PKCE code verifier. Auto-generated if not provided in options.")
+  pkceCodeVerifier: z12.string().describe(
+    "PKCE code verifier. Auto-generated if not provided in options."
+  )
 });
+var zPushedAuthorizationRequestUnsignedV1_0 = zPushedAuthorizationRequestUnsignedBase(zAuthorizationRequestV1_0);
+var zPushedAuthorizationRequestUnsignedV1_3 = zPushedAuthorizationRequestUnsignedBase(zAuthorizationRequestV1_3);
 function isPushedAuthorizationRequestSigned(par) {
   return "request" in par && typeof par.request === "string";
 }
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = z11.looseObject({
-  expires_in: z11.number().int(),
-  request_uri: z11.string()
+var zPushedAuthorizationResponse = z12.looseObject({
+  expires_in: z12.number().int(),
+  request_uri: z12.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1295,7 +1354,7 @@ async function createPushedAuthorizationRequest(options) {
     callbacks: options.callbacks,
     codeVerifier: options.pkceCodeVerifier
   });
-  const authorizationRequest = zAuthorizationRequest.parse({
+  const baseAuthorizationRequest = {
     authorization_details: options.authorization_details,
     client_id: options.clientId,
     code_challenge: pkce.codeChallenge,
@@ -1304,13 +1363,16 @@ async function createPushedAuthorizationRequest(options) {
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     ),
     redirect_uri: options.redirectUri,
-    response_mode: options.responseMode,
     response_type: "code",
     scope: options.scope,
     state: options.state ?? encodeToBase64Url6(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     )
-  });
+  };
+  const authorizationRequest = parseAuthorizationRequestByVersion(
+    options,
+    baseAuthorizationRequest
+  );
   const requireSigned = options.authorizationServerMetadata?.require_signed_request_object ?? false;
   if (requireSigned) {
     const { dpop } = options;
@@ -1340,13 +1402,31 @@ async function createPushedAuthorizationRequest(options) {
       pkceCodeVerifier: pkce.codeVerifier,
       request: requestJwt.jwt
     };
-  } else {
-    return {
-      authorizationRequest,
-      client_id: options.clientId,
-      pkceCodeVerifier: pkce.codeVerifier
-    };
   }
+  return {
+    authorizationRequest,
+    client_id: options.clientId,
+    pkceCodeVerifier: pkce.codeVerifier
+  };
+}
+function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
+  const version = options.config.itWalletSpecsVersion;
+  if (hasConfigVersion(options, ItWalletSpecsVersion3.V1_0)) {
+    return zAuthorizationRequestV1_0.parse({
+      ...baseAuthorizationRequest,
+      response_mode: options.responseMode
+    });
+  }
+  if (hasConfigVersion(options, ItWalletSpecsVersion3.V1_3)) {
+    return zAuthorizationRequestV1_3.parse(
+      baseAuthorizationRequest
+    );
+  }
+  throw new ItWalletSpecsVersionError2(
+    "createPushedAuthorizationRequest",
+    version,
+    [ItWalletSpecsVersion3.V1_0, ItWalletSpecsVersion3.V1_3]
+  );
 }
 
 // src/authorization-request/fetch-authorization-response.ts
@@ -1439,10 +1519,12 @@ function parseAuthorizationRequest(options) {
 
 // src/authorization-request/parse-pushed-authorization-request.ts
 import {
+  ItWalletSpecsVersion as ItWalletSpecsVersion4,
+  ItWalletSpecsVersionError as ItWalletSpecsVersionError3,
   formatZodError as formatZodError2,
-  parseWithErrorHandling as parseWithErrorHandling6
+  parseWithErrorHandling as parseWithErrorHandling7
 } from "@pagopa/io-wallet-utils";
-import z13 from "zod";
+import z14 from "zod";
 
 // src/jar/fetch-jar-request-object.ts
 import {
@@ -1508,31 +1590,34 @@ async function parseJarRequest(options) {
 }
 
 // src/jar/z-jar.ts
-import z12 from "zod";
-var zJarAuthorizationRequest = z12.looseObject({
-  client_id: z12.optional(z12.string()),
-  request: z12.optional(z12.string()),
-  request_uri: z12.url().optional()
+import z13 from "zod";
+var zJarAuthorizationRequest = z13.looseObject({
+  client_id: z13.optional(z13.string()),
+  request: z13.optional(z13.string()),
+  request_uri: z13.url().optional()
 });
-var zJarRequestObjectPayload = z12.looseObject({
+var zJarRequestObjectPayload = z13.looseObject({
   ...zJwtPayload.shape,
-  client_id: z12.string()
+  client_id: z13.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = z12.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = z13.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = z12.looseObject({
+var zJarRequestObjectHeader = z13.looseObject({
   ...zJwtHeader.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = z12.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = z13.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
 // src/authorization-request/parse-pushed-authorization-request.ts
 async function parsePushedAuthorizationRequest(options) {
-  const parsed = parseWithErrorHandling6(
-    z13.union([zAuthorizationRequest, zJarAuthorizationRequest]),
+  const authorizationRequestSchema = getAuthorizationRequestSchema(
+    options.config
+  );
+  const parsed = parseWithErrorHandling7(
+    z14.union([authorizationRequestSchema, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1547,7 +1632,9 @@ async function parsePushedAuthorizationRequest(options) {
       errorMessagePrefix: "Error decoding pushed authorization request JWT:",
       jwt: parsedJar.authorizationRequestJwt
     });
-    parsedAuthorizationRequest = zAuthorizationRequest.safeParse(jwt.payload);
+    parsedAuthorizationRequest = authorizationRequestSchema.safeParse(
+      jwt.payload
+    );
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Invalid authorization request. Could not parse jar request payload.
@@ -1556,7 +1643,7 @@ ${formatZodError2(parsedAuthorizationRequest.error)}`
     }
     authorizationRequestJwt = parsedJar.authorizationRequestJwt;
   } else {
-    parsedAuthorizationRequest = zAuthorizationRequest.safeParse(
+    parsedAuthorizationRequest = authorizationRequestSchema.safeParse(
       options.authorizationRequest
     );
     if (!parsedAuthorizationRequest.success) {
@@ -1577,6 +1664,19 @@ ${formatZodError2(parsedAuthorizationRequest.error)}`
     dpop
   };
 }
+function getAuthorizationRequestSchema(config) {
+  if (config.isVersion(ItWalletSpecsVersion4.V1_0)) {
+    return zAuthorizationRequestV1_0;
+  }
+  if (config.isVersion(ItWalletSpecsVersion4.V1_3)) {
+    return zAuthorizationRequestV1_3;
+  }
+  throw new ItWalletSpecsVersionError3(
+    "parsePushedAuthorizationRequest",
+    config.itWalletSpecsVersion,
+    [ItWalletSpecsVersion4.V1_0, ItWalletSpecsVersion4.V1_3]
+  );
+}
 
 // src/authorization-request/verify-authorization-request.ts
 async function verifyAuthorizationRequest(options) {
@@ -1628,7 +1728,7 @@ import {
   zCompactJwe,
   zCompactJwt as zCompactJwt4
 } from "@openid4vc/oauth2";
-import { parseWithErrorHandling as parseWithErrorHandling7 } from "@pagopa/io-wallet-utils";
+import { parseWithErrorHandling as parseWithErrorHandling8 } from "@pagopa/io-wallet-utils";
 async function verifyJarRequest(options) {
   const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
   const requestObjectIsEncrypted = zCompactJwe.safeParse(
@@ -1694,7 +1794,7 @@ async function verifyJarRequestObject(options) {
     errorMessagePrefix: "Error decoding JAR authorization request JWT:",
     jwt: authorizationRequestJwt
   });
-  const authorizationRequestPayload = parseWithErrorHandling7(
+  const authorizationRequestPayload = parseWithErrorHandling8(
     zJarRequestObjectPayload,
     jwt.payload
   );
@@ -1811,7 +1911,8 @@ function clientAuthenticationWalletAttestationJwt(options) {
     const clientAttestationPop = await createClientAttestationPopJwt({
       authorizationServer: authorizationServerMetadata.issuer,
       callbacks: options.callbacks,
-      clientAttestation: options.walletAttestationJwt
+      clientAttestation: options.walletAttestationJwt,
+      config: options.config
     });
     headers.set(oauthClientAttestationHeader, options.walletAttestationJwt);
     headers.set(oauthClientAttestationPopHeader, clientAttestationPop);
@@ -1824,17 +1925,41 @@ import {
   addSecondsToDate as addSecondsToDate4,
   dateToSeconds as dateToSeconds5
 } from "@pagopa/io-wallet-utils";
+
+// src/client-attestation/jwk-thumbprint.ts
+import {
+  HashAlgorithm as HashAlgorithm6,
+  calculateJwkThumbprint as calculateJwkThumbprint4
+} from "@openid4vc/oauth2";
+var SUPPORTED_KTY = ["RSA", "EC"];
+var calculateDpopJwkThumbprint = (options) => {
+  if (!SUPPORTED_KTY.includes(
+    options.dpopJwkPublic.kty
+  )) {
+    throw new ClientAttestationError(
+      `Unsupported JWK key type "${options.dpopJwkPublic.kty}" for thumbprint computation. Supported types: ${SUPPORTED_KTY.join(", ")}.`
+    );
+  }
+  return calculateJwkThumbprint4({
+    hashAlgorithm: HashAlgorithm6.Sha256,
+    hashCallback: options.callbacks.hash,
+    jwk: options.dpopJwkPublic
+  });
+};
+
+// src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
 var createWalletAttestationJwt = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
     const exp = options.expiresAt ?? addSecondsToDate4(iat, 3600);
+    const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
       exp: dateToSeconds5(exp),
       iat: dateToSeconds5(iat),
       iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
+      sub: dpopJwkThumbprint,
       ...options.walletLink && { wallet_link: options.walletLink },
       ...options.walletName && { wallet_name: options.walletName },
       aal: options.authenticatorAssuranceLevel
@@ -1880,12 +2005,13 @@ var createWalletAttestationJwt2 = async (options) => {
     if (options.nbf && options.nbf >= exp) {
       throw new ValidationError5("nbf must be before exp");
     }
+    const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
       exp: dateToSeconds6(exp),
       iat: dateToSeconds6(iat),
       iss: options.issuer,
-      sub: options.dpopJwkPublic.kid,
+      sub: dpopJwkThumbprint,
       ...options.nbf && { nbf: dateToSeconds6(options.nbf) },
       ...options.status && { status: options.status },
       ...options.walletLink && { wallet_link: options.walletLink },
@@ -1936,13 +2062,14 @@ var createWalletAttestationJwt3 = async (options) => {
     if (options.nbf && options.nbf >= exp) {
       throw new ValidationError6("nbf must be before exp");
     }
+    const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
       exp: dateToSeconds7(exp),
       iat: dateToSeconds7(iat),
       iss: options.issuer,
       status: options.status,
-      sub: options.dpopJwkPublic.kid,
+      sub: dpopJwkThumbprint,
       wallet_link: options.walletLink,
       wallet_name: options.walletName,
       ...options.nbf && { nbf: dateToSeconds7(options.nbf) },
@@ -1981,8 +2108,8 @@ var createWalletAttestationJwt3 = async (options) => {
 };
 
 // src/common/jwt/z-jwe.ts
-import { z as z14 } from "zod";
-var zCompactJwe2 = z14.string().regex(
+import { z as z15 } from "zod";
+var zCompactJwe2 = z15.string().regex(
   /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
   {
     message: "Not a valid compact jwe"
@@ -2073,73 +2200,73 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-import { dateToSeconds as dateToSeconds9, parseWithErrorHandling as parseWithErrorHandling8 } from "@pagopa/io-wallet-utils";
+import { dateToSeconds as dateToSeconds9, parseWithErrorHandling as parseWithErrorHandling9 } from "@pagopa/io-wallet-utils";
 
 // src/mrtd-pop/z-mrtd-pop.ts
-import z15 from "zod";
-var zMrtdChallengeJwtHeader = z15.looseObject({
-  alg: z15.string(),
-  kid: z15.string(),
-  typ: z15.literal("mrtd-ias+jwt")
+import z16 from "zod";
+var zMrtdChallengeJwtHeader = z16.looseObject({
+  alg: z16.string(),
+  kid: z16.string(),
+  typ: z16.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = z15.looseObject({
-  aud: z15.string(),
-  exp: z15.number(),
-  htm: z15.literal("POST"),
-  htu: z15.url(),
-  iat: z15.number(),
-  iss: z15.string(),
-  mrtd_auth_session: z15.string(),
-  mrtd_pop_jwt_nonce: z15.string(),
-  state: z15.string(),
-  status: z15.literal("require_interaction"),
-  type: z15.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = z16.looseObject({
+  aud: z16.string(),
+  exp: z16.number(),
+  htm: z16.literal("POST"),
+  htu: z16.url(),
+  iat: z16.number(),
+  iss: z16.string(),
+  mrtd_auth_session: z16.string(),
+  mrtd_pop_jwt_nonce: z16.string(),
+  state: z16.string(),
+  status: z16.literal("require_interaction"),
+  type: z16.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = z15.looseObject({
-  alg: z15.string(),
-  kid: z15.string(),
-  typ: z15.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = z16.looseObject({
+  alg: z16.string(),
+  kid: z16.string(),
+  typ: z16.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = z15.looseObject({
-  aud: z15.string(),
-  challenge: z15.string(),
-  exp: z15.number(),
-  htm: z15.literal("POST"),
-  htu: z15.url(),
-  iat: z15.number(),
-  iss: z15.string(),
-  mrtd_pop_nonce: z15.string(),
-  mrz: z15.string().optional()
+var zMrtdPopInitResponseJwtPayload = z16.looseObject({
+  aud: z16.string(),
+  challenge: z16.string(),
+  exp: z16.number(),
+  htm: z16.literal("POST"),
+  htu: z16.url(),
+  iat: z16.number(),
+  iss: z16.string(),
+  mrtd_pop_nonce: z16.string(),
+  mrz: z16.string().optional()
 });
-var zMrtdData = z15.looseObject({
-  dg1: z15.string(),
-  dg11: z15.string(),
-  sod_mrtd: z15.string()
+var zMrtdData = z16.looseObject({
+  dg1: z16.string(),
+  dg11: z16.string(),
+  sod_mrtd: z16.string()
 });
-var zIasData = z15.looseObject({
-  challenge_signed: z15.string(),
-  ias_pk: z15.string(),
-  sod_ias: z15.string()
+var zIasData = z16.looseObject({
+  challenge_signed: z16.string(),
+  ias_pk: z16.string(),
+  sod_ias: z16.string()
 });
-var zMrtdValidationJwtHeader = z15.looseObject({
-  alg: z15.string(),
-  kid: z15.string(),
-  typ: z15.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = z16.looseObject({
+  alg: z16.string(),
+  kid: z16.string(),
+  typ: z16.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = z15.looseObject({
-  aud: z15.string(),
-  document_type: z15.literal("cie"),
-  exp: z15.number(),
+var zMrtdValidationJwtPayload = z16.looseObject({
+  aud: z16.string(),
+  document_type: z16.literal("cie"),
+  exp: z16.number(),
   ias: zIasData,
-  iat: z15.number(),
-  iss: z15.string(),
+  iat: z16.number(),
+  iss: z16.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = z15.looseObject({
-  mrtd_val_pop_nonce: z15.string(),
-  redirect_uri: z15.url(),
-  status: z15.literal("require_interaction"),
-  type: z15.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = z16.looseObject({
+  mrtd_val_pop_nonce: z16.string(),
+  redirect_uri: z16.url(),
+  status: z16.literal("require_interaction"),
+  type: z16.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2151,12 +2278,12 @@ async function createMrtdValidationJwt(options) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
     const iat = dateToSeconds9(options.issuedAt);
-    const header = parseWithErrorHandling8(zMrtdValidationJwtHeader, {
+    const header = parseWithErrorHandling9(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
       typ: "mrtd-ias+jwt"
     });
-    const payload = parseWithErrorHandling8(zMrtdValidationJwtPayload, {
+    const payload = parseWithErrorHandling9(zMrtdValidationJwtPayload, {
       aud: options.audience,
       document_type: "cie",
       exp: iat + JWT_EXPIRY_SECONDS2,
@@ -2257,7 +2384,7 @@ import {
   ValidationError as ValidationError8,
   createFetcher as createFetcher5,
   hasStatusOrThrow as hasStatusOrThrow5,
-  parseWithErrorHandling as parseWithErrorHandling9
+  parseWithErrorHandling as parseWithErrorHandling10
 } from "@pagopa/io-wallet-utils";
 async function fetchMrtdPopVerify(options) {
   try {
@@ -2276,7 +2403,7 @@ async function fetchMrtdPopVerify(options) {
       method: "POST"
     });
     await hasStatusOrThrow5(202, UnexpectedStatusCodeError5)(response);
-    const parsed = parseWithErrorHandling9(
+    const parsed = parseWithErrorHandling10(
       zMrtdPopVerifyResponse,
       await response.json(),
       "Failed to parse MRTD PoP verify response"
@@ -2351,7 +2478,7 @@ async function verifyMrtdChallenge(options) {
 
 // src/index.ts
 import {
-  HashAlgorithm as HashAlgorithm6,
+  HashAlgorithm as HashAlgorithm7,
   Oauth2JwtParseError as Oauth2JwtParseError3,
   verifyJwt as verifyJwt7
 } from "@openid4vc/oauth2";
@@ -2360,7 +2487,8 @@ export {
   CreateTokenDPoPError,
   CreateTokenResponseError,
   FetchTokenResponseError,
-  HashAlgorithm6 as HashAlgorithm,
+  HashAlgorithm7 as HashAlgorithm,
+  IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
   MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
@@ -2428,12 +2556,17 @@ export {
   zAccessTokenResponse,
   zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
-  zAuthorizationRequest,
+  zAuthorizationRequestV1_0,
+  zAuthorizationRequestV1_3,
   zCertificateChain,
   zCompactJwe2 as zCompactJwe,
   zCompactJwt,
   zDpopJwtHeader,
   zDpopJwtPayload,
+  zItWalletClientAttestationPopJwtAlg,
+  zItWalletClientAttestationPopJwtHeader,
+  zItWalletClientAttestationPopJwtPayload,
+  zItWalletClientAttestationPopJwtTyp,
   zJarAuthorizationRequest,
   zJarRequestObjectHeader,
   zJarRequestObjectPayload,
@@ -2450,7 +2583,8 @@ export {
   zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload,
   zPushedAuthorizationRequestSigned,
-  zPushedAuthorizationRequestUnsigned,
+  zPushedAuthorizationRequestUnsignedV1_0,
+  zPushedAuthorizationRequestUnsignedV1_3,
   zPushedAuthorizationResponse,
   zRefreshTokenGrantIdentifier,
   zSignedAuthorizationRequestJwtHeaderTyp,