@pagopa/io-wallet-oauth2 1.5.7 → 2.0.0-apt

package/dist/index.js

@@ -34,12 +34,9 @@ __export(index_exports, {
   CreateTokenDPoPError: () => CreateTokenDPoPError,
   CreateTokenResponseError: () => CreateTokenResponseError,
   FetchTokenResponseError: () => FetchTokenResponseError,
-  HashAlgorithm: () => import_oauth216.HashAlgorithm,
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: () => IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
-  MAX_JTI_LENGTH: () => MAX_JTI_LENGTH,
   MrtdPopError: () => MrtdPopError,
   Oauth2Error: () => Oauth2Error,
-  Oauth2JwtParseError: () => import_oauth216.Oauth2JwtParseError,
   PkceCodeChallengeMethod: () => PkceCodeChallengeMethod,
   PushedAuthorizationRequestError: () => PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod: () => SupportedClientAuthenticationMethod,
@@ -54,11 +51,11 @@ __export(index_exports, {
   createPushedAuthorizationRequest: () => createPushedAuthorizationRequest,
   createTokenDPoP: () => createTokenDPoP,
   createTokenRequest: () => createTokenRequest,
+  createTokenRequestAPTITUDE: () => createTokenRequestAPTITUDE,
+  createTokenRequestV1_4: () => createTokenRequestV1_4,
   createWalletAttestationJwtV1_0: () => createWalletAttestationJwt,
   createWalletAttestationJwtV1_3: () => createWalletAttestationJwt2,
   createWalletAttestationJwtV1_4: () => createWalletAttestationJwt3,
-  decodeJwt: () => decodeJwt,
-  decodeJwtHeader: () => decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders: () => extractClientAttestationJwtsFromHeaders,
   extractDpopJwtFromHeaders: () => extractDpopJwtFromHeaders,
   fetchJarRequestObject: () => fetchJarRequestObject,
@@ -73,12 +70,12 @@ __export(index_exports, {
   isPushedAuthorizationRequestSigned: () => isPushedAuthorizationRequestSigned,
   isPushedAuthorizationRequestUnsigned: () => isPushedAuthorizationRequestUnsigned,
   jwtAuthorizationRequestJwtHeaderTyp: () => jwtAuthorizationRequestJwtHeaderTyp,
-  jwtHeaderFromJwtSigner: () => jwtHeaderFromJwtSigner,
   parseAccessTokenRequest: () => parseAccessTokenRequest,
   parseAuthorizationRequest: () => parseAuthorizationRequest,
   parseJarRequest: () => parseJarRequest,
   parseMrtdChallenge: () => parseMrtdChallenge,
   parsePushedAuthorizationRequest: () => parsePushedAuthorizationRequest,
+  preAuthorizedCodeGrantIdentifier: () => preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier: () => refreshTokenGrantIdentifier,
   signedAuthorizationRequestJwtHeaderTyp: () => signedAuthorizationRequestJwtHeaderTyp,
   toURLSearchParams: () => toURLSearchParams,
@@ -88,7 +85,6 @@ __export(index_exports, {
   verifyClientAttestation: () => verifyClientAttestation,
   verifyClientAttestationPopJwt: () => verifyClientAttestationPopJwt,
   verifyJarRequest: () => verifyJarRequest,
-  verifyJwt: () => import_oauth216.verifyJwt,
   verifyMrtdChallenge: () => verifyMrtdChallenge,
   verifyPkce: () => verifyPkce,
   verifyPushedAuthorizationRequest: () => verifyPushedAuthorizationRequest,
@@ -100,14 +96,12 @@ __export(index_exports, {
   zAccessTokenProfileJwtHeader: () => zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload: () => zAccessTokenProfileJwtPayload,
   zAccessTokenRequest: () => zAccessTokenRequest,
+  zAccessTokenRequestAPTITUDE: () => zAccessTokenRequestAPTITUDE,
   zAccessTokenResponse: () => zAccessTokenResponse,
-  zAlgValueNotNone: () => zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier: () => zAuthorizationCodeGrantIdentifier,
+  zAuthorizationCodeTokenRequest: () => zAuthorizationCodeTokenRequest,
   zAuthorizationRequestV1_0: () => zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3: () => zAuthorizationRequestV1_3,
-  zCertificateChain: () => zCertificateChain,
-  zCompactJwe: () => zCompactJwe2,
-  zCompactJwt: () => zCompactJwt,
   zDpopJwtHeader: () => zDpopJwtHeader,
   zDpopJwtPayload: () => zDpopJwtPayload,
   zItWalletClientAttestationPopJwtAlg: () => zItWalletClientAttestationPopJwtAlg,
@@ -117,11 +111,6 @@ __export(index_exports, {
   zJarAuthorizationRequest: () => zJarAuthorizationRequest,
   zJarRequestObjectHeader: () => zJarRequestObjectHeader,
   zJarRequestObjectPayload: () => zJarRequestObjectPayload,
-  zJwk: () => zJwk,
-  zJwkSet: () => zJwkSet,
-  zJwtConfirmationPayload: () => zJwtConfirmationPayload,
-  zJwtHeader: () => zJwtHeader,
-  zJwtPayload: () => zJwtPayload,
   zMrtdChallengeJwtHeader: () => zMrtdChallengeJwtHeader,
   zMrtdChallengeJwtPayload: () => zMrtdChallengeJwtPayload,
   zMrtdPopInitResponseJwtHeader: () => zMrtdPopInitResponseJwtHeader,
@@ -129,6 +118,8 @@ __export(index_exports, {
   zMrtdPopVerifyResponse: () => zMrtdPopVerifyResponse,
   zMrtdValidationJwtHeader: () => zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload: () => zMrtdValidationJwtPayload,
+  zPreAuthorizedCodeGrantIdentifier: () => zPreAuthorizedCodeGrantIdentifier,
+  zPreAuthorizedCodeTokenRequest: () => zPreAuthorizedCodeTokenRequest,
   zPushedAuthorizationRequestSigned: () => zPushedAuthorizationRequestSigned,
   zPushedAuthorizationRequestUnsignedV1_0: () => zPushedAuthorizationRequestUnsignedV1_0,
   zPushedAuthorizationRequestUnsignedV1_3: () => zPushedAuthorizationRequestUnsignedV1_3,
@@ -136,8 +127,8 @@ __export(index_exports, {
   zRefreshTokenGrantIdentifier: () => zRefreshTokenGrantIdentifier,
   zRefreshTokenProfileJwtHeader: () => zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload: () => zRefreshTokenProfileJwtPayload,
+  zRefreshTokenTokenRequest: () => zRefreshTokenTokenRequest,
   zSignedAuthorizationRequestJwtHeaderTyp: () => zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain: () => zTrustChain,
   zWalletAttestationJwtHeaderV1_0: () => zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3: () => zWalletAttestationJwtHeaderV1_3,
   zWalletAttestationJwtHeaderV1_4: () => zWalletAttestationJwtHeaderV1_4,
@@ -151,178 +142,68 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/access-token/create-token-request.ts
-var createTokenRequest = async (options) => ({
-  ...options.additionalRequestPayload,
-  code: options.authorizationCode,
-  code_verifier: options.pkceCodeVerifier,
-  grant_type: "authorization_code",
-  redirect_uri: options.redirectUri
-});
-
-// src/access-token/create-token-response.ts
-var import_oauth22 = require("@openid4vc/oauth2");
-var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
-
-// src/common/jwt/decode-jwt-header.ts
-var import_oauth2 = require("@openid4vc/oauth2");
 var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
 
-// src/common/jwt/z-jwt.ts
-var import_zod3 = __toESM(require("zod"));
-
-// src/common/jwk/z-jwk.ts
-var import_zod2 = __toESM(require("zod"));
-
-// src/common/z-common.ts
-var import_zod = __toESM(require("zod"));
-var zTrustChain = import_zod.default.tuple([import_zod.default.string()], import_zod.default.string());
-var zCertificateChain = import_zod.default.array(import_zod.default.string()).nonempty();
-var zAlgValueNotNone = import_zod.default.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
-
-// src/common/jwk/z-jwk.ts
-var zJwk = import_zod2.default.looseObject({
-  alg: import_zod2.default.optional(import_zod2.default.string()),
-  crv: import_zod2.default.optional(import_zod2.default.string()),
-  d: import_zod2.default.optional(import_zod2.default.string()),
-  dp: import_zod2.default.optional(import_zod2.default.string()),
-  dq: import_zod2.default.optional(import_zod2.default.string()),
-  e: import_zod2.default.optional(import_zod2.default.string()),
-  ext: import_zod2.default.optional(import_zod2.default.boolean()),
-  k: import_zod2.default.optional(import_zod2.default.string()),
-  key_ops: import_zod2.default.optional(import_zod2.default.array(import_zod2.default.string())),
-  kid: import_zod2.default.optional(import_zod2.default.string()),
-  kty: import_zod2.default.string(),
-  n: import_zod2.default.optional(import_zod2.default.string()),
-  oth: import_zod2.default.optional(
-    import_zod2.default.array(
-      import_zod2.default.looseObject({
-        d: import_zod2.default.optional(import_zod2.default.string()),
-        r: import_zod2.default.optional(import_zod2.default.string()),
-        t: import_zod2.default.optional(import_zod2.default.string())
-      })
-    )
-  ),
-  p: import_zod2.default.optional(import_zod2.default.string()),
-  q: import_zod2.default.optional(import_zod2.default.string()),
-  qi: import_zod2.default.optional(import_zod2.default.string()),
-  use: import_zod2.default.optional(import_zod2.default.string()),
-  x: import_zod2.default.optional(import_zod2.default.string()),
-  x5c: import_zod2.default.optional(zCertificateChain),
-  x5t: import_zod2.default.optional(import_zod2.default.string()),
-  "x5t#S256": import_zod2.default.optional(import_zod2.default.string()),
-  x5u: import_zod2.default.optional(import_zod2.default.string()),
-  y: import_zod2.default.optional(import_zod2.default.string())
-});
-var zJwkSet = import_zod2.default.looseObject({ keys: import_zod2.default.array(zJwk) });
-
-// src/common/jwt/z-jwt.ts
-var MAX_JTI_LENGTH = 256;
-var zCompactJwt = import_zod3.default.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
-  message: "Not a valid compact jwt"
-});
-var zJwtConfirmationPayload = import_zod3.default.looseObject({
-  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
-  jkt: import_zod3.default.string().optional(),
-  jwk: zJwk.optional()
-});
-var zJwtPayload = import_zod3.default.looseObject({
-  aud: import_zod3.default.string().optional(),
-  cnf: zJwtConfirmationPayload.optional(),
-  exp: import_zod3.default.number().int().optional(),
-  iat: import_zod3.default.number().int().optional(),
-  iss: import_zod3.default.string().optional(),
-  jti: import_zod3.default.string().max(MAX_JTI_LENGTH).optional(),
-  nbf: import_zod3.default.number().int().optional(),
-  nonce: import_zod3.default.string().optional(),
-  // Reserved for status parameters
-  status: import_zod3.default.record(import_zod3.default.string(), import_zod3.default.any()).optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional()
-});
-var zJwtHeader = import_zod3.default.looseObject({
-  alg: zAlgValueNotNone,
-  jwk: zJwk.optional(),
-  kid: import_zod3.default.string().optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional(),
-  typ: import_zod3.default.string().optional(),
-  x5c: zCertificateChain.optional()
-});
+// src/access-token/z-grant-type.ts
+var import_zod = require("zod");
+var zAuthorizationCodeGrantIdentifier = import_zod.z.literal("authorization_code");
+var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
+var zPreAuthorizedCodeGrantIdentifier = import_zod.z.literal(
+  "urn:ietf:params:oauth:grant-type:pre-authorized_code"
+);
+var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
+var zRefreshTokenGrantIdentifier = import_zod.z.literal("refresh_token");
+var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
-// src/common/jwt/decode-jwt-header.ts
-function decodeJwtHeader(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length <= 2) {
-    throw new import_oauth2.Oauth2JwtParseError(
-      (0, import_io_wallet_utils.formatError)(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const [headerPart] = jwtParts;
-  let headerJson;
-  try {
-    headerJson = (0, import_io_wallet_utils.stringToJsonWithErrorHandling)(
-      (0, import_io_wallet_utils.encodeToUtf8String)((0, import_io_wallet_utils.decodeBase64)(headerPart)),
-      (0, import_io_wallet_utils.formatError)(
-        "Unable to parse jwt header to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new import_oauth2.Oauth2JwtParseError(
-      (0, import_io_wallet_utils.formatError)(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const header = (0, import_io_wallet_utils.parseWithErrorHandling)(
-    options.headerSchema ?? zJwtHeader,
-    headerJson,
-    (0, import_io_wallet_utils.formatError)("Invalid JWT header", options.errorMessagePrefix)
-  );
-  return {
-    header
-  };
-}
-function jwtHeaderFromJwtSigner(signer) {
-  if (signer.method === "did") {
-    return {
-      alg: signer.alg,
-      kid: signer.didUrl
-    };
-  }
-  if (signer.method === "federation") {
-    return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain
-    };
-  }
-  if (signer.method === "jwk") {
+// src/access-token/create-token-request.ts
+var createTokenRequestV1_4 = (options) => {
+  if (options.grantType === refreshTokenGrantIdentifier) {
     return {
-      alg: signer.alg,
-      jwk: signer.publicJwk
+      ...options.additionalRequestPayload,
+      grant_type: refreshTokenGrantIdentifier,
+      refresh_token: options.refreshToken,
+      scope: options.scope
     };
   }
-  if (signer.method === "x5c") {
+  return {
+    ...options.additionalRequestPayload,
+    code: options.authorizationCode,
+    code_verifier: options.pkceCodeVerifier,
+    grant_type: authorizationCodeGrantIdentifier,
+    redirect_uri: options.redirectUri
+  };
+};
+function createTokenRequestAPTITUDE(options) {
+  if (options.grantType === preAuthorizedCodeGrantIdentifier) {
     return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain,
-      x5c: signer.x5c
+      ...options.additionalRequestPayload,
+      grant_type: preAuthorizedCodeGrantIdentifier,
+      "pre-authorized_code": options.preAuthorizedCode,
+      tx_code: options.txCode
     };
   }
-  return { alg: signer.alg };
+  return createTokenRequestV1_4(options);
+}
+var dispatchCreateTokenRequest = (0, import_io_wallet_utils.createVersionDispatcher)({
+  [import_io_wallet_utils.ItWalletSpecsVersion.APTITUDE]: (o) => createTokenRequestAPTITUDE(o),
+  [import_io_wallet_utils.ItWalletSpecsVersion.V1_0]: (o) => createTokenRequestV1_4(o),
+  [import_io_wallet_utils.ItWalletSpecsVersion.V1_3]: (o) => createTokenRequestV1_4(o),
+  [import_io_wallet_utils.ItWalletSpecsVersion.V1_4]: (o) => createTokenRequestV1_4(o)
+});
+function createTokenRequest(options) {
+  return dispatchCreateTokenRequest(options);
 }
 
+// src/access-token/create-token-response.ts
+var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
+
 // src/errors.ts
 var Oauth2Error = class extends Error {
   statusCode;
   constructor(message, options) {
-    super(message, options);
+    const errorMessage = message ?? "Unknown error occurred.";
+    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${String(options.cause)}` : "";
+    super(`${errorMessage}${causeMessage}`, options);
     this.name = "Oauth2Error";
     this.statusCode = options?.statusCode;
   }
@@ -373,70 +254,83 @@ var ClientAttestationError = class extends Oauth2Error {
 };
 
 // src/access-token/z-token.ts
-var import_zod4 = require("zod");
-var zAccessTokenRequest = import_zod4.z.discriminatedUnion("grant_type", [
-  import_zod4.z.object({
-    code: import_zod4.z.string().nonempty(),
-    code_verifier: import_zod4.z.string().nonempty(),
-    grant_type: import_zod4.z.literal("authorization_code"),
-    redirect_uri: import_zod4.z.string().nonempty()
-  }),
-  import_zod4.z.object({
-    grant_type: import_zod4.z.literal("refresh_token"),
-    refresh_token: import_zod4.z.string().nonempty(),
-    scope: import_zod4.z.string().optional()
-  })
+var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
+var import_zod2 = require("zod");
+var zPreAuthorizedCodeTokenRequest = import_zod2.z.object({
+  grant_type: zPreAuthorizedCodeGrantIdentifier,
+  "pre-authorized_code": import_zod2.z.string().nonempty(),
+  tx_code: import_zod2.z.string().optional()
+});
+var zAuthorizationCodeTokenRequest = import_zod2.z.object({
+  code: import_zod2.z.string().nonempty(),
+  code_verifier: import_zod2.z.string().nonempty(),
+  grant_type: zAuthorizationCodeGrantIdentifier,
+  redirect_uri: import_zod2.z.string().nonempty()
+});
+var zRefreshTokenTokenRequest = import_zod2.z.object({
+  grant_type: zRefreshTokenGrantIdentifier,
+  refresh_token: import_zod2.z.string().nonempty(),
+  scope: import_zod2.z.string().optional()
+});
+var zAccessTokenRequest = import_zod2.z.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest
+]);
+var zAccessTokenRequestAPTITUDE = import_zod2.z.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest,
+  zPreAuthorizedCodeTokenRequest
 ]);
-var zAccessTokenResponse = import_zod4.z.looseObject({
-  access_token: import_zod4.z.string(),
-  authorization_details: import_zod4.z.array(
-    import_zod4.z.looseObject({
-      credential_configuration_id: import_zod4.z.optional(import_zod4.z.string()),
-      credential_identifiers: import_zod4.z.optional(import_zod4.z.array(import_zod4.z.string())),
-      type: import_zod4.z.literal("openid_credential")
+var zAccessTokenResponse = import_zod2.z.looseObject({
+  access_token: import_zod2.z.string(),
+  authorization_details: import_zod2.z.array(
+    import_zod2.z.looseObject({
+      credential_configuration_id: import_zod2.z.optional(import_zod2.z.string()),
+      credential_identifiers: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string())),
+      type: import_zod2.z.literal("openid_credential")
     })
   ).optional(),
-  expires_in: import_zod4.z.optional(import_zod4.z.number().int()),
-  refresh_token: import_zod4.z.optional(import_zod4.z.string()),
-  token_type: import_zod4.z.union([import_zod4.z.literal("Bearer"), import_zod4.z.literal("DPoP")])
+  expires_in: import_zod2.z.optional(import_zod2.z.number().int()),
+  refresh_token: import_zod2.z.optional(import_zod2.z.string()),
+  token_type: import_zod2.z.union([import_zod2.z.literal("Bearer"), import_zod2.z.literal("DPoP")])
 });
-var zAccessTokenProfileJwtHeader = import_zod4.z.looseObject({
-  ...zJwtHeader.shape,
-  typ: import_zod4.z.enum(["application/at+jwt", "at+jwt"])
+var zAccessTokenProfileJwtHeader = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtHeader.shape,
+  typ: import_zod2.z.enum(["application/at+jwt", "at+jwt"])
 });
-var zAccessTokenProfileJwtPayload = import_zod4.z.looseObject({
-  ...zJwtPayload.shape,
-  aud: import_zod4.z.string(),
-  client_id: import_zod4.z.string(),
-  cnf: import_zod4.z.object({
-    jkt: import_zod4.z.string()
+var zAccessTokenProfileJwtPayload = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtPayload.shape,
+  aud: import_zod2.z.string(),
+  client_id: import_zod2.z.string(),
+  cnf: import_zod2.z.object({
+    jkt: import_zod2.z.string()
   }).optional(),
-  exp: import_zod4.z.number(),
-  iat: import_zod4.z.number(),
-  iss: import_zod4.z.string(),
-  jti: import_zod4.z.string().max(MAX_JTI_LENGTH),
-  nbf: import_zod4.z.number().optional(),
-  scope: import_zod4.z.string().optional(),
-  sub: import_zod4.z.string()
+  exp: import_zod2.z.number(),
+  iat: import_zod2.z.number(),
+  iss: import_zod2.z.string(),
+  jti: import_zod2.z.string().max(import_io_wallet_utils2.MAX_JTI_LENGTH),
+  nbf: import_zod2.z.number().optional(),
+  scope: import_zod2.z.string().optional(),
+  sub: import_zod2.z.string()
 });
-var zRefreshTokenProfileJwtHeader = import_zod4.z.looseObject({
-  ...zJwtHeader.shape,
-  kid: import_zod4.z.string(),
-  typ: import_zod4.z.literal("rt+jwt")
+var zRefreshTokenProfileJwtHeader = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtHeader.shape,
+  kid: import_zod2.z.string(),
+  typ: import_zod2.z.literal("rt+jwt")
 });
-var zRefreshTokenProfileJwtPayload = import_zod4.z.looseObject({
-  ...zJwtPayload.shape,
-  aud: import_zod4.z.string(),
-  client_id: import_zod4.z.string(),
-  cnf: import_zod4.z.object({
-    jkt: import_zod4.z.string()
+var zRefreshTokenProfileJwtPayload = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtPayload.shape,
+  aud: import_zod2.z.string(),
+  client_id: import_zod2.z.string(),
+  cnf: import_zod2.z.object({
+    jkt: import_zod2.z.string()
   }),
-  exp: import_zod4.z.number().int(),
-  iat: import_zod4.z.number().int(),
-  iss: import_zod4.z.string(),
-  jti: import_zod4.z.string().max(MAX_JTI_LENGTH),
-  nbf: import_zod4.z.number().int(),
-  sub: import_zod4.z.string()
+  exp: import_zod2.z.number().int(),
+  iat: import_zod2.z.number().int(),
+  iss: import_zod2.z.string(),
+  jti: import_zod2.z.string().max(import_io_wallet_utils2.MAX_JTI_LENGTH),
+  nbf: import_zod2.z.number().int(),
+  sub: import_zod2.z.string()
 });
 
 // src/access-token/create-token-response.ts
@@ -465,7 +359,7 @@ function resolveRefreshTokenKid(signer) {
   }
   return void 0;
 }
-async function createAccessTokenResponse(options) {
+async function createAccessTokenResponseV1_4(options) {
   try {
     const now = options.now ?? /* @__PURE__ */ new Date();
     if (options.tokenType === "DPoP" && !options.dpop) {
@@ -483,26 +377,26 @@ async function createAccessTokenResponse(options) {
         `refreshTokenExpiresInSeconds (${options.refreshTokenExpiresInSeconds}) must be greater than expiresInSeconds (${options.expiresInSeconds}) so the Refresh Token remains usable after the Access Token expires.`
       );
     }
-    const dpopJkt = options.dpop ? await (0, import_oauth22.calculateJwkThumbprint)({
-      hashAlgorithm: import_oauth22.HashAlgorithm.Sha256,
+    const dpopJkt = options.dpop ? await (0, import_io_wallet_utils3.calculateJwkThumbprint)({
+      hashAlgorithm: import_io_wallet_utils3.HashAlgorithm.Sha256,
       hashCallback: options.callbacks.hash,
       jwk: options.dpop.jwk
     }) : void 0;
-    const accessTokenExpiresAt = (0, import_io_wallet_utils2.addSecondsToDate)(
+    const accessTokenExpiresAt = (0, import_io_wallet_utils3.addSecondsToDate)(
       now,
       options.expiresInSeconds
     );
-    const header = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
-      ...jwtHeaderFromJwtSigner(options.signer),
+    const header = (0, import_io_wallet_utils3.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
+      ...(0, import_io_wallet_utils3.jwtHeaderFromJwtSigner)(options.signer),
       typ: "at+jwt"
     });
-    const payload = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
+    const payload = (0, import_io_wallet_utils3.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
       ...options.additionalPayload,
       aud: options.audience,
       client_id: options.clientId,
       cnf: dpopJkt ? { jkt: dpopJkt } : void 0,
-      exp: (0, import_io_wallet_utils2.dateToSeconds)(accessTokenExpiresAt),
-      iat: (0, import_io_wallet_utils2.dateToSeconds)(now),
+      exp: (0, import_io_wallet_utils3.dateToSeconds)(accessTokenExpiresAt),
+      iat: (0, import_io_wallet_utils3.dateToSeconds)(now),
       iss: options.authorizationServer,
       jti: await generateUuidV4(options.callbacks.generateRandom),
       nbf: options.nbf,
@@ -521,7 +415,7 @@ async function createAccessTokenResponse(options) {
           "Unable to resolve a kid for the Refresh Token JOSE header. Provide signer.kid or a publicJwk.kid."
         );
       }
-      const refreshTokenHeader = (0, import_io_wallet_utils2.parseWithErrorHandling)(
+      const refreshTokenHeader = (0, import_io_wallet_utils3.parseWithErrorHandling)(
         zRefreshTokenProfileJwtHeader,
         {
           alg: options.signer.alg,
@@ -529,19 +423,19 @@ async function createAccessTokenResponse(options) {
           typ: "rt+jwt"
         }
       );
-      const refreshTokenPayload = (0, import_io_wallet_utils2.parseWithErrorHandling)(
+      const refreshTokenPayload = (0, import_io_wallet_utils3.parseWithErrorHandling)(
         zRefreshTokenProfileJwtPayload,
         {
           aud: options.authorizationServer,
           client_id: options.clientId,
           cnf: { jkt: dpopJkt },
-          exp: (0, import_io_wallet_utils2.dateToSeconds)(
-            (0, import_io_wallet_utils2.addSecondsToDate)(now, options.refreshTokenExpiresInSeconds)
+          exp: (0, import_io_wallet_utils3.dateToSeconds)(
+            (0, import_io_wallet_utils3.addSecondsToDate)(now, options.refreshTokenExpiresInSeconds)
           ),
-          iat: (0, import_io_wallet_utils2.dateToSeconds)(now),
+          iat: (0, import_io_wallet_utils3.dateToSeconds)(now),
           iss: options.authorizationServer,
           jti: await generateUuidV4(options.callbacks.generateRandom),
-          nbf: (0, import_io_wallet_utils2.dateToSeconds)(accessTokenExpiresAt),
+          nbf: (0, import_io_wallet_utils3.dateToSeconds)(accessTokenExpiresAt),
           sub: options.subject
         }
       );
@@ -554,7 +448,7 @@ async function createAccessTokenResponse(options) {
       );
       refreshToken = refreshTokenSignResult.jwt;
     }
-    const accessTokenResponse = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenResponse, {
+    const accessTokenResponse = (0, import_io_wallet_utils3.parseWithErrorHandling)(zAccessTokenResponse, {
       ...options.additionalPayload,
       access_token: jwt,
       expires_in: options.expiresInSeconds,
@@ -571,30 +465,39 @@ async function createAccessTokenResponse(options) {
     );
   }
 }
+var dispatchCreateAccessTokenResponse = (0, import_io_wallet_utils3.createVersionDispatcher)({
+  [import_io_wallet_utils3.ItWalletSpecsVersion.APTITUDE]: (o) => createAccessTokenResponseV1_4(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_0]: (o) => createAccessTokenResponseV1_4(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_3]: (o) => createAccessTokenResponseV1_4(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_4]: (o) => createAccessTokenResponseV1_4(o)
+});
+function createAccessTokenResponse(options) {
+  return dispatchCreateAccessTokenResponse(options);
+}
 
 // src/access-token/fetch-token-response.ts
-var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
-async function fetchTokenResponse(options) {
+var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+async function fetchTokenResponseV1_4(options) {
   try {
-    const fetch = (0, import_io_wallet_utils3.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils4.createFetcher)(options.callbacks.fetch);
     const tokenResponse = await fetch(options.accessTokenEndpoint, {
       body: toURLSearchParams(options.accessTokenRequest),
       headers: {
-        [import_io_wallet_utils3.HEADERS.CONTENT_TYPE]: import_io_wallet_utils3.CONTENT_TYPES.FORM_URLENCODED,
-        [import_io_wallet_utils3.HEADERS.DPOP]: options.dPoP,
-        [import_io_wallet_utils3.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils3.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils4.HEADERS.CONTENT_TYPE]: import_io_wallet_utils4.CONTENT_TYPES.FORM_URLENCODED,
+        [import_io_wallet_utils4.HEADERS.DPOP]: options.dPoP,
+        [import_io_wallet_utils4.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils4.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils3.hasStatusOrThrow)(200, import_io_wallet_utils3.UnexpectedStatusCodeError)(tokenResponse);
-    return (0, import_io_wallet_utils3.parseWithErrorHandling)(
+    await (0, import_io_wallet_utils4.hasStatusOrThrow)(200, import_io_wallet_utils4.UnexpectedStatusCodeError)(tokenResponse);
+    return (0, import_io_wallet_utils4.parseWithErrorHandling)(
       zAccessTokenResponse,
       await tokenResponse.json(),
       "Failed to parse token response"
     );
   } catch (error) {
-    if (error instanceof import_io_wallet_utils3.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils3.ValidationError) {
+    if (error instanceof import_io_wallet_utils4.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils4.ValidationError) {
       throw error;
     }
     throw new FetchTokenResponseError(
@@ -613,135 +516,83 @@ function toURLSearchParams(data) {
   });
   return params;
 }
+var dispatchFetchTokenResponse = (0, import_io_wallet_utils4.createVersionDispatcher)({
+  [import_io_wallet_utils4.ItWalletSpecsVersion.APTITUDE]: (o) => fetchTokenResponseV1_4(o),
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_0]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_3]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_4]: (o) => fetchTokenResponseV1_4(
+    o
+  )
+});
+function fetchTokenResponse(options) {
+  return dispatchFetchTokenResponse(options);
+}
 
 // src/access-token/parse-token-request.ts
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/wallet-attestation.ts
-var import_oauth25 = require("@openid4vc/oauth2");
-var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/types.ts
-var import_zod5 = __toESM(require("zod"));
-var zOauthClientAttestationHeader = import_zod5.default.literal(
+var import_zod3 = __toESM(require("zod"));
+var zOauthClientAttestationHeader = import_zod3.default.literal(
   "OAuth-Client-Attestation"
 );
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = import_zod5.default.literal(
+var zOauthClientAttestationPopHeader = import_zod3.default.literal(
   "OAuth-Client-Attestation-PoP"
 );
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
 
 // src/client-attestation/verify-wallet-attestation-jwt-base.ts
-var import_oauth24 = require("@openid4vc/oauth2");
-
-// src/common/jwt/decode-jwt.ts
-var import_oauth23 = require("@openid4vc/oauth2");
-var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
-function decodeJwt(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length !== 3) {
-    throw new import_oauth23.Oauth2JwtParseError(
-      (0, import_io_wallet_utils4.formatError)(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  let payloadJson;
-  try {
-    const payloadPart = jwtParts[1];
-    if (payloadPart === void 0) {
-      throw new import_oauth23.Oauth2JwtParseError(
-        (0, import_io_wallet_utils4.formatError)(
-          "Unable to decode because Jwt is not a valid!",
-          options.errorMessagePrefix
-        )
-      );
-    }
-    payloadJson = (0, import_io_wallet_utils4.stringToJsonWithErrorHandling)(
-      (0, import_io_wallet_utils4.encodeToUtf8String)((0, import_io_wallet_utils4.decodeBase64)(payloadPart)),
-      (0, import_io_wallet_utils4.formatError)(
-        "Unable to parse jwt payload to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new import_oauth23.Oauth2JwtParseError(
-      (0, import_io_wallet_utils4.formatError)(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const signaturePart = jwtParts[2];
-  if (signaturePart === void 0) {
-    throw new import_oauth23.Oauth2JwtParseError(
-      (0, import_io_wallet_utils4.formatError)(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const { header } = decodeJwtHeader({
-    errorMessagePrefix: options.errorMessagePrefix,
-    headerSchema: options.headerSchema,
-    jwt: options.jwt
-  });
-  const payload = (0, import_io_wallet_utils4.parseWithErrorHandling)(
-    options.payloadSchema ?? zJwtPayload,
-    payloadJson,
-    (0, import_io_wallet_utils4.formatError)("Invalid JWT payload", options.errorMessagePrefix)
-  );
-  return {
-    header,
-    payload,
-    signature: signaturePart
-  };
-}
-
-// src/client-attestation/verify-wallet-attestation-jwt-base.ts
+var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
 async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
-  const { header, payload } = decodeJwt({
+  const { header, payload } = (0, import_io_wallet_utils5.decodeJwt)({
     errorMessagePrefix: "Error decoding wallet attestation JWT:",
     headerSchema,
     jwt: options.walletAttestationJwt,
     payloadSchema
   });
-  const { signer } = await (0, import_oauth24.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils5.verifyJwt)({
     compact: options.walletAttestationJwt,
     errorMessage: "wallet attestation verification failed.",
     header,
     now: options.now,
     payload,
-    signer: (0, import_oauth24.jwtSignerFromJwt)({ header, payload }),
+    signer: (0, import_io_wallet_utils5.jwtSignerFromJwt)({ header, payload }),
     verifyJwtCallback: options.callbacks.verifyJwt
   });
   return { header, payload, signer };
 }
 
 // src/client-attestation/v1.0/z-wallet-attestation.ts
-var import_zod6 = require("zod");
-var zWalletAttestationJwtHeaderV1_0 = import_zod6.z.looseObject({
-  ...zJwtHeader.shape,
-  trust_chain: zTrustChain,
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
+var import_zod4 = require("zod");
+var zWalletAttestationJwtHeaderV1_0 = import_zod4.z.looseObject({
+  ...import_io_wallet_utils6.zJwtHeader.shape,
+  trust_chain: import_io_wallet_utils6.zTrustChain,
   // REQUIRED in v1.0
-  typ: import_zod6.z.literal("oauth-client-attestation+jwt")
+  typ: import_zod4.z.literal("oauth-client-attestation+jwt")
 });
-var zWalletAttestationJwtPayloadV1_0 = import_zod6.z.looseObject({
-  ...zJwtPayload.shape,
-  aal: import_zod6.z.string(),
-  cnf: import_zod6.z.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_0 = import_zod4.z.looseObject({
+  ...import_io_wallet_utils6.zJwtPayload.shape,
+  aal: import_zod4.z.string(),
+  cnf: import_zod4.z.object({
+    jwk: import_io_wallet_utils6.zJwk
   }),
-  exp: import_zod6.z.number(),
-  iat: import_zod6.z.number(),
-  iss: import_zod6.z.string(),
-  sub: import_zod6.z.string(),
-  wallet_link: import_zod6.z.url().optional(),
-  wallet_name: import_zod6.z.string().optional()
+  exp: import_zod4.z.number(),
+  iat: import_zod4.z.number(),
+  iss: import_zod4.z.string(),
+  sub: import_zod4.z.string(),
+  wallet_link: import_zod4.z.url().optional(),
+  wallet_name: import_zod4.z.string().optional()
 });
-var zWalletAttestationJwtV1_0 = import_zod6.z.string().min(1);
+var zWalletAttestationJwtV1_0 = import_zod4.z.string().min(1);
 
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
@@ -753,37 +604,38 @@ async function verifyWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.3/z-wallet-attestation.ts
-var import_zod7 = require("zod");
-var zWalletAttestationJwtHeaderV1_3 = import_zod7.z.looseObject({
-  ...zJwtHeader.shape,
-  trust_chain: zTrustChain.optional(),
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_zod5 = require("zod");
+var zWalletAttestationJwtHeaderV1_3 = import_zod5.z.looseObject({
+  ...import_io_wallet_utils7.zJwtHeader.shape,
+  trust_chain: import_io_wallet_utils7.zTrustChain.optional(),
   // OPTIONAL in v1.3
-  typ: import_zod7.z.literal("oauth-client-attestation+jwt"),
-  x5c: zCertificateChain
+  typ: import_zod5.z.literal("oauth-client-attestation+jwt"),
+  x5c: import_io_wallet_utils7.zCertificateChain
   // REQUIRED in v1.3
 });
-var zWalletAttestationJwtPayloadV1_3 = import_zod7.z.looseObject({
-  ...zJwtPayload.shape,
-  cnf: import_zod7.z.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_3 = import_zod5.z.looseObject({
+  ...import_io_wallet_utils7.zJwtPayload.shape,
+  cnf: import_zod5.z.object({
+    jwk: import_io_wallet_utils7.zJwk
   }),
-  exp: import_zod7.z.number(),
-  iat: import_zod7.z.number(),
-  iss: import_zod7.z.string(),
-  nbf: import_zod7.z.number().optional(),
+  exp: import_zod5.z.number(),
+  iat: import_zod5.z.number(),
+  iss: import_zod5.z.string(),
+  nbf: import_zod5.z.number().optional(),
   // NEW in v1.3
-  status: import_zod7.z.object({
-    status_list: import_zod7.z.object({
-      idx: import_zod7.z.number().int(),
-      uri: import_zod7.z.string()
+  status: import_zod5.z.object({
+    status_list: import_zod5.z.object({
+      idx: import_zod5.z.number().int(),
+      uri: import_zod5.z.string()
     })
   }).optional(),
   // NEW in v1.3 - status object for revocation
-  sub: import_zod7.z.string(),
-  wallet_link: import_zod7.z.url().optional(),
-  wallet_name: import_zod7.z.string().optional()
+  sub: import_zod5.z.string(),
+  wallet_link: import_zod5.z.url().optional(),
+  wallet_name: import_zod5.z.string().optional()
 });
-var zWalletAttestationJwtV1_3 = import_zod7.z.string().min(1);
+var zWalletAttestationJwtV1_3 = import_zod5.z.string().min(1);
 
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
@@ -795,28 +647,29 @@ async function verifyWalletAttestationJwt2(options) {
 }
 
 // src/client-attestation/v1.4/z-wallet-attestation.ts
-var import_zod8 = require("zod");
-var zWalletAttestationJwtHeaderV1_4 = import_zod8.z.looseObject({
-  ...zJwtHeader.shape,
-  kid: import_zod8.z.string(),
-  trust_chain: zTrustChain.optional(),
-  typ: import_zod8.z.literal("oauth-client-attestation+jwt"),
-  x5c: zCertificateChain
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_zod6 = require("zod");
+var zWalletAttestationJwtHeaderV1_4 = import_zod6.z.looseObject({
+  ...import_io_wallet_utils8.zJwtHeader.shape,
+  kid: import_zod6.z.string(),
+  trust_chain: import_io_wallet_utils8.zTrustChain.optional(),
+  typ: import_zod6.z.literal("oauth-client-attestation+jwt"),
+  x5c: import_io_wallet_utils8.zCertificateChain
 });
-var zWalletAttestationJwtPayloadV1_4 = import_zod8.z.looseObject({
-  ...zJwtPayload.shape,
-  cnf: import_zod8.z.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_4 = import_zod6.z.looseObject({
+  ...import_io_wallet_utils8.zJwtPayload.shape,
+  cnf: import_zod6.z.object({
+    jwk: import_io_wallet_utils8.zJwk
   }),
-  exp: import_zod8.z.number().int(),
-  iat: import_zod8.z.number().int(),
-  iss: import_zod8.z.string(),
-  nbf: import_zod8.z.number().optional(),
-  sub: import_zod8.z.string(),
-  wallet_link: import_zod8.z.url(),
-  wallet_name: import_zod8.z.string()
+  exp: import_zod6.z.number().int(),
+  iat: import_zod6.z.number().int(),
+  iss: import_zod6.z.string(),
+  nbf: import_zod6.z.number().optional(),
+  sub: import_zod6.z.string(),
+  wallet_link: import_zod6.z.url(),
+  wallet_name: import_zod6.z.string()
 });
-var zWalletAttestationJwtV1_4 = import_zod8.z.string().min(1);
+var zWalletAttestationJwtV1_4 = import_zod6.z.string().min(1);
 
 // src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt3(options) {
@@ -828,10 +681,11 @@ async function verifyWalletAttestationJwt3(options) {
 }
 
 // src/client-attestation/wallet-attestation.ts
-var dispatchVerifyWalletAttestationJwt = (0, import_io_wallet_utils5.createVersionDispatcher)({
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
+var dispatchVerifyWalletAttestationJwt = (0, import_io_wallet_utils9.createVersionDispatcher)({
+  [import_io_wallet_utils9.ItWalletSpecsVersion.APTITUDE]: (o) => verifyWalletAttestationJwt3(o),
+  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
+  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
+  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
 });
 async function verifyWalletAttestationJwt4(options) {
   return dispatchVerifyWalletAttestationJwt(options);
@@ -847,7 +701,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   if (!walletAttestationHeader || !clientAttestationPopHeader) {
     return { valid: false };
   }
-  if (!import_oauth25.zCompactJwt.safeParse(walletAttestationHeader).success || !import_oauth25.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
+  if (!import_io_wallet_utils9.zCompactJwt.safeParse(walletAttestationHeader).success || !import_io_wallet_utils9.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
     return { valid: false };
   }
   return {
@@ -858,8 +712,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 }
 
 // src/token-dpop/create-token-dpop.ts
-var import_oauth26 = require("@openid4vc/oauth2");
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
 var import_js_base64 = require("js-base64");
 
 // src/token-dpop/dpop-utils.ts
@@ -871,29 +724,29 @@ var htuFromRequestUrl = (requestUrl) => {
 };
 
 // src/token-dpop/z-dpop.ts
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
-var import_zod9 = __toESM(require("zod"));
-var zDpopJwtPayload = import_zod9.default.looseObject({
-  ...zJwtPayload.shape,
-  ath: import_zod9.default.optional(import_zod9.default.string()),
-  htm: import_io_wallet_utils6.zHttpMethod,
-  htu: import_zod9.default.url(),
-  iat: import_zod9.default.number().int().nonnegative(),
-  jti: import_zod9.default.string().max(MAX_JTI_LENGTH)
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_zod7 = __toESM(require("zod"));
+var zDpopJwtPayload = import_zod7.default.looseObject({
+  ...import_io_wallet_utils10.zJwtPayload.shape,
+  ath: import_zod7.default.optional(import_zod7.default.string()),
+  htm: import_io_wallet_utils10.zHttpMethod,
+  htu: import_zod7.default.url(),
+  iat: import_zod7.default.number().int().nonnegative(),
+  jti: import_zod7.default.string().max(import_io_wallet_utils10.MAX_JTI_LENGTH)
 });
-var zDpopJwtHeader = import_zod9.default.looseObject({
-  ...zJwtHeader.shape,
-  jwk: zJwk,
-  typ: import_zod9.default.literal("dpop+jwt")
+var zDpopJwtHeader = import_zod7.default.looseObject({
+  ...import_io_wallet_utils10.zJwtHeader.shape,
+  jwk: import_io_wallet_utils10.zJwk,
+  typ: import_zod7.default.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
 async function createTokenDPoP(options) {
   try {
-    const ath = options.accessToken ? (0, import_io_wallet_utils7.encodeToBase64Url)(
+    const ath = options.accessToken ? (0, import_io_wallet_utils11.encodeToBase64Url)(
       await options.callbacks.hash(
-        (0, import_io_wallet_utils7.decodeUtf8String)(options.accessToken),
-        import_oauth26.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils11.decodeUtf8String)(options.accessToken),
+        import_io_wallet_utils11.HashAlgorithm.Sha256
       )
     ) : void 0;
     const jti = options.jti ?? (options.callbacks.generateRandom ? import_js_base64.Base64.fromUint8Array(
@@ -905,16 +758,16 @@ async function createTokenDPoP(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const header = (0, import_io_wallet_utils7.parseWithErrorHandling)(zDpopJwtHeader, {
+    const header = (0, import_io_wallet_utils11.parseWithErrorHandling)(zDpopJwtHeader, {
       alg: options.signer.alg,
       jwk: options.signer.publicJwk,
       typ: "dpop+jwt"
     });
-    const payload = (0, import_io_wallet_utils7.parseWithErrorHandling)(zDpopJwtPayload, {
+    const payload = (0, import_io_wallet_utils11.parseWithErrorHandling)(zDpopJwtPayload, {
       ath,
       htm: options.tokenRequest.method,
       htu: htuFromRequestUrl(options.tokenRequest.url),
-      iat: (0, import_io_wallet_utils7.dateToSeconds)(options.issuedAt),
+      iat: (0, import_io_wallet_utils11.dateToSeconds)(options.issuedAt),
       jti
     });
     return options.callbacks.signJwt(options.signer, {
@@ -922,7 +775,7 @@ async function createTokenDPoP(options) {
       payload
     });
   } catch (error) {
-    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils7.ValidationError) {
+    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils11.ValidationError) {
       throw error;
     }
     throw new CreateTokenDPoPError(
@@ -935,28 +788,21 @@ function extractDpopJwtFromHeaders(headers) {
   if (!dpopJwt) {
     return { valid: true };
   }
-  if (!import_oauth26.zCompactJwt.safeParse(dpopJwt).success) {
+  if (!import_io_wallet_utils11.zCompactJwt.safeParse(dpopJwt).success) {
     return { valid: false };
   }
   return { dpopJwt, valid: true };
 }
 
-// src/access-token/z-grant-type.ts
-var import_zod10 = require("zod");
-var zAuthorizationCodeGrantIdentifier = import_zod10.z.literal("authorization_code");
-var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = import_zod10.z.literal("refresh_token");
-var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
-
 // src/access-token/parse-token-request.ts
-function parseAccessTokenRequest(options) {
+function parseAccessTokenRequestV1_4(options) {
   const validationResult = zAccessTokenRequest.safeParse(
     options.accessTokenRequest
   );
   if (!validationResult.success) {
     throw new Oauth2Error(
       `Access token request validation failed:
-${(0, import_io_wallet_utils8.formatZodError)(validationResult.error)}`
+${(0, import_io_wallet_utils12.formatZodError)(validationResult.error)}`
     );
   }
   const accessTokenRequest = validationResult.data;
@@ -970,6 +816,25 @@ ${(0, import_io_wallet_utils8.formatZodError)(validationResult.error)}`
     ...securityHeaders
   };
 }
+function parseAccessTokenRequestAPTITUDE(options) {
+  const validationResult = zAccessTokenRequestAPTITUDE.safeParse(
+    options.accessTokenRequest
+  );
+  if (!validationResult.success) {
+    throw new Oauth2Error(
+      `Access token request validation failed:
+${(0, import_io_wallet_utils12.formatZodError)(validationResult.error)}`
+    );
+  }
+  const accessTokenRequest = validationResult.data;
+  const grant = parseGrantParametersAPTITUDE(accessTokenRequest);
+  const securityHeaders = parseSecurityHeaders(options.request.headers);
+  return {
+    accessTokenRequest,
+    grant,
+    ...securityHeaders
+  };
+}
 function parseGrantParameters(accessTokenRequest) {
   if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
     return {
@@ -987,6 +852,30 @@ function parseGrantParameters(accessTokenRequest) {
     `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}'`
   );
 }
+function parseGrantParametersAPTITUDE(accessTokenRequest) {
+  if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
+    return {
+      code: accessTokenRequest.code,
+      grantType: authorizationCodeGrantIdentifier
+    };
+  }
+  if (accessTokenRequest.grant_type === refreshTokenGrantIdentifier) {
+    return {
+      grantType: refreshTokenGrantIdentifier,
+      refreshToken: accessTokenRequest.refresh_token
+    };
+  }
+  if (accessTokenRequest.grant_type === preAuthorizedCodeGrantIdentifier) {
+    return {
+      grantType: preAuthorizedCodeGrantIdentifier,
+      preAuthorizedCode: accessTokenRequest["pre-authorized_code"],
+      txCode: accessTokenRequest.tx_code
+    };
+  }
+  throw new Oauth2Error(
+    `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}', '${preAuthorizedCodeGrantIdentifier}'`
+  );
+}
 function parseSecurityHeaders(headers) {
   const extractedDpopJwt = extractDpopJwtFromHeaders(headers);
   if (!extractedDpopJwt.valid) {
@@ -1021,38 +910,58 @@ function parseSecurityHeaders(headers) {
     dpop: { jwt: extractedDpopJwt.dpopJwt }
   };
 }
+var dispatchParseTokenRequest = (0, import_io_wallet_utils12.createVersionDispatcher)({
+  [import_io_wallet_utils12.ItWalletSpecsVersion.APTITUDE]: (o) => parseAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_0]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_3]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_4]: (o) => parseAccessTokenRequestV1_4(
+    o
+  )
+});
+function parseAccessTokenRequest(options) {
+  return dispatchParseTokenRequest(options);
+}
+
+// src/access-token/verify-access-token-request.ts
+var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/verify-client-attestation.ts
-var import_oauth28 = require("@openid4vc/oauth2");
+var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/client-attestation-pop.ts
-var import_oauth27 = require("@openid4vc/oauth2");
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/z-client-attestation-pop.ts
-var import_zod11 = __toESM(require("zod"));
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_zod8 = __toESM(require("zod"));
 var IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES = [
   "ES256",
   "ES384",
   "ES512"
 ];
-var zItWalletClientAttestationPopJwtAlg = import_zod11.default.enum(
+var zItWalletClientAttestationPopJwtAlg = import_zod8.default.enum(
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES
 );
-var zItWalletClientAttestationPopJwtPayload = import_zod11.default.looseObject({
-  ...zJwtPayload.shape,
-  aud: import_zod11.default.string(),
-  exp: import_zod11.default.number().int().optional(),
-  iat: import_zod11.default.number().int(),
-  iss: import_zod11.default.string(),
-  jti: import_zod11.default.string().max(MAX_JTI_LENGTH),
-  nonce: import_zod11.default.string().optional()
+var zItWalletClientAttestationPopJwtPayload = import_zod8.default.looseObject({
+  ...import_io_wallet_utils13.zJwtPayload.shape,
+  aud: import_zod8.default.string(),
+  exp: import_zod8.default.number().int().optional(),
+  iat: import_zod8.default.number().int(),
+  iss: import_zod8.default.string(),
+  jti: import_zod8.default.string().max(import_io_wallet_utils13.MAX_JTI_LENGTH),
+  nonce: import_zod8.default.string().optional()
 });
-var zItWalletClientAttestationPopJwtTyp = import_zod11.default.literal(
+var zItWalletClientAttestationPopJwtTyp = import_zod8.default.literal(
   "oauth-client-attestation-pop+jwt"
 );
-var zItWalletClientAttestationPopJwtHeader = import_zod11.default.looseObject({
-  ...zJwtHeader.shape,
+var zItWalletClientAttestationPopJwtHeader = import_zod8.default.looseObject({
+  ...import_io_wallet_utils13.zJwtHeader.shape,
   typ: zItWalletClientAttestationPopJwtTyp
 });
 
@@ -1066,14 +975,14 @@ function assertSupportedClientAttestationPopAlg(alg) {
 }
 async function verifyClientAttestationPopJwt(options) {
   try {
-    const { header, payload } = decodeJwt({
+    const { header, payload } = (0, import_io_wallet_utils14.decodeJwt)({
       errorMessagePrefix: "Error decoding client attestation PoP JWT:",
       headerSchema: zItWalletClientAttestationPopJwtHeader,
       jwt: options.clientAttestationPopJwt,
       payloadSchema: zItWalletClientAttestationPopJwtPayload
     });
     assertSupportedClientAttestationPopAlg(header.alg);
-    const { signer } = await (0, import_oauth27.verifyJwt)({
+    const { signer } = await (0, import_io_wallet_utils14.verifyJwt)({
       compact: options.clientAttestationPopJwt,
       errorMessage: "client attestation pop jwt verification failed",
       expectedAudience: options.authorizationServer,
@@ -1102,7 +1011,7 @@ async function verifyClientAttestationPopJwt(options) {
 }
 async function createClientAttestationPopJwt(options) {
   try {
-    const clientAttestation = decodeJwt({
+    const clientAttestation = (0, import_io_wallet_utils14.decodeJwt)({
       errorMessagePrefix: "Error decoding client attestation JWT:",
       jwt: options.clientAttestation
     });
@@ -1129,22 +1038,22 @@ async function createClientAttestationPopJwt(options) {
       typ: zItWalletClientAttestationPopJwtTyp.value
     };
     const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils9.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
+    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils14.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
     if (!jti) {
       throw new Oauth2Error(
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const payload = (0, import_io_wallet_utils9.parseWithErrorHandling)(
+    const payload = (0, import_io_wallet_utils14.parseWithErrorHandling)(
       zItWalletClientAttestationPopJwtPayload,
       {
         aud: options.authorizationServer,
-        iat: (0, import_io_wallet_utils9.dateToSeconds)(issuedAt),
+        iat: (0, import_io_wallet_utils14.dateToSeconds)(issuedAt),
         iss: sub,
         jti,
-        ...options.config.itWalletSpecsVersion === import_io_wallet_utils9.ItWalletSpecsVersion.V1_0 ? {
-          exp: (0, import_io_wallet_utils9.dateToSeconds)(
-            "expiresAt" in options && options.expiresAt ? options.expiresAt : (0, import_io_wallet_utils9.addSecondsToDate)(issuedAt, 1 * 60)
+        ...options.config.itWalletSpecsVersion === import_io_wallet_utils14.ItWalletSpecsVersion.V1_0 ? {
+          exp: (0, import_io_wallet_utils14.dateToSeconds)(
+            "expiresAt" in options && options.expiresAt ? options.expiresAt : (0, import_io_wallet_utils14.addSecondsToDate)(issuedAt, 1 * 60)
           )
         } : {}
       }
@@ -1189,8 +1098,8 @@ async function verifyClientAttestation(options) {
     );
   }
   if (options.clientAttestation.ensureConfirmationKeyMatchesDpopKey && options.dpopJwkThumbprint) {
-    const clientAttestationJkt = await (0, import_oauth28.calculateJwkThumbprint)({
-      hashAlgorithm: import_oauth28.HashAlgorithm.Sha256,
+    const clientAttestationJkt = await (0, import_io_wallet_utils15.calculateJwkThumbprint)({
+      hashAlgorithm: import_io_wallet_utils15.HashAlgorithm.Sha256,
       hashCallback: options.callbacks.hash,
       jwk: clientAttestation.payload.cnf.jwk
     });
@@ -1207,8 +1116,7 @@ async function verifyClientAttestation(options) {
 }
 
 // src/pkce.ts
-var import_oauth29 = require("@openid4vc/oauth2");
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
 var PkceCodeChallengeMethod = {
   Plain: "plain",
   S256: "S256"
@@ -1226,7 +1134,7 @@ async function createPkce(options) {
   const codeChallengeMethod = allowedCodeChallengeMethods.includes(
     PkceCodeChallengeMethod.S256
   ) ? PkceCodeChallengeMethod.S256 : PkceCodeChallengeMethod.Plain;
-  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils10.encodeToBase64Url)(await options.callbacks.generateRandom(64));
+  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils16.encodeToBase64Url)(await options.callbacks.generateRandom(64));
   return {
     codeChallenge: await calculateCodeChallenge({
       codeChallengeMethod,
@@ -1254,10 +1162,10 @@ async function calculateCodeChallenge(options) {
     return options.codeVerifier;
   }
   if (options.codeChallengeMethod === PkceCodeChallengeMethod.S256) {
-    return (0, import_io_wallet_utils10.encodeToBase64Url)(
+    return (0, import_io_wallet_utils16.encodeToBase64Url)(
       await options.hashCallback(
-        (0, import_io_wallet_utils10.decodeUtf8String)(options.codeVerifier),
-        import_oauth29.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils16.decodeUtf8String)(options.codeVerifier),
+        import_io_wallet_utils16.HashAlgorithm.Sha256
       )
     );
   }
@@ -1267,10 +1175,9 @@ async function calculateCodeChallenge(options) {
 }
 
 // src/token-dpop/verify-token-dpop.ts
-var import_oauth210 = require("@openid4vc/oauth2");
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
 async function verifyTokenDPoP(options) {
-  const { header, payload } = decodeJwt({
+  const { header, payload } = (0, import_io_wallet_utils17.decodeJwt)({
     errorMessagePrefix: "Error decoding access token DPoP JWT:",
     headerSchema: zDpopJwtHeader,
     jwt: options.dpopJwt,
@@ -1308,10 +1215,10 @@ async function verifyTokenDPoP(options) {
     );
   }
   if (options.accessToken) {
-    const expectedAth = (0, import_io_wallet_utils11.encodeToBase64Url)(
+    const expectedAth = (0, import_io_wallet_utils17.encodeToBase64Url)(
       await options.callbacks.hash(
-        (0, import_io_wallet_utils11.decodeUtf8String)(options.accessToken),
-        import_oauth210.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils17.decodeUtf8String)(options.accessToken),
+        import_io_wallet_utils17.HashAlgorithm.Sha256
       )
     );
     if (!payload.ath) {
@@ -1325,8 +1232,8 @@ async function verifyTokenDPoP(options) {
       );
     }
   }
-  const jwkThumbprint = await (0, import_oauth210.calculateJwkThumbprint)({
-    hashAlgorithm: import_oauth210.HashAlgorithm.Sha256,
+  const jwkThumbprint = await (0, import_io_wallet_utils17.calculateJwkThumbprint)({
+    hashAlgorithm: import_io_wallet_utils17.HashAlgorithm.Sha256,
     hashCallback: options.callbacks.hash,
     jwk: header.jwk
   });
@@ -1336,7 +1243,7 @@ async function verifyTokenDPoP(options) {
     );
   }
   try {
-    (0, import_io_wallet_utils11.verifyJwtIatOrThrow)({
+    (0, import_io_wallet_utils17.verifyJwtIatOrThrow)({
       iat: payload.iat,
       now: options.now
     });
@@ -1345,7 +1252,7 @@ async function verifyTokenDPoP(options) {
       throw new Oauth2Error(`Invalid iat claim in dpop JWT: ${error.message}`);
     }
   }
-  await (0, import_oauth210.verifyJwt)({
+  await (0, import_io_wallet_utils17.verifyJwt)({
     compact: options.dpopJwt,
     errorMessage: "dpop jwt verification failed",
     header,
@@ -1366,7 +1273,7 @@ async function verifyTokenDPoP(options) {
 }
 
 // src/access-token/verify-access-token-request.ts
-async function verifyAccessTokenRequest(options) {
+async function verifyAccessTokenRequestV1_4(options) {
   if (options.dpop.expectedNonce === "") {
     throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
@@ -1395,12 +1302,44 @@ async function verifyAccessTokenRequest(options) {
   if (options.grant.code !== options.expectedCode) {
     throw new Oauth2Error(`Invalid 'code' provided`);
   }
-  if (options.codeExpiresAt) {
-    const now = options.now ?? /* @__PURE__ */ new Date();
-    if (now.getTime() > options.codeExpiresAt.getTime()) {
-      throw new Oauth2Error(`Expired 'code' provided`);
-    }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+  if (!header.jwk) {
+    throw new Oauth2Error("DPoP header does not contain a JWK");
+  }
+  return {
+    clientAttestation: clientAttestationResult,
+    dpop: { jwk: header.jwk, jwkThumbprint }
+  };
+}
+async function verifyAccessTokenRequestAPTITUDE(options) {
+  if (options.dpop.expectedNonce === "") {
+    throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
+  if (!isPreAuthorizedCodeVerification(options)) {
+    await verifyPkce({
+      callbacks: options.callbacks,
+      codeChallenge: options.pkce.codeChallenge,
+      codeChallengeMethod: options.pkce.codeChallengeMethod,
+      codeVerifier: options.pkce.codeVerifier
+    });
+  }
+  const { header, jwkThumbprint } = await verifyTokenDPoP({
+    allowedSigningAlgs: options.dpop.allowedSigningAlgs,
+    callbacks: options.callbacks,
+    dpopJwt: options.dpop.jwt,
+    expectedNonce: options.dpop.expectedNonce,
+    now: options.now,
+    request: options.request
+  });
+  const clientAttestationResult = await verifyClientAttestation({
+    authorizationServerMetadata: options.authorizationServerMetadata,
+    callbacks: options.callbacks,
+    clientAttestation: options.clientAttestation,
+    config: options.config,
+    dpopJwkThumbprint: jwkThumbprint,
+    now: options.now
+  });
+  verifyGrantParameters(options);
   if (!header.jwk) {
     throw new Oauth2Error("DPoP header does not contain a JWK");
   }
@@ -1409,38 +1348,102 @@ async function verifyAccessTokenRequest(options) {
     dpop: { jwk: header.jwk, jwkThumbprint }
   };
 }
+function isPreAuthorizedCodeVerification(options) {
+  return options.grant.grantType === preAuthorizedCodeGrantIdentifier;
+}
+function verifyGrantParameters(options) {
+  if (isPreAuthorizedCodeVerification(options)) {
+    if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) {
+      throw new Oauth2Error(`Invalid 'pre-authorized_code' provided`);
+    }
+    verifyTransactionCode(options.grant.txCode, options.expectedTxCode);
+    verifyCodeExpiration(
+      options.preAuthorizedCodeExpiresAt,
+      options.now,
+      "pre-authorized_code"
+    );
+    return;
+  }
+  if (options.grant.grantType !== authorizationCodeGrantIdentifier) {
+    throw new Oauth2Error(
+      "Only authorization_code and pre-authorized_code grants can be verified"
+    );
+  }
+  if (options.grant.code !== options.expectedCode) {
+    throw new Oauth2Error(`Invalid 'code' provided`);
+  }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+}
+function verifyTransactionCode(txCode, expectedTxCode) {
+  if (txCode === expectedTxCode) return;
+  if (expectedTxCode === void 0) {
+    throw new Oauth2Error("Request contains 'tx_code' that was not expected");
+  }
+  if (txCode === void 0) {
+    throw new Oauth2Error("Missing required 'tx_code' in request");
+  }
+  throw new Oauth2Error("Invalid 'tx_code' provided");
+}
+function verifyCodeExpiration(expiresAt, date, codeParameter) {
+  if (!expiresAt) return;
+  if (Number.isNaN(expiresAt.getTime())) {
+    throw new Oauth2Error(`Invalid expiration date for '${codeParameter}'`);
+  }
+  const now = date ?? /* @__PURE__ */ new Date();
+  if (now.getTime() > expiresAt.getTime()) {
+    throw new Oauth2Error(`Expired '${codeParameter}' provided`);
+  }
+}
+var dispatchVerifyAccessTokenRequest = (0, import_io_wallet_utils18.createVersionDispatcher)({
+  [import_io_wallet_utils18.ItWalletSpecsVersion.APTITUDE]: (o) => verifyAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [import_io_wallet_utils18.ItWalletSpecsVersion.V1_0]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils18.ItWalletSpecsVersion.V1_3]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils18.ItWalletSpecsVersion.V1_4]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  )
+});
+function verifyAccessTokenRequest(options) {
+  return dispatchVerifyAccessTokenRequest(options);
+}
 
 // src/authorization-request/create-authorization-request.ts
-var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-request/z-authorization-request.ts
-var import_zod12 = __toESM(require("zod"));
-var zOpenidCredentialAuthorizationDetails = import_zod12.default.object({
-  credential_configuration_id: import_zod12.default.string(),
-  type: import_zod12.default.literal("openid_credential")
+var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
+var import_zod9 = __toESM(require("zod"));
+var zOpenidCredentialAuthorizationDetails = import_zod9.default.object({
+  credential_configuration_id: import_zod9.default.string(),
+  type: import_zod9.default.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = import_zod12.default.object({
-  challenge_method: import_zod12.default.literal("mrtd+ias"),
-  challenge_redirect_uri: import_zod12.default.url(),
-  idphinting: import_zod12.default.url(),
-  type: import_zod12.default.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = import_zod9.default.object({
+  challenge_method: import_zod9.default.literal("mrtd+ias"),
+  challenge_redirect_uri: import_zod9.default.url(),
+  idphinting: import_zod9.default.url(),
+  type: import_zod9.default.literal("it_l2+document_proof")
 });
-var zAuthorizationRequestBaseObject = import_zod12.default.looseObject({
-  authorization_details: import_zod12.default.array(
-    import_zod12.default.discriminatedUnion("type", [
+var zAuthorizationRequestBaseObject = import_zod9.default.looseObject({
+  authorization_details: import_zod9.default.array(
+    import_zod9.default.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: import_zod12.default.string(),
-  code_challenge: import_zod12.default.string(),
-  code_challenge_method: import_zod12.default.string(),
-  issuer_state: import_zod12.default.optional(import_zod12.default.string()),
-  jti: import_zod12.default.string().max(MAX_JTI_LENGTH),
-  redirect_uri: import_zod12.default.url(),
-  response_type: import_zod12.default.string(),
-  scope: import_zod12.default.string().optional(),
-  state: import_zod12.default.string()
+  client_id: import_zod9.default.string(),
+  code_challenge: import_zod9.default.string(),
+  code_challenge_method: import_zod9.default.string(),
+  issuer_state: import_zod9.default.optional(import_zod9.default.string()),
+  jti: import_zod9.default.string().max(import_io_wallet_utils19.MAX_JTI_LENGTH),
+  redirect_uri: import_zod9.default.url(),
+  response_type: import_zod9.default.string(),
+  scope: import_zod9.default.string().optional(),
+  state: import_zod9.default.string()
 });
 var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
@@ -1450,7 +1453,7 @@ var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   }
 );
 var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
-  response_mode: import_zod12.default.string()
+  response_mode: import_zod9.default.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1459,25 +1462,25 @@ var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
   }
 );
 var zAuthorizationRequestV1_3 = zAuthorizationRequestBase;
-var zPushedAuthorizationRequestSigned = import_zod12.default.looseObject({
-  client_id: import_zod12.default.string().describe(
+var zPushedAuthorizationRequestSigned = import_zod9.default.looseObject({
+  client_id: import_zod9.default.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod12.default.string().describe(
+  pkceCodeVerifier: import_zod9.default.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: import_zod12.default.string().describe(
+  request: import_zod9.default.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => import_zod12.default.looseObject({
+var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => import_zod9.default.looseObject({
   authorizationRequest: authorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: import_zod12.default.string().describe(
+  client_id: import_zod9.default.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod12.default.string().describe(
+  pkceCodeVerifier: import_zod9.default.string().describe(
     "PKCE code verifier. Auto-generated if not provided in options."
   )
 });
@@ -1489,9 +1492,9 @@ function isPushedAuthorizationRequestSigned(par) {
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = import_zod12.default.looseObject({
-  expires_in: import_zod12.default.number().int(),
-  request_uri: import_zod12.default.string()
+var zPushedAuthorizationResponse = import_zod9.default.looseObject({
+  expires_in: import_zod9.default.number().int(),
+  request_uri: import_zod9.default.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1509,13 +1512,13 @@ async function createPushedAuthorizationRequest(options) {
     code_challenge: pkce.codeChallenge,
     code_challenge_method: pkce.codeChallengeMethod,
     ...options.issuerState !== void 0 ? { issuer_state: options.issuerState } : {},
-    jti: options.jti ?? (0, import_io_wallet_utils12.encodeToBase64Url)(
+    jti: options.jti ?? (0, import_io_wallet_utils20.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     ),
     redirect_uri: options.redirectUri,
     response_type: "code",
     scope: options.scope,
-    state: options.state ?? (0, import_io_wallet_utils12.encodeToBase64Url)(
+    state: options.state ?? (0, import_io_wallet_utils20.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     )
   };
@@ -1532,7 +1535,7 @@ async function createPushedAuthorizationRequest(options) {
       );
     }
     const iat = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils12.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils20.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
     const requestJwt = await options.callbacks.signJwt(dpop.signer, {
       header: {
         alg: dpop.signer.alg,
@@ -1541,8 +1544,8 @@ async function createPushedAuthorizationRequest(options) {
       },
       payload: {
         aud: options.audience,
-        exp: (0, import_io_wallet_utils12.dateToSeconds)(exp),
-        iat: (0, import_io_wallet_utils12.dateToSeconds)(iat),
+        exp: (0, import_io_wallet_utils20.dateToSeconds)(exp),
+        iat: (0, import_io_wallet_utils20.dateToSeconds)(iat),
         iss: dpop.signer.publicJwk.kid,
         ...authorizationRequest
       }
@@ -1560,27 +1563,30 @@ async function createPushedAuthorizationRequest(options) {
   };
 }
 function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
-  return (0, import_io_wallet_utils12.dispatchByVersion)(options.config.itWalletSpecsVersion, {
-    [import_io_wallet_utils12.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0.parse({
+  return (0, import_io_wallet_utils20.dispatchByVersion)(options.config.itWalletSpecsVersion, {
+    [import_io_wallet_utils20.ItWalletSpecsVersion.APTITUDE]: () => zAuthorizationRequestV1_3.parse(
+      baseAuthorizationRequest
+    ),
+    [import_io_wallet_utils20.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0.parse({
       ...baseAuthorizationRequest,
       response_mode: options.responseMode
     }),
-    [import_io_wallet_utils12.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3.parse(
+    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
+    [import_io_wallet_utils20.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     ),
-    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [import_io_wallet_utils12.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3.parse(
+    [import_io_wallet_utils20.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     )
   });
 }
 
 // src/authorization-request/fetch-authorization-response.ts
-var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
 async function fetchPushedAuthorizationResponse(options) {
   try {
-    const fetch = (0, import_io_wallet_utils13.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils21.createFetcher)(options.callbacks.fetch);
     const body = isPushedAuthorizationRequestSigned(
       options.pushedAuthorizationRequest
     ) ? new URLSearchParams({
@@ -1594,25 +1600,25 @@ async function fetchPushedAuthorizationResponse(options) {
       {
         body,
         headers: {
-          [import_io_wallet_utils13.HEADERS.CONTENT_TYPE]: import_io_wallet_utils13.CONTENT_TYPES.FORM_URLENCODED,
-          [import_io_wallet_utils13.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-          [import_io_wallet_utils13.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+          [import_io_wallet_utils21.HEADERS.CONTENT_TYPE]: import_io_wallet_utils21.CONTENT_TYPES.FORM_URLENCODED,
+          [import_io_wallet_utils21.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+          [import_io_wallet_utils21.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
         },
         method: "POST"
       }
     );
-    await (0, import_io_wallet_utils13.hasStatusOrThrow)(201, import_io_wallet_utils13.UnexpectedStatusCodeError)(parResponse);
+    await (0, import_io_wallet_utils21.hasStatusOrThrow)(201, import_io_wallet_utils21.UnexpectedStatusCodeError)(parResponse);
     const parResponseJson = await parResponse.json();
     const parsedParResponse = zPushedAuthorizationResponse.safeParse(parResponseJson);
     if (!parsedParResponse.success) {
-      throw new import_io_wallet_utils13.ValidationError(
+      throw new import_io_wallet_utils21.ValidationError(
         `Failed to parse pushed authorization response`,
         parsedParResponse.error
       );
     }
     return parsedParResponse.data;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils13.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils13.ValidationError) {
+    if (error instanceof import_io_wallet_utils21.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils21.ValidationError) {
       throw error;
     }
     throw new PushedAuthorizationRequestError(
@@ -1658,22 +1664,22 @@ function parseAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-pushed-authorization-request.ts
-var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
-var import_zod14 = __toESM(require("zod"));
+var import_io_wallet_utils24 = require("@pagopa/io-wallet-utils");
+var import_zod11 = __toESM(require("zod"));
 
 // src/jar/fetch-jar-request-object.ts
-var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
 async function fetchJarRequestObject(options) {
   const { fetch, requestUri } = options;
   const JAR_ACCEPT_HEADER = [
-    import_io_wallet_utils14.ContentType.OAuthAuthorizationRequestJwt,
+    import_io_wallet_utils22.ContentType.OAuthAuthorizationRequestJwt,
     // Preferred: application/oauth-authz-req+jwt
-    `${import_io_wallet_utils14.ContentType.Jwt};q=0.9`,
+    `${import_io_wallet_utils22.ContentType.Jwt};q=0.9`,
     // Fallback: application/jwt
     "text/plain"
     // Final fallback: text/plain
   ].join(", ");
-  const response = await (0, import_io_wallet_utils14.createFetcher)(fetch)(requestUri, {
+  const response = await (0, import_io_wallet_utils22.createFetcher)(fetch)(requestUri, {
     headers: {
       Accept: JAR_ACCEPT_HEADER
     },
@@ -1683,7 +1689,7 @@ async function fetchJarRequestObject(options) {
       `Fetching request_object from request_uri '${requestUri}' failed`
     );
   });
-  await (0, import_io_wallet_utils14.hasStatusOrThrow)(200, import_io_wallet_utils14.UnexpectedStatusCodeError)(response);
+  await (0, import_io_wallet_utils22.hasStatusOrThrow)(200, import_io_wallet_utils22.UnexpectedStatusCodeError)(response);
   return await response.text();
 }
 
@@ -1720,25 +1726,26 @@ async function parseJarRequest(options) {
 }
 
 // src/jar/z-jar.ts
-var import_zod13 = __toESM(require("zod"));
-var zJarAuthorizationRequest = import_zod13.default.looseObject({
-  client_id: import_zod13.default.optional(import_zod13.default.string()),
-  request: import_zod13.default.optional(import_zod13.default.string()),
-  request_uri: import_zod13.default.url().optional()
+var import_io_wallet_utils23 = require("@pagopa/io-wallet-utils");
+var import_zod10 = __toESM(require("zod"));
+var zJarAuthorizationRequest = import_zod10.default.looseObject({
+  client_id: import_zod10.default.optional(import_zod10.default.string()),
+  request: import_zod10.default.optional(import_zod10.default.string()),
+  request_uri: import_zod10.default.url().optional()
 });
-var zJarRequestObjectPayload = import_zod13.default.looseObject({
-  ...zJwtPayload.shape,
-  client_id: import_zod13.default.string()
+var zJarRequestObjectPayload = import_zod10.default.looseObject({
+  ...import_io_wallet_utils23.zJwtPayload.shape,
+  client_id: import_zod10.default.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = import_zod13.default.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = import_zod10.default.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = import_zod13.default.looseObject({
-  ...zJwtHeader.shape,
+var zJarRequestObjectHeader = import_zod10.default.looseObject({
+  ...import_io_wallet_utils23.zJwtHeader.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = import_zod13.default.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = import_zod10.default.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
 // src/authorization-request/parse-pushed-authorization-request.ts
@@ -1746,8 +1753,8 @@ async function parsePushedAuthorizationRequest(options) {
   const authorizationRequestSchema = getAuthorizationRequestSchema(
     options.config
   );
-  const parsed = (0, import_io_wallet_utils15.parseWithErrorHandling)(
-    import_zod14.default.union([authorizationRequestSchema, zJarAuthorizationRequest]),
+  const parsed = (0, import_io_wallet_utils24.parseWithErrorHandling)(
+    import_zod11.default.union([authorizationRequestSchema, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1758,7 +1765,7 @@ async function parsePushedAuthorizationRequest(options) {
       callbacks: options.callbacks,
       jarRequestParams: parsed
     });
-    const jwt = decodeJwt({
+    const jwt = (0, import_io_wallet_utils24.decodeJwt)({
       errorMessagePrefix: "Error decoding pushed authorization request JWT:",
       jwt: parsedJar.authorizationRequestJwt
     });
@@ -1768,7 +1775,7 @@ async function parsePushedAuthorizationRequest(options) {
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Invalid authorization request. Could not parse jar request payload.
-${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils24.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
     authorizationRequestJwt = parsedJar.authorizationRequestJwt;
@@ -1779,7 +1786,7 @@ ${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Error occurred during validation of pushed authorization request.
-${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils24.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
   }
@@ -1795,12 +1802,13 @@ ${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)
   };
 }
 function getAuthorizationRequestSchema(config) {
-  return (0, import_io_wallet_utils15.dispatchByVersion)(config.itWalletSpecsVersion, {
-    [import_io_wallet_utils15.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0,
-    [import_io_wallet_utils15.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3,
+  return (0, import_io_wallet_utils24.dispatchByVersion)(config.itWalletSpecsVersion, {
+    [import_io_wallet_utils24.ItWalletSpecsVersion.APTITUDE]: () => zAuthorizationRequestV1_3,
+    [import_io_wallet_utils24.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0,
     // V1_4 reuses V1_3 PAR schema — no breaking changes between versions.
+    [import_io_wallet_utils24.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3,
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [import_io_wallet_utils15.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3
+    [import_io_wallet_utils24.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3
   });
 }
 
@@ -1848,18 +1856,20 @@ async function verifyAuthorizationRequestDpop(options, request, callbacks, now)
   };
 }
 
+// src/authorization-request/verify-pushed-authorization-request.ts
+var import_io_wallet_utils26 = require("@pagopa/io-wallet-utils");
+
 // src/jar/verify-jar-request.ts
-var import_oauth211 = require("@openid4vc/oauth2");
-var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils25 = require("@pagopa/io-wallet-utils");
 async function verifyJarRequest(options) {
   const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
-  const requestObjectIsEncrypted = import_oauth211.zCompactJwe.safeParse(
+  const requestObjectIsEncrypted = import_io_wallet_utils25.zCompactJwe.safeParse(
     authorizationRequestJwt
   ).success;
   if (requestObjectIsEncrypted) {
     throw new Oauth2Error("Encrypted JWE request objects are not supported.");
   }
-  const requestIsSigned = import_oauth211.zCompactJwt.safeParse(
+  const requestIsSigned = import_io_wallet_utils25.zCompactJwt.safeParse(
     authorizationRequestJwt
   ).success;
   if (!requestIsSigned) {
@@ -1912,15 +1922,15 @@ async function verifyJarRequest(options) {
 }
 async function verifyJarRequestObject(options) {
   const { authorizationRequestJwt, callbacks, jwtSigner } = options;
-  const jwt = decodeJwt({
+  const jwt = (0, import_io_wallet_utils25.decodeJwt)({
     errorMessagePrefix: "Error decoding JAR authorization request JWT:",
     jwt: authorizationRequestJwt
   });
-  const authorizationRequestPayload = (0, import_io_wallet_utils16.parseWithErrorHandling)(
+  const authorizationRequestPayload = (0, import_io_wallet_utils25.parseWithErrorHandling)(
     zJarRequestObjectPayload,
     jwt.payload
   );
-  const { signer } = await (0, import_oauth211.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils25.verifyJwt)({
     compact: authorizationRequestJwt,
     header: jwt.header,
     payload: authorizationRequestPayload,
@@ -1953,7 +1963,7 @@ async function verifyPushedAuthorizationRequest(options) {
   let jar;
   if (options.authorizationRequestJwt) {
     if (requireSigned) {
-      const decoded = decodeJwt({
+      const decoded = (0, import_io_wallet_utils26.decodeJwt)({
         errorMessagePrefix: "Error decoding pushed authorization request JWT:",
         jwt: options.authorizationRequestJwt.jwt
       });
@@ -2042,10 +2052,10 @@ function clientAuthenticationWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils28 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/jwk-thumbprint.ts
-var import_oauth212 = require("@openid4vc/oauth2");
+var import_io_wallet_utils27 = require("@pagopa/io-wallet-utils");
 var SUPPORTED_KTY = ["RSA", "EC"];
 var calculateDpopJwkThumbprint = (options) => {
   if (!SUPPORTED_KTY.includes(
@@ -2055,8 +2065,8 @@ var calculateDpopJwkThumbprint = (options) => {
       `Unsupported JWK key type "${options.dpopJwkPublic.kty}" for thumbprint computation. Supported types: ${SUPPORTED_KTY.join(", ")}.`
     );
   }
-  return (0, import_oauth212.calculateJwkThumbprint)({
-    hashAlgorithm: import_oauth212.HashAlgorithm.Sha256,
+  return (0, import_io_wallet_utils27.calculateJwkThumbprint)({
+    hashAlgorithm: import_io_wallet_utils27.HashAlgorithm.Sha256,
     hashCallback: options.callbacks.hash,
     jwk: options.dpopJwkPublic
   });
@@ -2067,12 +2077,12 @@ var createWalletAttestationJwt = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils17.addSecondsToDate)(iat, 3600);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils28.addSecondsToDate)(iat, 3600);
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils17.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils17.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils28.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils28.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
       ...options.walletLink && { wallet_link: options.walletLink },
@@ -2089,7 +2099,7 @@ var createWalletAttestationJwt = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    (0, import_io_wallet_utils28.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_0,
       jwt: result.jwt,
@@ -2097,7 +2107,7 @@ var createWalletAttestationJwt = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils17.ValidationError) {
+    if (error instanceof import_io_wallet_utils28.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -2107,23 +2117,23 @@ var createWalletAttestationJwt = async (options) => {
 };
 
 // src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils29 = require("@pagopa/io-wallet-utils");
 var createWalletAttestationJwt2 = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils18.addSecondsToDate)(iat, 3600);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils29.addSecondsToDate)(iat, 3600);
     if (options.nbf && options.nbf >= exp) {
-      throw new import_io_wallet_utils18.ValidationError("nbf must be before exp");
+      throw new import_io_wallet_utils29.ValidationError("nbf must be before exp");
     }
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils18.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils18.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils29.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils29.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
-      ...options.nbf && { nbf: (0, import_io_wallet_utils18.dateToSeconds)(options.nbf) },
+      ...options.nbf && { nbf: (0, import_io_wallet_utils29.dateToSeconds)(options.nbf) },
       ...options.status && { status: options.status },
       ...options.walletLink && { wallet_link: options.walletLink },
       ...options.walletName && { wallet_name: options.walletName }
@@ -2142,7 +2152,7 @@ var createWalletAttestationJwt2 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    (0, import_io_wallet_utils29.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_3,
       jwt: result.jwt,
@@ -2150,7 +2160,7 @@ var createWalletAttestationJwt2 = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils18.ValidationError) {
+    if (error instanceof import_io_wallet_utils29.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -2160,33 +2170,33 @@ var createWalletAttestationJwt2 = async (options) => {
 };
 
 // src/client-attestation/v1.4/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils30 = require("@pagopa/io-wallet-utils");
 var DEFAULT_EXPIRATION_SECONDS = 3600;
 var MAX_EXPIRATION_SECONDS = 86400;
 var createWalletAttestationJwt3 = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils19.addSecondsToDate)(iat, DEFAULT_EXPIRATION_SECONDS);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils30.addSecondsToDate)(iat, DEFAULT_EXPIRATION_SECONDS);
     if (exp <= iat) {
-      throw new import_io_wallet_utils19.ValidationError("exp must be after iat");
+      throw new import_io_wallet_utils30.ValidationError("exp must be after iat");
     }
-    if (exp > (0, import_io_wallet_utils19.addSecondsToDate)(iat, MAX_EXPIRATION_SECONDS)) {
-      throw new import_io_wallet_utils19.ValidationError("exp must not be more than 24 hours after iat");
+    if (exp > (0, import_io_wallet_utils30.addSecondsToDate)(iat, MAX_EXPIRATION_SECONDS)) {
+      throw new import_io_wallet_utils30.ValidationError("exp must not be more than 24 hours after iat");
     }
     if (options.nbf && options.nbf >= exp) {
-      throw new import_io_wallet_utils19.ValidationError("nbf must be before exp");
+      throw new import_io_wallet_utils30.ValidationError("nbf must be before exp");
     }
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils19.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils19.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils30.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils30.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
       wallet_link: options.walletLink,
       wallet_name: options.walletName,
-      ...options.nbf && { nbf: (0, import_io_wallet_utils19.dateToSeconds)(options.nbf) }
+      ...options.nbf && { nbf: (0, import_io_wallet_utils30.dateToSeconds)(options.nbf) }
     };
     const header = {
       alg: options.signer.alg,
@@ -2201,7 +2211,7 @@ var createWalletAttestationJwt3 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    (0, import_io_wallet_utils30.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_4,
       jwt: result.jwt,
@@ -2209,7 +2219,7 @@ var createWalletAttestationJwt3 = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils19.ValidationError) {
+    if (error instanceof import_io_wallet_utils30.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -2218,17 +2228,8 @@ var createWalletAttestationJwt3 = async (options) => {
   }
 };
 
-// src/common/jwt/z-jwe.ts
-var import_zod15 = require("zod");
-var zCompactJwe2 = import_zod15.z.string().regex(
-  /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
-  {
-    message: "Not a valid compact jwe"
-  }
-);
-
 // src/jar/create-jar-request.ts
-var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils31 = require("@pagopa/io-wallet-utils");
 async function createJarRequest(options) {
   const {
     authorizationRequestHeader,
@@ -2246,8 +2247,8 @@ async function createJarRequest(options) {
     payload: {
       ...options.additionalJwtPayload,
       ...authorizationRequestPayload,
-      exp: (0, import_io_wallet_utils20.dateToSeconds)((0, import_io_wallet_utils20.addSecondsToDate)(now, options.expiresInSeconds)),
-      iat: (0, import_io_wallet_utils20.dateToSeconds)(now)
+      exp: (0, import_io_wallet_utils31.dateToSeconds)((0, import_io_wallet_utils31.addSecondsToDate)(now, options.expiresInSeconds)),
+      iat: (0, import_io_wallet_utils31.dateToSeconds)(now)
     }
   });
   authorizationRequestJwt = jwt;
@@ -2275,6 +2276,7 @@ async function createJarRequest(options) {
 }
 
 // src/jarm-form-post-jwt.ts
+var import_io_wallet_utils32 = require("@pagopa/io-wallet-utils");
 var getJwtFromFormPost = async (options) => {
   const inputRegex = /<input[^<>]*>/gi;
   const nameRegex = /name="response"/gi;
@@ -2289,7 +2291,7 @@ var getJwtFromFormPost = async (options) => {
         const responseJwt = matchValue[1];
         if (responseJwt) {
           const jwt = responseJwt.replace(lineExpressionRegex, "");
-          const decodedJwt = decodeJwt({
+          const decodedJwt = (0, import_io_wallet_utils32.decodeJwt)({
             errorMessagePrefix: "Error decoding JARM form post JWT:",
             jwt,
             payloadSchema: options.schema
@@ -2311,73 +2313,73 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils33 = require("@pagopa/io-wallet-utils");
 
 // src/mrtd-pop/z-mrtd-pop.ts
-var import_zod16 = __toESM(require("zod"));
-var zMrtdChallengeJwtHeader = import_zod16.default.looseObject({
-  alg: import_zod16.default.string(),
-  kid: import_zod16.default.string(),
-  typ: import_zod16.default.literal("mrtd-ias+jwt")
+var import_zod12 = __toESM(require("zod"));
+var zMrtdChallengeJwtHeader = import_zod12.default.looseObject({
+  alg: import_zod12.default.string(),
+  kid: import_zod12.default.string(),
+  typ: import_zod12.default.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = import_zod16.default.looseObject({
-  aud: import_zod16.default.string(),
-  exp: import_zod16.default.number(),
-  htm: import_zod16.default.literal("POST"),
-  htu: import_zod16.default.url(),
-  iat: import_zod16.default.number(),
-  iss: import_zod16.default.string(),
-  mrtd_auth_session: import_zod16.default.string(),
-  mrtd_pop_jwt_nonce: import_zod16.default.string(),
-  state: import_zod16.default.string(),
-  status: import_zod16.default.literal("require_interaction"),
-  type: import_zod16.default.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = import_zod12.default.looseObject({
+  aud: import_zod12.default.string(),
+  exp: import_zod12.default.number(),
+  htm: import_zod12.default.literal("POST"),
+  htu: import_zod12.default.url(),
+  iat: import_zod12.default.number(),
+  iss: import_zod12.default.string(),
+  mrtd_auth_session: import_zod12.default.string(),
+  mrtd_pop_jwt_nonce: import_zod12.default.string(),
+  state: import_zod12.default.string(),
+  status: import_zod12.default.literal("require_interaction"),
+  type: import_zod12.default.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = import_zod16.default.looseObject({
-  alg: import_zod16.default.string(),
-  kid: import_zod16.default.string(),
-  typ: import_zod16.default.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = import_zod12.default.looseObject({
+  alg: import_zod12.default.string(),
+  kid: import_zod12.default.string(),
+  typ: import_zod12.default.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = import_zod16.default.looseObject({
-  aud: import_zod16.default.string(),
-  challenge: import_zod16.default.string(),
-  exp: import_zod16.default.number(),
-  htm: import_zod16.default.literal("POST"),
-  htu: import_zod16.default.url(),
-  iat: import_zod16.default.number(),
-  iss: import_zod16.default.string(),
-  mrtd_pop_nonce: import_zod16.default.string(),
-  mrz: import_zod16.default.string().optional()
+var zMrtdPopInitResponseJwtPayload = import_zod12.default.looseObject({
+  aud: import_zod12.default.string(),
+  challenge: import_zod12.default.string(),
+  exp: import_zod12.default.number(),
+  htm: import_zod12.default.literal("POST"),
+  htu: import_zod12.default.url(),
+  iat: import_zod12.default.number(),
+  iss: import_zod12.default.string(),
+  mrtd_pop_nonce: import_zod12.default.string(),
+  mrz: import_zod12.default.string().optional()
 });
-var zMrtdData = import_zod16.default.looseObject({
-  dg1: import_zod16.default.string(),
-  dg11: import_zod16.default.string(),
-  sod_mrtd: import_zod16.default.string()
+var zMrtdData = import_zod12.default.looseObject({
+  dg1: import_zod12.default.string(),
+  dg11: import_zod12.default.string(),
+  sod_mrtd: import_zod12.default.string()
 });
-var zIasData = import_zod16.default.looseObject({
-  challenge_signed: import_zod16.default.string(),
-  ias_pk: import_zod16.default.string(),
-  sod_ias: import_zod16.default.string()
+var zIasData = import_zod12.default.looseObject({
+  challenge_signed: import_zod12.default.string(),
+  ias_pk: import_zod12.default.string(),
+  sod_ias: import_zod12.default.string()
 });
-var zMrtdValidationJwtHeader = import_zod16.default.looseObject({
-  alg: import_zod16.default.string(),
-  kid: import_zod16.default.string(),
-  typ: import_zod16.default.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = import_zod12.default.looseObject({
+  alg: import_zod12.default.string(),
+  kid: import_zod12.default.string(),
+  typ: import_zod12.default.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = import_zod16.default.looseObject({
-  aud: import_zod16.default.string(),
-  document_type: import_zod16.default.literal("cie"),
-  exp: import_zod16.default.number(),
+var zMrtdValidationJwtPayload = import_zod12.default.looseObject({
+  aud: import_zod12.default.string(),
+  document_type: import_zod12.default.literal("cie"),
+  exp: import_zod12.default.number(),
   ias: zIasData,
-  iat: import_zod16.default.number(),
-  iss: import_zod16.default.string(),
+  iat: import_zod12.default.number(),
+  iss: import_zod12.default.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = import_zod16.default.looseObject({
-  mrtd_val_pop_nonce: import_zod16.default.string(),
-  redirect_uri: import_zod16.default.url(),
-  status: import_zod16.default.literal("require_interaction"),
-  type: import_zod16.default.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = import_zod12.default.looseObject({
+  mrtd_val_pop_nonce: import_zod12.default.string(),
+  redirect_uri: import_zod12.default.url(),
+  status: import_zod12.default.literal("require_interaction"),
+  type: import_zod12.default.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2388,13 +2390,13 @@ async function createMrtdValidationJwt(options) {
     if (!kid) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
-    const iat = (0, import_io_wallet_utils21.dateToSeconds)(options.issuedAt);
-    const header = (0, import_io_wallet_utils21.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
+    const iat = (0, import_io_wallet_utils33.dateToSeconds)(options.issuedAt);
+    const header = (0, import_io_wallet_utils33.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
       typ: "mrtd-ias+jwt"
     });
-    const payload = (0, import_io_wallet_utils21.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
+    const payload = (0, import_io_wallet_utils33.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
       aud: options.audience,
       document_type: "cie",
       exp: iat + JWT_EXPIRY_SECONDS2,
@@ -2427,37 +2429,36 @@ async function createMrtdValidationJwt(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-init.ts
-var import_oauth213 = require("@openid4vc/oauth2");
-var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils34 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopInit(options) {
   try {
-    const fetch = (0, import_io_wallet_utils22.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils34.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popInitEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
         mrtd_pop_jwt_nonce: options.mrtdPopJwtNonce
       }),
       headers: {
-        [import_io_wallet_utils22.HEADERS.CONTENT_TYPE]: import_io_wallet_utils22.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils34.HEADERS.CONTENT_TYPE]: import_io_wallet_utils34.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils34.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils34.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils22.hasStatusOrThrow)(202, import_io_wallet_utils22.UnexpectedStatusCodeError)(response);
+    await (0, import_io_wallet_utils34.hasStatusOrThrow)(202, import_io_wallet_utils34.UnexpectedStatusCodeError)(response);
     const responseJwt = await response.text();
-    const jwt = decodeJwt({
+    const jwt = (0, import_io_wallet_utils34.decodeJwt)({
       errorMessagePrefix: "Error decoding MRTD PoP init response JWT:",
       headerSchema: zMrtdPopInitResponseJwtHeader,
       jwt: responseJwt,
       payloadSchema: zMrtdPopInitResponseJwtPayload
     });
-    const { signer } = await (0, import_oauth213.verifyJwt)({
+    const { signer } = await (0, import_io_wallet_utils34.verifyJwt)({
       compact: responseJwt,
       errorMessage: "Error verifying MRTD PoP init response JWT",
       header: jwt.header,
       payload: jwt.payload,
-      signer: options.signer ?? (0, import_oauth213.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
+      signer: options.signer ?? (0, import_io_wallet_utils34.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
       verifyJwtCallback: options.callbacks.verifyJwt
     });
     return {
@@ -2468,7 +2469,7 @@ async function fetchMrtdPopInit(options) {
       signer
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils22.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils22.ValidationError) {
+    if (error instanceof import_io_wallet_utils34.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils34.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2478,10 +2479,10 @@ async function fetchMrtdPopInit(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-verify.ts
-var import_io_wallet_utils23 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils35 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopVerify(options) {
   try {
-    const fetch = (0, import_io_wallet_utils23.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils35.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popVerifyEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
@@ -2489,14 +2490,14 @@ async function fetchMrtdPopVerify(options) {
         mrtd_validation_jwt: options.mrtdValidationJwt
       }),
       headers: {
-        [import_io_wallet_utils23.HEADERS.CONTENT_TYPE]: import_io_wallet_utils23.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils23.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils23.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils35.HEADERS.CONTENT_TYPE]: import_io_wallet_utils35.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils35.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils35.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils23.hasStatusOrThrow)(202, import_io_wallet_utils23.UnexpectedStatusCodeError)(response);
-    const parsed = (0, import_io_wallet_utils23.parseWithErrorHandling)(
+    await (0, import_io_wallet_utils35.hasStatusOrThrow)(202, import_io_wallet_utils35.UnexpectedStatusCodeError)(response);
+    const parsed = (0, import_io_wallet_utils35.parseWithErrorHandling)(
       zMrtdPopVerifyResponse,
       await response.json(),
       "Failed to parse MRTD PoP verify response"
@@ -2506,7 +2507,7 @@ async function fetchMrtdPopVerify(options) {
       redirectUri: parsed.redirect_uri
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils23.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils23.ValidationError) {
+    if (error instanceof import_io_wallet_utils35.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils35.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2516,7 +2517,7 @@ async function fetchMrtdPopVerify(options) {
 }
 
 // src/mrtd-pop/parse-mrtd-challenge.ts
-var import_oauth214 = require("@openid4vc/oauth2");
+var import_io_wallet_utils36 = require("@pagopa/io-wallet-utils");
 function parseMrtdChallenge(options) {
   const url = new URL(options.redirectUrl);
   const challengeJwt = url.searchParams.get("challenge_info");
@@ -2525,12 +2526,12 @@ function parseMrtdChallenge(options) {
       "Missing 'challenge_info' query parameter in redirect URL"
     );
   }
-  if (!import_oauth214.zCompactJwt.safeParse(challengeJwt).success) {
+  if (!import_io_wallet_utils36.zCompactJwt.safeParse(challengeJwt).success) {
     throw new MrtdPopError(
       "Invalid JWT format in 'challenge_info' query parameter"
     );
   }
-  const { header, payload } = decodeJwt({
+  const { header, payload } = (0, import_io_wallet_utils36.decodeJwt)({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2540,10 +2541,10 @@ function parseMrtdChallenge(options) {
 }
 
 // src/mrtd-pop/verify-mrtd-challenge.ts
-var import_oauth215 = require("@openid4vc/oauth2");
+var import_io_wallet_utils37 = require("@pagopa/io-wallet-utils");
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
-  const jwt = decodeJwt({
+  const jwt = (0, import_io_wallet_utils37.decodeJwt)({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2555,31 +2556,25 @@ async function verifyMrtdChallenge(options) {
     );
   }
   const payload = jwt.payload;
-  const { signer } = await (0, import_oauth215.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils37.verifyJwt)({
     compact: challengeJwt,
     errorMessage: "Error verifying MRTD challenge JWT",
     header: jwt.header,
     payload,
-    signer: options.signer ?? (0, import_oauth215.jwtSignerFromJwt)({ header: jwt.header, payload }),
+    signer: options.signer ?? (0, import_io_wallet_utils37.jwtSignerFromJwt)({ header: jwt.header, payload }),
     verifyJwtCallback: callbacks.verifyJwt
   });
   return { header: jwt.header, payload: jwt.payload, signer };
 }
-
-// src/index.ts
-var import_oauth216 = require("@openid4vc/oauth2");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ClientAttestationError,
   CreateTokenDPoPError,
   CreateTokenResponseError,
   FetchTokenResponseError,
-  HashAlgorithm,
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
-  MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
-  Oauth2JwtParseError,
   PkceCodeChallengeMethod,
   PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod,
@@ -2594,11 +2589,11 @@ var import_oauth216 = require("@openid4vc/oauth2");
   createPushedAuthorizationRequest,
   createTokenDPoP,
   createTokenRequest,
+  createTokenRequestAPTITUDE,
+  createTokenRequestV1_4,
   createWalletAttestationJwtV1_0,
   createWalletAttestationJwtV1_3,
   createWalletAttestationJwtV1_4,
-  decodeJwt,
-  decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders,
   extractDpopJwtFromHeaders,
   fetchJarRequestObject,
@@ -2613,12 +2608,12 @@ var import_oauth216 = require("@openid4vc/oauth2");
   isPushedAuthorizationRequestSigned,
   isPushedAuthorizationRequestUnsigned,
   jwtAuthorizationRequestJwtHeaderTyp,
-  jwtHeaderFromJwtSigner,
   parseAccessTokenRequest,
   parseAuthorizationRequest,
   parseJarRequest,
   parseMrtdChallenge,
   parsePushedAuthorizationRequest,
+  preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier,
   signedAuthorizationRequestJwtHeaderTyp,
   toURLSearchParams,
@@ -2628,7 +2623,6 @@ var import_oauth216 = require("@openid4vc/oauth2");
   verifyClientAttestation,
   verifyClientAttestationPopJwt,
   verifyJarRequest,
-  verifyJwt,
   verifyMrtdChallenge,
   verifyPkce,
   verifyPushedAuthorizationRequest,
@@ -2640,14 +2634,12 @@ var import_oauth216 = require("@openid4vc/oauth2");
   zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
+  zAccessTokenRequestAPTITUDE,
   zAccessTokenResponse,
-  zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
+  zAuthorizationCodeTokenRequest,
   zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3,
-  zCertificateChain,
-  zCompactJwe,
-  zCompactJwt,
   zDpopJwtHeader,
   zDpopJwtPayload,
   zItWalletClientAttestationPopJwtAlg,
@@ -2657,11 +2649,6 @@ var import_oauth216 = require("@openid4vc/oauth2");
   zJarAuthorizationRequest,
   zJarRequestObjectHeader,
   zJarRequestObjectPayload,
-  zJwk,
-  zJwkSet,
-  zJwtConfirmationPayload,
-  zJwtHeader,
-  zJwtPayload,
   zMrtdChallengeJwtHeader,
   zMrtdChallengeJwtPayload,
   zMrtdPopInitResponseJwtHeader,
@@ -2669,6 +2656,8 @@ var import_oauth216 = require("@openid4vc/oauth2");
   zMrtdPopVerifyResponse,
   zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload,
+  zPreAuthorizedCodeGrantIdentifier,
+  zPreAuthorizedCodeTokenRequest,
   zPushedAuthorizationRequestSigned,
   zPushedAuthorizationRequestUnsignedV1_0,
   zPushedAuthorizationRequestUnsignedV1_3,
@@ -2676,8 +2665,8 @@ var import_oauth216 = require("@openid4vc/oauth2");
   zRefreshTokenGrantIdentifier,
   zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload,
+  zRefreshTokenTokenRequest,
   zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain,
   zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3,
   zWalletAttestationJwtHeaderV1_4,