@pagopa/io-wallet-oauth2 1.5.8 → 2.0.0-apt

package/dist/index.d.ts

@@ -1,83 +1,143 @@
-import * as _openid4vc_oauth2 from '@openid4vc/oauth2';
-import { CallbackContext, JwtSigner as JwtSigner$1, JwtSignerJwk as JwtSignerJwk$1, ClientAttestationJwtPayload, RequestDpopOptions, JwtSignerWithJwk as JwtSignerWithJwk$1, HttpMethod as HttpMethod$1 } from '@openid4vc/oauth2';
-export { CallbackContext, ClientAttestationPopJwtHeader, ClientAttestationPopJwtPayload, DecryptJweCallback, EncryptJweCallback, GenerateRandomCallback, HashAlgorithm, JweEncryptor, JwtSigner, JwtSignerJwk, Oauth2JwtParseError, RequestDpopOptions, SignJwtCallback, VerifyJwtCallback, verifyJwt } from '@openid4vc/oauth2';
-import z, { z as z$1 } from 'zod';
-import { RequestLike as RequestLike$1, ItWalletSpecsVersion, IoWalletSdkConfig, FetchHeaders, HttpMethod, BaseSchema, ContentType, Fetch } from '@pagopa/io-wallet-utils';
-import { ItWalletAuthorizationServerMetadata } from '@pagopa/io-wallet-oid-federation';
+import * as _pagopa_io_wallet_utils from '@pagopa/io-wallet-utils';
+import { IoWalletSdkConfig, ItWalletSpecsVersion, CallbackContext, Jwk, JwtSigner, RequestLike, JwtSignerJwk, JwtPayload, FetchHeaders, RequestDpopOptions, decodeJwt, JwtSignerWithJwk, ClientAuthenticationCallback as ClientAuthenticationCallback$1, ClientAuthenticationCallbackOptions as ClientAuthenticationCallbackOptions$1, JweEncryptor, Fetch, DecodeJwtResult, HttpMethod } from '@pagopa/io-wallet-utils';
+import z$1, { z } from 'zod';
 
-interface RetrieveAuthorizationCodeAccessTokenOptions {
-    /**
-     * Additional payload to include in the access token request. Items will be encoded and sent
-     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
-     */
-    additionalRequestPayload?: Record<string, unknown>;
-    /**
-     * The authorization code
-     */
-    authorizationCode: string;
-    /**
-     * Callbacks to use for requesting access token
-     */
-    callbacks: Pick<CallbackContext, "clientAuthentication" | "fetch" | "generateRandom" | "hash" | "signJwt">;
-    /**
-     * PKCE Code verifier that was used in the authorization request.
-     */
-    pkceCodeVerifier: string;
-    /**
-     * Redirect uri to include in the access token request.
-     * It MUST be set as in the Request Object.
-     */
-    redirectUri: string;
-}
-/**
- * Creates an OAuth 2.0 authorization-code access token request body.
- *
- * @param options - Access token request inputs.
- * @param options.additionalRequestPayload - Extra form fields to include in the token request.
- * @param options.authorizationCode - Authorization code received from the authorization response.
- * @param options.pkceCodeVerifier - PKCE verifier associated with the authorization request.
- * @param options.redirectUri - Redirect URI used in the authorization request.
- * @returns URL-form-encodable authorization-code grant request data.
- */
-declare const createTokenRequest: (options: RetrieveAuthorizationCodeAccessTokenOptions) => Promise<{
-    code: string;
-    code_verifier: string;
+declare const zAuthorizationCodeGrantIdentifier: z.ZodLiteral<"authorization_code">;
+declare const authorizationCodeGrantIdentifier: "authorization_code";
+type AuthorizationCodeGrantIdentifier = z.infer<typeof zAuthorizationCodeGrantIdentifier>;
+declare const zPreAuthorizedCodeGrantIdentifier: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">;
+declare const preAuthorizedCodeGrantIdentifier: "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+type PreAuthorizedCodeGrantIdentifier = z.infer<typeof zPreAuthorizedCodeGrantIdentifier>;
+declare const zRefreshTokenGrantIdentifier: z.ZodLiteral<"refresh_token">;
+declare const refreshTokenGrantIdentifier: "refresh_token";
+type RefreshTokenGrantIdentifier = z.infer<typeof zRefreshTokenGrantIdentifier>;
+
+declare const zPreAuthorizedCodeTokenRequest: z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">;
+    "pre-authorized_code": z.ZodString;
+    tx_code: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const zAuthorizationCodeTokenRequest: z.ZodObject<{
+    code: z.ZodString;
+    code_verifier: z.ZodString;
+    grant_type: z.ZodLiteral<"authorization_code">;
+    redirect_uri: z.ZodString;
+}, z.core.$strip>;
+declare const zRefreshTokenTokenRequest: z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const zAccessTokenRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    code: z.ZodString;
+    code_verifier: z.ZodString;
+    grant_type: z.ZodLiteral<"authorization_code">;
+    redirect_uri: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">;
+type AccessTokenRequest = z.infer<typeof zAccessTokenRequest>;
+declare const zAccessTokenRequestAPTITUDE: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    code: z.ZodString;
+    code_verifier: z.ZodString;
+    grant_type: z.ZodLiteral<"authorization_code">;
+    redirect_uri: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">;
+    "pre-authorized_code": z.ZodString;
+    tx_code: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">;
+type AccessTokenRequestAPTITUDE = z.infer<typeof zAccessTokenRequestAPTITUDE>;
+type AuthorizationCodeGrantType = Extract<AccessTokenRequest, {
     grant_type: "authorization_code";
-    redirect_uri: string;
 }>;
-
-declare const zJwk: z.ZodObject<{
-    alg: z.ZodOptional<z.ZodString>;
-    crv: z.ZodOptional<z.ZodString>;
-    d: z.ZodOptional<z.ZodString>;
-    dp: z.ZodOptional<z.ZodString>;
-    dq: z.ZodOptional<z.ZodString>;
-    e: z.ZodOptional<z.ZodString>;
-    ext: z.ZodOptional<z.ZodBoolean>;
-    k: z.ZodOptional<z.ZodString>;
-    key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    kid: z.ZodOptional<z.ZodString>;
-    kty: z.ZodString;
-    n: z.ZodOptional<z.ZodString>;
-    oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        d: z.ZodOptional<z.ZodString>;
-        r: z.ZodOptional<z.ZodString>;
-        t: z.ZodOptional<z.ZodString>;
+type PreAuthorizedCodeGrantType = Extract<AccessTokenRequestAPTITUDE, {
+    grant_type: "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+}>;
+type RefreshTokenGrantType = Extract<AccessTokenRequest, {
+    grant_type: "refresh_token";
+}>;
+declare const zAccessTokenResponse: z.ZodObject<{
+    access_token: z.ZodString;
+    authorization_details: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        credential_configuration_id: z.ZodOptional<z.ZodString>;
+        credential_identifiers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        type: z.ZodLiteral<"openid_credential">;
     }, z.core.$loose>>>;
-    p: z.ZodOptional<z.ZodString>;
-    q: z.ZodOptional<z.ZodString>;
-    qi: z.ZodOptional<z.ZodString>;
-    use: z.ZodOptional<z.ZodString>;
-    x: z.ZodOptional<z.ZodString>;
+    expires_in: z.ZodOptional<z.ZodNumber>;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    token_type: z.ZodUnion<readonly [z.ZodLiteral<"Bearer">, z.ZodLiteral<"DPoP">]>;
+}, z.core.$loose>;
+type AccessTokenResponse = z.infer<typeof zAccessTokenResponse>;
+declare const zAccessTokenProfileJwtHeader: z.ZodObject<{
+    typ: z.ZodEnum<{
+        "application/at+jwt": "application/at+jwt";
+        "at+jwt": "at+jwt";
+    }>;
+    alg: z.ZodString;
+    jwk: z.ZodOptional<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodString;
+        n: z.ZodOptional<z.ZodString>;
+        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            d: z.ZodOptional<z.ZodString>;
+            r: z.ZodOptional<z.ZodString>;
+            t: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    kid: z.ZodOptional<z.ZodString>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
     x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    x5t: z.ZodOptional<z.ZodString>;
-    "x5t#S256": z.ZodOptional<z.ZodString>;
-    x5u: z.ZodOptional<z.ZodString>;
-    y: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
-type Jwk = z.infer<typeof zJwk>;
-declare const zJwkSet: z.ZodObject<{
-    keys: z.ZodArray<z.ZodObject<{
+type AccessTokenProfileJwtHeader = z.infer<typeof zAccessTokenProfileJwtHeader>;
+declare const zAccessTokenProfileJwtPayload: z.ZodObject<{
+    aud: z.ZodString;
+    client_id: z.ZodString;
+    cnf: z.ZodOptional<z.ZodObject<{
+        jkt: z.ZodString;
+    }, z.core.$strip>>;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    iss: z.ZodString;
+    jti: z.ZodString;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    scope: z.ZodOptional<z.ZodString>;
+    sub: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+}, z.core.$loose>;
+type AccessTokenProfileJwtPayload = z.infer<typeof zAccessTokenProfileJwtPayload>;
+declare const zRefreshTokenProfileJwtHeader: z.ZodObject<{
+    kid: z.ZodString;
+    typ: z.ZodLiteral<"rt+jwt">;
+    alg: z.ZodString;
+    jwk: z.ZodOptional<z.ZodObject<{
         alg: z.ZodOptional<z.ZodString>;
         crv: z.ZodOptional<z.ZodString>;
         d: z.ZodOptional<z.ZodString>;
@@ -106,8 +166,123 @@ declare const zJwkSet: z.ZodObject<{
         x5u: z.ZodOptional<z.ZodString>;
         y: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+type RefreshTokenProfileJwtHeader = z.infer<typeof zRefreshTokenProfileJwtHeader>;
+declare const zRefreshTokenProfileJwtPayload: z.ZodObject<{
+    aud: z.ZodString;
+    client_id: z.ZodString;
+    cnf: z.ZodObject<{
+        jkt: z.ZodString;
+    }, z.core.$strip>;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    iss: z.ZodString;
+    jti: z.ZodString;
+    nbf: z.ZodNumber;
+    sub: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
 }, z.core.$loose>;
-type JwkSet = z.infer<typeof zJwkSet>;
+type RefreshTokenProfileJwtPayload = z.infer<typeof zRefreshTokenProfileJwtPayload>;
+
+interface BaseRetrieveAccessTokenOptions {
+    /**
+     * Additional payload to include in the access token request. Items are encoded and sent
+     * using x-www-form-urlencoded format. Nested items (JSON) are stringified and url encoded.
+     * Can be used to include form fields such as client_id or authorization_details.
+     */
+    additionalRequestPayload?: Record<string, unknown>;
+    config: IoWalletSdkConfig;
+}
+interface RetrieveAccessTokenOptionsAuthCode<V extends ItWalletSpecsVersion> extends BaseRetrieveAccessTokenOptions {
+    /**
+     * The authorization code
+     */
+    authorizationCode: string;
+    config: IoWalletSdkConfig<V>;
+    /** The authorization_code grant type. */
+    grantType: AuthorizationCodeGrantIdentifier;
+    /**
+     * PKCE Code verifier that was used in the authorization request.
+     */
+    pkceCodeVerifier: string;
+    /**
+     * Redirect uri to include in the access token request.
+     * It MUST be set as in the Request Object.
+     */
+    redirectUri: string;
+}
+interface RetrieveAccessTokenOptionsPreAuthorizedCode extends BaseRetrieveAccessTokenOptions {
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
+    /** The pre_authorized_code grant type. */
+    grantType: PreAuthorizedCodeGrantIdentifier;
+    /** The pre-authorized code received in the credential offer. */
+    preAuthorizedCode: string;
+    /** Required when the credential offer contains a tx_code object. */
+    txCode?: string;
+}
+interface RetrieveAccessTokenOptionsRefreshToken<V extends ItWalletSpecsVersion> extends BaseRetrieveAccessTokenOptions {
+    config: IoWalletSdkConfig<V>;
+    /** The refresh_token grant type. */
+    grantType: RefreshTokenGrantIdentifier;
+    /** The refresh token received in the credential offer. */
+    refreshToken: string;
+    /** The refresh token OPTIONAL scope. */
+    scope?: string;
+}
+type RetrieveAccessTokenOptionsShared<V extends ItWalletSpecsVersion> = RetrieveAccessTokenOptionsAuthCode<V> | RetrieveAccessTokenOptionsRefreshToken<V>;
+type RetrieveAccessTokenOptions = RetrieveAccessTokenOptionsShared<ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4>;
+type RetrieveAccessTokenOptionsAPTITUDE = RetrieveAccessTokenOptionsPreAuthorizedCode | RetrieveAccessTokenOptionsShared<ItWalletSpecsVersion.APTITUDE>;
+type CreateTokenRequestOptions = RetrieveAccessTokenOptions | RetrieveAccessTokenOptionsAPTITUDE;
+type CreateTokenRequestReturnType = AuthorizationCodeGrantType | PreAuthorizedCodeGrantType | RefreshTokenGrantType;
+declare const createTokenRequestV1_4: <V extends ItWalletSpecsVersion>(options: RetrieveAccessTokenOptionsShared<V>) => {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    scope: string | undefined;
+} | {
+    code: string;
+    code_verifier: string;
+    grant_type: "authorization_code";
+    redirect_uri: string;
+};
+declare function createTokenRequestAPTITUDE(options: RetrieveAccessTokenOptionsAPTITUDE): CreateTokenRequestReturnType;
+/**
+ * Creates an authorization-code or pre-authorized_code access token request body.
+ *
+ * Authorization-code requests retain the existing default grant and require PKCE
+ * and a redirect URI.
+ *
+ *  * * Version Differences:
+ * - v1.4: only support authorization_code grant type.
+ * - APTITUDE: add support for pre-authorized_code grant type. Pre Authorized
+ *   requests use preAuthorizedCode and optional txCode, without PKCE or a redirect URI.
+ *
+ * @param options - Access token request inputs and version config.
+ * @param options.config - The IoWalletSdkConfig instance to use.
+ * @param options.grantType - The grant type to use.
+ * @param options.additionalRequestPayload - Extra form fields to include in the token request.
+ *
+ * **authorization_code grant type parameters:**
+ * @param options.authorizationCode - Authorization code received from the authorization response.
+ * @param options.pkceCodeVerifier - PKCE verifier associated with the authorization request.
+ * @param options.redirectUri - Redirect URI used in the authorization request.
+ *
+ * **refresh_token grant type parameters (APTITUDE only):**
+ * @param options.refreshToken - Refresh token.
+ * @param options.scope - The refresh token OPTIONAL scope.
+ *
+ * **pre-authorized_code grant type parameters (APTITUDE only):**
+ * @param options.preAuthorizedCode - Pre-authorized code received in the credential offer.
+ * @param options.txCode - Transaction code required when the credential offer contains a `tx_code` object.
+ *
+ * @returns URL-form-encodable grant request data.
+ */
+declare function createTokenRequest(options: RetrieveAccessTokenOptions): AuthorizationCodeGrantType | RefreshTokenGrantType;
+declare function createTokenRequest(options: RetrieveAccessTokenOptionsAPTITUDE): AuthorizationCodeGrantType | PreAuthorizedCodeGrantType | RefreshTokenGrantType;
+declare function createTokenRequest(options: CreateTokenRequestOptions): CreateTokenRequestReturnType;
 
 interface CreateAccessTokenResponseOptions {
     /**
@@ -132,6 +307,7 @@ interface CreateAccessTokenResponseOptions {
      * OAuth client identifier (`client_id` claim).
      */
     clientId: string;
+    config: IoWalletSdkConfig;
     /**
      * DPoP public key used to bind the access token (`cnf.jkt` claim).
      */
@@ -169,7 +345,7 @@ interface CreateAccessTokenResponseOptions {
     /**
      * Signer used to produce the access token JWT.
      */
-    signer: JwtSigner$1;
+    signer: JwtSigner;
     /**
      * Subject identifier represented by the access token (`sub` claim).
      */
@@ -194,7 +370,7 @@ interface CreateAccessTokenResponseOptions {
  * public key, and results in `nbf` equal to the Access Token `exp` and `exp`
  * later than that.
  *
- * @param options - Access token response creation options.
+ * @param options - Access token response creation options and version config.
  * @returns OAuth token response with a signed access token JWT, and a signed Refresh Token JWT when requested.
  * @throws {CreateTokenResponseError} If DPoP binding is required but missing, if Refresh Token issuance is requested without a valid DPoP configuration or lifetime, if the signer has no resolvable `kid` for the Refresh Token, or if response creation otherwise fails, including validation failures from the generated JWT headers or payloads.
  * @throws {ValidationError} If the generated JWT header or payload fails validation.
@@ -213,158 +389,12 @@ declare function createAccessTokenResponse(options: CreateAccessTokenResponseOpt
     refresh_token?: string | undefined;
 }>;
 
-declare const zAccessTokenRequest: z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
-    code: z$1.ZodString;
-    code_verifier: z$1.ZodString;
-    grant_type: z$1.ZodLiteral<"authorization_code">;
-    redirect_uri: z$1.ZodString;
-}, z$1.core.$strip>, z$1.ZodObject<{
-    grant_type: z$1.ZodLiteral<"refresh_token">;
-    refresh_token: z$1.ZodString;
-    scope: z$1.ZodOptional<z$1.ZodString>;
-}, z$1.core.$strip>], "grant_type">;
-type AccessTokenRequest = z$1.infer<typeof zAccessTokenRequest>;
-type AuthorizationCodeGrantType = Extract<AccessTokenRequest, {
-    grant_type: "authorization_code";
-}>;
-type RefreshTokenGrantType = Extract<AccessTokenRequest, {
-    grant_type: "refresh_token";
-}>;
-declare const zAccessTokenResponse: z$1.ZodObject<{
-    access_token: z$1.ZodString;
-    authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-        credential_configuration_id: z$1.ZodOptional<z$1.ZodString>;
-        credential_identifiers: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        type: z$1.ZodLiteral<"openid_credential">;
-    }, z$1.core.$loose>>>;
-    expires_in: z$1.ZodOptional<z$1.ZodNumber>;
-    refresh_token: z$1.ZodOptional<z$1.ZodString>;
-    token_type: z$1.ZodUnion<readonly [z$1.ZodLiteral<"Bearer">, z$1.ZodLiteral<"DPoP">]>;
-}, z$1.core.$loose>;
-type AccessTokenResponse = z$1.infer<typeof zAccessTokenResponse>;
-declare const zAccessTokenProfileJwtHeader: z$1.ZodObject<{
-    typ: z$1.ZodEnum<{
-        "application/at+jwt": "application/at+jwt";
-        "at+jwt": "at+jwt";
-    }>;
-    alg: z$1.ZodString;
-    jwk: z$1.ZodOptional<z$1.ZodObject<{
-        alg: z$1.ZodOptional<z$1.ZodString>;
-        crv: z$1.ZodOptional<z$1.ZodString>;
-        d: z$1.ZodOptional<z$1.ZodString>;
-        dp: z$1.ZodOptional<z$1.ZodString>;
-        dq: z$1.ZodOptional<z$1.ZodString>;
-        e: z$1.ZodOptional<z$1.ZodString>;
-        ext: z$1.ZodOptional<z$1.ZodBoolean>;
-        k: z$1.ZodOptional<z$1.ZodString>;
-        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        kid: z$1.ZodOptional<z$1.ZodString>;
-        kty: z$1.ZodString;
-        n: z$1.ZodOptional<z$1.ZodString>;
-        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-            d: z$1.ZodOptional<z$1.ZodString>;
-            r: z$1.ZodOptional<z$1.ZodString>;
-            t: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>>>;
-        p: z$1.ZodOptional<z$1.ZodString>;
-        q: z$1.ZodOptional<z$1.ZodString>;
-        qi: z$1.ZodOptional<z$1.ZodString>;
-        use: z$1.ZodOptional<z$1.ZodString>;
-        x: z$1.ZodOptional<z$1.ZodString>;
-        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        x5t: z$1.ZodOptional<z$1.ZodString>;
-        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-        x5u: z$1.ZodOptional<z$1.ZodString>;
-        y: z$1.ZodOptional<z$1.ZodString>;
-    }, z$1.core.$loose>>;
-    kid: z$1.ZodOptional<z$1.ZodString>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-}, z$1.core.$loose>;
-type AccessTokenProfileJwtHeader = z$1.infer<typeof zAccessTokenProfileJwtHeader>;
-declare const zAccessTokenProfileJwtPayload: z$1.ZodObject<{
-    aud: z$1.ZodString;
-    client_id: z$1.ZodString;
-    cnf: z$1.ZodOptional<z$1.ZodObject<{
-        jkt: z$1.ZodString;
-    }, z$1.core.$strip>>;
-    exp: z$1.ZodNumber;
-    iat: z$1.ZodNumber;
-    iss: z$1.ZodString;
-    jti: z$1.ZodString;
-    nbf: z$1.ZodOptional<z$1.ZodNumber>;
-    scope: z$1.ZodOptional<z$1.ZodString>;
-    sub: z$1.ZodString;
-    nonce: z$1.ZodOptional<z$1.ZodString>;
-    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-}, z$1.core.$loose>;
-type AccessTokenProfileJwtPayload = z$1.infer<typeof zAccessTokenProfileJwtPayload>;
-declare const zRefreshTokenProfileJwtHeader: z$1.ZodObject<{
-    kid: z$1.ZodString;
-    typ: z$1.ZodLiteral<"rt+jwt">;
-    alg: z$1.ZodString;
-    jwk: z$1.ZodOptional<z$1.ZodObject<{
-        alg: z$1.ZodOptional<z$1.ZodString>;
-        crv: z$1.ZodOptional<z$1.ZodString>;
-        d: z$1.ZodOptional<z$1.ZodString>;
-        dp: z$1.ZodOptional<z$1.ZodString>;
-        dq: z$1.ZodOptional<z$1.ZodString>;
-        e: z$1.ZodOptional<z$1.ZodString>;
-        ext: z$1.ZodOptional<z$1.ZodBoolean>;
-        k: z$1.ZodOptional<z$1.ZodString>;
-        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        kid: z$1.ZodOptional<z$1.ZodString>;
-        kty: z$1.ZodString;
-        n: z$1.ZodOptional<z$1.ZodString>;
-        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-            d: z$1.ZodOptional<z$1.ZodString>;
-            r: z$1.ZodOptional<z$1.ZodString>;
-            t: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>>>;
-        p: z$1.ZodOptional<z$1.ZodString>;
-        q: z$1.ZodOptional<z$1.ZodString>;
-        qi: z$1.ZodOptional<z$1.ZodString>;
-        use: z$1.ZodOptional<z$1.ZodString>;
-        x: z$1.ZodOptional<z$1.ZodString>;
-        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        x5t: z$1.ZodOptional<z$1.ZodString>;
-        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-        x5u: z$1.ZodOptional<z$1.ZodString>;
-        y: z$1.ZodOptional<z$1.ZodString>;
-    }, z$1.core.$loose>>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-}, z$1.core.$loose>;
-type RefreshTokenProfileJwtHeader = z$1.infer<typeof zRefreshTokenProfileJwtHeader>;
-declare const zRefreshTokenProfileJwtPayload: z$1.ZodObject<{
-    aud: z$1.ZodString;
-    client_id: z$1.ZodString;
-    cnf: z$1.ZodObject<{
-        jkt: z$1.ZodString;
-    }, z$1.core.$strip>;
-    exp: z$1.ZodNumber;
-    iat: z$1.ZodNumber;
-    iss: z$1.ZodString;
-    jti: z$1.ZodString;
-    nbf: z$1.ZodNumber;
-    sub: z$1.ZodString;
-    nonce: z$1.ZodOptional<z$1.ZodString>;
-    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-}, z$1.core.$loose>;
-type RefreshTokenProfileJwtPayload = z$1.infer<typeof zRefreshTokenProfileJwtPayload>;
-
-interface FetchTokenResponseOptions {
+interface BaseFetchTokenResponseOptions {
     /**
      * The endpoint URL where the access token request will be sent
      * This should be the authorization server's token endpoint
      */
     accessTokenEndpoint: string;
-    /**
-     * The access token request payload
-     */
-    accessTokenRequest: AccessTokenRequest;
     /**
      * Callbacks to use for requesting access token
      */
@@ -374,6 +404,7 @@ interface FetchTokenResponseOptions {
      * Used for OAuth-Client-Attestation-PoP header to prove possession of the client key
      */
     clientAttestationDPoP: string;
+    config: IoWalletSdkConfig;
     /**
      * DPoP proof for the token request
      */
@@ -384,33 +415,47 @@ interface FetchTokenResponseOptions {
      */
     walletAttestation: string;
 }
-/**
- * Sends an access token request to the authorization server and returns the response
- *
- * @param options - Configuration options for the access token request
- * @returns Promise that resolves to the parsed access token response
- * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code
- * @throws {ValidationError} When the response cannot be parsed as a valid access token response
- * @throws {FetchTokenResponseError} When an unexpected error occurs during the request
- */
-declare function fetchTokenResponse(options: FetchTokenResponseOptions): Promise<AccessTokenResponse>;
+interface FetchTokenResponseOptionsShared<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4> extends BaseFetchTokenResponseOptions {
+    /**
+     * The authorization-code or refresh-token request payload.
+     */
+    accessTokenRequest: AccessTokenRequest;
+    config: IoWalletSdkConfig<V>;
+}
+interface FetchTokenResponseOptionsAPTITUDE extends BaseFetchTokenResponseOptions {
+    /**
+     * The authorization-code, pre-authorized-code or refresh-token request payload.
+     */
+    accessTokenRequest: AccessTokenRequestAPTITUDE;
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
+}
+type FetchTokenResponseOptions = FetchTokenResponseOptionsAPTITUDE | FetchTokenResponseOptionsShared;
 /**
  * Converts an access token request object into URL-encoded form parameters.
  *
  * Object values are JSON-stringified so structured extension parameters such as
  * `authorization_details` can be sent in `application/x-www-form-urlencoded` requests.
  *
+ * Version Differences:
+ * - APTITUDE: extracts `authorization_server` (OPTIONAL), `pre-authorized_code` (REQUIRED), and `tx_code` (OPTIONAL)
+ *
  * @param data - Access token request payload.
  * @returns URLSearchParams containing all defined request fields.
  */
-declare function toURLSearchParams(data: AccessTokenRequest): URLSearchParams;
-
-declare const zAuthorizationCodeGrantIdentifier: z$1.ZodLiteral<"authorization_code">;
-declare const authorizationCodeGrantIdentifier: "authorization_code";
-type AuthorizationCodeGrantIdentifier = z$1.infer<typeof zAuthorizationCodeGrantIdentifier>;
-declare const zRefreshTokenGrantIdentifier: z$1.ZodLiteral<"refresh_token">;
-declare const refreshTokenGrantIdentifier: "refresh_token";
-type RefreshTokenGrantIdentifier = z$1.infer<typeof zRefreshTokenGrantIdentifier>;
+declare function toURLSearchParams(data: FetchTokenResponseOptions["accessTokenRequest"]): URLSearchParams;
+/**
+ * Sends an access token request to the authorization server and returns the response
+ *
+ * * Version Differences:
+ * - APTITUDE: add support for pre-authorized-code grant type.
+ *
+ * @param options - Configuration options for the access token request and version config.
+ * @returns Promise that resolves to the parsed access token response
+ * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code
+ * @throws {ValidationError} When the response cannot be parsed as a valid access token response
+ * @throws {FetchTokenResponseError} When an unexpected error occurs during the request
+ */
+declare function fetchTokenResponse(options: FetchTokenResponseOptions): Promise<AccessTokenResponse>;
 
 interface ParsedAccessTokenAuthorizationCodeRequestGrant {
     code: string;
@@ -420,9 +465,14 @@ interface ParsedAccessTokenRefreshTokenRequestGrant {
     grantType: RefreshTokenGrantIdentifier;
     refreshToken: string;
 }
-type ParsedAccessTokenRequestGrant = ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
-interface ParseAccessTokenRequestResult {
-    accessTokenRequest: AccessTokenRequest;
+interface ParsedAccessTokenPreAuthorizedCodeRequestGrant {
+    grantType: PreAuthorizedCodeGrantIdentifier;
+    preAuthorizedCode: string;
+    txCode?: string;
+}
+type ParsedAccessTokenRequestGrantV1_4 = ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
+type ParsedAccessTokenRequestGrantAPTITUDE = ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenPreAuthorizedCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
+interface BaseParseAccessTokenRequestResult {
     /**
      * The client attestation jwts from the access token request headers
      */
@@ -436,33 +486,57 @@ interface ParseAccessTokenRequestResult {
     dpop: {
         jwt: string;
     };
-    grant: ParsedAccessTokenRequestGrant;
+}
+interface ParseAccessTokenRequestResultV1_4 extends BaseParseAccessTokenRequestResult {
+    accessTokenRequest: AccessTokenRequest;
+    grant: ParsedAccessTokenRequestGrantV1_4;
     /**
      * The pkce code verifier from the access token request
      */
     pkceCodeVerifier?: string;
 }
+interface ParseAccessTokenRequestResultAPTITUDE extends BaseParseAccessTokenRequestResult {
+    accessTokenRequest: AccessTokenRequestAPTITUDE;
+    grant: ParsedAccessTokenRequestGrantAPTITUDE;
+}
 interface ParseAccessTokenRequestOptions {
     /**
      * The access token request as a JSON object. Your server should decode the
      * `x-www-url-form-urlencoded` body into an object (e.g. using `bodyParser.urlEncoded()` in express)
      */
     accessTokenRequest: Record<string, unknown>;
-    request: RequestLike$1;
+    config: IoWalletSdkConfig;
+    request: RequestLike;
+}
+interface ParseAccessTokenRequestOptionsShared<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4> extends ParseAccessTokenRequestOptions {
+    /**
+     * The IT-Wallet specs version to use for parsing the access token request.
+     */
+    config: IoWalletSdkConfig<V>;
+}
+interface ParseAccessTokenRequestOptionsAPTITUDE extends ParseAccessTokenRequestOptions {
+    /**
+     * The IT-Wallet specs version to use for parsing the access token request.
+     */
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
 }
+type ParseAccessTokenRequestResult = ParseAccessTokenRequestResultAPTITUDE | ParseAccessTokenRequestResultV1_4;
 /**
  * Parses and validates an OAuth 2.0 access token request.
  *
  * This function performs the following steps:
  * 1. Validates the request body against the access token request schema
- * 2. Extracts and validates grant-specific parameters (authorization code or refresh token)
+ * 2. Extracts grant parameters for authorization code, pre-authorized code or refresh token
  * 3. Parses security headers (DPoP and Client Attestation JWTs)
- * 4. Extracts PKCE code verifier if present
+ * 4. Extracts PKCE code verifier if present (V1_4 only)
  *
  * Note: This function only parses and validates the structure of the request.
  * Cryptographic verification of JWTs and tokens should be performed separately.
  *
- * @param options - Configuration object containing the access token request body and HTTP request
+ * * * Version Differences:
+ * - APTITUDE: add support for pre-authorized-code grant type.
+ *
+ * @param options - Configuration object containing the access token request body and HTTP request, and version config
  * @returns Parsed access token request with typed grant parameters and extracted security headers
  * @throws {Oauth2Error} If validation fails or required parameters are missing
  *
@@ -479,8 +553,62 @@ interface ParseAccessTokenRequestOptions {
  * });
  * ```
  */
+declare function parseAccessTokenRequest<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4>(options: ParseAccessTokenRequestOptionsShared<V>): ParseAccessTokenRequestResultV1_4;
+declare function parseAccessTokenRequest(options: ParseAccessTokenRequestOptionsAPTITUDE): ParseAccessTokenRequestResultAPTITUDE;
 declare function parseAccessTokenRequest(options: ParseAccessTokenRequestOptions): ParseAccessTokenRequestResult;
 
+/**
+ * Lean Authorization Server Metadata interface consumed by the oauth2 package.
+ *
+ * This interface captures only the fields that this package actually reads,
+ * keeping it free of any dependency on the `oid-federation` package and preventing
+ * a circular build dependency between the two packages.
+ *
+ * In practice callers pass the richer types produced by `@pagopa/io-wallet-oid-federation`
+ * (e.g. `ItWalletAuthorizationServerMetadataV1_3`); those types satisfy this interface
+ * structurally, so no explicit cast is required at call sites.
+ *
+ * @see {@link https://www.rfc-editor.org/rfc/rfc8414 RFC 8414 – OAuth 2.0 Authorization Server Metadata}
+ */
+interface BaseAuthorizationServerMetadata {
+    /**
+     * List of PKCE code-challenge transformation methods supported by the server.
+     *
+     * IT-Wallet mandates that `"S256"` be present.
+     *
+     * @see {@link https://www.rfc-editor.org/rfc/rfc7636#section-4.3 RFC 7636 §4.3}
+     */
+    code_challenge_methods_supported: string[];
+    /**
+     * URL that uniquely identifies the Authorization Server.
+     *
+     * Used as the expected `aud` claim when verifying JAR request objects and as the
+     * `authorization_server` value when creating Client Attestation PoP JWTs.
+     *
+     * @see {@link https://www.rfc-editor.org/rfc/rfc8414#section-2 RFC 8414 §2}
+     */
+    issuer: string;
+    /**
+     * When `true` the server mandates that every authorization request be sent as a
+     * signed JWT (JAR). Unsigned PAR bodies are rejected in that case.
+     *
+     * Defaults to `false` when absent (permissive mode).
+     *
+     * @default false
+     * @see {@link https://www.rfc-editor.org/rfc/rfc9101#section-10.5 RFC 9101 §10.5}
+     */
+    require_signed_request_object?: boolean;
+    /**
+     * Client authentication methods supported by the token endpoint.
+     *
+     * The oauth2 package inspects this array for the `"attest_jwt_client_auth"` value
+     * to determine whether Wallet Attestation–based client authentication is available.
+     *
+     * @see {@link https://www.rfc-editor.org/rfc/rfc8414#section-2 RFC 8414 §2}
+     */
+    token_endpoint_auth_methods_supported?: string[];
+}
+
 interface VerifyClientAttestationPopJwtOptions {
     /**
      * The issuer identifier of the authorization server handling the client attestation
@@ -609,9 +737,10 @@ declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationP
         } | undefined;
         nbf?: number | undefined;
         status?: Record<string, any> | undefined;
+        sub?: string | undefined;
         trust_chain?: [string, ...string[]] | undefined;
     };
-    signer: _openid4vc_oauth2.JwtSignerWithJwk;
+    signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
 }>;
 interface BaseCreateClientAttestationPopJwtOptions<V extends ItWalletSpecsVersion> {
     /**
@@ -646,7 +775,7 @@ interface BaseCreateClientAttestationPopJwtOptions<V extends ItWalletSpecsVersio
      * If not provided, the signer will be derived based on the
      * `cnf.jwk` and `alg` in the client attestation.
      */
-    signer?: JwtSignerJwk$1;
+    signer?: JwtSignerJwk;
 }
 type NoClientAttestationPopJwtExtraOptions = Record<never, never>;
 interface CreateClientAttestationPopJwtVersionOptions {
@@ -703,7 +832,7 @@ interface VerifyClientAttestationOptions {
     /**
      * The authorization server metadata.
      */
-    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
+    authorizationServerMetadata: BaseAuthorizationServerMetadata;
     /**
      * Callbacks for hashing and JWT verification.
      */
@@ -834,14 +963,14 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
             sub: string;
             wallet_link?: string | undefined;
             wallet_name?: string | undefined;
-            aud?: string | undefined;
+            aud?: string | string[] | undefined;
             jti?: string | undefined;
             nbf?: number | undefined;
             nonce?: string | undefined;
             status?: Record<string, any> | undefined;
             trust_chain?: [string, ...string[]] | undefined;
         };
-        signer: _openid4vc_oauth2.JwtSignerWithJwk;
+        signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
     };
     clientAttestationPop: {
         header: {
@@ -928,9 +1057,10 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
             } | undefined;
             nbf?: number | undefined;
             status?: Record<string, any> | undefined;
+            sub?: string | undefined;
             trust_chain?: [string, ...string[]] | undefined;
         };
-        signer: _openid4vc_oauth2.JwtSignerWithJwk;
+        signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
     };
 }>;
 
@@ -944,15 +1074,15 @@ interface BaseVerifyWalletAttestationJwtOptions {
  */
 interface BaseWalletAttestationOptions {
     callbacks: Pick<CallbackContext, "hash" | "signJwt">;
-    dpopJwkPublic: ClientAttestationJwtPayload["cnf"]["jwk"];
+    dpopJwkPublic: NonNullable<NonNullable<JwtPayload["cnf"]>["jwk"]>;
     expiresAt?: Date;
     issuer: string;
     walletLink?: string;
     walletName?: string;
 }
-declare const zOauthClientAttestationHeader: z.ZodLiteral<"OAuth-Client-Attestation">;
+declare const zOauthClientAttestationHeader: z$1.ZodLiteral<"OAuth-Client-Attestation">;
 declare const oauthClientAttestationHeader: "OAuth-Client-Attestation";
-declare const zOauthClientAttestationPopHeader: z.ZodLiteral<"OAuth-Client-Attestation-PoP">;
+declare const zOauthClientAttestationPopHeader: z$1.ZodLiteral<"OAuth-Client-Attestation-PoP">;
 declare const oauthClientAttestationPopHeader: "OAuth-Client-Attestation-PoP";
 
 interface VerifyWalletAttestationJwtOptionsV1_0 extends BaseVerifyWalletAttestationJwtOptions {
@@ -965,7 +1095,7 @@ type VerifiedWalletAttestationJwtV1_0 = Awaited<ReturnType<typeof verifyWalletAt
  * @param options - v1.0 verification options.
  * @returns Decoded and verified wallet attestation JWT data.
  * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.0 schema.
- * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
+ * @throws {JwtParseError} If the JWT cannot be decoded.
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
  */
 declare function verifyWalletAttestationJwt$3(options: VerifyWalletAttestationJwtOptionsV1_0): Promise<{
@@ -1050,14 +1180,14 @@ declare function verifyWalletAttestationJwt$3(options: VerifyWalletAttestationJw
         sub: string;
         wallet_link?: string | undefined;
         wallet_name?: string | undefined;
-        aud?: string | undefined;
+        aud?: string | string[] | undefined;
         jti?: string | undefined;
         nbf?: number | undefined;
         nonce?: string | undefined;
         status?: Record<string, any> | undefined;
         trust_chain?: [string, ...string[]] | undefined;
     };
-    signer: _openid4vc_oauth2.JwtSignerWithJwk;
+    signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
 }>;
 
 interface VerifyWalletAttestationJwtOptionsV1_3 extends BaseVerifyWalletAttestationJwtOptions {
@@ -1070,7 +1200,7 @@ type VerifiedWalletAttestationJwtV1_3 = Awaited<ReturnType<typeof verifyWalletAt
  * @param options - v1.3 verification options.
  * @returns Decoded and verified wallet attestation JWT data.
  * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.3 schema.
- * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
+ * @throws {JwtParseError} If the JWT cannot be decoded.
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
  */
 declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJwtOptionsV1_3): Promise<{
@@ -1161,12 +1291,12 @@ declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJw
         } | undefined;
         wallet_link?: string | undefined;
         wallet_name?: string | undefined;
-        aud?: string | undefined;
+        aud?: string | string[] | undefined;
         jti?: string | undefined;
         nonce?: string | undefined;
         trust_chain?: [string, ...string[]] | undefined;
     };
-    signer: _openid4vc_oauth2.JwtSignerWithJwk;
+    signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
 }>;
 
 interface VerifyWalletAttestationJwtOptionsV1_4 extends BaseVerifyWalletAttestationJwtOptions {
@@ -1179,7 +1309,7 @@ type VerifiedWalletAttestationJwtV1_4 = Awaited<ReturnType<typeof verifyWalletAt
  * @param options - v1.4 verification options.
  * @returns Decoded and verified wallet attestation JWT data.
  * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.4 schema.
- * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
+ * @throws {JwtParseError} If the JWT cannot be decoded.
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
  */
 declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJwtOptionsV1_4): Promise<{
@@ -1264,13 +1394,13 @@ declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJw
         wallet_link: string;
         wallet_name: string;
         nbf?: number | undefined;
-        aud?: string | undefined;
+        aud?: string | string[] | undefined;
         jti?: string | undefined;
         nonce?: string | undefined;
         status?: Record<string, any> | undefined;
         trust_chain?: [string, ...string[]] | undefined;
     };
-    signer: _openid4vc_oauth2.JwtSignerWithJwk;
+    signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
 }>;
 
 type VerifiedWalletAttestationJwt = VerifiedWalletAttestationJwtV1_0 | VerifiedWalletAttestationJwtV1_3 | VerifiedWalletAttestationJwtV1_4;
@@ -1281,7 +1411,7 @@ type VerifyWalletAttestationJwtOptions = VerifyWalletAttestationJwtOptionsV1_0 |
  * @param options - Version-specific wallet attestation verification options.
  * @returns Decoded and verified wallet attestation data for the configured version.
  * @throws {ValidationError} If JWT header or payload validation fails.
- * @throws {Oauth2JwtParseError} If the attestation JWT cannot be decoded.
+ * @throws {JwtParseError} If the attestation JWT cannot be decoded.
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
  * @throws {ItWalletSpecsVersionError} If the configured version is unsupported.
  */
@@ -1389,15 +1519,11 @@ interface VerifyAccessTokenRequestDpop {
      */
     jwt: string;
 }
-interface VerifyAccessTokenRequestOptions {
-    /**
-     * The access token request to verify
-     */
-    accessTokenRequest: AccessTokenRequest;
+interface BaseVerifyAccessTokenRequestOptions {
     /**
      * The authorization server metadata
      */
-    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
+    authorizationServerMetadata: BaseAuthorizationServerMetadata;
     /**
      * Callbacks used during verification
      */
@@ -1406,15 +1532,29 @@ interface VerifyAccessTokenRequestOptions {
      * Options for verifying the client attestation
      */
     clientAttestation: ClientAttestationOptions;
-    /**
-     * The expiration date of the authorization code
-     */
-    codeExpiresAt?: Date;
     config: IoWalletSdkConfig;
     /**
      * The dpop verification options
      */
     dpop: VerifyAccessTokenRequestDpop;
+    /**
+     * The current time to use when verifying the JWTs.
+     * If not provided current time will be used.
+     *
+     * @default new Date()
+     */
+    now?: Date;
+    /**
+     * The HTTP request information
+     */
+    request: RequestLike;
+}
+interface VerifyAccessTokenRequestOptions<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0> extends BaseVerifyAccessTokenRequestOptions {
+    /**
+     * The expiration date of the authorization code
+     */
+    codeExpiresAt?: Date;
+    config: IoWalletSdkConfig<V>;
     /**
      * The expected authorization code
      */
@@ -1423,22 +1563,25 @@ interface VerifyAccessTokenRequestOptions {
      * The parsed authorization code grant
      */
     grant: ParsedAccessTokenAuthorizationCodeRequestGrant;
-    /**
-     * The current time to use when verifying the JWTs.
-     * If not provided current time will be used.
-     *
-     * @default new Date()
-     */
-    now?: Date;
     /**
      * The pkce options including code verifier, challenge and method
      */
     pkce: VerifyAccessTokenRequestPkce;
-    /**
-     * The HTTP request information
-     */
-    request: RequestLike$1;
 }
+interface VerifyPreAuthorizedCodeAccessTokenRequestOptions extends BaseVerifyAccessTokenRequestOptions {
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
+    /** The pre-authorized code stored by the authorization server. */
+    expectedPreAuthorizedCode: string;
+    /** The stored transaction code, if one was required by the credential offer. */
+    expectedTxCode?: string;
+    /** The parsed pre-authorized code grant */
+    grant: ParsedAccessTokenPreAuthorizedCodeRequestGrant;
+    /** The expiration date stored with the pre-authorized code. */
+    preAuthorizedCodeExpiresAt?: Date;
+}
+type SupportedAccessTokenVerificationOptionsV1_4 = VerifyAccessTokenRequestOptions<ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4>;
+type SupportedAccessTokenVerificationOptionsAPTITUDE = VerifyAccessTokenRequestOptions<ItWalletSpecsVersion.APTITUDE> | VerifyPreAuthorizedCodeAccessTokenRequestOptions;
+type SupportedAccessTokenVerificationOptions = SupportedAccessTokenVerificationOptionsAPTITUDE | SupportedAccessTokenVerificationOptionsV1_4;
 interface VerifyAccessTokenRequestResult {
     clientAttestation: {
         clientAttestation: VerifiedWalletAttestationJwt;
@@ -1454,18 +1597,26 @@ interface VerifyAccessTokenRequestResult {
     };
 }
 /**
- * Verifies an authorization code token request by validating PKCE, DPoP, and client attestation.
+ * Verifies an authorization-code or pre-authorized-code token request.
  *
- * This function performs comprehensive validation of an OAuth 2.0 authorization code token request
- * according to Italian IT-Wallet specifications, including:
- * - PKCE code verifier validation against the stored code challenge
+ * Both grants retain the SDK's IT-Wallet DPoP and client attestation requirements:
+ * - PKCE verification against the stored code challenge for authorization-code requests only
  * - DPoP proof JWT verification and JWK thumbprint extraction
  * - Client attestation JWT and attestation PoP JWT verification
- * - Authorization code validity and expiration checks
- *
- * @param options - Configuration options for token request verification
+ * - Authorization code or pre-authorized code validity and expiration checks
+ * - Transaction code verification when required by the credential offer
+ *
+ * The caller must enforce single-use redemption of codes atomically when issuing
+ * the token, and limit transaction-code attempts. This verifier does not store state.
+ * The upstream verifier allows optional DPoP and client attestation; the local
+ * implementation retains the SDK's required security checks and error types.
+ *
+ * * Version Differences:
+ * - APTITUDE: add support for pre-authorized-code grant type.
+ * *
+ * @param options - Configuration options for token request verification and version config
  * @returns A promise that resolves with verified client attestation and DPoP information
- * @throws {Oauth2Error} If the authorization code is invalid or expired
+ * @throws {Oauth2Error} If the grant code is invalid or expired, or the transaction code is missing, unexpected or invalid
  * @throws {Oauth2Error} If PKCE verification fails
  * @throws {Oauth2Error} If DPoP verification fails
  * @throws {Oauth2Error} If client attestation verification fails
@@ -1490,108 +1641,108 @@ interface VerifyAccessTokenRequestResult {
  * });
  * ```
  */
-declare function verifyAccessTokenRequest(options: VerifyAccessTokenRequestOptions): Promise<VerifyAccessTokenRequestResult>;
+declare function verifyAccessTokenRequest(options: SupportedAccessTokenVerificationOptionsAPTITUDE | SupportedAccessTokenVerificationOptionsV1_4): Promise<VerifyAccessTokenRequestResult>;
 
-declare const zAuthorizationRequestV1_0: z.ZodObject<{
-    authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        credential_configuration_id: z.ZodString;
-        type: z.ZodLiteral<"openid_credential">;
-    }, z.core.$strip>, z.ZodObject<{
-        challenge_method: z.ZodLiteral<"mrtd+ias">;
-        challenge_redirect_uri: z.ZodURL;
-        idphinting: z.ZodURL;
-        type: z.ZodLiteral<"it_l2+document_proof">;
-    }, z.core.$strip>], "type">>>;
-    client_id: z.ZodString;
-    code_challenge: z.ZodString;
-    code_challenge_method: z.ZodString;
-    issuer_state: z.ZodOptional<z.ZodString>;
-    jti: z.ZodString;
-    redirect_uri: z.ZodURL;
-    response_type: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
-    response_mode: z.ZodString;
-}, z.core.$loose>;
-type AuthorizationRequestV1_0 = z.infer<typeof zAuthorizationRequestV1_0>;
-declare const zAuthorizationRequestV1_3: z.ZodObject<{
-    authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        credential_configuration_id: z.ZodString;
-        type: z.ZodLiteral<"openid_credential">;
-    }, z.core.$strip>, z.ZodObject<{
-        challenge_method: z.ZodLiteral<"mrtd+ias">;
-        challenge_redirect_uri: z.ZodURL;
-        idphinting: z.ZodURL;
-        type: z.ZodLiteral<"it_l2+document_proof">;
-    }, z.core.$strip>], "type">>>;
-    client_id: z.ZodString;
-    code_challenge: z.ZodString;
-    code_challenge_method: z.ZodString;
-    issuer_state: z.ZodOptional<z.ZodString>;
-    jti: z.ZodString;
-    redirect_uri: z.ZodURL;
-    response_type: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
-}, z.core.$loose>;
-type AuthorizationRequestV1_3 = z.infer<typeof zAuthorizationRequestV1_3>;
-declare const zPushedAuthorizationRequestSigned: z.ZodObject<{
-    client_id: z.ZodString;
-    pkceCodeVerifier: z.ZodString;
-    request: z.ZodString;
-}, z.core.$loose>;
-type PushedAuthorizationRequestSigned = z.infer<typeof zPushedAuthorizationRequestSigned>;
-declare const zPushedAuthorizationRequestUnsignedV1_0: z.ZodObject<{
-    authorizationRequest: z.ZodObject<{
-        authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            credential_configuration_id: z.ZodString;
-            type: z.ZodLiteral<"openid_credential">;
-        }, z.core.$strip>, z.ZodObject<{
-            challenge_method: z.ZodLiteral<"mrtd+ias">;
-            challenge_redirect_uri: z.ZodURL;
-            idphinting: z.ZodURL;
-            type: z.ZodLiteral<"it_l2+document_proof">;
-        }, z.core.$strip>], "type">>>;
-        client_id: z.ZodString;
-        code_challenge: z.ZodString;
-        code_challenge_method: z.ZodString;
-        issuer_state: z.ZodOptional<z.ZodString>;
-        jti: z.ZodString;
-        redirect_uri: z.ZodURL;
-        response_type: z.ZodString;
-        scope: z.ZodOptional<z.ZodString>;
-        state: z.ZodString;
-        response_mode: z.ZodString;
-    }, z.core.$loose>;
-    client_id: z.ZodString;
-    pkceCodeVerifier: z.ZodString;
-}, z.core.$loose>;
-type PushedAuthorizationRequestUnsignedV1_0 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_0>;
-declare const zPushedAuthorizationRequestUnsignedV1_3: z.ZodObject<{
-    authorizationRequest: z.ZodObject<{
-        authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            credential_configuration_id: z.ZodString;
-            type: z.ZodLiteral<"openid_credential">;
-        }, z.core.$strip>, z.ZodObject<{
-            challenge_method: z.ZodLiteral<"mrtd+ias">;
-            challenge_redirect_uri: z.ZodURL;
-            idphinting: z.ZodURL;
-            type: z.ZodLiteral<"it_l2+document_proof">;
-        }, z.core.$strip>], "type">>>;
-        client_id: z.ZodString;
-        code_challenge: z.ZodString;
-        code_challenge_method: z.ZodString;
-        issuer_state: z.ZodOptional<z.ZodString>;
-        jti: z.ZodString;
-        redirect_uri: z.ZodURL;
-        response_type: z.ZodString;
-        scope: z.ZodOptional<z.ZodString>;
-        state: z.ZodString;
-    }, z.core.$loose>;
-    client_id: z.ZodString;
-    pkceCodeVerifier: z.ZodString;
-}, z.core.$loose>;
-type PushedAuthorizationRequestUnsignedV1_3 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_3>;
+declare const zAuthorizationRequestV1_0: z$1.ZodObject<{
+    authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
+        credential_configuration_id: z$1.ZodString;
+        type: z$1.ZodLiteral<"openid_credential">;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+        challenge_method: z$1.ZodLiteral<"mrtd+ias">;
+        challenge_redirect_uri: z$1.ZodURL;
+        idphinting: z$1.ZodURL;
+        type: z$1.ZodLiteral<"it_l2+document_proof">;
+    }, z$1.core.$strip>], "type">>>;
+    client_id: z$1.ZodString;
+    code_challenge: z$1.ZodString;
+    code_challenge_method: z$1.ZodString;
+    issuer_state: z$1.ZodOptional<z$1.ZodString>;
+    jti: z$1.ZodString;
+    redirect_uri: z$1.ZodURL;
+    response_type: z$1.ZodString;
+    scope: z$1.ZodOptional<z$1.ZodString>;
+    state: z$1.ZodString;
+    response_mode: z$1.ZodString;
+}, z$1.core.$loose>;
+type AuthorizationRequestV1_0 = z$1.infer<typeof zAuthorizationRequestV1_0>;
+declare const zAuthorizationRequestV1_3: z$1.ZodObject<{
+    authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
+        credential_configuration_id: z$1.ZodString;
+        type: z$1.ZodLiteral<"openid_credential">;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+        challenge_method: z$1.ZodLiteral<"mrtd+ias">;
+        challenge_redirect_uri: z$1.ZodURL;
+        idphinting: z$1.ZodURL;
+        type: z$1.ZodLiteral<"it_l2+document_proof">;
+    }, z$1.core.$strip>], "type">>>;
+    client_id: z$1.ZodString;
+    code_challenge: z$1.ZodString;
+    code_challenge_method: z$1.ZodString;
+    issuer_state: z$1.ZodOptional<z$1.ZodString>;
+    jti: z$1.ZodString;
+    redirect_uri: z$1.ZodURL;
+    response_type: z$1.ZodString;
+    scope: z$1.ZodOptional<z$1.ZodString>;
+    state: z$1.ZodString;
+}, z$1.core.$loose>;
+type AuthorizationRequestV1_3 = z$1.infer<typeof zAuthorizationRequestV1_3>;
+declare const zPushedAuthorizationRequestSigned: z$1.ZodObject<{
+    client_id: z$1.ZodString;
+    pkceCodeVerifier: z$1.ZodString;
+    request: z$1.ZodString;
+}, z$1.core.$loose>;
+type PushedAuthorizationRequestSigned = z$1.infer<typeof zPushedAuthorizationRequestSigned>;
+declare const zPushedAuthorizationRequestUnsignedV1_0: z$1.ZodObject<{
+    authorizationRequest: z$1.ZodObject<{
+        authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
+            credential_configuration_id: z$1.ZodString;
+            type: z$1.ZodLiteral<"openid_credential">;
+        }, z$1.core.$strip>, z$1.ZodObject<{
+            challenge_method: z$1.ZodLiteral<"mrtd+ias">;
+            challenge_redirect_uri: z$1.ZodURL;
+            idphinting: z$1.ZodURL;
+            type: z$1.ZodLiteral<"it_l2+document_proof">;
+        }, z$1.core.$strip>], "type">>>;
+        client_id: z$1.ZodString;
+        code_challenge: z$1.ZodString;
+        code_challenge_method: z$1.ZodString;
+        issuer_state: z$1.ZodOptional<z$1.ZodString>;
+        jti: z$1.ZodString;
+        redirect_uri: z$1.ZodURL;
+        response_type: z$1.ZodString;
+        scope: z$1.ZodOptional<z$1.ZodString>;
+        state: z$1.ZodString;
+        response_mode: z$1.ZodString;
+    }, z$1.core.$loose>;
+    client_id: z$1.ZodString;
+    pkceCodeVerifier: z$1.ZodString;
+}, z$1.core.$loose>;
+type PushedAuthorizationRequestUnsignedV1_0 = z$1.infer<typeof zPushedAuthorizationRequestUnsignedV1_0>;
+declare const zPushedAuthorizationRequestUnsignedV1_3: z$1.ZodObject<{
+    authorizationRequest: z$1.ZodObject<{
+        authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
+            credential_configuration_id: z$1.ZodString;
+            type: z$1.ZodLiteral<"openid_credential">;
+        }, z$1.core.$strip>, z$1.ZodObject<{
+            challenge_method: z$1.ZodLiteral<"mrtd+ias">;
+            challenge_redirect_uri: z$1.ZodURL;
+            idphinting: z$1.ZodURL;
+            type: z$1.ZodLiteral<"it_l2+document_proof">;
+        }, z$1.core.$strip>], "type">>>;
+        client_id: z$1.ZodString;
+        code_challenge: z$1.ZodString;
+        code_challenge_method: z$1.ZodString;
+        issuer_state: z$1.ZodOptional<z$1.ZodString>;
+        jti: z$1.ZodString;
+        redirect_uri: z$1.ZodURL;
+        response_type: z$1.ZodString;
+        scope: z$1.ZodOptional<z$1.ZodString>;
+        state: z$1.ZodString;
+    }, z$1.core.$loose>;
+    client_id: z$1.ZodString;
+    pkceCodeVerifier: z$1.ZodString;
+}, z$1.core.$loose>;
+type PushedAuthorizationRequestUnsignedV1_3 = z$1.infer<typeof zPushedAuthorizationRequestUnsignedV1_3>;
 /**
  * Union type for Pushed Authorization Request - can be either signed (JAR) or unsigned.
  * The variant depends on the Authorization Server's require_signed_request_object metadata.
@@ -1611,11 +1762,11 @@ declare function isPushedAuthorizationRequestSigned(par: PushedAuthorizationRequ
  * @returns True when the request contains version-specific `authorizationRequest` data.
  */
 declare function isPushedAuthorizationRequestUnsigned(par: PushedAuthorizationRequest): par is PushedAuthorizationRequestUnsignedV1_0 | PushedAuthorizationRequestUnsignedV1_3;
-declare const zPushedAuthorizationResponse: z.ZodObject<{
-    expires_in: z.ZodNumber;
-    request_uri: z.ZodString;
-}, z.core.$loose>;
-type PushedAuthorizationResponse = z.infer<typeof zPushedAuthorizationResponse>;
+declare const zPushedAuthorizationResponse: z$1.ZodObject<{
+    expires_in: z$1.ZodNumber;
+    request_uri: z$1.ZodString;
+}, z$1.core.$loose>;
+type PushedAuthorizationResponse = z$1.infer<typeof zPushedAuthorizationResponse>;
 
 type AuthorizationRequest$1 = AuthorizationRequestV1_0 | AuthorizationRequestV1_3;
 interface BaseCreatePushedAuthorizationRequestOptions<V extends ItWalletSpecsVersion> {
@@ -1646,7 +1797,7 @@ interface BaseCreatePushedAuthorizationRequestOptions<V extends ItWalletSpecsVer
      * MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation.
      */
     clientId: string;
-    codeChallengeMethodsSupported: ItWalletAuthorizationServerMetadata["code_challenge_methods_supported"];
+    codeChallengeMethodsSupported: BaseAuthorizationServerMetadata["code_challenge_methods_supported"];
     config: IoWalletSdkConfig<V>;
     /**
      * DPoP options. Required when `require_signed_request_object` is `true`
@@ -1877,7 +2028,7 @@ interface fetchPushedAuthorizationResponseOptions {
 declare function fetchPushedAuthorizationResponse(options: fetchPushedAuthorizationResponseOptions): Promise<PushedAuthorizationResponse>;
 
 interface ParseAuthorizationRequestOptions {
-    request: RequestLike$1;
+    request: RequestLike;
 }
 interface ParseAuthorizationRequestResult {
     /**
@@ -1920,7 +2071,7 @@ interface ParsePushedAuthorizationRequestOptions {
     authorizationRequest: unknown;
     callbacks: Pick<CallbackContext, "fetch">;
     config: IoWalletSdkConfig;
-    request: RequestLike$1;
+    request: RequestLike;
 }
 interface ParsePushedAuthorizationRequestResult extends ParseAuthorizationRequestResult {
     authorizationRequest: AuthorizationRequest;
@@ -1990,7 +2141,7 @@ interface VerifyAuthorizationRequestOptions {
     authorizationRequest: {
         client_id?: string;
     };
-    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
+    authorizationServerMetadata: BaseAuthorizationServerMetadata;
     callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
     clientAttestation: ClientAttestationOptions;
     config: IoWalletSdkConfig;
@@ -2002,7 +2153,7 @@ interface VerifyAuthorizationRequestOptions {
      * @default new Date()
      */
     now?: Date;
-    request: RequestLike$1;
+    request: RequestLike;
 }
 /**
  * Verifies an authorization request by validating DPoP and client attestation credentials.
@@ -2060,375 +2211,139 @@ interface VerifyAuthorizationRequestOptions {
  */
 declare function verifyAuthorizationRequest(options: VerifyAuthorizationRequestOptions): Promise<VerifyAuthorizationRequestResult>;
 
-declare const zTrustChain: z.ZodTuple<[z.ZodString], z.ZodString>;
-type TrustChain = z.infer<typeof zTrustChain>;
-declare const zCertificateChain: z.ZodArray<z.ZodString>;
-type CertificateChain = z.infer<typeof zCertificateChain>;
-declare const zAlgValueNotNone: z.ZodString;
-interface RequestLike {
-    headers: FetchHeaders;
-    method: HttpMethod;
-    url: string;
-}
+declare const zJarAuthorizationRequest: z$1.ZodObject<{
+    client_id: z$1.ZodOptional<z$1.ZodString>;
+    request: z$1.ZodOptional<z$1.ZodString>;
+    request_uri: z$1.ZodOptional<z$1.ZodURL>;
+}, z$1.core.$loose>;
+type JarAuthorizationRequest = z$1.infer<typeof zJarAuthorizationRequest>;
+declare const zJarRequestObjectPayload: z$1.ZodObject<{
+    client_id: z$1.ZodString;
+    aud: z$1.ZodOptional<z$1.ZodUnion<[z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
+    cnf: z$1.ZodOptional<z$1.ZodObject<{
+        jkt: z$1.ZodOptional<z$1.ZodString>;
+        jwk: z$1.ZodOptional<z$1.ZodObject<{
+            alg: z$1.ZodOptional<z$1.ZodString>;
+            crv: z$1.ZodOptional<z$1.ZodString>;
+            d: z$1.ZodOptional<z$1.ZodString>;
+            dp: z$1.ZodOptional<z$1.ZodString>;
+            dq: z$1.ZodOptional<z$1.ZodString>;
+            e: z$1.ZodOptional<z$1.ZodString>;
+            ext: z$1.ZodOptional<z$1.ZodBoolean>;
+            k: z$1.ZodOptional<z$1.ZodString>;
+            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            kid: z$1.ZodOptional<z$1.ZodString>;
+            kty: z$1.ZodString;
+            n: z$1.ZodOptional<z$1.ZodString>;
+            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+                d: z$1.ZodOptional<z$1.ZodString>;
+                r: z$1.ZodOptional<z$1.ZodString>;
+                t: z$1.ZodOptional<z$1.ZodString>;
+            }, z$1.core.$loose>>>;
+            p: z$1.ZodOptional<z$1.ZodString>;
+            q: z$1.ZodOptional<z$1.ZodString>;
+            qi: z$1.ZodOptional<z$1.ZodString>;
+            use: z$1.ZodOptional<z$1.ZodString>;
+            x: z$1.ZodOptional<z$1.ZodString>;
+            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            x5t: z$1.ZodOptional<z$1.ZodString>;
+            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+            x5u: z$1.ZodOptional<z$1.ZodString>;
+            y: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>;
+    }, z$1.core.$loose>>;
+    exp: z$1.ZodOptional<z$1.ZodNumber>;
+    iat: z$1.ZodOptional<z$1.ZodNumber>;
+    iss: z$1.ZodOptional<z$1.ZodString>;
+    jti: z$1.ZodOptional<z$1.ZodString>;
+    nbf: z$1.ZodOptional<z$1.ZodNumber>;
+    nonce: z$1.ZodOptional<z$1.ZodString>;
+    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
+    sub: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+}, z$1.core.$loose>;
+type JarRequestObjectPayload = z$1.infer<typeof zJarRequestObjectPayload>;
+declare const zSignedAuthorizationRequestJwtHeaderTyp: z$1.ZodLiteral<"oauth-authz-req+jwt">;
+declare const zJarRequestObjectHeader: z$1.ZodObject<{
+    typ: z$1.ZodLiteral<"oauth-authz-req+jwt">;
+    alg: z$1.ZodString;
+    jwk: z$1.ZodOptional<z$1.ZodObject<{
+        alg: z$1.ZodOptional<z$1.ZodString>;
+        crv: z$1.ZodOptional<z$1.ZodString>;
+        d: z$1.ZodOptional<z$1.ZodString>;
+        dp: z$1.ZodOptional<z$1.ZodString>;
+        dq: z$1.ZodOptional<z$1.ZodString>;
+        e: z$1.ZodOptional<z$1.ZodString>;
+        ext: z$1.ZodOptional<z$1.ZodBoolean>;
+        k: z$1.ZodOptional<z$1.ZodString>;
+        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        kid: z$1.ZodOptional<z$1.ZodString>;
+        kty: z$1.ZodString;
+        n: z$1.ZodOptional<z$1.ZodString>;
+        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            d: z$1.ZodOptional<z$1.ZodString>;
+            r: z$1.ZodOptional<z$1.ZodString>;
+            t: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>>;
+        p: z$1.ZodOptional<z$1.ZodString>;
+        q: z$1.ZodOptional<z$1.ZodString>;
+        qi: z$1.ZodOptional<z$1.ZodString>;
+        use: z$1.ZodOptional<z$1.ZodString>;
+        x: z$1.ZodOptional<z$1.ZodString>;
+        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        x5t: z$1.ZodOptional<z$1.ZodString>;
+        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+        x5u: z$1.ZodOptional<z$1.ZodString>;
+        y: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$loose>>;
+    kid: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+}, z$1.core.$loose>;
+type JarRequestObjectHeader = z$1.infer<typeof zJarRequestObjectHeader>;
+declare const signedAuthorizationRequestJwtHeaderTyp: "oauth-authz-req+jwt";
+declare const jwtAuthorizationRequestJwtHeaderTyp: "jwt";
 
-declare const MAX_JTI_LENGTH = 256;
-interface JwtSignerDid {
-    alg: string;
-    didUrl: string;
-    /**
-     * The key id that should be used for signing. You need to make sure the kid actually matches
-     * with the key associated with the didUrl.
-     */
-    kid?: string;
-    method: "did";
+interface VerifyJarRequestOptions {
+    authorizationRequestJwt: string;
+    callbacks: Pick<CallbackContext, "verifyJwt">;
+    jarRequestParams: {
+        client_id?: string;
+    };
+    jwtSigner: JwtSigner;
+    now?: Date;
 }
-interface JwtSignerJwk {
-    alg: string;
-    /**
-     * The key id that should be used for signing. You need to make sure the kid actually matches
-     * with the key associated with the jwk.
-     *
-     * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't
-     * be included in the JWT header.
-     */
-    kid?: string;
-    method: "jwk";
-    publicJwk: Jwk;
+interface VerifiedJarRequest {
+    authorizationRequestPayload: JarRequestObjectPayload;
+    jwt: {
+        payload: JarRequestObjectPayload;
+    } & Omit<ReturnType<typeof decodeJwt>, "payload">;
+    signer: JwtSignerWithJwk;
 }
-interface JwtSignerX5c {
-    alg: string;
+/**
+ * Verifies a JAR (JWT Secured Authorization Request) request by validating and verifying signatures.
+ *
+ * @param options - The input parameters
+ * @param options.jarRequestParams - The JAR authorization request parameters
+ * @param options.callbacks - Context containing the relevant Jose crypto operations
+ * @returns The verified authorization request parameters and metadata
+ */
+declare function verifyJarRequest(options: VerifyJarRequestOptions): Promise<VerifiedJarRequest>;
+
+interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestResult {
     /**
-     * The key id that should be used for signing. You need to make sure the kid actually matches
-     * with the key associated with the leaf certificate.
+     * The verified JAR request, if `authorizationRequestJwt` was provided
      */
-    kid?: string;
-    method: "x5c";
-    trustChain?: TrustChain;
-    x5c: string[];
+    jar?: VerifiedJarRequest;
 }
-interface JwtSignerFederation {
-    alg: string;
+interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizationRequestOptions, "authorizationServerMetadata"> {
     /**
-     * The key id that should be used for signing. You need to make sure the kid actually matches
-     * with a key present in the federation.
-     */
-    kid: string;
-    method: "federation";
-    trustChain?: TrustChain;
-}
-interface JwtSignerCustom {
-    alg: string;
-    /**
-     * The key id that should be used for signing.
-     */
-    kid?: string;
-    method: "custom";
-}
-type JwtSigner = JwtSignerCustom | JwtSignerDid | JwtSignerFederation | JwtSignerJwk | JwtSignerX5c;
-type JwtSignerWithJwk = {
-    publicJwk: Jwk;
-} & JwtSigner;
-type JweEncryptor = {
-    /**
-     * base64-url encoded apu
-     */
-    apu?: string;
-    /**
-     * base64-url encoded apv
-     */
-    apv?: string;
-    enc: string;
-} & JwtSignerJwk;
-declare const zCompactJwt: z.ZodString;
-declare const zJwtConfirmationPayload: z.ZodObject<{
-    jkt: z.ZodOptional<z.ZodString>;
-    jwk: z.ZodOptional<z.ZodObject<{
-        alg: z.ZodOptional<z.ZodString>;
-        crv: z.ZodOptional<z.ZodString>;
-        d: z.ZodOptional<z.ZodString>;
-        dp: z.ZodOptional<z.ZodString>;
-        dq: z.ZodOptional<z.ZodString>;
-        e: z.ZodOptional<z.ZodString>;
-        ext: z.ZodOptional<z.ZodBoolean>;
-        k: z.ZodOptional<z.ZodString>;
-        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        kid: z.ZodOptional<z.ZodString>;
-        kty: z.ZodString;
-        n: z.ZodOptional<z.ZodString>;
-        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            d: z.ZodOptional<z.ZodString>;
-            r: z.ZodOptional<z.ZodString>;
-            t: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>>;
-        p: z.ZodOptional<z.ZodString>;
-        q: z.ZodOptional<z.ZodString>;
-        qi: z.ZodOptional<z.ZodString>;
-        use: z.ZodOptional<z.ZodString>;
-        x: z.ZodOptional<z.ZodString>;
-        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        x5t: z.ZodOptional<z.ZodString>;
-        "x5t#S256": z.ZodOptional<z.ZodString>;
-        x5u: z.ZodOptional<z.ZodString>;
-        y: z.ZodOptional<z.ZodString>;
-    }, z.core.$loose>>;
-}, z.core.$loose>;
-declare const zJwtPayload: z.ZodObject<{
-    aud: z.ZodOptional<z.ZodString>;
-    cnf: z.ZodOptional<z.ZodObject<{
-        jkt: z.ZodOptional<z.ZodString>;
-        jwk: z.ZodOptional<z.ZodObject<{
-            alg: z.ZodOptional<z.ZodString>;
-            crv: z.ZodOptional<z.ZodString>;
-            d: z.ZodOptional<z.ZodString>;
-            dp: z.ZodOptional<z.ZodString>;
-            dq: z.ZodOptional<z.ZodString>;
-            e: z.ZodOptional<z.ZodString>;
-            ext: z.ZodOptional<z.ZodBoolean>;
-            k: z.ZodOptional<z.ZodString>;
-            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            kid: z.ZodOptional<z.ZodString>;
-            kty: z.ZodString;
-            n: z.ZodOptional<z.ZodString>;
-            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                d: z.ZodOptional<z.ZodString>;
-                r: z.ZodOptional<z.ZodString>;
-                t: z.ZodOptional<z.ZodString>;
-            }, z.core.$loose>>>;
-            p: z.ZodOptional<z.ZodString>;
-            q: z.ZodOptional<z.ZodString>;
-            qi: z.ZodOptional<z.ZodString>;
-            use: z.ZodOptional<z.ZodString>;
-            x: z.ZodOptional<z.ZodString>;
-            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            x5t: z.ZodOptional<z.ZodString>;
-            "x5t#S256": z.ZodOptional<z.ZodString>;
-            x5u: z.ZodOptional<z.ZodString>;
-            y: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>;
-    }, z.core.$loose>>;
-    exp: z.ZodOptional<z.ZodNumber>;
-    iat: z.ZodOptional<z.ZodNumber>;
-    iss: z.ZodOptional<z.ZodString>;
-    jti: z.ZodOptional<z.ZodString>;
-    nbf: z.ZodOptional<z.ZodNumber>;
-    nonce: z.ZodOptional<z.ZodString>;
-    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-}, z.core.$loose>;
-type JwtPayload = z.infer<typeof zJwtPayload>;
-declare const zJwtHeader: z.ZodObject<{
-    alg: z.ZodString;
-    jwk: z.ZodOptional<z.ZodObject<{
-        alg: z.ZodOptional<z.ZodString>;
-        crv: z.ZodOptional<z.ZodString>;
-        d: z.ZodOptional<z.ZodString>;
-        dp: z.ZodOptional<z.ZodString>;
-        dq: z.ZodOptional<z.ZodString>;
-        e: z.ZodOptional<z.ZodString>;
-        ext: z.ZodOptional<z.ZodBoolean>;
-        k: z.ZodOptional<z.ZodString>;
-        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        kid: z.ZodOptional<z.ZodString>;
-        kty: z.ZodString;
-        n: z.ZodOptional<z.ZodString>;
-        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            d: z.ZodOptional<z.ZodString>;
-            r: z.ZodOptional<z.ZodString>;
-            t: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>>;
-        p: z.ZodOptional<z.ZodString>;
-        q: z.ZodOptional<z.ZodString>;
-        qi: z.ZodOptional<z.ZodString>;
-        use: z.ZodOptional<z.ZodString>;
-        x: z.ZodOptional<z.ZodString>;
-        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        x5t: z.ZodOptional<z.ZodString>;
-        "x5t#S256": z.ZodOptional<z.ZodString>;
-        x5u: z.ZodOptional<z.ZodString>;
-        y: z.ZodOptional<z.ZodString>;
-    }, z.core.$loose>>;
-    kid: z.ZodOptional<z.ZodString>;
-    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-    typ: z.ZodOptional<z.ZodString>;
-    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$loose>;
-type JwtHeader = z.infer<typeof zJwtHeader>;
-
-interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
-    /**
-     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
-     */
-    errorMessagePrefix?: string;
-    /**
-     * Schema to use for validating the header. If not provided the
-     * default `zJwtHeader` schema will be used
-     */
-    headerSchema?: HeaderSchema;
-    /**
-     * The compact encoded jwt
-     */
-    jwt: string;
-    /**
-     * Schema to use for validating the payload. If not provided the
-     * default `zJwtPayload` schema will be used
-     */
-    payloadSchema?: PayloadSchema;
-}
-interface DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> {
-    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
-    payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;
-    signature: string;
-}
-/**
- * Decodes a compact JWT and validates its header and payload with Zod schemas.
- *
- * This helper does not verify the JWT signature.
- *
- * @param options - Decode options.
- * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
- * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
- * @param options.jwt - Compact JWT to decode.
- * @param options.payloadSchema - Optional schema for the JWT payload; defaults to `zJwtPayload`.
- * @returns Decoded and schema-validated JWT header, payload, and signature segment.
- * @throws {Oauth2JwtParseError} If the JWT shape or base64url JSON segments are invalid.
- * @throws {ValidationError} If header or payload schema validation fails.
- */
-declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
-type IsSchemaProvided<T> = T extends undefined ? false : true;
-type InferSchemaOrDefaultOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? z.infer<ProvidedSchema> : never : z.infer<DefaultSchema>;
-
-declare const zJarAuthorizationRequest: z.ZodObject<{
-    client_id: z.ZodOptional<z.ZodString>;
-    request: z.ZodOptional<z.ZodString>;
-    request_uri: z.ZodOptional<z.ZodURL>;
-}, z.core.$loose>;
-type JarAuthorizationRequest = z.infer<typeof zJarAuthorizationRequest>;
-declare const zJarRequestObjectPayload: z.ZodObject<{
-    client_id: z.ZodString;
-    aud: z.ZodOptional<z.ZodString>;
-    cnf: z.ZodOptional<z.ZodObject<{
-        jkt: z.ZodOptional<z.ZodString>;
-        jwk: z.ZodOptional<z.ZodObject<{
-            alg: z.ZodOptional<z.ZodString>;
-            crv: z.ZodOptional<z.ZodString>;
-            d: z.ZodOptional<z.ZodString>;
-            dp: z.ZodOptional<z.ZodString>;
-            dq: z.ZodOptional<z.ZodString>;
-            e: z.ZodOptional<z.ZodString>;
-            ext: z.ZodOptional<z.ZodBoolean>;
-            k: z.ZodOptional<z.ZodString>;
-            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            kid: z.ZodOptional<z.ZodString>;
-            kty: z.ZodString;
-            n: z.ZodOptional<z.ZodString>;
-            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                d: z.ZodOptional<z.ZodString>;
-                r: z.ZodOptional<z.ZodString>;
-                t: z.ZodOptional<z.ZodString>;
-            }, z.core.$loose>>>;
-            p: z.ZodOptional<z.ZodString>;
-            q: z.ZodOptional<z.ZodString>;
-            qi: z.ZodOptional<z.ZodString>;
-            use: z.ZodOptional<z.ZodString>;
-            x: z.ZodOptional<z.ZodString>;
-            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            x5t: z.ZodOptional<z.ZodString>;
-            "x5t#S256": z.ZodOptional<z.ZodString>;
-            x5u: z.ZodOptional<z.ZodString>;
-            y: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>;
-    }, z.core.$loose>>;
-    exp: z.ZodOptional<z.ZodNumber>;
-    iat: z.ZodOptional<z.ZodNumber>;
-    iss: z.ZodOptional<z.ZodString>;
-    jti: z.ZodOptional<z.ZodString>;
-    nbf: z.ZodOptional<z.ZodNumber>;
-    nonce: z.ZodOptional<z.ZodString>;
-    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-}, z.core.$loose>;
-type JarRequestObjectPayload = z.infer<typeof zJarRequestObjectPayload>;
-declare const zSignedAuthorizationRequestJwtHeaderTyp: z.ZodLiteral<"oauth-authz-req+jwt">;
-declare const zJarRequestObjectHeader: z.ZodObject<{
-    typ: z.ZodLiteral<"oauth-authz-req+jwt">;
-    alg: z.ZodString;
-    jwk: z.ZodOptional<z.ZodObject<{
-        alg: z.ZodOptional<z.ZodString>;
-        crv: z.ZodOptional<z.ZodString>;
-        d: z.ZodOptional<z.ZodString>;
-        dp: z.ZodOptional<z.ZodString>;
-        dq: z.ZodOptional<z.ZodString>;
-        e: z.ZodOptional<z.ZodString>;
-        ext: z.ZodOptional<z.ZodBoolean>;
-        k: z.ZodOptional<z.ZodString>;
-        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        kid: z.ZodOptional<z.ZodString>;
-        kty: z.ZodString;
-        n: z.ZodOptional<z.ZodString>;
-        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            d: z.ZodOptional<z.ZodString>;
-            r: z.ZodOptional<z.ZodString>;
-            t: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>>;
-        p: z.ZodOptional<z.ZodString>;
-        q: z.ZodOptional<z.ZodString>;
-        qi: z.ZodOptional<z.ZodString>;
-        use: z.ZodOptional<z.ZodString>;
-        x: z.ZodOptional<z.ZodString>;
-        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        x5t: z.ZodOptional<z.ZodString>;
-        "x5t#S256": z.ZodOptional<z.ZodString>;
-        x5u: z.ZodOptional<z.ZodString>;
-        y: z.ZodOptional<z.ZodString>;
-    }, z.core.$loose>>;
-    kid: z.ZodOptional<z.ZodString>;
-    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$loose>;
-type JarRequestObjectHeader = z.infer<typeof zJarRequestObjectHeader>;
-declare const signedAuthorizationRequestJwtHeaderTyp: "oauth-authz-req+jwt";
-declare const jwtAuthorizationRequestJwtHeaderTyp: "jwt";
-
-interface VerifyJarRequestOptions {
-    authorizationRequestJwt: string;
-    callbacks: Pick<CallbackContext, "verifyJwt">;
-    jarRequestParams: {
-        client_id?: string;
-    };
-    jwtSigner: JwtSigner$1;
-    now?: Date;
-}
-interface VerifiedJarRequest {
-    authorizationRequestPayload: JarRequestObjectPayload;
-    jwt: {
-        payload: JarRequestObjectPayload;
-    } & Omit<ReturnType<typeof decodeJwt>, "payload">;
-    signer: JwtSignerWithJwk$1;
-}
-/**
- * Verifies a JAR (JWT Secured Authorization Request) request by validating and verifying signatures.
- *
- * @param options - The input parameters
- * @param options.jarRequestParams - The JAR authorization request parameters
- * @param options.callbacks - Context containing the relevant Jose crypto operations
- * @returns The verified authorization request parameters and metadata
- */
-declare function verifyJarRequest(options: VerifyJarRequestOptions): Promise<VerifiedJarRequest>;
-
-interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestResult {
-    /**
-     * The verified JAR request, if `authorizationRequestJwt` was provided
-     */
-    jar?: VerifiedJarRequest;
-}
-interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizationRequestOptions, "authorizationServerMetadata"> {
-    /**
-     * The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
-     * you MUST provide this value to ensure the JWT is verified.
+     * The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
+     * you MUST provide this value to ensure the JWT is verified.
      */
     authorizationRequestJwt?: {
         jwt: string;
-        signer: JwtSigner$1;
+        signer: JwtSigner;
     };
     /**
      * Authorization Server metadata for enforcing JAR signing policy.
@@ -2555,7 +2470,7 @@ type SupportedClientAuthenticationMethod = (typeof SupportedClientAuthentication
  */
 interface IsClientAttestationSupportedOptions {
     /** Authorization server metadata containing supported authentication methods. */
-    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
+    authorizationServerMetadata: BaseAuthorizationServerMetadata;
 }
 /**
  * Checks whether the authorization server supports client attestation authentication.
@@ -2566,39 +2481,8 @@ interface IsClientAttestationSupportedOptions {
 declare function isClientAttestationSupported(options: IsClientAttestationSupportedOptions): {
     supported: boolean;
 };
-/**
- * Options for client authentication
- */
-interface ClientAuthenticationCallbackOptions {
-    /**
-     * Metadata of the authorization server
-     */
-    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
-    /**
-     * The body as a JSON object. If content type `x-www-form-urlencoded`
-     * is used, it will be encoded after this call.
-     *
-     * You can modify this object
-     */
-    body: Record<string, unknown>;
-    contentType: ContentType;
-    /**
-     * Headers for the request. You can modify this object
-     */
-    headers: FetchHeaders;
-    /**
-     * http method that will be used
-     */
-    method: HttpMethod;
-    /**
-     * URL to which the request will be made
-     */
-    url: string;
-}
-/**
- * Callback method to determine the client authentication for a request.
- */
-type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
+type ClientAuthenticationCallbackOptions = ClientAuthenticationCallbackOptions$1<BaseAuthorizationServerMetadata>;
+type ClientAuthenticationCallback = ClientAuthenticationCallback$1<ClientAuthenticationCallbackOptions>;
 /**
  * Creates a client authentication callback that leaves the request unchanged.
  *
@@ -2630,42 +2514,42 @@ declare function clientAuthenticationWalletAttestationJwt<V extends ItWalletSpec
  * - trust_chain is REQUIRED
  * - x5c is NOT supported
  */
-declare const zWalletAttestationJwtHeaderV1_0: z$1.ZodObject<{
-    trust_chain: z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>;
-    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
-    alg: z$1.ZodString;
-    jwk: z$1.ZodOptional<z$1.ZodObject<{
-        alg: z$1.ZodOptional<z$1.ZodString>;
-        crv: z$1.ZodOptional<z$1.ZodString>;
-        d: z$1.ZodOptional<z$1.ZodString>;
-        dp: z$1.ZodOptional<z$1.ZodString>;
-        dq: z$1.ZodOptional<z$1.ZodString>;
-        e: z$1.ZodOptional<z$1.ZodString>;
-        ext: z$1.ZodOptional<z$1.ZodBoolean>;
-        k: z$1.ZodOptional<z$1.ZodString>;
-        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        kid: z$1.ZodOptional<z$1.ZodString>;
-        kty: z$1.ZodString;
-        n: z$1.ZodOptional<z$1.ZodString>;
-        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-            d: z$1.ZodOptional<z$1.ZodString>;
-            r: z$1.ZodOptional<z$1.ZodString>;
-            t: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>>>;
-        p: z$1.ZodOptional<z$1.ZodString>;
-        q: z$1.ZodOptional<z$1.ZodString>;
-        qi: z$1.ZodOptional<z$1.ZodString>;
-        use: z$1.ZodOptional<z$1.ZodString>;
-        x: z$1.ZodOptional<z$1.ZodString>;
-        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        x5t: z$1.ZodOptional<z$1.ZodString>;
-        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-        x5u: z$1.ZodOptional<z$1.ZodString>;
-        y: z$1.ZodOptional<z$1.ZodString>;
-    }, z$1.core.$loose>>;
-    kid: z$1.ZodOptional<z$1.ZodString>;
-    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-}, z$1.core.$loose>;
+declare const zWalletAttestationJwtHeaderV1_0: z.ZodObject<{
+    trust_chain: z.ZodTuple<[z.ZodString], z.ZodString>;
+    typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
+    alg: z.ZodString;
+    jwk: z.ZodOptional<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodString;
+        n: z.ZodOptional<z.ZodString>;
+        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            d: z.ZodOptional<z.ZodString>;
+            r: z.ZodOptional<z.ZodString>;
+            t: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    kid: z.ZodOptional<z.ZodString>;
+    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
 /**
  * JWT Payload schema for IT-Wallet v1.0 Wallet Attestation
  *
@@ -2673,52 +2557,52 @@ declare const zWalletAttestationJwtHeaderV1_0: z$1.ZodObject<{
  * - Standard claims only
  * - No nbf or status support
  */
-declare const zWalletAttestationJwtPayloadV1_0: z$1.ZodObject<{
-    aal: z$1.ZodString;
-    cnf: z$1.ZodObject<{
-        jwk: z$1.ZodObject<{
-            alg: z$1.ZodOptional<z$1.ZodString>;
-            crv: z$1.ZodOptional<z$1.ZodString>;
-            d: z$1.ZodOptional<z$1.ZodString>;
-            dp: z$1.ZodOptional<z$1.ZodString>;
-            dq: z$1.ZodOptional<z$1.ZodString>;
-            e: z$1.ZodOptional<z$1.ZodString>;
-            ext: z$1.ZodOptional<z$1.ZodBoolean>;
-            k: z$1.ZodOptional<z$1.ZodString>;
-            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            kid: z$1.ZodOptional<z$1.ZodString>;
-            kty: z$1.ZodString;
-            n: z$1.ZodOptional<z$1.ZodString>;
-            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-                d: z$1.ZodOptional<z$1.ZodString>;
-                r: z$1.ZodOptional<z$1.ZodString>;
-                t: z$1.ZodOptional<z$1.ZodString>;
-            }, z$1.core.$loose>>>;
-            p: z$1.ZodOptional<z$1.ZodString>;
-            q: z$1.ZodOptional<z$1.ZodString>;
-            qi: z$1.ZodOptional<z$1.ZodString>;
-            use: z$1.ZodOptional<z$1.ZodString>;
-            x: z$1.ZodOptional<z$1.ZodString>;
-            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            x5t: z$1.ZodOptional<z$1.ZodString>;
-            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-            x5u: z$1.ZodOptional<z$1.ZodString>;
-            y: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>;
-    }, z$1.core.$strip>;
-    exp: z$1.ZodNumber;
-    iat: z$1.ZodNumber;
-    iss: z$1.ZodString;
-    sub: z$1.ZodString;
-    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
-    wallet_name: z$1.ZodOptional<z$1.ZodString>;
-    aud: z$1.ZodOptional<z$1.ZodString>;
-    jti: z$1.ZodOptional<z$1.ZodString>;
-    nbf: z$1.ZodOptional<z$1.ZodNumber>;
-    nonce: z$1.ZodOptional<z$1.ZodString>;
-    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-}, z$1.core.$loose>;
+declare const zWalletAttestationJwtPayloadV1_0: z.ZodObject<{
+    aal: z.ZodString;
+    cnf: z.ZodObject<{
+        jwk: z.ZodObject<{
+            alg: z.ZodOptional<z.ZodString>;
+            crv: z.ZodOptional<z.ZodString>;
+            d: z.ZodOptional<z.ZodString>;
+            dp: z.ZodOptional<z.ZodString>;
+            dq: z.ZodOptional<z.ZodString>;
+            e: z.ZodOptional<z.ZodString>;
+            ext: z.ZodOptional<z.ZodBoolean>;
+            k: z.ZodOptional<z.ZodString>;
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            kid: z.ZodOptional<z.ZodString>;
+            kty: z.ZodString;
+            n: z.ZodOptional<z.ZodString>;
+            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                d: z.ZodOptional<z.ZodString>;
+                r: z.ZodOptional<z.ZodString>;
+                t: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>>>;
+            p: z.ZodOptional<z.ZodString>;
+            q: z.ZodOptional<z.ZodString>;
+            qi: z.ZodOptional<z.ZodString>;
+            use: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodString>;
+            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            x5t: z.ZodOptional<z.ZodString>;
+            "x5t#S256": z.ZodOptional<z.ZodString>;
+            x5u: z.ZodOptional<z.ZodString>;
+            y: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>;
+    }, z.core.$strip>;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    iss: z.ZodString;
+    sub: z.ZodString;
+    wallet_link: z.ZodOptional<z.ZodURL>;
+    wallet_name: z.ZodOptional<z.ZodString>;
+    aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString>]>>;
+    jti: z.ZodOptional<z.ZodString>;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    nonce: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+}, z.core.$loose>;
 /**
  * Wallet Attestation JWT type for v1.0
  * The JWT is returned as a compact string
@@ -2728,7 +2612,7 @@ type WalletAttestationJwtV1_0 = string;
  * Zod schema for wallet attestation JWT validation (v1.0)
  * Validates that the result is a non-empty string
  */
-declare const zWalletAttestationJwtV1_0: z$1.ZodString;
+declare const zWalletAttestationJwtV1_0: z.ZodString;
 
 /**
  * Options for creating a wallet attestation with v1.0
@@ -2767,42 +2651,42 @@ declare const createWalletAttestationJwt$2: (options: WalletAttestationOptionsV1
  * - x5c is REQUIRED
  * - trust_chain is OPTIONAL
  */
-declare const zWalletAttestationJwtHeaderV1_3: z$1.ZodObject<{
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
-    x5c: z$1.ZodArray<z$1.ZodString>;
-    alg: z$1.ZodString;
-    jwk: z$1.ZodOptional<z$1.ZodObject<{
-        alg: z$1.ZodOptional<z$1.ZodString>;
-        crv: z$1.ZodOptional<z$1.ZodString>;
-        d: z$1.ZodOptional<z$1.ZodString>;
-        dp: z$1.ZodOptional<z$1.ZodString>;
-        dq: z$1.ZodOptional<z$1.ZodString>;
-        e: z$1.ZodOptional<z$1.ZodString>;
-        ext: z$1.ZodOptional<z$1.ZodBoolean>;
-        k: z$1.ZodOptional<z$1.ZodString>;
-        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        kid: z$1.ZodOptional<z$1.ZodString>;
-        kty: z$1.ZodString;
-        n: z$1.ZodOptional<z$1.ZodString>;
-        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-            d: z$1.ZodOptional<z$1.ZodString>;
-            r: z$1.ZodOptional<z$1.ZodString>;
-            t: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>>>;
-        p: z$1.ZodOptional<z$1.ZodString>;
-        q: z$1.ZodOptional<z$1.ZodString>;
-        qi: z$1.ZodOptional<z$1.ZodString>;
-        use: z$1.ZodOptional<z$1.ZodString>;
-        x: z$1.ZodOptional<z$1.ZodString>;
-        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        x5t: z$1.ZodOptional<z$1.ZodString>;
-        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-        x5u: z$1.ZodOptional<z$1.ZodString>;
-        y: z$1.ZodOptional<z$1.ZodString>;
-    }, z$1.core.$loose>>;
-    kid: z$1.ZodOptional<z$1.ZodString>;
-}, z$1.core.$loose>;
+declare const zWalletAttestationJwtHeaderV1_3: z.ZodObject<{
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+    typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
+    x5c: z.ZodArray<z.ZodString>;
+    alg: z.ZodString;
+    jwk: z.ZodOptional<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodString;
+        n: z.ZodOptional<z.ZodString>;
+        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            d: z.ZodOptional<z.ZodString>;
+            r: z.ZodOptional<z.ZodString>;
+            t: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    kid: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
 /**
  * JWT Payload schema for IT-Wallet v1.3 Wallet Attestation
  *
@@ -2810,56 +2694,56 @@ declare const zWalletAttestationJwtHeaderV1_3: z$1.ZodObject<{
  * - Supports nbf (not before) claim
  * - Supports status claim for revocation mechanisms
  */
-declare const zWalletAttestationJwtPayloadV1_3: z$1.ZodObject<{
-    cnf: z$1.ZodObject<{
-        jwk: z$1.ZodObject<{
-            alg: z$1.ZodOptional<z$1.ZodString>;
-            crv: z$1.ZodOptional<z$1.ZodString>;
-            d: z$1.ZodOptional<z$1.ZodString>;
-            dp: z$1.ZodOptional<z$1.ZodString>;
-            dq: z$1.ZodOptional<z$1.ZodString>;
-            e: z$1.ZodOptional<z$1.ZodString>;
-            ext: z$1.ZodOptional<z$1.ZodBoolean>;
-            k: z$1.ZodOptional<z$1.ZodString>;
-            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            kid: z$1.ZodOptional<z$1.ZodString>;
-            kty: z$1.ZodString;
-            n: z$1.ZodOptional<z$1.ZodString>;
-            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-                d: z$1.ZodOptional<z$1.ZodString>;
-                r: z$1.ZodOptional<z$1.ZodString>;
-                t: z$1.ZodOptional<z$1.ZodString>;
-            }, z$1.core.$loose>>>;
-            p: z$1.ZodOptional<z$1.ZodString>;
-            q: z$1.ZodOptional<z$1.ZodString>;
-            qi: z$1.ZodOptional<z$1.ZodString>;
-            use: z$1.ZodOptional<z$1.ZodString>;
-            x: z$1.ZodOptional<z$1.ZodString>;
-            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            x5t: z$1.ZodOptional<z$1.ZodString>;
-            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-            x5u: z$1.ZodOptional<z$1.ZodString>;
-            y: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>;
-    }, z$1.core.$strip>;
-    exp: z$1.ZodNumber;
-    iat: z$1.ZodNumber;
-    iss: z$1.ZodString;
-    nbf: z$1.ZodOptional<z$1.ZodNumber>;
-    status: z$1.ZodOptional<z$1.ZodObject<{
-        status_list: z$1.ZodObject<{
-            idx: z$1.ZodNumber;
-            uri: z$1.ZodString;
-        }, z$1.core.$strip>;
-    }, z$1.core.$strip>>;
-    sub: z$1.ZodString;
-    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
-    wallet_name: z$1.ZodOptional<z$1.ZodString>;
-    aud: z$1.ZodOptional<z$1.ZodString>;
-    jti: z$1.ZodOptional<z$1.ZodString>;
-    nonce: z$1.ZodOptional<z$1.ZodString>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-}, z$1.core.$loose>;
+declare const zWalletAttestationJwtPayloadV1_3: z.ZodObject<{
+    cnf: z.ZodObject<{
+        jwk: z.ZodObject<{
+            alg: z.ZodOptional<z.ZodString>;
+            crv: z.ZodOptional<z.ZodString>;
+            d: z.ZodOptional<z.ZodString>;
+            dp: z.ZodOptional<z.ZodString>;
+            dq: z.ZodOptional<z.ZodString>;
+            e: z.ZodOptional<z.ZodString>;
+            ext: z.ZodOptional<z.ZodBoolean>;
+            k: z.ZodOptional<z.ZodString>;
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            kid: z.ZodOptional<z.ZodString>;
+            kty: z.ZodString;
+            n: z.ZodOptional<z.ZodString>;
+            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                d: z.ZodOptional<z.ZodString>;
+                r: z.ZodOptional<z.ZodString>;
+                t: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>>>;
+            p: z.ZodOptional<z.ZodString>;
+            q: z.ZodOptional<z.ZodString>;
+            qi: z.ZodOptional<z.ZodString>;
+            use: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodString>;
+            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            x5t: z.ZodOptional<z.ZodString>;
+            "x5t#S256": z.ZodOptional<z.ZodString>;
+            x5u: z.ZodOptional<z.ZodString>;
+            y: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>;
+    }, z.core.$strip>;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    iss: z.ZodString;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    status: z.ZodOptional<z.ZodObject<{
+        status_list: z.ZodObject<{
+            idx: z.ZodNumber;
+            uri: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    sub: z.ZodString;
+    wallet_link: z.ZodOptional<z.ZodURL>;
+    wallet_name: z.ZodOptional<z.ZodString>;
+    aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString>]>>;
+    jti: z.ZodOptional<z.ZodString>;
+    nonce: z.ZodOptional<z.ZodString>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+}, z.core.$loose>;
 /**
  * Wallet Attestation JWT type for v1.3
  * The JWT is returned as a compact string
@@ -2869,7 +2753,7 @@ type WalletAttestationJwtV1_3 = string;
  * Zod schema for wallet attestation JWT validation (v1.3)
  * Validates that the result is a non-empty string
  */
-declare const zWalletAttestationJwtV1_3: z$1.ZodString;
+declare const zWalletAttestationJwtV1_3: z.ZodString;
 
 /**
  * Options for creating a wallet attestation with v1.3
@@ -2907,166 +2791,11 @@ interface WalletAttestationOptionsV1_3 extends BaseWalletAttestationOptions {
  */
 declare const createWalletAttestationJwt$1: (options: WalletAttestationOptionsV1_3) => Promise<WalletAttestationJwtV1_3>;
 
-declare const zWalletAttestationJwtHeaderV1_4: z$1.ZodObject<{
-    kid: z$1.ZodString;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
-    x5c: z$1.ZodArray<z$1.ZodString>;
-    alg: z$1.ZodString;
-    jwk: z$1.ZodOptional<z$1.ZodObject<{
-        alg: z$1.ZodOptional<z$1.ZodString>;
-        crv: z$1.ZodOptional<z$1.ZodString>;
-        d: z$1.ZodOptional<z$1.ZodString>;
-        dp: z$1.ZodOptional<z$1.ZodString>;
-        dq: z$1.ZodOptional<z$1.ZodString>;
-        e: z$1.ZodOptional<z$1.ZodString>;
-        ext: z$1.ZodOptional<z$1.ZodBoolean>;
-        k: z$1.ZodOptional<z$1.ZodString>;
-        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        kid: z$1.ZodOptional<z$1.ZodString>;
-        kty: z$1.ZodString;
-        n: z$1.ZodOptional<z$1.ZodString>;
-        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-            d: z$1.ZodOptional<z$1.ZodString>;
-            r: z$1.ZodOptional<z$1.ZodString>;
-            t: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>>>;
-        p: z$1.ZodOptional<z$1.ZodString>;
-        q: z$1.ZodOptional<z$1.ZodString>;
-        qi: z$1.ZodOptional<z$1.ZodString>;
-        use: z$1.ZodOptional<z$1.ZodString>;
-        x: z$1.ZodOptional<z$1.ZodString>;
-        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-        x5t: z$1.ZodOptional<z$1.ZodString>;
-        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-        x5u: z$1.ZodOptional<z$1.ZodString>;
-        y: z$1.ZodOptional<z$1.ZodString>;
-    }, z$1.core.$loose>>;
-}, z$1.core.$loose>;
-declare const zWalletAttestationJwtPayloadV1_4: z$1.ZodObject<{
-    cnf: z$1.ZodObject<{
-        jwk: z$1.ZodObject<{
-            alg: z$1.ZodOptional<z$1.ZodString>;
-            crv: z$1.ZodOptional<z$1.ZodString>;
-            d: z$1.ZodOptional<z$1.ZodString>;
-            dp: z$1.ZodOptional<z$1.ZodString>;
-            dq: z$1.ZodOptional<z$1.ZodString>;
-            e: z$1.ZodOptional<z$1.ZodString>;
-            ext: z$1.ZodOptional<z$1.ZodBoolean>;
-            k: z$1.ZodOptional<z$1.ZodString>;
-            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            kid: z$1.ZodOptional<z$1.ZodString>;
-            kty: z$1.ZodString;
-            n: z$1.ZodOptional<z$1.ZodString>;
-            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
-                d: z$1.ZodOptional<z$1.ZodString>;
-                r: z$1.ZodOptional<z$1.ZodString>;
-                t: z$1.ZodOptional<z$1.ZodString>;
-            }, z$1.core.$loose>>>;
-            p: z$1.ZodOptional<z$1.ZodString>;
-            q: z$1.ZodOptional<z$1.ZodString>;
-            qi: z$1.ZodOptional<z$1.ZodString>;
-            use: z$1.ZodOptional<z$1.ZodString>;
-            x: z$1.ZodOptional<z$1.ZodString>;
-            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
-            x5t: z$1.ZodOptional<z$1.ZodString>;
-            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
-            x5u: z$1.ZodOptional<z$1.ZodString>;
-            y: z$1.ZodOptional<z$1.ZodString>;
-        }, z$1.core.$loose>;
-    }, z$1.core.$strip>;
-    exp: z$1.ZodNumber;
-    iat: z$1.ZodNumber;
-    iss: z$1.ZodString;
-    nbf: z$1.ZodOptional<z$1.ZodNumber>;
-    sub: z$1.ZodString;
-    wallet_link: z$1.ZodURL;
-    wallet_name: z$1.ZodString;
-    aud: z$1.ZodOptional<z$1.ZodString>;
-    jti: z$1.ZodOptional<z$1.ZodString>;
-    nonce: z$1.ZodOptional<z$1.ZodString>;
-    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
-    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
-}, z$1.core.$loose>;
-type WalletAttestationJwtV1_4 = string;
-declare const zWalletAttestationJwtV1_4: z$1.ZodString;
-
-interface WalletAttestationOptionsV1_4 extends Omit<BaseWalletAttestationOptions, "walletLink" | "walletName"> {
-    nbf?: Date;
-    signer: {
-        alg: string;
-        kid: string;
-        method: "x5c";
-        trustChain?: [string, ...string[]];
-        x5c: [string, ...string[]];
-    };
-    walletLink: string;
-    walletName: string;
-}
-/**
- * Creates a wallet attestation JWT for IT-Wallet v1.4.
- *
- * @param options - v1.4 wallet attestation creation options.
- * @returns Signed wallet attestation JWT.
- * @throws {ValidationError} If temporal constraints or generated JWT validation fail.
- * @throws {ClientAttestationError} For unexpected errors during attestation creation.
- */
-declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_4) => Promise<WalletAttestationJwtV1_4>;
-
-declare const IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: readonly ["ES256", "ES384", "ES512"];
-declare const zItWalletClientAttestationPopJwtAlg: z.ZodEnum<{
-    ES256: "ES256";
-    ES384: "ES384";
-    ES512: "ES512";
-}>;
-type ItWalletClientAttestationPopJwtAlg = z.infer<typeof zItWalletClientAttestationPopJwtAlg>;
-declare const zItWalletClientAttestationPopJwtPayload: z.ZodObject<{
-    aud: z.ZodString;
-    exp: z.ZodOptional<z.ZodNumber>;
-    iat: z.ZodNumber;
-    iss: z.ZodString;
-    jti: z.ZodString;
-    nonce: z.ZodOptional<z.ZodString>;
-    cnf: z.ZodOptional<z.ZodObject<{
-        jkt: z.ZodOptional<z.ZodString>;
-        jwk: z.ZodOptional<z.ZodObject<{
-            alg: z.ZodOptional<z.ZodString>;
-            crv: z.ZodOptional<z.ZodString>;
-            d: z.ZodOptional<z.ZodString>;
-            dp: z.ZodOptional<z.ZodString>;
-            dq: z.ZodOptional<z.ZodString>;
-            e: z.ZodOptional<z.ZodString>;
-            ext: z.ZodOptional<z.ZodBoolean>;
-            k: z.ZodOptional<z.ZodString>;
-            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            kid: z.ZodOptional<z.ZodString>;
-            kty: z.ZodString;
-            n: z.ZodOptional<z.ZodString>;
-            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                d: z.ZodOptional<z.ZodString>;
-                r: z.ZodOptional<z.ZodString>;
-                t: z.ZodOptional<z.ZodString>;
-            }, z.core.$loose>>>;
-            p: z.ZodOptional<z.ZodString>;
-            q: z.ZodOptional<z.ZodString>;
-            qi: z.ZodOptional<z.ZodString>;
-            use: z.ZodOptional<z.ZodString>;
-            x: z.ZodOptional<z.ZodString>;
-            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            x5t: z.ZodOptional<z.ZodString>;
-            "x5t#S256": z.ZodOptional<z.ZodString>;
-            x5u: z.ZodOptional<z.ZodString>;
-            y: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>;
-    }, z.core.$loose>>;
-    nbf: z.ZodOptional<z.ZodNumber>;
-    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+declare const zWalletAttestationJwtHeaderV1_4: z.ZodObject<{
+    kid: z.ZodString;
     trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-}, z.core.$loose>;
-type ItWalletClientAttestationPopJwtPayload = z.infer<typeof zItWalletClientAttestationPopJwtPayload>;
-declare const zItWalletClientAttestationPopJwtTyp: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
-declare const zItWalletClientAttestationPopJwtHeader: z.ZodObject<{
-    typ: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
+    typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
+    x5c: z.ZodArray<z.ZodString>;
     alg: z.ZodString;
     jwk: z.ZodOptional<z.ZodObject<{
         alg: z.ZodOptional<z.ZodString>;
@@ -3097,113 +2826,167 @@ declare const zItWalletClientAttestationPopJwtHeader: z.ZodObject<{
         x5u: z.ZodOptional<z.ZodString>;
         y: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
-    kid: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+declare const zWalletAttestationJwtPayloadV1_4: z.ZodObject<{
+    cnf: z.ZodObject<{
+        jwk: z.ZodObject<{
+            alg: z.ZodOptional<z.ZodString>;
+            crv: z.ZodOptional<z.ZodString>;
+            d: z.ZodOptional<z.ZodString>;
+            dp: z.ZodOptional<z.ZodString>;
+            dq: z.ZodOptional<z.ZodString>;
+            e: z.ZodOptional<z.ZodString>;
+            ext: z.ZodOptional<z.ZodBoolean>;
+            k: z.ZodOptional<z.ZodString>;
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            kid: z.ZodOptional<z.ZodString>;
+            kty: z.ZodString;
+            n: z.ZodOptional<z.ZodString>;
+            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                d: z.ZodOptional<z.ZodString>;
+                r: z.ZodOptional<z.ZodString>;
+                t: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>>>;
+            p: z.ZodOptional<z.ZodString>;
+            q: z.ZodOptional<z.ZodString>;
+            qi: z.ZodOptional<z.ZodString>;
+            use: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodString>;
+            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            x5t: z.ZodOptional<z.ZodString>;
+            "x5t#S256": z.ZodOptional<z.ZodString>;
+            x5u: z.ZodOptional<z.ZodString>;
+            y: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>;
+    }, z.core.$strip>;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    iss: z.ZodString;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    sub: z.ZodString;
+    wallet_link: z.ZodURL;
+    wallet_name: z.ZodString;
+    aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString>]>>;
+    jti: z.ZodOptional<z.ZodString>;
+    nonce: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
-type ItWalletClientAttestationPopJwtHeader = z.infer<typeof zItWalletClientAttestationPopJwtHeader>;
+type WalletAttestationJwtV1_4 = string;
+declare const zWalletAttestationJwtV1_4: z.ZodString;
 
-interface DecodeJwtHeaderOptions<HeaderSchema extends BaseSchema | undefined> {
-    /**
-     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
-     */
-    errorMessagePrefix?: string;
-    /**
-     * Schema to use for validating the header. If not provided the
-     * default `zJwtHeader` schema will be used
-     */
-    headerSchema?: HeaderSchema;
-    /**
-     * The compact encoded jwt
-     */
-    jwt: string;
-}
-interface DecodeJwtHeaderResult<HeaderSchema extends BaseSchema | undefined = undefined> {
-    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
+interface WalletAttestationOptionsV1_4 extends Omit<BaseWalletAttestationOptions, "walletLink" | "walletName"> {
+    nbf?: Date;
+    signer: {
+        alg: string;
+        kid: string;
+        method: "x5c";
+        trustChain?: [string, ...string[]];
+        x5c: [string, ...string[]];
+    };
+    walletLink: string;
+    walletName: string;
 }
 /**
- * Decodes and validates the header of a compact JWT.
- *
- * This helper does not verify the JWT signature or parse the payload.
- *
- * @param options - Header decode options.
- * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
- * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
- * @param options.jwt - Compact JWT to decode.
- * @returns Decoded and schema-validated JWT header.
- * @throws {Oauth2JwtParseError} If the JWT shape or header JSON is invalid.
- * @throws {ValidationError} If header schema validation fails.
- */
-declare function decodeJwtHeader<HeaderSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtHeaderOptions<HeaderSchema>): DecodeJwtHeaderResult<HeaderSchema>;
-/**
- * Builds a JWT header from an SDK signer descriptor.
+ * Creates a wallet attestation JWT for IT-Wallet v1.4.
  *
- * @param signer - Signer descriptor used by SDK signing callbacks.
- * @returns Header fields required by the signer method.
+ * @param options - v1.4 wallet attestation creation options.
+ * @returns Signed wallet attestation JWT.
+ * @throws {ValidationError} If temporal constraints or generated JWT validation fail.
+ * @throws {ClientAttestationError} For unexpected errors during attestation creation.
  */
-declare function jwtHeaderFromJwtSigner(signer: JwtSigner): {
-    alg: string;
-    kid: string;
-    trust_chain?: undefined;
-    jwk?: undefined;
-    x5c?: undefined;
-} | {
-    alg: string;
-    kid: string;
-    trust_chain: [string, ...string[]] | undefined;
-    jwk?: undefined;
-    x5c?: undefined;
-} | {
-    alg: string;
-    jwk: {
-        [x: string]: unknown;
-        kty: string;
-        alg?: string | undefined;
-        crv?: string | undefined;
-        d?: string | undefined;
-        dp?: string | undefined;
-        dq?: string | undefined;
-        e?: string | undefined;
-        ext?: boolean | undefined;
-        k?: string | undefined;
-        key_ops?: string[] | undefined;
-        kid?: string | undefined;
-        n?: string | undefined;
-        oth?: {
-            [x: string]: unknown;
-            d?: string | undefined;
-            r?: string | undefined;
-            t?: string | undefined;
-        }[] | undefined;
-        p?: string | undefined;
-        q?: string | undefined;
-        qi?: string | undefined;
-        use?: string | undefined;
-        x?: string | undefined;
-        x5c?: string[] | undefined;
-        x5t?: string | undefined;
-        "x5t#S256"?: string | undefined;
-        x5u?: string | undefined;
-        y?: string | undefined;
-    };
-    kid?: undefined;
-    trust_chain?: undefined;
-    x5c?: undefined;
-} | {
-    alg: string;
-    kid: string | undefined;
-    trust_chain: [string, ...string[]] | undefined;
-    x5c: string[];
-    jwk?: undefined;
-} | {
-    alg: string;
-    kid?: undefined;
-    trust_chain?: undefined;
-    jwk?: undefined;
-    x5c?: undefined;
-};
+declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_4) => Promise<WalletAttestationJwtV1_4>;
 
-declare const zCompactJwe: z$1.ZodString;
+declare const IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: readonly ["ES256", "ES384", "ES512"];
+declare const zItWalletClientAttestationPopJwtAlg: z$1.ZodEnum<{
+    ES256: "ES256";
+    ES384: "ES384";
+    ES512: "ES512";
+}>;
+type ItWalletClientAttestationPopJwtAlg = z$1.infer<typeof zItWalletClientAttestationPopJwtAlg>;
+declare const zItWalletClientAttestationPopJwtPayload: z$1.ZodObject<{
+    aud: z$1.ZodString;
+    exp: z$1.ZodOptional<z$1.ZodNumber>;
+    iat: z$1.ZodNumber;
+    iss: z$1.ZodString;
+    jti: z$1.ZodString;
+    nonce: z$1.ZodOptional<z$1.ZodString>;
+    cnf: z$1.ZodOptional<z$1.ZodObject<{
+        jkt: z$1.ZodOptional<z$1.ZodString>;
+        jwk: z$1.ZodOptional<z$1.ZodObject<{
+            alg: z$1.ZodOptional<z$1.ZodString>;
+            crv: z$1.ZodOptional<z$1.ZodString>;
+            d: z$1.ZodOptional<z$1.ZodString>;
+            dp: z$1.ZodOptional<z$1.ZodString>;
+            dq: z$1.ZodOptional<z$1.ZodString>;
+            e: z$1.ZodOptional<z$1.ZodString>;
+            ext: z$1.ZodOptional<z$1.ZodBoolean>;
+            k: z$1.ZodOptional<z$1.ZodString>;
+            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            kid: z$1.ZodOptional<z$1.ZodString>;
+            kty: z$1.ZodString;
+            n: z$1.ZodOptional<z$1.ZodString>;
+            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+                d: z$1.ZodOptional<z$1.ZodString>;
+                r: z$1.ZodOptional<z$1.ZodString>;
+                t: z$1.ZodOptional<z$1.ZodString>;
+            }, z$1.core.$loose>>>;
+            p: z$1.ZodOptional<z$1.ZodString>;
+            q: z$1.ZodOptional<z$1.ZodString>;
+            qi: z$1.ZodOptional<z$1.ZodString>;
+            use: z$1.ZodOptional<z$1.ZodString>;
+            x: z$1.ZodOptional<z$1.ZodString>;
+            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            x5t: z$1.ZodOptional<z$1.ZodString>;
+            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+            x5u: z$1.ZodOptional<z$1.ZodString>;
+            y: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>;
+    }, z$1.core.$loose>>;
+    nbf: z$1.ZodOptional<z$1.ZodNumber>;
+    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
+    sub: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+}, z$1.core.$loose>;
+type ItWalletClientAttestationPopJwtPayload = z$1.infer<typeof zItWalletClientAttestationPopJwtPayload>;
+declare const zItWalletClientAttestationPopJwtTyp: z$1.ZodLiteral<"oauth-client-attestation-pop+jwt">;
+declare const zItWalletClientAttestationPopJwtHeader: z$1.ZodObject<{
+    typ: z$1.ZodLiteral<"oauth-client-attestation-pop+jwt">;
+    alg: z$1.ZodString;
+    jwk: z$1.ZodOptional<z$1.ZodObject<{
+        alg: z$1.ZodOptional<z$1.ZodString>;
+        crv: z$1.ZodOptional<z$1.ZodString>;
+        d: z$1.ZodOptional<z$1.ZodString>;
+        dp: z$1.ZodOptional<z$1.ZodString>;
+        dq: z$1.ZodOptional<z$1.ZodString>;
+        e: z$1.ZodOptional<z$1.ZodString>;
+        ext: z$1.ZodOptional<z$1.ZodBoolean>;
+        k: z$1.ZodOptional<z$1.ZodString>;
+        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        kid: z$1.ZodOptional<z$1.ZodString>;
+        kty: z$1.ZodString;
+        n: z$1.ZodOptional<z$1.ZodString>;
+        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            d: z$1.ZodOptional<z$1.ZodString>;
+            r: z$1.ZodOptional<z$1.ZodString>;
+            t: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>>;
+        p: z$1.ZodOptional<z$1.ZodString>;
+        q: z$1.ZodOptional<z$1.ZodString>;
+        qi: z$1.ZodOptional<z$1.ZodString>;
+        use: z$1.ZodOptional<z$1.ZodString>;
+        x: z$1.ZodOptional<z$1.ZodString>;
+        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        x5t: z$1.ZodOptional<z$1.ZodString>;
+        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+        x5u: z$1.ZodOptional<z$1.ZodString>;
+        y: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$loose>>;
+    kid: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+}, z$1.core.$loose>;
+type ItWalletClientAttestationPopJwtHeader = z$1.infer<typeof zItWalletClientAttestationPopJwtHeader>;
 
 /**
  * Generic error thrown on OAuth2 operations
@@ -3419,7 +3202,7 @@ interface GetJwtFromFormPostOptions<T> {
     /**
      * Schema for parsing and validating
      */
-    schema: z.ZodSchema<T>;
+    schema: z$1.ZodSchema<T>;
 }
 /**
  * Decode a form_post.jwt and return the final JWT.
@@ -3460,7 +3243,7 @@ interface GetJwtFromFormPostOptions<T> {
  * ```
  */
 declare const getJwtFromFormPost: <T>(options: GetJwtFromFormPostOptions<T>) => Promise<{
-    decodedJwt: DecodeJwtResult<undefined, z.ZodSchema<T>>;
+    decodedJwt: DecodeJwtResult<undefined, z$1.ZodSchema<T>>;
     jwt: string;
 }>;
 
@@ -3496,7 +3279,7 @@ interface CreateMrtdValidationJwtOptions {
     /** NFC-read document evidence */
     documentData: MrtdDocumentData;
     issuedAt?: Date;
-    signer: JwtSignerJwk$1;
+    signer: JwtSignerJwk;
 }
 /**
  * Creates a signed JWT containing MRTD validation data for Phase 3 of L2+ flow.
@@ -3527,7 +3310,7 @@ interface FetchMrtdPopInitOptions {
      * Optional custom signer for verifying the MRTD PoP init response JWT.
      * If not provided, the library will attempt to verify using JWT header.
      */
-    signer?: JwtSigner$1;
+    signer?: JwtSigner;
     /**
      * Attestation header value for the wallet's own attestation, to be included in the request.
      */
@@ -3539,7 +3322,7 @@ interface FetchMrtdPopInitResult {
     mrz?: string;
     /** htu from the init response — the verify endpoint */
     popVerifyEndpoint: string;
-    signer: JwtSigner$1;
+    signer: JwtSigner;
 }
 /**
  * Initiates MRTD Proof of Possession validation (Phase 3.2 of L2+ flow).
@@ -3598,81 +3381,81 @@ declare function fetchMrtdPopVerify(options: FetchMrtdPopVerifyOptions): Promise
  * @see IT-Wallet L2+ specification Section 12.1.3 (eID Substantial Authentication with MRTD Verification)
  */
 /** JWT header for MRTD challenge (Phase 3.1) */
-declare const zMrtdChallengeJwtHeader: z.ZodObject<{
-    alg: z.ZodString;
-    kid: z.ZodString;
-    typ: z.ZodLiteral<"mrtd-ias+jwt">;
-}, z.core.$loose>;
-type MrtdChallengeJwtHeader = z.infer<typeof zMrtdChallengeJwtHeader>;
+declare const zMrtdChallengeJwtHeader: z$1.ZodObject<{
+    alg: z$1.ZodString;
+    kid: z$1.ZodString;
+    typ: z$1.ZodLiteral<"mrtd-ias+jwt">;
+}, z$1.core.$loose>;
+type MrtdChallengeJwtHeader = z$1.infer<typeof zMrtdChallengeJwtHeader>;
 /** JWT payload for MRTD challenge containing session correlation and endpoint parameters */
-declare const zMrtdChallengeJwtPayload: z.ZodObject<{
-    aud: z.ZodString;
-    exp: z.ZodNumber;
-    htm: z.ZodLiteral<"POST">;
-    htu: z.ZodURL;
-    iat: z.ZodNumber;
-    iss: z.ZodString;
-    mrtd_auth_session: z.ZodString;
-    mrtd_pop_jwt_nonce: z.ZodString;
-    state: z.ZodString;
-    status: z.ZodLiteral<"require_interaction">;
-    type: z.ZodLiteral<"mrtd+ias">;
-}, z.core.$loose>;
-type MrtdChallengeJwtPayload = z.infer<typeof zMrtdChallengeJwtPayload>;
+declare const zMrtdChallengeJwtPayload: z$1.ZodObject<{
+    aud: z$1.ZodString;
+    exp: z$1.ZodNumber;
+    htm: z$1.ZodLiteral<"POST">;
+    htu: z$1.ZodURL;
+    iat: z$1.ZodNumber;
+    iss: z$1.ZodString;
+    mrtd_auth_session: z$1.ZodString;
+    mrtd_pop_jwt_nonce: z$1.ZodString;
+    state: z$1.ZodString;
+    status: z$1.ZodLiteral<"require_interaction">;
+    type: z$1.ZodLiteral<"mrtd+ias">;
+}, z$1.core.$loose>;
+type MrtdChallengeJwtPayload = z$1.infer<typeof zMrtdChallengeJwtPayload>;
 /** JWT header for MRTD PoP initialization response (Phase 3.3) */
-declare const zMrtdPopInitResponseJwtHeader: z.ZodObject<{
-    alg: z.ZodString;
-    kid: z.ZodString;
-    typ: z.ZodLiteral<"mrtd-ias-pop+jwt">;
-}, z.core.$loose>;
-type MrtdPopInitResponseJwtHeader = z.infer<typeof zMrtdPopInitResponseJwtHeader>;
+declare const zMrtdPopInitResponseJwtHeader: z$1.ZodObject<{
+    alg: z$1.ZodString;
+    kid: z$1.ZodString;
+    typ: z$1.ZodLiteral<"mrtd-ias-pop+jwt">;
+}, z$1.core.$loose>;
+type MrtdPopInitResponseJwtHeader = z$1.infer<typeof zMrtdPopInitResponseJwtHeader>;
 /** JWT payload for MRTD PoP initialization response containing challenge and nonce */
-declare const zMrtdPopInitResponseJwtPayload: z.ZodObject<{
-    aud: z.ZodString;
-    challenge: z.ZodString;
-    exp: z.ZodNumber;
-    htm: z.ZodLiteral<"POST">;
-    htu: z.ZodURL;
-    iat: z.ZodNumber;
-    iss: z.ZodString;
-    mrtd_pop_nonce: z.ZodString;
-    mrz: z.ZodOptional<z.ZodString>;
-}, z.core.$loose>;
-type MrtdPopInitResponseJwtPayload = z.infer<typeof zMrtdPopInitResponseJwtPayload>;
+declare const zMrtdPopInitResponseJwtPayload: z$1.ZodObject<{
+    aud: z$1.ZodString;
+    challenge: z$1.ZodString;
+    exp: z$1.ZodNumber;
+    htm: z$1.ZodLiteral<"POST">;
+    htu: z$1.ZodURL;
+    iat: z$1.ZodNumber;
+    iss: z$1.ZodString;
+    mrtd_pop_nonce: z$1.ZodString;
+    mrz: z$1.ZodOptional<z$1.ZodString>;
+}, z$1.core.$loose>;
+type MrtdPopInitResponseJwtPayload = z$1.infer<typeof zMrtdPopInitResponseJwtPayload>;
 /** JWT header for MRTD validation (signed by Wallet Instance) */
-declare const zMrtdValidationJwtHeader: z.ZodObject<{
-    alg: z.ZodString;
-    kid: z.ZodString;
-    typ: z.ZodLiteral<"mrtd-ias+jwt">;
-}, z.core.$loose>;
-type MrtdValidationJwtHeader = z.infer<typeof zMrtdValidationJwtHeader>;
+declare const zMrtdValidationJwtHeader: z$1.ZodObject<{
+    alg: z$1.ZodString;
+    kid: z$1.ZodString;
+    typ: z$1.ZodLiteral<"mrtd-ias+jwt">;
+}, z$1.core.$loose>;
+type MrtdValidationJwtHeader = z$1.infer<typeof zMrtdValidationJwtHeader>;
 /** JWT payload for MRTD validation containing NFC-read document evidence */
-declare const zMrtdValidationJwtPayload: z.ZodObject<{
-    aud: z.ZodString;
-    document_type: z.ZodLiteral<"cie">;
-    exp: z.ZodNumber;
-    ias: z.ZodObject<{
-        challenge_signed: z.ZodString;
-        ias_pk: z.ZodString;
-        sod_ias: z.ZodString;
-    }, z.core.$loose>;
-    iat: z.ZodNumber;
-    iss: z.ZodString;
-    mrtd: z.ZodObject<{
-        dg1: z.ZodString;
-        dg11: z.ZodString;
-        sod_mrtd: z.ZodString;
-    }, z.core.$loose>;
-}, z.core.$loose>;
-type MrtdValidationJwtPayload = z.infer<typeof zMrtdValidationJwtPayload>;
+declare const zMrtdValidationJwtPayload: z$1.ZodObject<{
+    aud: z$1.ZodString;
+    document_type: z$1.ZodLiteral<"cie">;
+    exp: z$1.ZodNumber;
+    ias: z$1.ZodObject<{
+        challenge_signed: z$1.ZodString;
+        ias_pk: z$1.ZodString;
+        sod_ias: z$1.ZodString;
+    }, z$1.core.$loose>;
+    iat: z$1.ZodNumber;
+    iss: z$1.ZodString;
+    mrtd: z$1.ZodObject<{
+        dg1: z$1.ZodString;
+        dg11: z$1.ZodString;
+        sod_mrtd: z$1.ZodString;
+    }, z$1.core.$loose>;
+}, z$1.core.$loose>;
+type MrtdValidationJwtPayload = z$1.infer<typeof zMrtdValidationJwtPayload>;
 /** Response from MRTD PoP verification endpoint (Phase 3.8) */
-declare const zMrtdPopVerifyResponse: z.ZodObject<{
-    mrtd_val_pop_nonce: z.ZodString;
-    redirect_uri: z.ZodURL;
-    status: z.ZodLiteral<"require_interaction">;
-    type: z.ZodLiteral<"redirect_to_web">;
-}, z.core.$loose>;
-type MrtdPopVerifyResponse = z.infer<typeof zMrtdPopVerifyResponse>;
+declare const zMrtdPopVerifyResponse: z$1.ZodObject<{
+    mrtd_val_pop_nonce: z$1.ZodString;
+    redirect_uri: z$1.ZodURL;
+    status: z$1.ZodLiteral<"require_interaction">;
+    type: z$1.ZodLiteral<"redirect_to_web">;
+}, z$1.core.$loose>;
+type MrtdPopVerifyResponse = z$1.infer<typeof zMrtdPopVerifyResponse>;
 
 interface ParseMrtdChallengeOptions {
     /** The full redirect URL containing ?challenge_info=<jwt> */
@@ -3707,12 +3490,12 @@ interface VerifyMrtdChallengeOptions {
      * Optional custom signer for verifying the MRTD challenge JWT.
      * If not provided, the library will attempt to verify using JWT header.
      */
-    signer?: JwtSigner$1;
+    signer?: JwtSigner;
 }
 interface VerifyMrtdChallengeResult {
     header: MrtdChallengeJwtHeader;
     payload: MrtdChallengeJwtPayload;
-    signer: JwtSigner$1;
+    signer: JwtSigner;
 }
 /**
  * Verifies the MRTD challenge JWT signature and validates claims.
@@ -3755,12 +3538,12 @@ interface CreateTokenDPoPOptions {
     /**
      * The signer of the dpop jwt. Only jwk signer allowed.
      */
-    signer: JwtSignerJwk$1;
+    signer: JwtSignerJwk;
     /**
      * The request for which to create the dpop jwt
      */
     tokenRequest: {
-        method: HttpMethod$1;
+        method: HttpMethod;
         url: string;
     };
 }
@@ -3775,7 +3558,7 @@ interface CreateTokenDPoPOptions {
  */
 declare function createTokenDPoP(options: CreateTokenDPoPOptions): Promise<{
     jwt: string;
-    signerJwk: _openid4vc_oauth2.Jwk;
+    signerJwk: _pagopa_io_wallet_utils.Jwk;
 }>;
 /**
  * Extracts and validates the DPoP JWT from request headers.
@@ -3840,7 +3623,7 @@ interface VerifyTokenDPoPOptions {
     /**
      * The request for which to verify the dpop jwt
      */
-    request: RequestLike$1;
+    request: RequestLike;
 }
 /**
  * Verifies a DPoP proof JWT against an HTTP request and optional token binding data.
@@ -3900,12 +3683,12 @@ declare function verifyTokenDPoP(options: VerifyTokenDPoPOptions): Promise<{
     jwkThumbprint: string;
     payload: {
         [x: string]: unknown;
-        htm: "GET" | "POST" | "PUT" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE" | "CONNECT" | "PATCH";
+        htm: "POST" | "GET" | "PUT" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE" | "CONNECT" | "PATCH";
         htu: string;
         iat: number;
         jti: string;
         ath?: string | undefined;
-        aud?: string | undefined;
+        aud?: string | string[] | undefined;
         cnf?: {
             [x: string]: unknown;
             jkt?: string | undefined;
@@ -3946,13 +3729,14 @@ declare function verifyTokenDPoP(options: VerifyTokenDPoPOptions): Promise<{
         nbf?: number | undefined;
         nonce?: string | undefined;
         status?: Record<string, any> | undefined;
+        sub?: string | undefined;
         trust_chain?: [string, ...string[]] | undefined;
     };
 }>;
 
-declare const zDpopJwtPayload: z.ZodObject<{
-    ath: z.ZodOptional<z.ZodString>;
-    htm: z.ZodEnum<{
+declare const zDpopJwtPayload: z$1.ZodObject<{
+    ath: z$1.ZodOptional<z$1.ZodString>;
+    htm: z$1.ZodEnum<{
         GET: "GET";
         POST: "POST";
         PUT: "PUT";
@@ -3963,86 +3747,87 @@ declare const zDpopJwtPayload: z.ZodObject<{
         CONNECT: "CONNECT";
         PATCH: "PATCH";
     }>;
-    htu: z.ZodURL;
-    iat: z.ZodNumber;
-    jti: z.ZodString;
-    aud: z.ZodOptional<z.ZodString>;
-    cnf: z.ZodOptional<z.ZodObject<{
-        jkt: z.ZodOptional<z.ZodString>;
-        jwk: z.ZodOptional<z.ZodObject<{
-            alg: z.ZodOptional<z.ZodString>;
-            crv: z.ZodOptional<z.ZodString>;
-            d: z.ZodOptional<z.ZodString>;
-            dp: z.ZodOptional<z.ZodString>;
-            dq: z.ZodOptional<z.ZodString>;
-            e: z.ZodOptional<z.ZodString>;
-            ext: z.ZodOptional<z.ZodBoolean>;
-            k: z.ZodOptional<z.ZodString>;
-            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            kid: z.ZodOptional<z.ZodString>;
-            kty: z.ZodString;
-            n: z.ZodOptional<z.ZodString>;
-            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                d: z.ZodOptional<z.ZodString>;
-                r: z.ZodOptional<z.ZodString>;
-                t: z.ZodOptional<z.ZodString>;
-            }, z.core.$loose>>>;
-            p: z.ZodOptional<z.ZodString>;
-            q: z.ZodOptional<z.ZodString>;
-            qi: z.ZodOptional<z.ZodString>;
-            use: z.ZodOptional<z.ZodString>;
-            x: z.ZodOptional<z.ZodString>;
-            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            x5t: z.ZodOptional<z.ZodString>;
-            "x5t#S256": z.ZodOptional<z.ZodString>;
-            x5u: z.ZodOptional<z.ZodString>;
-            y: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>;
-    }, z.core.$loose>>;
-    exp: z.ZodOptional<z.ZodNumber>;
-    iss: z.ZodOptional<z.ZodString>;
-    nbf: z.ZodOptional<z.ZodNumber>;
-    nonce: z.ZodOptional<z.ZodString>;
-    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-}, z.core.$loose>;
-type DpopJwtPayload = z.infer<typeof zDpopJwtPayload>;
-declare const zDpopJwtHeader: z.ZodObject<{
-    jwk: z.ZodObject<{
-        alg: z.ZodOptional<z.ZodString>;
-        crv: z.ZodOptional<z.ZodString>;
-        d: z.ZodOptional<z.ZodString>;
-        dp: z.ZodOptional<z.ZodString>;
-        dq: z.ZodOptional<z.ZodString>;
-        e: z.ZodOptional<z.ZodString>;
-        ext: z.ZodOptional<z.ZodBoolean>;
-        k: z.ZodOptional<z.ZodString>;
-        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        kid: z.ZodOptional<z.ZodString>;
-        kty: z.ZodString;
-        n: z.ZodOptional<z.ZodString>;
-        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            d: z.ZodOptional<z.ZodString>;
-            r: z.ZodOptional<z.ZodString>;
-            t: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>>;
-        p: z.ZodOptional<z.ZodString>;
-        q: z.ZodOptional<z.ZodString>;
-        qi: z.ZodOptional<z.ZodString>;
-        use: z.ZodOptional<z.ZodString>;
-        x: z.ZodOptional<z.ZodString>;
-        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        x5t: z.ZodOptional<z.ZodString>;
-        "x5t#S256": z.ZodOptional<z.ZodString>;
-        x5u: z.ZodOptional<z.ZodString>;
-        y: z.ZodOptional<z.ZodString>;
-    }, z.core.$loose>;
-    typ: z.ZodLiteral<"dpop+jwt">;
-    alg: z.ZodString;
-    kid: z.ZodOptional<z.ZodString>;
-    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
-    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$loose>;
-type DpopJwtHeader = z.infer<typeof zDpopJwtHeader>;
+    htu: z$1.ZodURL;
+    iat: z$1.ZodNumber;
+    jti: z$1.ZodString;
+    aud: z$1.ZodOptional<z$1.ZodUnion<[z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
+    cnf: z$1.ZodOptional<z$1.ZodObject<{
+        jkt: z$1.ZodOptional<z$1.ZodString>;
+        jwk: z$1.ZodOptional<z$1.ZodObject<{
+            alg: z$1.ZodOptional<z$1.ZodString>;
+            crv: z$1.ZodOptional<z$1.ZodString>;
+            d: z$1.ZodOptional<z$1.ZodString>;
+            dp: z$1.ZodOptional<z$1.ZodString>;
+            dq: z$1.ZodOptional<z$1.ZodString>;
+            e: z$1.ZodOptional<z$1.ZodString>;
+            ext: z$1.ZodOptional<z$1.ZodBoolean>;
+            k: z$1.ZodOptional<z$1.ZodString>;
+            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            kid: z$1.ZodOptional<z$1.ZodString>;
+            kty: z$1.ZodString;
+            n: z$1.ZodOptional<z$1.ZodString>;
+            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+                d: z$1.ZodOptional<z$1.ZodString>;
+                r: z$1.ZodOptional<z$1.ZodString>;
+                t: z$1.ZodOptional<z$1.ZodString>;
+            }, z$1.core.$loose>>>;
+            p: z$1.ZodOptional<z$1.ZodString>;
+            q: z$1.ZodOptional<z$1.ZodString>;
+            qi: z$1.ZodOptional<z$1.ZodString>;
+            use: z$1.ZodOptional<z$1.ZodString>;
+            x: z$1.ZodOptional<z$1.ZodString>;
+            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+            x5t: z$1.ZodOptional<z$1.ZodString>;
+            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+            x5u: z$1.ZodOptional<z$1.ZodString>;
+            y: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>;
+    }, z$1.core.$loose>>;
+    exp: z$1.ZodOptional<z$1.ZodNumber>;
+    iss: z$1.ZodOptional<z$1.ZodString>;
+    nbf: z$1.ZodOptional<z$1.ZodNumber>;
+    nonce: z$1.ZodOptional<z$1.ZodString>;
+    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
+    sub: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+}, z$1.core.$loose>;
+type DpopJwtPayload = z$1.infer<typeof zDpopJwtPayload>;
+declare const zDpopJwtHeader: z$1.ZodObject<{
+    jwk: z$1.ZodObject<{
+        alg: z$1.ZodOptional<z$1.ZodString>;
+        crv: z$1.ZodOptional<z$1.ZodString>;
+        d: z$1.ZodOptional<z$1.ZodString>;
+        dp: z$1.ZodOptional<z$1.ZodString>;
+        dq: z$1.ZodOptional<z$1.ZodString>;
+        e: z$1.ZodOptional<z$1.ZodString>;
+        ext: z$1.ZodOptional<z$1.ZodBoolean>;
+        k: z$1.ZodOptional<z$1.ZodString>;
+        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        kid: z$1.ZodOptional<z$1.ZodString>;
+        kty: z$1.ZodString;
+        n: z$1.ZodOptional<z$1.ZodString>;
+        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            d: z$1.ZodOptional<z$1.ZodString>;
+            r: z$1.ZodOptional<z$1.ZodString>;
+            t: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$loose>>>;
+        p: z$1.ZodOptional<z$1.ZodString>;
+        q: z$1.ZodOptional<z$1.ZodString>;
+        qi: z$1.ZodOptional<z$1.ZodString>;
+        use: z$1.ZodOptional<z$1.ZodString>;
+        x: z$1.ZodOptional<z$1.ZodString>;
+        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        x5t: z$1.ZodOptional<z$1.ZodString>;
+        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
+        x5u: z$1.ZodOptional<z$1.ZodString>;
+        y: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$loose>;
+    typ: z$1.ZodLiteral<"dpop+jwt">;
+    alg: z$1.ZodString;
+    kid: z$1.ZodOptional<z$1.ZodString>;
+    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
+    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+}, z$1.core.$loose>;
+type DpopJwtHeader = z$1.infer<typeof zDpopJwtHeader>;
 
-export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, type CertificateChain, ClientAttestationError, type ClientAttestationOptions, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, type CreatePushedAuthorizationRequestOptionsV1_4, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type InferSchemaOrDefaultOutput, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerWithJwk, type JwtSignerX5c, MAX_JTI_LENGTH, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RefreshTokenProfileJwtHeader, type RefreshTokenProfileJwtPayload, type RequestLike, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type TrustChain, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, decodeJwt, decodeJwtHeader, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zCertificateChain, zCompactJwe, zCompactJwt, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zRefreshTokenProfileJwtHeader, zRefreshTokenProfileJwtPayload, zSignedAuthorizationRequestJwtHeaderTyp, zTrustChain, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };
+export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenRequestAPTITUDE, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseAuthorizationServerMetadata, type BaseFetchTokenResponseOptions, type BaseParseAccessTokenRequestResult, type BaseRetrieveAccessTokenOptions, type BaseVerifyAccessTokenRequestOptions, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, ClientAttestationError, type ClientAttestationOptions, type ItWalletClientAttestationPopJwtHeader as ClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload as ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, type CreatePushedAuthorizationRequestOptionsV1_4, CreateTokenDPoPError, type CreateTokenDPoPOptions, type CreateTokenRequestOptions, type CreateTokenRequestReturnType, CreateTokenResponseError, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type FetchTokenResponseOptionsAPTITUDE, type FetchTokenResponseOptionsShared, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestOptionsAPTITUDE, type ParseAccessTokenRequestOptionsShared, type ParseAccessTokenRequestResult, type ParseAccessTokenRequestResultAPTITUDE, type ParseAccessTokenRequestResultV1_4, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenPreAuthorizedCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedAccessTokenRequestGrantAPTITUDE, type ParsedAccessTokenRequestGrantV1_4, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type PreAuthorizedCodeGrantType, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RefreshTokenProfileJwtHeader, type RefreshTokenProfileJwtPayload, type RetrieveAccessTokenOptions, type RetrieveAccessTokenOptionsAPTITUDE, type RetrieveAccessTokenOptionsAuthCode, type RetrieveAccessTokenOptionsPreAuthorizedCode, type RetrieveAccessTokenOptionsRefreshToken, type RetrieveAccessTokenOptionsShared, type SupportedAccessTokenVerificationOptions, type SupportedAccessTokenVerificationOptionsAPTITUDE, type SupportedAccessTokenVerificationOptionsV1_4, SupportedClientAuthenticationMethod, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPreAuthorizedCodeAccessTokenRequestOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createTokenRequestAPTITUDE, createTokenRequestV1_4, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenRequestAPTITUDE, zAccessTokenResponse, zAuthorizationCodeGrantIdentifier, zAuthorizationCodeTokenRequest, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPreAuthorizedCodeGrantIdentifier, zPreAuthorizedCodeTokenRequest, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zRefreshTokenProfileJwtHeader, zRefreshTokenProfileJwtPayload, zRefreshTokenTokenRequest, zSignedAuthorizationRequestJwtHeaderTyp, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };