@pagopa/io-wallet-oauth2 1.5.8 → 2.0.0-apt

package/dist/index.mjs

@@ -1,189 +1,78 @@
 // src/access-token/create-token-request.ts
-var createTokenRequest = async (options) => ({
-  ...options.additionalRequestPayload,
-  code: options.authorizationCode,
-  code_verifier: options.pkceCodeVerifier,
-  grant_type: "authorization_code",
-  redirect_uri: options.redirectUri
-});
-
-// src/access-token/create-token-response.ts
-import {
-  HashAlgorithm,
-  calculateJwkThumbprint
-} from "@openid4vc/oauth2";
-import {
-  addSecondsToDate,
-  dateToSeconds,
-  parseWithErrorHandling as parseWithErrorHandling2
-} from "@pagopa/io-wallet-utils";
-
-// src/common/jwt/decode-jwt-header.ts
-import { Oauth2JwtParseError } from "@openid4vc/oauth2";
 import {
-  decodeBase64,
-  encodeToUtf8String,
-  formatError,
-  parseWithErrorHandling,
-  stringToJsonWithErrorHandling
+  ItWalletSpecsVersion,
+  createVersionDispatcher
 } from "@pagopa/io-wallet-utils";
 
-// src/common/jwt/z-jwt.ts
-import z3 from "zod";
-
-// src/common/jwk/z-jwk.ts
-import z2 from "zod";
-
-// src/common/z-common.ts
-import z from "zod";
-var zTrustChain = z.tuple([z.string()], z.string());
-var zCertificateChain = z.array(z.string()).nonempty();
-var zAlgValueNotNone = z.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
-
-// src/common/jwk/z-jwk.ts
-var zJwk = z2.looseObject({
-  alg: z2.optional(z2.string()),
-  crv: z2.optional(z2.string()),
-  d: z2.optional(z2.string()),
-  dp: z2.optional(z2.string()),
-  dq: z2.optional(z2.string()),
-  e: z2.optional(z2.string()),
-  ext: z2.optional(z2.boolean()),
-  k: z2.optional(z2.string()),
-  key_ops: z2.optional(z2.array(z2.string())),
-  kid: z2.optional(z2.string()),
-  kty: z2.string(),
-  n: z2.optional(z2.string()),
-  oth: z2.optional(
-    z2.array(
-      z2.looseObject({
-        d: z2.optional(z2.string()),
-        r: z2.optional(z2.string()),
-        t: z2.optional(z2.string())
-      })
-    )
-  ),
-  p: z2.optional(z2.string()),
-  q: z2.optional(z2.string()),
-  qi: z2.optional(z2.string()),
-  use: z2.optional(z2.string()),
-  x: z2.optional(z2.string()),
-  x5c: z2.optional(zCertificateChain),
-  x5t: z2.optional(z2.string()),
-  "x5t#S256": z2.optional(z2.string()),
-  x5u: z2.optional(z2.string()),
-  y: z2.optional(z2.string())
-});
-var zJwkSet = z2.looseObject({ keys: z2.array(zJwk) });
-
-// src/common/jwt/z-jwt.ts
-var MAX_JTI_LENGTH = 256;
-var zCompactJwt = z3.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
-  message: "Not a valid compact jwt"
-});
-var zJwtConfirmationPayload = z3.looseObject({
-  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
-  jkt: z3.string().optional(),
-  jwk: zJwk.optional()
-});
-var zJwtPayload = z3.looseObject({
-  aud: z3.string().optional(),
-  cnf: zJwtConfirmationPayload.optional(),
-  exp: z3.number().int().optional(),
-  iat: z3.number().int().optional(),
-  iss: z3.string().optional(),
-  jti: z3.string().max(MAX_JTI_LENGTH).optional(),
-  nbf: z3.number().int().optional(),
-  nonce: z3.string().optional(),
-  // Reserved for status parameters
-  status: z3.record(z3.string(), z3.any()).optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional()
-});
-var zJwtHeader = z3.looseObject({
-  alg: zAlgValueNotNone,
-  jwk: zJwk.optional(),
-  kid: z3.string().optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional(),
-  typ: z3.string().optional(),
-  x5c: zCertificateChain.optional()
-});
+// src/access-token/z-grant-type.ts
+import { z } from "zod";
+var zAuthorizationCodeGrantIdentifier = z.literal("authorization_code");
+var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
+var zPreAuthorizedCodeGrantIdentifier = z.literal(
+  "urn:ietf:params:oauth:grant-type:pre-authorized_code"
+);
+var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
+var zRefreshTokenGrantIdentifier = z.literal("refresh_token");
+var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
-// src/common/jwt/decode-jwt-header.ts
-function decodeJwtHeader(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length <= 2) {
-    throw new Oauth2JwtParseError(
-      formatError(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const [headerPart] = jwtParts;
-  let headerJson;
-  try {
-    headerJson = stringToJsonWithErrorHandling(
-      encodeToUtf8String(decodeBase64(headerPart)),
-      formatError(
-        "Unable to parse jwt header to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new Oauth2JwtParseError(
-      formatError(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const header = parseWithErrorHandling(
-    options.headerSchema ?? zJwtHeader,
-    headerJson,
-    formatError("Invalid JWT header", options.errorMessagePrefix)
-  );
-  return {
-    header
-  };
-}
-function jwtHeaderFromJwtSigner(signer) {
-  if (signer.method === "did") {
-    return {
-      alg: signer.alg,
-      kid: signer.didUrl
-    };
-  }
-  if (signer.method === "federation") {
-    return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain
-    };
-  }
-  if (signer.method === "jwk") {
+// src/access-token/create-token-request.ts
+var createTokenRequestV1_4 = (options) => {
+  if (options.grantType === refreshTokenGrantIdentifier) {
     return {
-      alg: signer.alg,
-      jwk: signer.publicJwk
+      ...options.additionalRequestPayload,
+      grant_type: refreshTokenGrantIdentifier,
+      refresh_token: options.refreshToken,
+      scope: options.scope
     };
   }
-  if (signer.method === "x5c") {
+  return {
+    ...options.additionalRequestPayload,
+    code: options.authorizationCode,
+    code_verifier: options.pkceCodeVerifier,
+    grant_type: authorizationCodeGrantIdentifier,
+    redirect_uri: options.redirectUri
+  };
+};
+function createTokenRequestAPTITUDE(options) {
+  if (options.grantType === preAuthorizedCodeGrantIdentifier) {
     return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain,
-      x5c: signer.x5c
+      ...options.additionalRequestPayload,
+      grant_type: preAuthorizedCodeGrantIdentifier,
+      "pre-authorized_code": options.preAuthorizedCode,
+      tx_code: options.txCode
     };
   }
-  return { alg: signer.alg };
+  return createTokenRequestV1_4(options);
+}
+var dispatchCreateTokenRequest = createVersionDispatcher({
+  [ItWalletSpecsVersion.APTITUDE]: (o) => createTokenRequestAPTITUDE(o),
+  [ItWalletSpecsVersion.V1_0]: (o) => createTokenRequestV1_4(o),
+  [ItWalletSpecsVersion.V1_3]: (o) => createTokenRequestV1_4(o),
+  [ItWalletSpecsVersion.V1_4]: (o) => createTokenRequestV1_4(o)
+});
+function createTokenRequest(options) {
+  return dispatchCreateTokenRequest(options);
 }
 
+// src/access-token/create-token-response.ts
+import {
+  HashAlgorithm,
+  ItWalletSpecsVersion as ItWalletSpecsVersion2,
+  addSecondsToDate,
+  calculateJwkThumbprint,
+  createVersionDispatcher as createVersionDispatcher2,
+  dateToSeconds,
+  jwtHeaderFromJwtSigner,
+  parseWithErrorHandling
+} from "@pagopa/io-wallet-utils";
+
 // src/errors.ts
 var Oauth2Error = class extends Error {
   statusCode;
   constructor(message, options) {
-    super(message, options);
+    const errorMessage = message ?? "Unknown error occurred.";
+    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${String(options.cause)}` : "";
+    super(`${errorMessage}${causeMessage}`, options);
     this.name = "Oauth2Error";
     this.statusCode = options?.statusCode;
   }
@@ -234,70 +123,87 @@ var ClientAttestationError = class extends Oauth2Error {
 };
 
 // src/access-token/z-token.ts
-import { z as z4 } from "zod";
-var zAccessTokenRequest = z4.discriminatedUnion("grant_type", [
-  z4.object({
-    code: z4.string().nonempty(),
-    code_verifier: z4.string().nonempty(),
-    grant_type: z4.literal("authorization_code"),
-    redirect_uri: z4.string().nonempty()
-  }),
-  z4.object({
-    grant_type: z4.literal("refresh_token"),
-    refresh_token: z4.string().nonempty(),
-    scope: z4.string().optional()
-  })
+import {
+  MAX_JTI_LENGTH,
+  zJwtHeader,
+  zJwtPayload
+} from "@pagopa/io-wallet-utils";
+import { z as z2 } from "zod";
+var zPreAuthorizedCodeTokenRequest = z2.object({
+  grant_type: zPreAuthorizedCodeGrantIdentifier,
+  "pre-authorized_code": z2.string().nonempty(),
+  tx_code: z2.string().optional()
+});
+var zAuthorizationCodeTokenRequest = z2.object({
+  code: z2.string().nonempty(),
+  code_verifier: z2.string().nonempty(),
+  grant_type: zAuthorizationCodeGrantIdentifier,
+  redirect_uri: z2.string().nonempty()
+});
+var zRefreshTokenTokenRequest = z2.object({
+  grant_type: zRefreshTokenGrantIdentifier,
+  refresh_token: z2.string().nonempty(),
+  scope: z2.string().optional()
+});
+var zAccessTokenRequest = z2.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest
+]);
+var zAccessTokenRequestAPTITUDE = z2.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest,
+  zPreAuthorizedCodeTokenRequest
 ]);
-var zAccessTokenResponse = z4.looseObject({
-  access_token: z4.string(),
-  authorization_details: z4.array(
-    z4.looseObject({
-      credential_configuration_id: z4.optional(z4.string()),
-      credential_identifiers: z4.optional(z4.array(z4.string())),
-      type: z4.literal("openid_credential")
+var zAccessTokenResponse = z2.looseObject({
+  access_token: z2.string(),
+  authorization_details: z2.array(
+    z2.looseObject({
+      credential_configuration_id: z2.optional(z2.string()),
+      credential_identifiers: z2.optional(z2.array(z2.string())),
+      type: z2.literal("openid_credential")
     })
   ).optional(),
-  expires_in: z4.optional(z4.number().int()),
-  refresh_token: z4.optional(z4.string()),
-  token_type: z4.union([z4.literal("Bearer"), z4.literal("DPoP")])
+  expires_in: z2.optional(z2.number().int()),
+  refresh_token: z2.optional(z2.string()),
+  token_type: z2.union([z2.literal("Bearer"), z2.literal("DPoP")])
 });
-var zAccessTokenProfileJwtHeader = z4.looseObject({
+var zAccessTokenProfileJwtHeader = z2.looseObject({
   ...zJwtHeader.shape,
-  typ: z4.enum(["application/at+jwt", "at+jwt"])
+  typ: z2.enum(["application/at+jwt", "at+jwt"])
 });
-var zAccessTokenProfileJwtPayload = z4.looseObject({
+var zAccessTokenProfileJwtPayload = z2.looseObject({
   ...zJwtPayload.shape,
-  aud: z4.string(),
-  client_id: z4.string(),
-  cnf: z4.object({
-    jkt: z4.string()
+  aud: z2.string(),
+  client_id: z2.string(),
+  cnf: z2.object({
+    jkt: z2.string()
   }).optional(),
-  exp: z4.number(),
-  iat: z4.number(),
-  iss: z4.string(),
-  jti: z4.string().max(MAX_JTI_LENGTH),
-  nbf: z4.number().optional(),
-  scope: z4.string().optional(),
-  sub: z4.string()
+  exp: z2.number(),
+  iat: z2.number(),
+  iss: z2.string(),
+  jti: z2.string().max(MAX_JTI_LENGTH),
+  nbf: z2.number().optional(),
+  scope: z2.string().optional(),
+  sub: z2.string()
 });
-var zRefreshTokenProfileJwtHeader = z4.looseObject({
+var zRefreshTokenProfileJwtHeader = z2.looseObject({
   ...zJwtHeader.shape,
-  kid: z4.string(),
-  typ: z4.literal("rt+jwt")
+  kid: z2.string(),
+  typ: z2.literal("rt+jwt")
 });
-var zRefreshTokenProfileJwtPayload = z4.looseObject({
+var zRefreshTokenProfileJwtPayload = z2.looseObject({
   ...zJwtPayload.shape,
-  aud: z4.string(),
-  client_id: z4.string(),
-  cnf: z4.object({
-    jkt: z4.string()
+  aud: z2.string(),
+  client_id: z2.string(),
+  cnf: z2.object({
+    jkt: z2.string()
   }),
-  exp: z4.number().int(),
-  iat: z4.number().int(),
-  iss: z4.string(),
-  jti: z4.string().max(MAX_JTI_LENGTH),
-  nbf: z4.number().int(),
-  sub: z4.string()
+  exp: z2.number().int(),
+  iat: z2.number().int(),
+  iss: z2.string(),
+  jti: z2.string().max(MAX_JTI_LENGTH),
+  nbf: z2.number().int(),
+  sub: z2.string()
 });
 
 // src/access-token/create-token-response.ts
@@ -326,7 +232,7 @@ function resolveRefreshTokenKid(signer) {
   }
   return void 0;
 }
-async function createAccessTokenResponse(options) {
+async function createAccessTokenResponseV1_4(options) {
   try {
     const now = options.now ?? /* @__PURE__ */ new Date();
     if (options.tokenType === "DPoP" && !options.dpop) {
@@ -353,11 +259,11 @@ async function createAccessTokenResponse(options) {
       now,
       options.expiresInSeconds
     );
-    const header = parseWithErrorHandling2(zAccessTokenProfileJwtHeader, {
+    const header = parseWithErrorHandling(zAccessTokenProfileJwtHeader, {
       ...jwtHeaderFromJwtSigner(options.signer),
       typ: "at+jwt"
     });
-    const payload = parseWithErrorHandling2(zAccessTokenProfileJwtPayload, {
+    const payload = parseWithErrorHandling(zAccessTokenProfileJwtPayload, {
       ...options.additionalPayload,
       aud: options.audience,
       client_id: options.clientId,
@@ -382,7 +288,7 @@ async function createAccessTokenResponse(options) {
           "Unable to resolve a kid for the Refresh Token JOSE header. Provide signer.kid or a publicJwk.kid."
         );
       }
-      const refreshTokenHeader = parseWithErrorHandling2(
+      const refreshTokenHeader = parseWithErrorHandling(
         zRefreshTokenProfileJwtHeader,
         {
           alg: options.signer.alg,
@@ -390,7 +296,7 @@ async function createAccessTokenResponse(options) {
           typ: "rt+jwt"
         }
       );
-      const refreshTokenPayload = parseWithErrorHandling2(
+      const refreshTokenPayload = parseWithErrorHandling(
         zRefreshTokenProfileJwtPayload,
         {
           aud: options.authorizationServer,
@@ -415,7 +321,7 @@ async function createAccessTokenResponse(options) {
       );
       refreshToken = refreshTokenSignResult.jwt;
     }
-    const accessTokenResponse = parseWithErrorHandling2(zAccessTokenResponse, {
+    const accessTokenResponse = parseWithErrorHandling(zAccessTokenResponse, {
       ...options.additionalPayload,
       access_token: jwt,
       expires_in: options.expiresInSeconds,
@@ -432,18 +338,29 @@ async function createAccessTokenResponse(options) {
     );
   }
 }
+var dispatchCreateAccessTokenResponse = createVersionDispatcher2({
+  [ItWalletSpecsVersion2.APTITUDE]: (o) => createAccessTokenResponseV1_4(o),
+  [ItWalletSpecsVersion2.V1_0]: (o) => createAccessTokenResponseV1_4(o),
+  [ItWalletSpecsVersion2.V1_3]: (o) => createAccessTokenResponseV1_4(o),
+  [ItWalletSpecsVersion2.V1_4]: (o) => createAccessTokenResponseV1_4(o)
+});
+function createAccessTokenResponse(options) {
+  return dispatchCreateAccessTokenResponse(options);
+}
 
 // src/access-token/fetch-token-response.ts
 import {
   CONTENT_TYPES,
   HEADERS,
+  ItWalletSpecsVersion as ItWalletSpecsVersion3,
   UnexpectedStatusCodeError,
   ValidationError,
   createFetcher,
+  createVersionDispatcher as createVersionDispatcher3,
   hasStatusOrThrow,
-  parseWithErrorHandling as parseWithErrorHandling3
+  parseWithErrorHandling as parseWithErrorHandling2
 } from "@pagopa/io-wallet-utils";
-async function fetchTokenResponse(options) {
+async function fetchTokenResponseV1_4(options) {
   try {
     const fetch = createFetcher(options.callbacks.fetch);
     const tokenResponse = await fetch(options.accessTokenEndpoint, {
@@ -457,7 +374,7 @@ async function fetchTokenResponse(options) {
       method: "POST"
     });
     await hasStatusOrThrow(200, UnexpectedStatusCodeError)(tokenResponse);
-    return parseWithErrorHandling3(
+    return parseWithErrorHandling2(
       zAccessTokenResponse,
       await tokenResponse.json(),
       "Failed to parse token response"
@@ -482,105 +399,53 @@ function toURLSearchParams(data) {
   });
   return params;
 }
+var dispatchFetchTokenResponse = createVersionDispatcher3({
+  [ItWalletSpecsVersion3.APTITUDE]: (o) => fetchTokenResponseV1_4(o),
+  [ItWalletSpecsVersion3.V1_0]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion3.V1_3]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion3.V1_4]: (o) => fetchTokenResponseV1_4(
+    o
+  )
+});
+function fetchTokenResponse(options) {
+  return dispatchFetchTokenResponse(options);
+}
 
 // src/access-token/parse-token-request.ts
 import {
+  ItWalletSpecsVersion as ItWalletSpecsVersion5,
+  createVersionDispatcher as createVersionDispatcher5,
   formatZodError
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/wallet-attestation.ts
-import { zCompactJwt as zCompactJwt2 } from "@openid4vc/oauth2";
 import {
-  ItWalletSpecsVersion,
-  createVersionDispatcher
+  ItWalletSpecsVersion as ItWalletSpecsVersion4,
+  createVersionDispatcher as createVersionDispatcher4,
+  zCompactJwt
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/types.ts
-import z5 from "zod";
-var zOauthClientAttestationHeader = z5.literal(
+import z3 from "zod";
+var zOauthClientAttestationHeader = z3.literal(
   "OAuth-Client-Attestation"
 );
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = z5.literal(
+var zOauthClientAttestationPopHeader = z3.literal(
   "OAuth-Client-Attestation-PoP"
 );
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
 
 // src/client-attestation/verify-wallet-attestation-jwt-base.ts
-import { jwtSignerFromJwt, verifyJwt } from "@openid4vc/oauth2";
-
-// src/common/jwt/decode-jwt.ts
-import { Oauth2JwtParseError as Oauth2JwtParseError2 } from "@openid4vc/oauth2";
 import {
-  decodeBase64 as decodeBase642,
-  encodeToUtf8String as encodeToUtf8String2,
-  formatError as formatError2,
-  parseWithErrorHandling as parseWithErrorHandling4,
-  stringToJsonWithErrorHandling as stringToJsonWithErrorHandling2
+  decodeJwt,
+  jwtSignerFromJwt,
+  verifyJwt
 } from "@pagopa/io-wallet-utils";
-function decodeJwt(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length !== 3) {
-    throw new Oauth2JwtParseError2(
-      formatError2(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  let payloadJson;
-  try {
-    const payloadPart = jwtParts[1];
-    if (payloadPart === void 0) {
-      throw new Oauth2JwtParseError2(
-        formatError2(
-          "Unable to decode because Jwt is not a valid!",
-          options.errorMessagePrefix
-        )
-      );
-    }
-    payloadJson = stringToJsonWithErrorHandling2(
-      encodeToUtf8String2(decodeBase642(payloadPart)),
-      formatError2(
-        "Unable to parse jwt payload to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new Oauth2JwtParseError2(
-      formatError2(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const signaturePart = jwtParts[2];
-  if (signaturePart === void 0) {
-    throw new Oauth2JwtParseError2(
-      formatError2(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const { header } = decodeJwtHeader({
-    errorMessagePrefix: options.errorMessagePrefix,
-    headerSchema: options.headerSchema,
-    jwt: options.jwt
-  });
-  const payload = parseWithErrorHandling4(
-    options.payloadSchema ?? zJwtPayload,
-    payloadJson,
-    formatError2("Invalid JWT payload", options.errorMessagePrefix)
-  );
-  return {
-    header,
-    payload,
-    signature: signaturePart
-  };
-}
-
-// src/client-attestation/verify-wallet-attestation-jwt-base.ts
 async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
   const { header, payload } = decodeJwt({
     errorMessagePrefix: "Error decoding wallet attestation JWT:",
@@ -601,27 +466,33 @@ async function verifyWalletAttestationBase(options, headerSchema, payloadSchema)
 }
 
 // src/client-attestation/v1.0/z-wallet-attestation.ts
-import { z as z6 } from "zod";
-var zWalletAttestationJwtHeaderV1_0 = z6.looseObject({
-  ...zJwtHeader.shape,
+import {
+  zJwk,
+  zJwtHeader as zJwtHeader2,
+  zJwtPayload as zJwtPayload2,
+  zTrustChain
+} from "@pagopa/io-wallet-utils";
+import { z as z4 } from "zod";
+var zWalletAttestationJwtHeaderV1_0 = z4.looseObject({
+  ...zJwtHeader2.shape,
   trust_chain: zTrustChain,
   // REQUIRED in v1.0
-  typ: z6.literal("oauth-client-attestation+jwt")
+  typ: z4.literal("oauth-client-attestation+jwt")
 });
-var zWalletAttestationJwtPayloadV1_0 = z6.looseObject({
-  ...zJwtPayload.shape,
-  aal: z6.string(),
-  cnf: z6.object({
+var zWalletAttestationJwtPayloadV1_0 = z4.looseObject({
+  ...zJwtPayload2.shape,
+  aal: z4.string(),
+  cnf: z4.object({
     jwk: zJwk
   }),
-  exp: z6.number(),
-  iat: z6.number(),
-  iss: z6.string(),
-  sub: z6.string(),
-  wallet_link: z6.url().optional(),
-  wallet_name: z6.string().optional()
+  exp: z4.number(),
+  iat: z4.number(),
+  iss: z4.string(),
+  sub: z4.string(),
+  wallet_link: z4.url().optional(),
+  wallet_name: z4.string().optional()
 });
-var zWalletAttestationJwtV1_0 = z6.string().min(1);
+var zWalletAttestationJwtV1_0 = z4.string().min(1);
 
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
@@ -633,37 +504,44 @@ async function verifyWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.3/z-wallet-attestation.ts
-import { z as z7 } from "zod";
-var zWalletAttestationJwtHeaderV1_3 = z7.looseObject({
-  ...zJwtHeader.shape,
-  trust_chain: zTrustChain.optional(),
+import {
+  zCertificateChain,
+  zJwk as zJwk2,
+  zJwtHeader as zJwtHeader3,
+  zJwtPayload as zJwtPayload3,
+  zTrustChain as zTrustChain2
+} from "@pagopa/io-wallet-utils";
+import { z as z5 } from "zod";
+var zWalletAttestationJwtHeaderV1_3 = z5.looseObject({
+  ...zJwtHeader3.shape,
+  trust_chain: zTrustChain2.optional(),
   // OPTIONAL in v1.3
-  typ: z7.literal("oauth-client-attestation+jwt"),
+  typ: z5.literal("oauth-client-attestation+jwt"),
   x5c: zCertificateChain
   // REQUIRED in v1.3
 });
-var zWalletAttestationJwtPayloadV1_3 = z7.looseObject({
-  ...zJwtPayload.shape,
-  cnf: z7.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_3 = z5.looseObject({
+  ...zJwtPayload3.shape,
+  cnf: z5.object({
+    jwk: zJwk2
   }),
-  exp: z7.number(),
-  iat: z7.number(),
-  iss: z7.string(),
-  nbf: z7.number().optional(),
+  exp: z5.number(),
+  iat: z5.number(),
+  iss: z5.string(),
+  nbf: z5.number().optional(),
   // NEW in v1.3
-  status: z7.object({
-    status_list: z7.object({
-      idx: z7.number().int(),
-      uri: z7.string()
+  status: z5.object({
+    status_list: z5.object({
+      idx: z5.number().int(),
+      uri: z5.string()
     })
   }).optional(),
   // NEW in v1.3 - status object for revocation
-  sub: z7.string(),
-  wallet_link: z7.url().optional(),
-  wallet_name: z7.string().optional()
+  sub: z5.string(),
+  wallet_link: z5.url().optional(),
+  wallet_name: z5.string().optional()
 });
-var zWalletAttestationJwtV1_3 = z7.string().min(1);
+var zWalletAttestationJwtV1_3 = z5.string().min(1);
 
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
@@ -675,28 +553,35 @@ async function verifyWalletAttestationJwt2(options) {
 }
 
 // src/client-attestation/v1.4/z-wallet-attestation.ts
-import { z as z8 } from "zod";
-var zWalletAttestationJwtHeaderV1_4 = z8.looseObject({
-  ...zJwtHeader.shape,
-  kid: z8.string(),
-  trust_chain: zTrustChain.optional(),
-  typ: z8.literal("oauth-client-attestation+jwt"),
-  x5c: zCertificateChain
+import {
+  zCertificateChain as zCertificateChain2,
+  zJwk as zJwk3,
+  zJwtHeader as zJwtHeader4,
+  zJwtPayload as zJwtPayload4,
+  zTrustChain as zTrustChain3
+} from "@pagopa/io-wallet-utils";
+import { z as z6 } from "zod";
+var zWalletAttestationJwtHeaderV1_4 = z6.looseObject({
+  ...zJwtHeader4.shape,
+  kid: z6.string(),
+  trust_chain: zTrustChain3.optional(),
+  typ: z6.literal("oauth-client-attestation+jwt"),
+  x5c: zCertificateChain2
 });
-var zWalletAttestationJwtPayloadV1_4 = z8.looseObject({
-  ...zJwtPayload.shape,
-  cnf: z8.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_4 = z6.looseObject({
+  ...zJwtPayload4.shape,
+  cnf: z6.object({
+    jwk: zJwk3
   }),
-  exp: z8.number().int(),
-  iat: z8.number().int(),
-  iss: z8.string(),
-  nbf: z8.number().optional(),
-  sub: z8.string(),
-  wallet_link: z8.url(),
-  wallet_name: z8.string()
+  exp: z6.number().int(),
+  iat: z6.number().int(),
+  iss: z6.string(),
+  nbf: z6.number().optional(),
+  sub: z6.string(),
+  wallet_link: z6.url(),
+  wallet_name: z6.string()
 });
-var zWalletAttestationJwtV1_4 = z8.string().min(1);
+var zWalletAttestationJwtV1_4 = z6.string().min(1);
 
 // src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt3(options) {
@@ -708,10 +593,11 @@ async function verifyWalletAttestationJwt3(options) {
 }
 
 // src/client-attestation/wallet-attestation.ts
-var dispatchVerifyWalletAttestationJwt = createVersionDispatcher({
-  [ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
-  [ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
-  [ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
+var dispatchVerifyWalletAttestationJwt = createVersionDispatcher4({
+  [ItWalletSpecsVersion4.APTITUDE]: (o) => verifyWalletAttestationJwt3(o),
+  [ItWalletSpecsVersion4.V1_0]: (o) => verifyWalletAttestationJwt(o),
+  [ItWalletSpecsVersion4.V1_3]: (o) => verifyWalletAttestationJwt2(o),
+  [ItWalletSpecsVersion4.V1_4]: (o) => verifyWalletAttestationJwt3(o)
 });
 async function verifyWalletAttestationJwt4(options) {
   return dispatchVerifyWalletAttestationJwt(options);
@@ -727,7 +613,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   if (!walletAttestationHeader || !clientAttestationPopHeader) {
     return { valid: false };
   }
-  if (!zCompactJwt2.safeParse(walletAttestationHeader).success || !zCompactJwt2.safeParse(clientAttestationPopHeader).success) {
+  if (!zCompactJwt.safeParse(walletAttestationHeader).success || !zCompactJwt.safeParse(clientAttestationPopHeader).success) {
     return { valid: false };
   }
   return {
@@ -740,14 +626,12 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 // src/token-dpop/create-token-dpop.ts
 import {
   HashAlgorithm as HashAlgorithm2,
-  zCompactJwt as zCompactJwt3
-} from "@openid4vc/oauth2";
-import {
   ValidationError as ValidationError2,
   dateToSeconds as dateToSeconds2,
   decodeUtf8String,
   encodeToBase64Url,
-  parseWithErrorHandling as parseWithErrorHandling5
+  parseWithErrorHandling as parseWithErrorHandling3,
+  zCompactJwt as zCompactJwt2
 } from "@pagopa/io-wallet-utils";
 import { Base64 } from "js-base64";
 
@@ -760,20 +644,26 @@ var htuFromRequestUrl = (requestUrl) => {
 };
 
 // src/token-dpop/z-dpop.ts
-import { zHttpMethod } from "@pagopa/io-wallet-utils";
-import z9 from "zod";
-var zDpopJwtPayload = z9.looseObject({
-  ...zJwtPayload.shape,
-  ath: z9.optional(z9.string()),
+import {
+  MAX_JTI_LENGTH as MAX_JTI_LENGTH2,
+  zHttpMethod,
+  zJwk as zJwk4,
+  zJwtHeader as zJwtHeader5,
+  zJwtPayload as zJwtPayload5
+} from "@pagopa/io-wallet-utils";
+import z7 from "zod";
+var zDpopJwtPayload = z7.looseObject({
+  ...zJwtPayload5.shape,
+  ath: z7.optional(z7.string()),
   htm: zHttpMethod,
-  htu: z9.url(),
-  iat: z9.number().int().nonnegative(),
-  jti: z9.string().max(MAX_JTI_LENGTH)
+  htu: z7.url(),
+  iat: z7.number().int().nonnegative(),
+  jti: z7.string().max(MAX_JTI_LENGTH2)
 });
-var zDpopJwtHeader = z9.looseObject({
-  ...zJwtHeader.shape,
-  jwk: zJwk,
-  typ: z9.literal("dpop+jwt")
+var zDpopJwtHeader = z7.looseObject({
+  ...zJwtHeader5.shape,
+  jwk: zJwk4,
+  typ: z7.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
@@ -794,12 +684,12 @@ async function createTokenDPoP(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const header = parseWithErrorHandling5(zDpopJwtHeader, {
+    const header = parseWithErrorHandling3(zDpopJwtHeader, {
       alg: options.signer.alg,
       jwk: options.signer.publicJwk,
       typ: "dpop+jwt"
     });
-    const payload = parseWithErrorHandling5(zDpopJwtPayload, {
+    const payload = parseWithErrorHandling3(zDpopJwtPayload, {
       ath,
       htm: options.tokenRequest.method,
       htu: htuFromRequestUrl(options.tokenRequest.url),
@@ -824,21 +714,14 @@ function extractDpopJwtFromHeaders(headers) {
   if (!dpopJwt) {
     return { valid: true };
   }
-  if (!zCompactJwt3.safeParse(dpopJwt).success) {
+  if (!zCompactJwt2.safeParse(dpopJwt).success) {
     return { valid: false };
   }
   return { dpopJwt, valid: true };
 }
 
-// src/access-token/z-grant-type.ts
-import { z as z10 } from "zod";
-var zAuthorizationCodeGrantIdentifier = z10.literal("authorization_code");
-var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = z10.literal("refresh_token");
-var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
-
 // src/access-token/parse-token-request.ts
-function parseAccessTokenRequest(options) {
+function parseAccessTokenRequestV1_4(options) {
   const validationResult = zAccessTokenRequest.safeParse(
     options.accessTokenRequest
   );
@@ -859,6 +742,25 @@ ${formatZodError(validationResult.error)}`
     ...securityHeaders
   };
 }
+function parseAccessTokenRequestAPTITUDE(options) {
+  const validationResult = zAccessTokenRequestAPTITUDE.safeParse(
+    options.accessTokenRequest
+  );
+  if (!validationResult.success) {
+    throw new Oauth2Error(
+      `Access token request validation failed:
+${formatZodError(validationResult.error)}`
+    );
+  }
+  const accessTokenRequest = validationResult.data;
+  const grant = parseGrantParametersAPTITUDE(accessTokenRequest);
+  const securityHeaders = parseSecurityHeaders(options.request.headers);
+  return {
+    accessTokenRequest,
+    grant,
+    ...securityHeaders
+  };
+}
 function parseGrantParameters(accessTokenRequest) {
   if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
     return {
@@ -876,6 +778,30 @@ function parseGrantParameters(accessTokenRequest) {
     `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}'`
   );
 }
+function parseGrantParametersAPTITUDE(accessTokenRequest) {
+  if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
+    return {
+      code: accessTokenRequest.code,
+      grantType: authorizationCodeGrantIdentifier
+    };
+  }
+  if (accessTokenRequest.grant_type === refreshTokenGrantIdentifier) {
+    return {
+      grantType: refreshTokenGrantIdentifier,
+      refreshToken: accessTokenRequest.refresh_token
+    };
+  }
+  if (accessTokenRequest.grant_type === preAuthorizedCodeGrantIdentifier) {
+    return {
+      grantType: preAuthorizedCodeGrantIdentifier,
+      preAuthorizedCode: accessTokenRequest["pre-authorized_code"],
+      txCode: accessTokenRequest.tx_code
+    };
+  }
+  throw new Oauth2Error(
+    `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}', '${preAuthorizedCodeGrantIdentifier}'`
+  );
+}
 function parseSecurityHeaders(headers) {
   const extractedDpopJwt = extractDpopJwtFromHeaders(headers);
   if (!extractedDpopJwt.valid) {
@@ -910,47 +836,76 @@ function parseSecurityHeaders(headers) {
     dpop: { jwt: extractedDpopJwt.dpopJwt }
   };
 }
+var dispatchParseTokenRequest = createVersionDispatcher5({
+  [ItWalletSpecsVersion5.APTITUDE]: (o) => parseAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [ItWalletSpecsVersion5.V1_0]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion5.V1_3]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion5.V1_4]: (o) => parseAccessTokenRequestV1_4(
+    o
+  )
+});
+function parseAccessTokenRequest(options) {
+  return dispatchParseTokenRequest(options);
+}
+
+// src/access-token/verify-access-token-request.ts
+import {
+  ItWalletSpecsVersion as ItWalletSpecsVersion7,
+  createVersionDispatcher as createVersionDispatcher6
+} from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/verify-client-attestation.ts
 import {
   HashAlgorithm as HashAlgorithm3,
   calculateJwkThumbprint as calculateJwkThumbprint2
-} from "@openid4vc/oauth2";
+} from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/client-attestation-pop.ts
-import { verifyJwt as verifyJwt2 } from "@openid4vc/oauth2";
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion2,
+  ItWalletSpecsVersion as ItWalletSpecsVersion6,
   addSecondsToDate as addSecondsToDate2,
   dateToSeconds as dateToSeconds3,
+  decodeJwt as decodeJwt2,
   encodeToBase64Url as encodeToBase64Url2,
-  parseWithErrorHandling as parseWithErrorHandling6
+  parseWithErrorHandling as parseWithErrorHandling4,
+  verifyJwt as verifyJwt2
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/z-client-attestation-pop.ts
-import z11 from "zod";
+import {
+  MAX_JTI_LENGTH as MAX_JTI_LENGTH3,
+  zJwtHeader as zJwtHeader6,
+  zJwtPayload as zJwtPayload6
+} from "@pagopa/io-wallet-utils";
+import z8 from "zod";
 var IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES = [
   "ES256",
   "ES384",
   "ES512"
 ];
-var zItWalletClientAttestationPopJwtAlg = z11.enum(
+var zItWalletClientAttestationPopJwtAlg = z8.enum(
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES
 );
-var zItWalletClientAttestationPopJwtPayload = z11.looseObject({
-  ...zJwtPayload.shape,
-  aud: z11.string(),
-  exp: z11.number().int().optional(),
-  iat: z11.number().int(),
-  iss: z11.string(),
-  jti: z11.string().max(MAX_JTI_LENGTH),
-  nonce: z11.string().optional()
+var zItWalletClientAttestationPopJwtPayload = z8.looseObject({
+  ...zJwtPayload6.shape,
+  aud: z8.string(),
+  exp: z8.number().int().optional(),
+  iat: z8.number().int(),
+  iss: z8.string(),
+  jti: z8.string().max(MAX_JTI_LENGTH3),
+  nonce: z8.string().optional()
 });
-var zItWalletClientAttestationPopJwtTyp = z11.literal(
+var zItWalletClientAttestationPopJwtTyp = z8.literal(
   "oauth-client-attestation-pop+jwt"
 );
-var zItWalletClientAttestationPopJwtHeader = z11.looseObject({
-  ...zJwtHeader.shape,
+var zItWalletClientAttestationPopJwtHeader = z8.looseObject({
+  ...zJwtHeader6.shape,
   typ: zItWalletClientAttestationPopJwtTyp
 });
 
@@ -964,7 +919,7 @@ function assertSupportedClientAttestationPopAlg(alg) {
 }
 async function verifyClientAttestationPopJwt(options) {
   try {
-    const { header, payload } = decodeJwt({
+    const { header, payload } = decodeJwt2({
       errorMessagePrefix: "Error decoding client attestation PoP JWT:",
       headerSchema: zItWalletClientAttestationPopJwtHeader,
       jwt: options.clientAttestationPopJwt,
@@ -1000,7 +955,7 @@ async function verifyClientAttestationPopJwt(options) {
 }
 async function createClientAttestationPopJwt(options) {
   try {
-    const clientAttestation = decodeJwt({
+    const clientAttestation = decodeJwt2({
       errorMessagePrefix: "Error decoding client attestation JWT:",
       jwt: options.clientAttestation
     });
@@ -1033,14 +988,14 @@ async function createClientAttestationPopJwt(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const payload = parseWithErrorHandling6(
+    const payload = parseWithErrorHandling4(
       zItWalletClientAttestationPopJwtPayload,
       {
         aud: options.authorizationServer,
         iat: dateToSeconds3(issuedAt),
         iss: sub,
         jti,
-        ...options.config.itWalletSpecsVersion === ItWalletSpecsVersion2.V1_0 ? {
+        ...options.config.itWalletSpecsVersion === ItWalletSpecsVersion6.V1_0 ? {
           exp: dateToSeconds3(
             "expiresAt" in options && options.expiresAt ? options.expiresAt : addSecondsToDate2(issuedAt, 1 * 60)
           )
@@ -1106,9 +1061,10 @@ async function verifyClientAttestation(options) {
 
 // src/pkce.ts
 import {
-  HashAlgorithm as HashAlgorithm4
-} from "@openid4vc/oauth2";
-import { decodeUtf8String as decodeUtf8String2, encodeToBase64Url as encodeToBase64Url3 } from "@pagopa/io-wallet-utils";
+  HashAlgorithm as HashAlgorithm4,
+  decodeUtf8String as decodeUtf8String2,
+  encodeToBase64Url as encodeToBase64Url3
+} from "@pagopa/io-wallet-utils";
 var PkceCodeChallengeMethod = {
   Plain: "plain",
   S256: "S256"
@@ -1170,15 +1126,14 @@ async function calculateCodeChallenge(options) {
 import {
   HashAlgorithm as HashAlgorithm5,
   calculateJwkThumbprint as calculateJwkThumbprint3,
-  verifyJwt as verifyJwt3
-} from "@openid4vc/oauth2";
-import {
+  decodeJwt as decodeJwt3,
   decodeUtf8String as decodeUtf8String3,
   encodeToBase64Url as encodeToBase64Url4,
+  verifyJwt as verifyJwt3,
   verifyJwtIatOrThrow
 } from "@pagopa/io-wallet-utils";
 async function verifyTokenDPoP(options) {
-  const { header, payload } = decodeJwt({
+  const { header, payload } = decodeJwt3({
     errorMessagePrefix: "Error decoding access token DPoP JWT:",
     headerSchema: zDpopJwtHeader,
     jwt: options.dpopJwt,
@@ -1274,7 +1229,7 @@ async function verifyTokenDPoP(options) {
 }
 
 // src/access-token/verify-access-token-request.ts
-async function verifyAccessTokenRequest(options) {
+async function verifyAccessTokenRequestV1_4(options) {
   if (options.dpop.expectedNonce === "") {
     throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
@@ -1303,12 +1258,44 @@ async function verifyAccessTokenRequest(options) {
   if (options.grant.code !== options.expectedCode) {
     throw new Oauth2Error(`Invalid 'code' provided`);
   }
-  if (options.codeExpiresAt) {
-    const now = options.now ?? /* @__PURE__ */ new Date();
-    if (now.getTime() > options.codeExpiresAt.getTime()) {
-      throw new Oauth2Error(`Expired 'code' provided`);
-    }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+  if (!header.jwk) {
+    throw new Oauth2Error("DPoP header does not contain a JWK");
+  }
+  return {
+    clientAttestation: clientAttestationResult,
+    dpop: { jwk: header.jwk, jwkThumbprint }
+  };
+}
+async function verifyAccessTokenRequestAPTITUDE(options) {
+  if (options.dpop.expectedNonce === "") {
+    throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
+  if (!isPreAuthorizedCodeVerification(options)) {
+    await verifyPkce({
+      callbacks: options.callbacks,
+      codeChallenge: options.pkce.codeChallenge,
+      codeChallengeMethod: options.pkce.codeChallengeMethod,
+      codeVerifier: options.pkce.codeVerifier
+    });
+  }
+  const { header, jwkThumbprint } = await verifyTokenDPoP({
+    allowedSigningAlgs: options.dpop.allowedSigningAlgs,
+    callbacks: options.callbacks,
+    dpopJwt: options.dpop.jwt,
+    expectedNonce: options.dpop.expectedNonce,
+    now: options.now,
+    request: options.request
+  });
+  const clientAttestationResult = await verifyClientAttestation({
+    authorizationServerMetadata: options.authorizationServerMetadata,
+    callbacks: options.callbacks,
+    clientAttestation: options.clientAttestation,
+    config: options.config,
+    dpopJwkThumbprint: jwkThumbprint,
+    now: options.now
+  });
+  verifyGrantParameters(options);
   if (!header.jwk) {
     throw new Oauth2Error("DPoP header does not contain a JWK");
   }
@@ -1317,10 +1304,73 @@ async function verifyAccessTokenRequest(options) {
     dpop: { jwk: header.jwk, jwkThumbprint }
   };
 }
+function isPreAuthorizedCodeVerification(options) {
+  return options.grant.grantType === preAuthorizedCodeGrantIdentifier;
+}
+function verifyGrantParameters(options) {
+  if (isPreAuthorizedCodeVerification(options)) {
+    if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) {
+      throw new Oauth2Error(`Invalid 'pre-authorized_code' provided`);
+    }
+    verifyTransactionCode(options.grant.txCode, options.expectedTxCode);
+    verifyCodeExpiration(
+      options.preAuthorizedCodeExpiresAt,
+      options.now,
+      "pre-authorized_code"
+    );
+    return;
+  }
+  if (options.grant.grantType !== authorizationCodeGrantIdentifier) {
+    throw new Oauth2Error(
+      "Only authorization_code and pre-authorized_code grants can be verified"
+    );
+  }
+  if (options.grant.code !== options.expectedCode) {
+    throw new Oauth2Error(`Invalid 'code' provided`);
+  }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+}
+function verifyTransactionCode(txCode, expectedTxCode) {
+  if (txCode === expectedTxCode) return;
+  if (expectedTxCode === void 0) {
+    throw new Oauth2Error("Request contains 'tx_code' that was not expected");
+  }
+  if (txCode === void 0) {
+    throw new Oauth2Error("Missing required 'tx_code' in request");
+  }
+  throw new Oauth2Error("Invalid 'tx_code' provided");
+}
+function verifyCodeExpiration(expiresAt, date, codeParameter) {
+  if (!expiresAt) return;
+  if (Number.isNaN(expiresAt.getTime())) {
+    throw new Oauth2Error(`Invalid expiration date for '${codeParameter}'`);
+  }
+  const now = date ?? /* @__PURE__ */ new Date();
+  if (now.getTime() > expiresAt.getTime()) {
+    throw new Oauth2Error(`Expired '${codeParameter}' provided`);
+  }
+}
+var dispatchVerifyAccessTokenRequest = createVersionDispatcher6({
+  [ItWalletSpecsVersion7.APTITUDE]: (o) => verifyAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [ItWalletSpecsVersion7.V1_0]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion7.V1_3]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion7.V1_4]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  )
+});
+function verifyAccessTokenRequest(options) {
+  return dispatchVerifyAccessTokenRequest(options);
+}
 
 // src/authorization-request/create-authorization-request.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion3,
+  ItWalletSpecsVersion as ItWalletSpecsVersion8,
   addSecondsToDate as addSecondsToDate3,
   dateToSeconds as dateToSeconds4,
   dispatchByVersion,
@@ -1328,33 +1378,34 @@ import {
 } from "@pagopa/io-wallet-utils";
 
 // src/authorization-request/z-authorization-request.ts
-import z12 from "zod";
-var zOpenidCredentialAuthorizationDetails = z12.object({
-  credential_configuration_id: z12.string(),
-  type: z12.literal("openid_credential")
+import { MAX_JTI_LENGTH as MAX_JTI_LENGTH4 } from "@pagopa/io-wallet-utils";
+import z9 from "zod";
+var zOpenidCredentialAuthorizationDetails = z9.object({
+  credential_configuration_id: z9.string(),
+  type: z9.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = z12.object({
-  challenge_method: z12.literal("mrtd+ias"),
-  challenge_redirect_uri: z12.url(),
-  idphinting: z12.url(),
-  type: z12.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = z9.object({
+  challenge_method: z9.literal("mrtd+ias"),
+  challenge_redirect_uri: z9.url(),
+  idphinting: z9.url(),
+  type: z9.literal("it_l2+document_proof")
 });
-var zAuthorizationRequestBaseObject = z12.looseObject({
-  authorization_details: z12.array(
-    z12.discriminatedUnion("type", [
+var zAuthorizationRequestBaseObject = z9.looseObject({
+  authorization_details: z9.array(
+    z9.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: z12.string(),
-  code_challenge: z12.string(),
-  code_challenge_method: z12.string(),
-  issuer_state: z12.optional(z12.string()),
-  jti: z12.string().max(MAX_JTI_LENGTH),
-  redirect_uri: z12.url(),
-  response_type: z12.string(),
-  scope: z12.string().optional(),
-  state: z12.string()
+  client_id: z9.string(),
+  code_challenge: z9.string(),
+  code_challenge_method: z9.string(),
+  issuer_state: z9.optional(z9.string()),
+  jti: z9.string().max(MAX_JTI_LENGTH4),
+  redirect_uri: z9.url(),
+  response_type: z9.string(),
+  scope: z9.string().optional(),
+  state: z9.string()
 });
 var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
@@ -1364,7 +1415,7 @@ var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   }
 );
 var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
-  response_mode: z12.string()
+  response_mode: z9.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1373,25 +1424,25 @@ var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
   }
 );
 var zAuthorizationRequestV1_3 = zAuthorizationRequestBase;
-var zPushedAuthorizationRequestSigned = z12.looseObject({
-  client_id: z12.string().describe(
+var zPushedAuthorizationRequestSigned = z9.looseObject({
+  client_id: z9.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: z12.string().describe(
+  pkceCodeVerifier: z9.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: z12.string().describe(
+  request: z9.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => z12.looseObject({
+var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => z9.looseObject({
   authorizationRequest: authorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: z12.string().describe(
+  client_id: z9.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: z12.string().describe(
+  pkceCodeVerifier: z9.string().describe(
     "PKCE code verifier. Auto-generated if not provided in options."
   )
 });
@@ -1403,9 +1454,9 @@ function isPushedAuthorizationRequestSigned(par) {
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = z12.looseObject({
-  expires_in: z12.number().int(),
-  request_uri: z12.string()
+var zPushedAuthorizationResponse = z9.looseObject({
+  expires_in: z9.number().int(),
+  request_uri: z9.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1475,16 +1526,19 @@ async function createPushedAuthorizationRequest(options) {
 }
 function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
   return dispatchByVersion(options.config.itWalletSpecsVersion, {
-    [ItWalletSpecsVersion3.V1_0]: () => zAuthorizationRequestV1_0.parse({
+    [ItWalletSpecsVersion8.APTITUDE]: () => zAuthorizationRequestV1_3.parse(
+      baseAuthorizationRequest
+    ),
+    [ItWalletSpecsVersion8.V1_0]: () => zAuthorizationRequestV1_0.parse({
       ...baseAuthorizationRequest,
       response_mode: options.responseMode
     }),
-    [ItWalletSpecsVersion3.V1_3]: () => zAuthorizationRequestV1_3.parse(
+    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
+    [ItWalletSpecsVersion8.V1_3]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     ),
-    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [ItWalletSpecsVersion3.V1_4]: () => zAuthorizationRequestV1_3.parse(
+    [ItWalletSpecsVersion8.V1_4]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     )
   });
@@ -1580,12 +1634,13 @@ function parseAuthorizationRequest(options) {
 
 // src/authorization-request/parse-pushed-authorization-request.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion4,
+  ItWalletSpecsVersion as ItWalletSpecsVersion9,
+  decodeJwt as decodeJwt4,
   dispatchByVersion as dispatchByVersion2,
   formatZodError as formatZodError2,
-  parseWithErrorHandling as parseWithErrorHandling7
+  parseWithErrorHandling as parseWithErrorHandling5
 } from "@pagopa/io-wallet-utils";
-import z14 from "zod";
+import z11 from "zod";
 
 // src/jar/fetch-jar-request-object.ts
 import {
@@ -1651,25 +1706,26 @@ async function parseJarRequest(options) {
 }
 
 // src/jar/z-jar.ts
-import z13 from "zod";
-var zJarAuthorizationRequest = z13.looseObject({
-  client_id: z13.optional(z13.string()),
-  request: z13.optional(z13.string()),
-  request_uri: z13.url().optional()
+import { zJwtHeader as zJwtHeader7, zJwtPayload as zJwtPayload7 } from "@pagopa/io-wallet-utils";
+import z10 from "zod";
+var zJarAuthorizationRequest = z10.looseObject({
+  client_id: z10.optional(z10.string()),
+  request: z10.optional(z10.string()),
+  request_uri: z10.url().optional()
 });
-var zJarRequestObjectPayload = z13.looseObject({
-  ...zJwtPayload.shape,
-  client_id: z13.string()
+var zJarRequestObjectPayload = z10.looseObject({
+  ...zJwtPayload7.shape,
+  client_id: z10.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = z13.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = z10.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = z13.looseObject({
-  ...zJwtHeader.shape,
+var zJarRequestObjectHeader = z10.looseObject({
+  ...zJwtHeader7.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = z13.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = z10.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
 // src/authorization-request/parse-pushed-authorization-request.ts
@@ -1677,8 +1733,8 @@ async function parsePushedAuthorizationRequest(options) {
   const authorizationRequestSchema = getAuthorizationRequestSchema(
     options.config
   );
-  const parsed = parseWithErrorHandling7(
-    z14.union([authorizationRequestSchema, zJarAuthorizationRequest]),
+  const parsed = parseWithErrorHandling5(
+    z11.union([authorizationRequestSchema, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1689,7 +1745,7 @@ async function parsePushedAuthorizationRequest(options) {
       callbacks: options.callbacks,
       jarRequestParams: parsed
     });
-    const jwt = decodeJwt({
+    const jwt = decodeJwt4({
       errorMessagePrefix: "Error decoding pushed authorization request JWT:",
       jwt: parsedJar.authorizationRequestJwt
     });
@@ -1727,11 +1783,12 @@ ${formatZodError2(parsedAuthorizationRequest.error)}`
 }
 function getAuthorizationRequestSchema(config) {
   return dispatchByVersion2(config.itWalletSpecsVersion, {
-    [ItWalletSpecsVersion4.V1_0]: () => zAuthorizationRequestV1_0,
-    [ItWalletSpecsVersion4.V1_3]: () => zAuthorizationRequestV1_3,
+    [ItWalletSpecsVersion9.APTITUDE]: () => zAuthorizationRequestV1_3,
+    [ItWalletSpecsVersion9.V1_0]: () => zAuthorizationRequestV1_0,
     // V1_4 reuses V1_3 PAR schema — no breaking changes between versions.
+    [ItWalletSpecsVersion9.V1_3]: () => zAuthorizationRequestV1_3,
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [ItWalletSpecsVersion4.V1_4]: () => zAuthorizationRequestV1_3
+    [ItWalletSpecsVersion9.V1_4]: () => zAuthorizationRequestV1_3
   });
 }
 
@@ -1779,13 +1836,17 @@ async function verifyAuthorizationRequestDpop(options, request, callbacks, now)
   };
 }
 
+// src/authorization-request/verify-pushed-authorization-request.ts
+import { decodeJwt as decodeJwt6 } from "@pagopa/io-wallet-utils";
+
 // src/jar/verify-jar-request.ts
 import {
+  decodeJwt as decodeJwt5,
+  parseWithErrorHandling as parseWithErrorHandling6,
   verifyJwt as verifyJwt4,
   zCompactJwe,
-  zCompactJwt as zCompactJwt4
-} from "@openid4vc/oauth2";
-import { parseWithErrorHandling as parseWithErrorHandling8 } from "@pagopa/io-wallet-utils";
+  zCompactJwt as zCompactJwt3
+} from "@pagopa/io-wallet-utils";
 async function verifyJarRequest(options) {
   const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
   const requestObjectIsEncrypted = zCompactJwe.safeParse(
@@ -1794,7 +1855,7 @@ async function verifyJarRequest(options) {
   if (requestObjectIsEncrypted) {
     throw new Oauth2Error("Encrypted JWE request objects are not supported.");
   }
-  const requestIsSigned = zCompactJwt4.safeParse(
+  const requestIsSigned = zCompactJwt3.safeParse(
     authorizationRequestJwt
   ).success;
   if (!requestIsSigned) {
@@ -1847,11 +1908,11 @@ async function verifyJarRequest(options) {
 }
 async function verifyJarRequestObject(options) {
   const { authorizationRequestJwt, callbacks, jwtSigner } = options;
-  const jwt = decodeJwt({
+  const jwt = decodeJwt5({
     errorMessagePrefix: "Error decoding JAR authorization request JWT:",
     jwt: authorizationRequestJwt
   });
-  const authorizationRequestPayload = parseWithErrorHandling8(
+  const authorizationRequestPayload = parseWithErrorHandling6(
     zJarRequestObjectPayload,
     jwt.payload
   );
@@ -1888,7 +1949,7 @@ async function verifyPushedAuthorizationRequest(options) {
   let jar;
   if (options.authorizationRequestJwt) {
     if (requireSigned) {
-      const decoded = decodeJwt({
+      const decoded = decodeJwt6({
         errorMessagePrefix: "Error decoding pushed authorization request JWT:",
         jwt: options.authorizationRequestJwt.jwt
       });
@@ -1980,14 +2041,15 @@ function clientAuthenticationWalletAttestationJwt(options) {
 import {
   ValidationError as ValidationError4,
   addSecondsToDate as addSecondsToDate4,
-  dateToSeconds as dateToSeconds5
+  dateToSeconds as dateToSeconds5,
+  decodeJwt as decodeJwt7
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/jwk-thumbprint.ts
 import {
   HashAlgorithm as HashAlgorithm6,
   calculateJwkThumbprint as calculateJwkThumbprint4
-} from "@openid4vc/oauth2";
+} from "@pagopa/io-wallet-utils";
 var SUPPORTED_KTY = ["RSA", "EC"];
 var calculateDpopJwkThumbprint = (options) => {
   if (!SUPPORTED_KTY.includes(
@@ -2031,7 +2093,7 @@ var createWalletAttestationJwt = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    decodeJwt7({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_0,
       jwt: result.jwt,
@@ -2052,7 +2114,8 @@ var createWalletAttestationJwt = async (options) => {
 import {
   ValidationError as ValidationError5,
   addSecondsToDate as addSecondsToDate5,
-  dateToSeconds as dateToSeconds6
+  dateToSeconds as dateToSeconds6,
+  decodeJwt as decodeJwt8
 } from "@pagopa/io-wallet-utils";
 var createWalletAttestationJwt2 = async (options) => {
   try {
@@ -2088,7 +2151,7 @@ var createWalletAttestationJwt2 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    decodeJwt8({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_3,
       jwt: result.jwt,
@@ -2109,7 +2172,8 @@ var createWalletAttestationJwt2 = async (options) => {
 import {
   ValidationError as ValidationError6,
   addSecondsToDate as addSecondsToDate6,
-  dateToSeconds as dateToSeconds7
+  dateToSeconds as dateToSeconds7,
+  decodeJwt as decodeJwt9
 } from "@pagopa/io-wallet-utils";
 var DEFAULT_EXPIRATION_SECONDS = 3600;
 var MAX_EXPIRATION_SECONDS = 86400;
@@ -2151,7 +2215,7 @@ var createWalletAttestationJwt3 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    decodeJwt9({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_4,
       jwt: result.jwt,
@@ -2168,17 +2232,11 @@ var createWalletAttestationJwt3 = async (options) => {
   }
 };
 
-// src/common/jwt/z-jwe.ts
-import { z as z15 } from "zod";
-var zCompactJwe2 = z15.string().regex(
-  /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
-  {
-    message: "Not a valid compact jwe"
-  }
-);
-
 // src/jar/create-jar-request.ts
-import { addSecondsToDate as addSecondsToDate7, dateToSeconds as dateToSeconds8 } from "@pagopa/io-wallet-utils";
+import {
+  addSecondsToDate as addSecondsToDate7,
+  dateToSeconds as dateToSeconds8
+} from "@pagopa/io-wallet-utils";
 async function createJarRequest(options) {
   const {
     authorizationRequestHeader,
@@ -2225,6 +2283,7 @@ async function createJarRequest(options) {
 }
 
 // src/jarm-form-post-jwt.ts
+import { decodeJwt as decodeJwt10 } from "@pagopa/io-wallet-utils";
 var getJwtFromFormPost = async (options) => {
   const inputRegex = /<input[^<>]*>/gi;
   const nameRegex = /name="response"/gi;
@@ -2239,7 +2298,7 @@ var getJwtFromFormPost = async (options) => {
         const responseJwt = matchValue[1];
         if (responseJwt) {
           const jwt = responseJwt.replace(lineExpressionRegex, "");
-          const decodedJwt = decodeJwt({
+          const decodedJwt = decodeJwt10({
             errorMessagePrefix: "Error decoding JARM form post JWT:",
             jwt,
             payloadSchema: options.schema
@@ -2261,73 +2320,76 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-import { dateToSeconds as dateToSeconds9, parseWithErrorHandling as parseWithErrorHandling9 } from "@pagopa/io-wallet-utils";
+import {
+  dateToSeconds as dateToSeconds9,
+  parseWithErrorHandling as parseWithErrorHandling7
+} from "@pagopa/io-wallet-utils";
 
 // src/mrtd-pop/z-mrtd-pop.ts
-import z16 from "zod";
-var zMrtdChallengeJwtHeader = z16.looseObject({
-  alg: z16.string(),
-  kid: z16.string(),
-  typ: z16.literal("mrtd-ias+jwt")
+import z12 from "zod";
+var zMrtdChallengeJwtHeader = z12.looseObject({
+  alg: z12.string(),
+  kid: z12.string(),
+  typ: z12.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = z16.looseObject({
-  aud: z16.string(),
-  exp: z16.number(),
-  htm: z16.literal("POST"),
-  htu: z16.url(),
-  iat: z16.number(),
-  iss: z16.string(),
-  mrtd_auth_session: z16.string(),
-  mrtd_pop_jwt_nonce: z16.string(),
-  state: z16.string(),
-  status: z16.literal("require_interaction"),
-  type: z16.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = z12.looseObject({
+  aud: z12.string(),
+  exp: z12.number(),
+  htm: z12.literal("POST"),
+  htu: z12.url(),
+  iat: z12.number(),
+  iss: z12.string(),
+  mrtd_auth_session: z12.string(),
+  mrtd_pop_jwt_nonce: z12.string(),
+  state: z12.string(),
+  status: z12.literal("require_interaction"),
+  type: z12.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = z16.looseObject({
-  alg: z16.string(),
-  kid: z16.string(),
-  typ: z16.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = z12.looseObject({
+  alg: z12.string(),
+  kid: z12.string(),
+  typ: z12.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = z16.looseObject({
-  aud: z16.string(),
-  challenge: z16.string(),
-  exp: z16.number(),
-  htm: z16.literal("POST"),
-  htu: z16.url(),
-  iat: z16.number(),
-  iss: z16.string(),
-  mrtd_pop_nonce: z16.string(),
-  mrz: z16.string().optional()
+var zMrtdPopInitResponseJwtPayload = z12.looseObject({
+  aud: z12.string(),
+  challenge: z12.string(),
+  exp: z12.number(),
+  htm: z12.literal("POST"),
+  htu: z12.url(),
+  iat: z12.number(),
+  iss: z12.string(),
+  mrtd_pop_nonce: z12.string(),
+  mrz: z12.string().optional()
 });
-var zMrtdData = z16.looseObject({
-  dg1: z16.string(),
-  dg11: z16.string(),
-  sod_mrtd: z16.string()
+var zMrtdData = z12.looseObject({
+  dg1: z12.string(),
+  dg11: z12.string(),
+  sod_mrtd: z12.string()
 });
-var zIasData = z16.looseObject({
-  challenge_signed: z16.string(),
-  ias_pk: z16.string(),
-  sod_ias: z16.string()
+var zIasData = z12.looseObject({
+  challenge_signed: z12.string(),
+  ias_pk: z12.string(),
+  sod_ias: z12.string()
 });
-var zMrtdValidationJwtHeader = z16.looseObject({
-  alg: z16.string(),
-  kid: z16.string(),
-  typ: z16.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = z12.looseObject({
+  alg: z12.string(),
+  kid: z12.string(),
+  typ: z12.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = z16.looseObject({
-  aud: z16.string(),
-  document_type: z16.literal("cie"),
-  exp: z16.number(),
+var zMrtdValidationJwtPayload = z12.looseObject({
+  aud: z12.string(),
+  document_type: z12.literal("cie"),
+  exp: z12.number(),
   ias: zIasData,
-  iat: z16.number(),
-  iss: z16.string(),
+  iat: z12.number(),
+  iss: z12.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = z16.looseObject({
-  mrtd_val_pop_nonce: z16.string(),
-  redirect_uri: z16.url(),
-  status: z16.literal("require_interaction"),
-  type: z16.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = z12.looseObject({
+  mrtd_val_pop_nonce: z12.string(),
+  redirect_uri: z12.url(),
+  status: z12.literal("require_interaction"),
+  type: z12.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2339,12 +2401,12 @@ async function createMrtdValidationJwt(options) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
     const iat = dateToSeconds9(options.issuedAt);
-    const header = parseWithErrorHandling9(zMrtdValidationJwtHeader, {
+    const header = parseWithErrorHandling7(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
       typ: "mrtd-ias+jwt"
     });
-    const payload = parseWithErrorHandling9(zMrtdValidationJwtPayload, {
+    const payload = parseWithErrorHandling7(zMrtdValidationJwtPayload, {
       aud: options.audience,
       document_type: "cie",
       exp: iat + JWT_EXPIRY_SECONDS2,
@@ -2377,17 +2439,16 @@ async function createMrtdValidationJwt(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-init.ts
-import {
-  jwtSignerFromJwt as jwtSignerFromJwt2,
-  verifyJwt as verifyJwt5
-} from "@openid4vc/oauth2";
 import {
   CONTENT_TYPES as CONTENT_TYPES3,
   HEADERS as HEADERS3,
   UnexpectedStatusCodeError as UnexpectedStatusCodeError4,
   ValidationError as ValidationError7,
   createFetcher as createFetcher4,
-  hasStatusOrThrow as hasStatusOrThrow4
+  decodeJwt as decodeJwt11,
+  hasStatusOrThrow as hasStatusOrThrow4,
+  jwtSignerFromJwt as jwtSignerFromJwt2,
+  verifyJwt as verifyJwt5
 } from "@pagopa/io-wallet-utils";
 async function fetchMrtdPopInit(options) {
   try {
@@ -2406,7 +2467,7 @@ async function fetchMrtdPopInit(options) {
     });
     await hasStatusOrThrow4(202, UnexpectedStatusCodeError4)(response);
     const responseJwt = await response.text();
-    const jwt = decodeJwt({
+    const jwt = decodeJwt11({
       errorMessagePrefix: "Error decoding MRTD PoP init response JWT:",
       headerSchema: zMrtdPopInitResponseJwtHeader,
       jwt: responseJwt,
@@ -2445,7 +2506,7 @@ import {
   ValidationError as ValidationError8,
   createFetcher as createFetcher5,
   hasStatusOrThrow as hasStatusOrThrow5,
-  parseWithErrorHandling as parseWithErrorHandling10
+  parseWithErrorHandling as parseWithErrorHandling8
 } from "@pagopa/io-wallet-utils";
 async function fetchMrtdPopVerify(options) {
   try {
@@ -2464,7 +2525,7 @@ async function fetchMrtdPopVerify(options) {
       method: "POST"
     });
     await hasStatusOrThrow5(202, UnexpectedStatusCodeError5)(response);
-    const parsed = parseWithErrorHandling10(
+    const parsed = parseWithErrorHandling8(
       zMrtdPopVerifyResponse,
       await response.json(),
       "Failed to parse MRTD PoP verify response"
@@ -2484,7 +2545,7 @@ async function fetchMrtdPopVerify(options) {
 }
 
 // src/mrtd-pop/parse-mrtd-challenge.ts
-import { zCompactJwt as zCompactJwt5 } from "@openid4vc/oauth2";
+import { decodeJwt as decodeJwt12, zCompactJwt as zCompactJwt4 } from "@pagopa/io-wallet-utils";
 function parseMrtdChallenge(options) {
   const url = new URL(options.redirectUrl);
   const challengeJwt = url.searchParams.get("challenge_info");
@@ -2493,12 +2554,12 @@ function parseMrtdChallenge(options) {
       "Missing 'challenge_info' query parameter in redirect URL"
     );
   }
-  if (!zCompactJwt5.safeParse(challengeJwt).success) {
+  if (!zCompactJwt4.safeParse(challengeJwt).success) {
     throw new MrtdPopError(
       "Invalid JWT format in 'challenge_info' query parameter"
     );
   }
-  const { header, payload } = decodeJwt({
+  const { header, payload } = decodeJwt12({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2509,12 +2570,13 @@ function parseMrtdChallenge(options) {
 
 // src/mrtd-pop/verify-mrtd-challenge.ts
 import {
+  decodeJwt as decodeJwt13,
   jwtSignerFromJwt as jwtSignerFromJwt3,
   verifyJwt as verifyJwt6
-} from "@openid4vc/oauth2";
+} from "@pagopa/io-wallet-utils";
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
-  const jwt = decodeJwt({
+  const jwt = decodeJwt13({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2536,24 +2598,14 @@ async function verifyMrtdChallenge(options) {
   });
   return { header: jwt.header, payload: jwt.payload, signer };
 }
-
-// src/index.ts
-import {
-  HashAlgorithm as HashAlgorithm7,
-  Oauth2JwtParseError as Oauth2JwtParseError3,
-  verifyJwt as verifyJwt7
-} from "@openid4vc/oauth2";
 export {
   ClientAttestationError,
   CreateTokenDPoPError,
   CreateTokenResponseError,
   FetchTokenResponseError,
-  HashAlgorithm7 as HashAlgorithm,
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
-  MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
-  Oauth2JwtParseError3 as Oauth2JwtParseError,
   PkceCodeChallengeMethod,
   PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod,
@@ -2568,11 +2620,11 @@ export {
   createPushedAuthorizationRequest,
   createTokenDPoP,
   createTokenRequest,
+  createTokenRequestAPTITUDE,
+  createTokenRequestV1_4,
   createWalletAttestationJwt as createWalletAttestationJwtV1_0,
   createWalletAttestationJwt2 as createWalletAttestationJwtV1_3,
   createWalletAttestationJwt3 as createWalletAttestationJwtV1_4,
-  decodeJwt,
-  decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders,
   extractDpopJwtFromHeaders,
   fetchJarRequestObject,
@@ -2587,12 +2639,12 @@ export {
   isPushedAuthorizationRequestSigned,
   isPushedAuthorizationRequestUnsigned,
   jwtAuthorizationRequestJwtHeaderTyp,
-  jwtHeaderFromJwtSigner,
   parseAccessTokenRequest,
   parseAuthorizationRequest,
   parseJarRequest,
   parseMrtdChallenge,
   parsePushedAuthorizationRequest,
+  preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier,
   signedAuthorizationRequestJwtHeaderTyp,
   toURLSearchParams,
@@ -2602,7 +2654,6 @@ export {
   verifyClientAttestation,
   verifyClientAttestationPopJwt,
   verifyJarRequest,
-  verifyJwt7 as verifyJwt,
   verifyMrtdChallenge,
   verifyPkce,
   verifyPushedAuthorizationRequest,
@@ -2614,14 +2665,12 @@ export {
   zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
+  zAccessTokenRequestAPTITUDE,
   zAccessTokenResponse,
-  zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
+  zAuthorizationCodeTokenRequest,
   zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3,
-  zCertificateChain,
-  zCompactJwe2 as zCompactJwe,
-  zCompactJwt,
   zDpopJwtHeader,
   zDpopJwtPayload,
   zItWalletClientAttestationPopJwtAlg,
@@ -2631,11 +2680,6 @@ export {
   zJarAuthorizationRequest,
   zJarRequestObjectHeader,
   zJarRequestObjectPayload,
-  zJwk,
-  zJwkSet,
-  zJwtConfirmationPayload,
-  zJwtHeader,
-  zJwtPayload,
   zMrtdChallengeJwtHeader,
   zMrtdChallengeJwtPayload,
   zMrtdPopInitResponseJwtHeader,
@@ -2643,6 +2687,8 @@ export {
   zMrtdPopVerifyResponse,
   zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload,
+  zPreAuthorizedCodeGrantIdentifier,
+  zPreAuthorizedCodeTokenRequest,
   zPushedAuthorizationRequestSigned,
   zPushedAuthorizationRequestUnsignedV1_0,
   zPushedAuthorizationRequestUnsignedV1_3,
@@ -2650,8 +2696,8 @@ export {
   zRefreshTokenGrantIdentifier,
   zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload,
+  zRefreshTokenTokenRequest,
   zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain,
   zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3,
   zWalletAttestationJwtHeaderV1_4,