@pagopa/io-wallet-oauth2 1.5.8 → 2.0.0-launchpad

package/dist/index.js

@@ -34,12 +34,9 @@ __export(index_exports, {
   CreateTokenDPoPError: () => CreateTokenDPoPError,
   CreateTokenResponseError: () => CreateTokenResponseError,
   FetchTokenResponseError: () => FetchTokenResponseError,
-  HashAlgorithm: () => import_oauth216.HashAlgorithm,
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: () => IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
-  MAX_JTI_LENGTH: () => MAX_JTI_LENGTH,
   MrtdPopError: () => MrtdPopError,
   Oauth2Error: () => Oauth2Error,
-  Oauth2JwtParseError: () => import_oauth216.Oauth2JwtParseError,
   PkceCodeChallengeMethod: () => PkceCodeChallengeMethod,
   PushedAuthorizationRequestError: () => PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod: () => SupportedClientAuthenticationMethod,
@@ -57,8 +54,6 @@ __export(index_exports, {
   createWalletAttestationJwtV1_0: () => createWalletAttestationJwt,
   createWalletAttestationJwtV1_3: () => createWalletAttestationJwt2,
   createWalletAttestationJwtV1_4: () => createWalletAttestationJwt3,
-  decodeJwt: () => decodeJwt,
-  decodeJwtHeader: () => decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders: () => extractClientAttestationJwtsFromHeaders,
   extractDpopJwtFromHeaders: () => extractDpopJwtFromHeaders,
   fetchJarRequestObject: () => fetchJarRequestObject,
@@ -73,7 +68,6 @@ __export(index_exports, {
   isPushedAuthorizationRequestSigned: () => isPushedAuthorizationRequestSigned,
   isPushedAuthorizationRequestUnsigned: () => isPushedAuthorizationRequestUnsigned,
   jwtAuthorizationRequestJwtHeaderTyp: () => jwtAuthorizationRequestJwtHeaderTyp,
-  jwtHeaderFromJwtSigner: () => jwtHeaderFromJwtSigner,
   parseAccessTokenRequest: () => parseAccessTokenRequest,
   parseAuthorizationRequest: () => parseAuthorizationRequest,
   parseJarRequest: () => parseJarRequest,
@@ -88,7 +82,6 @@ __export(index_exports, {
   verifyClientAttestation: () => verifyClientAttestation,
   verifyClientAttestationPopJwt: () => verifyClientAttestationPopJwt,
   verifyJarRequest: () => verifyJarRequest,
-  verifyJwt: () => import_oauth216.verifyJwt,
   verifyMrtdChallenge: () => verifyMrtdChallenge,
   verifyPkce: () => verifyPkce,
   verifyPushedAuthorizationRequest: () => verifyPushedAuthorizationRequest,
@@ -101,13 +94,9 @@ __export(index_exports, {
   zAccessTokenProfileJwtPayload: () => zAccessTokenProfileJwtPayload,
   zAccessTokenRequest: () => zAccessTokenRequest,
   zAccessTokenResponse: () => zAccessTokenResponse,
-  zAlgValueNotNone: () => zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier: () => zAuthorizationCodeGrantIdentifier,
   zAuthorizationRequestV1_0: () => zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3: () => zAuthorizationRequestV1_3,
-  zCertificateChain: () => zCertificateChain,
-  zCompactJwe: () => zCompactJwe2,
-  zCompactJwt: () => zCompactJwt,
   zDpopJwtHeader: () => zDpopJwtHeader,
   zDpopJwtPayload: () => zDpopJwtPayload,
   zItWalletClientAttestationPopJwtAlg: () => zItWalletClientAttestationPopJwtAlg,
@@ -117,11 +106,6 @@ __export(index_exports, {
   zJarAuthorizationRequest: () => zJarAuthorizationRequest,
   zJarRequestObjectHeader: () => zJarRequestObjectHeader,
   zJarRequestObjectPayload: () => zJarRequestObjectPayload,
-  zJwk: () => zJwk,
-  zJwkSet: () => zJwkSet,
-  zJwtConfirmationPayload: () => zJwtConfirmationPayload,
-  zJwtHeader: () => zJwtHeader,
-  zJwtPayload: () => zJwtPayload,
   zMrtdChallengeJwtHeader: () => zMrtdChallengeJwtHeader,
   zMrtdChallengeJwtPayload: () => zMrtdChallengeJwtPayload,
   zMrtdPopInitResponseJwtHeader: () => zMrtdPopInitResponseJwtHeader,
@@ -137,7 +121,6 @@ __export(index_exports, {
   zRefreshTokenProfileJwtHeader: () => zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload: () => zRefreshTokenProfileJwtPayload,
   zSignedAuthorizationRequestJwtHeaderTyp: () => zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain: () => zTrustChain,
   zWalletAttestationJwtHeaderV1_0: () => zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3: () => zWalletAttestationJwtHeaderV1_3,
   zWalletAttestationJwtHeaderV1_4: () => zWalletAttestationJwtHeaderV1_4,
@@ -160,169 +143,15 @@ var createTokenRequest = async (options) => ({
 });
 
 // src/access-token/create-token-response.ts
-var import_oauth22 = require("@openid4vc/oauth2");
 var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
 
-// src/common/jwt/decode-jwt-header.ts
-var import_oauth2 = require("@openid4vc/oauth2");
-var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
-
-// src/common/jwt/z-jwt.ts
-var import_zod3 = __toESM(require("zod"));
-
-// src/common/jwk/z-jwk.ts
-var import_zod2 = __toESM(require("zod"));
-
-// src/common/z-common.ts
-var import_zod = __toESM(require("zod"));
-var zTrustChain = import_zod.default.tuple([import_zod.default.string()], import_zod.default.string());
-var zCertificateChain = import_zod.default.array(import_zod.default.string()).nonempty();
-var zAlgValueNotNone = import_zod.default.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
-
-// src/common/jwk/z-jwk.ts
-var zJwk = import_zod2.default.looseObject({
-  alg: import_zod2.default.optional(import_zod2.default.string()),
-  crv: import_zod2.default.optional(import_zod2.default.string()),
-  d: import_zod2.default.optional(import_zod2.default.string()),
-  dp: import_zod2.default.optional(import_zod2.default.string()),
-  dq: import_zod2.default.optional(import_zod2.default.string()),
-  e: import_zod2.default.optional(import_zod2.default.string()),
-  ext: import_zod2.default.optional(import_zod2.default.boolean()),
-  k: import_zod2.default.optional(import_zod2.default.string()),
-  key_ops: import_zod2.default.optional(import_zod2.default.array(import_zod2.default.string())),
-  kid: import_zod2.default.optional(import_zod2.default.string()),
-  kty: import_zod2.default.string(),
-  n: import_zod2.default.optional(import_zod2.default.string()),
-  oth: import_zod2.default.optional(
-    import_zod2.default.array(
-      import_zod2.default.looseObject({
-        d: import_zod2.default.optional(import_zod2.default.string()),
-        r: import_zod2.default.optional(import_zod2.default.string()),
-        t: import_zod2.default.optional(import_zod2.default.string())
-      })
-    )
-  ),
-  p: import_zod2.default.optional(import_zod2.default.string()),
-  q: import_zod2.default.optional(import_zod2.default.string()),
-  qi: import_zod2.default.optional(import_zod2.default.string()),
-  use: import_zod2.default.optional(import_zod2.default.string()),
-  x: import_zod2.default.optional(import_zod2.default.string()),
-  x5c: import_zod2.default.optional(zCertificateChain),
-  x5t: import_zod2.default.optional(import_zod2.default.string()),
-  "x5t#S256": import_zod2.default.optional(import_zod2.default.string()),
-  x5u: import_zod2.default.optional(import_zod2.default.string()),
-  y: import_zod2.default.optional(import_zod2.default.string())
-});
-var zJwkSet = import_zod2.default.looseObject({ keys: import_zod2.default.array(zJwk) });
-
-// src/common/jwt/z-jwt.ts
-var MAX_JTI_LENGTH = 256;
-var zCompactJwt = import_zod3.default.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
-  message: "Not a valid compact jwt"
-});
-var zJwtConfirmationPayload = import_zod3.default.looseObject({
-  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
-  jkt: import_zod3.default.string().optional(),
-  jwk: zJwk.optional()
-});
-var zJwtPayload = import_zod3.default.looseObject({
-  aud: import_zod3.default.string().optional(),
-  cnf: zJwtConfirmationPayload.optional(),
-  exp: import_zod3.default.number().int().optional(),
-  iat: import_zod3.default.number().int().optional(),
-  iss: import_zod3.default.string().optional(),
-  jti: import_zod3.default.string().max(MAX_JTI_LENGTH).optional(),
-  nbf: import_zod3.default.number().int().optional(),
-  nonce: import_zod3.default.string().optional(),
-  // Reserved for status parameters
-  status: import_zod3.default.record(import_zod3.default.string(), import_zod3.default.any()).optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional()
-});
-var zJwtHeader = import_zod3.default.looseObject({
-  alg: zAlgValueNotNone,
-  jwk: zJwk.optional(),
-  kid: import_zod3.default.string().optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional(),
-  typ: import_zod3.default.string().optional(),
-  x5c: zCertificateChain.optional()
-});
-
-// src/common/jwt/decode-jwt-header.ts
-function decodeJwtHeader(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length <= 2) {
-    throw new import_oauth2.Oauth2JwtParseError(
-      (0, import_io_wallet_utils.formatError)(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const [headerPart] = jwtParts;
-  let headerJson;
-  try {
-    headerJson = (0, import_io_wallet_utils.stringToJsonWithErrorHandling)(
-      (0, import_io_wallet_utils.encodeToUtf8String)((0, import_io_wallet_utils.decodeBase64)(headerPart)),
-      (0, import_io_wallet_utils.formatError)(
-        "Unable to parse jwt header to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new import_oauth2.Oauth2JwtParseError(
-      (0, import_io_wallet_utils.formatError)(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const header = (0, import_io_wallet_utils.parseWithErrorHandling)(
-    options.headerSchema ?? zJwtHeader,
-    headerJson,
-    (0, import_io_wallet_utils.formatError)("Invalid JWT header", options.errorMessagePrefix)
-  );
-  return {
-    header
-  };
-}
-function jwtHeaderFromJwtSigner(signer) {
-  if (signer.method === "did") {
-    return {
-      alg: signer.alg,
-      kid: signer.didUrl
-    };
-  }
-  if (signer.method === "federation") {
-    return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain
-    };
-  }
-  if (signer.method === "jwk") {
-    return {
-      alg: signer.alg,
-      jwk: signer.publicJwk
-    };
-  }
-  if (signer.method === "x5c") {
-    return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain,
-      x5c: signer.x5c
-    };
-  }
-  return { alg: signer.alg };
-}
-
 // src/errors.ts
 var Oauth2Error = class extends Error {
   statusCode;
   constructor(message, options) {
-    super(message, options);
+    const errorMessage = message ?? "Unknown error occurred.";
+    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${String(options.cause)}` : "";
+    super(`${errorMessage}${causeMessage}`, options);
     this.name = "Oauth2Error";
     this.statusCode = options?.statusCode;
   }
@@ -373,70 +202,71 @@ var ClientAttestationError = class extends Oauth2Error {
 };
 
 // src/access-token/z-token.ts
-var import_zod4 = require("zod");
-var zAccessTokenRequest = import_zod4.z.discriminatedUnion("grant_type", [
-  import_zod4.z.object({
-    code: import_zod4.z.string().nonempty(),
-    code_verifier: import_zod4.z.string().nonempty(),
-    grant_type: import_zod4.z.literal("authorization_code"),
-    redirect_uri: import_zod4.z.string().nonempty()
+var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
+var import_zod = require("zod");
+var zAccessTokenRequest = import_zod.z.discriminatedUnion("grant_type", [
+  import_zod.z.object({
+    code: import_zod.z.string().nonempty(),
+    code_verifier: import_zod.z.string().nonempty(),
+    grant_type: import_zod.z.literal("authorization_code"),
+    redirect_uri: import_zod.z.string().nonempty()
   }),
-  import_zod4.z.object({
-    grant_type: import_zod4.z.literal("refresh_token"),
-    refresh_token: import_zod4.z.string().nonempty(),
-    scope: import_zod4.z.string().optional()
+  import_zod.z.object({
+    grant_type: import_zod.z.literal("refresh_token"),
+    refresh_token: import_zod.z.string().nonempty(),
+    scope: import_zod.z.string().optional()
   })
 ]);
-var zAccessTokenResponse = import_zod4.z.looseObject({
-  access_token: import_zod4.z.string(),
-  authorization_details: import_zod4.z.array(
-    import_zod4.z.looseObject({
-      credential_configuration_id: import_zod4.z.optional(import_zod4.z.string()),
-      credential_identifiers: import_zod4.z.optional(import_zod4.z.array(import_zod4.z.string())),
-      type: import_zod4.z.literal("openid_credential")
+var zAccessTokenResponse = import_zod.z.looseObject({
+  access_token: import_zod.z.string(),
+  authorization_details: import_zod.z.array(
+    import_zod.z.looseObject({
+      credential_configuration_id: import_zod.z.optional(import_zod.z.string()),
+      credential_identifiers: import_zod.z.optional(import_zod.z.array(import_zod.z.string())),
+      type: import_zod.z.literal("openid_credential")
     })
   ).optional(),
-  expires_in: import_zod4.z.optional(import_zod4.z.number().int()),
-  refresh_token: import_zod4.z.optional(import_zod4.z.string()),
-  token_type: import_zod4.z.union([import_zod4.z.literal("Bearer"), import_zod4.z.literal("DPoP")])
+  expires_in: import_zod.z.optional(import_zod.z.number().int()),
+  refresh_token: import_zod.z.optional(import_zod.z.string()),
+  token_type: import_zod.z.union([import_zod.z.literal("Bearer"), import_zod.z.literal("DPoP")])
 });
-var zAccessTokenProfileJwtHeader = import_zod4.z.looseObject({
-  ...zJwtHeader.shape,
-  typ: import_zod4.z.enum(["application/at+jwt", "at+jwt"])
+var zAccessTokenProfileJwtHeader = import_zod.z.looseObject({
+  ...import_io_wallet_utils.zJwtHeader.shape,
+  typ: import_zod.z.enum(["application/at+jwt", "at+jwt"])
 });
-var zAccessTokenProfileJwtPayload = import_zod4.z.looseObject({
-  ...zJwtPayload.shape,
-  aud: import_zod4.z.string(),
-  client_id: import_zod4.z.string(),
-  cnf: import_zod4.z.object({
-    jkt: import_zod4.z.string()
+var zAccessTokenProfileJwtPayload = import_zod.z.looseObject({
+  ...import_io_wallet_utils.zJwtPayload.shape,
+  aud: import_zod.z.string(),
+  client_id: import_zod.z.string(),
+  cnf: import_zod.z.object({
+    jkt: import_zod.z.string()
   }).optional(),
-  exp: import_zod4.z.number(),
-  iat: import_zod4.z.number(),
-  iss: import_zod4.z.string(),
-  jti: import_zod4.z.string().max(MAX_JTI_LENGTH),
-  nbf: import_zod4.z.number().optional(),
-  scope: import_zod4.z.string().optional(),
-  sub: import_zod4.z.string()
+  exp: import_zod.z.number(),
+  iat: import_zod.z.number(),
+  iss: import_zod.z.string(),
+  jti: import_zod.z.string().max(import_io_wallet_utils.MAX_JTI_LENGTH),
+  nbf: import_zod.z.number().optional(),
+  scope: import_zod.z.string().optional(),
+  sub: import_zod.z.string()
 });
-var zRefreshTokenProfileJwtHeader = import_zod4.z.looseObject({
-  ...zJwtHeader.shape,
-  kid: import_zod4.z.string(),
-  typ: import_zod4.z.literal("rt+jwt")
+var zRefreshTokenProfileJwtHeader = import_zod.z.looseObject({
+  ...import_io_wallet_utils.zJwtHeader.shape,
+  kid: import_zod.z.string(),
+  typ: import_zod.z.literal("rt+jwt")
 });
-var zRefreshTokenProfileJwtPayload = import_zod4.z.looseObject({
-  ...zJwtPayload.shape,
-  aud: import_zod4.z.string(),
-  client_id: import_zod4.z.string(),
-  cnf: import_zod4.z.object({
-    jkt: import_zod4.z.string()
+var zRefreshTokenProfileJwtPayload = import_zod.z.looseObject({
+  ...import_io_wallet_utils.zJwtPayload.shape,
+  aud: import_zod.z.string(),
+  client_id: import_zod.z.string(),
+  cnf: import_zod.z.object({
+    jkt: import_zod.z.string()
   }),
-  exp: import_zod4.z.number().int(),
-  iat: import_zod4.z.number().int(),
-  iss: import_zod4.z.string(),
-  jti: import_zod4.z.string().max(MAX_JTI_LENGTH),
-  nbf: import_zod4.z.number().int(),
-  sub: import_zod4.z.string()
+  exp: import_zod.z.number().int(),
+  iat: import_zod.z.number().int(),
+  iss: import_zod.z.string(),
+  jti: import_zod.z.string().max(import_io_wallet_utils.MAX_JTI_LENGTH),
+  nbf: import_zod.z.number().int(),
+  sub: import_zod.z.string()
 });
 
 // src/access-token/create-token-response.ts
@@ -483,8 +313,8 @@ async function createAccessTokenResponse(options) {
         `refreshTokenExpiresInSeconds (${options.refreshTokenExpiresInSeconds}) must be greater than expiresInSeconds (${options.expiresInSeconds}) so the Refresh Token remains usable after the Access Token expires.`
       );
     }
-    const dpopJkt = options.dpop ? await (0, import_oauth22.calculateJwkThumbprint)({
-      hashAlgorithm: import_oauth22.HashAlgorithm.Sha256,
+    const dpopJkt = options.dpop ? await (0, import_io_wallet_utils2.calculateJwkThumbprint)({
+      hashAlgorithm: import_io_wallet_utils2.HashAlgorithm.Sha256,
       hashCallback: options.callbacks.hash,
       jwk: options.dpop.jwk
     }) : void 0;
@@ -493,7 +323,7 @@ async function createAccessTokenResponse(options) {
       options.expiresInSeconds
     );
     const header = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
-      ...jwtHeaderFromJwtSigner(options.signer),
+      ...(0, import_io_wallet_utils2.jwtHeaderFromJwtSigner)(options.signer),
       typ: "at+jwt"
     });
     const payload = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
@@ -615,133 +445,66 @@ function toURLSearchParams(data) {
 }
 
 // src/access-token/parse-token-request.ts
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/wallet-attestation.ts
-var import_oauth25 = require("@openid4vc/oauth2");
-var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/types.ts
-var import_zod5 = __toESM(require("zod"));
-var zOauthClientAttestationHeader = import_zod5.default.literal(
+var import_zod2 = __toESM(require("zod"));
+var zOauthClientAttestationHeader = import_zod2.default.literal(
   "OAuth-Client-Attestation"
 );
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = import_zod5.default.literal(
+var zOauthClientAttestationPopHeader = import_zod2.default.literal(
   "OAuth-Client-Attestation-PoP"
 );
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
 
 // src/client-attestation/verify-wallet-attestation-jwt-base.ts
-var import_oauth24 = require("@openid4vc/oauth2");
-
-// src/common/jwt/decode-jwt.ts
-var import_oauth23 = require("@openid4vc/oauth2");
 var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
-function decodeJwt(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length !== 3) {
-    throw new import_oauth23.Oauth2JwtParseError(
-      (0, import_io_wallet_utils4.formatError)(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  let payloadJson;
-  try {
-    const payloadPart = jwtParts[1];
-    if (payloadPart === void 0) {
-      throw new import_oauth23.Oauth2JwtParseError(
-        (0, import_io_wallet_utils4.formatError)(
-          "Unable to decode because Jwt is not a valid!",
-          options.errorMessagePrefix
-        )
-      );
-    }
-    payloadJson = (0, import_io_wallet_utils4.stringToJsonWithErrorHandling)(
-      (0, import_io_wallet_utils4.encodeToUtf8String)((0, import_io_wallet_utils4.decodeBase64)(payloadPart)),
-      (0, import_io_wallet_utils4.formatError)(
-        "Unable to parse jwt payload to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new import_oauth23.Oauth2JwtParseError(
-      (0, import_io_wallet_utils4.formatError)(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const signaturePart = jwtParts[2];
-  if (signaturePart === void 0) {
-    throw new import_oauth23.Oauth2JwtParseError(
-      (0, import_io_wallet_utils4.formatError)(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const { header } = decodeJwtHeader({
-    errorMessagePrefix: options.errorMessagePrefix,
-    headerSchema: options.headerSchema,
-    jwt: options.jwt
-  });
-  const payload = (0, import_io_wallet_utils4.parseWithErrorHandling)(
-    options.payloadSchema ?? zJwtPayload,
-    payloadJson,
-    (0, import_io_wallet_utils4.formatError)("Invalid JWT payload", options.errorMessagePrefix)
-  );
-  return {
-    header,
-    payload,
-    signature: signaturePart
-  };
-}
-
-// src/client-attestation/verify-wallet-attestation-jwt-base.ts
 async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
-  const { header, payload } = decodeJwt({
+  const { header, payload } = (0, import_io_wallet_utils4.decodeJwt)({
     errorMessagePrefix: "Error decoding wallet attestation JWT:",
     headerSchema,
     jwt: options.walletAttestationJwt,
     payloadSchema
   });
-  const { signer } = await (0, import_oauth24.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils4.verifyJwt)({
     compact: options.walletAttestationJwt,
     errorMessage: "wallet attestation verification failed.",
     header,
     now: options.now,
     payload,
-    signer: (0, import_oauth24.jwtSignerFromJwt)({ header, payload }),
+    signer: (0, import_io_wallet_utils4.jwtSignerFromJwt)({ header, payload }),
     verifyJwtCallback: options.callbacks.verifyJwt
   });
   return { header, payload, signer };
 }
 
 // src/client-attestation/v1.0/z-wallet-attestation.ts
-var import_zod6 = require("zod");
-var zWalletAttestationJwtHeaderV1_0 = import_zod6.z.looseObject({
-  ...zJwtHeader.shape,
-  trust_chain: zTrustChain,
+var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+var import_zod3 = require("zod");
+var zWalletAttestationJwtHeaderV1_0 = import_zod3.z.looseObject({
+  ...import_io_wallet_utils5.zJwtHeader.shape,
+  trust_chain: import_io_wallet_utils5.zTrustChain,
   // REQUIRED in v1.0
-  typ: import_zod6.z.literal("oauth-client-attestation+jwt")
+  typ: import_zod3.z.literal("oauth-client-attestation+jwt")
 });
-var zWalletAttestationJwtPayloadV1_0 = import_zod6.z.looseObject({
-  ...zJwtPayload.shape,
-  aal: import_zod6.z.string(),
-  cnf: import_zod6.z.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_0 = import_zod3.z.looseObject({
+  ...import_io_wallet_utils5.zJwtPayload.shape,
+  aal: import_zod3.z.string(),
+  cnf: import_zod3.z.object({
+    jwk: import_io_wallet_utils5.zJwk
   }),
-  exp: import_zod6.z.number(),
-  iat: import_zod6.z.number(),
-  iss: import_zod6.z.string(),
-  sub: import_zod6.z.string(),
-  wallet_link: import_zod6.z.url().optional(),
-  wallet_name: import_zod6.z.string().optional()
+  exp: import_zod3.z.number(),
+  iat: import_zod3.z.number(),
+  iss: import_zod3.z.string(),
+  sub: import_zod3.z.string(),
+  wallet_link: import_zod3.z.url().optional(),
+  wallet_name: import_zod3.z.string().optional()
 });
-var zWalletAttestationJwtV1_0 = import_zod6.z.string().min(1);
+var zWalletAttestationJwtV1_0 = import_zod3.z.string().min(1);
 
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
@@ -753,37 +516,38 @@ async function verifyWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.3/z-wallet-attestation.ts
-var import_zod7 = require("zod");
-var zWalletAttestationJwtHeaderV1_3 = import_zod7.z.looseObject({
-  ...zJwtHeader.shape,
-  trust_chain: zTrustChain.optional(),
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
+var import_zod4 = require("zod");
+var zWalletAttestationJwtHeaderV1_3 = import_zod4.z.looseObject({
+  ...import_io_wallet_utils6.zJwtHeader.shape,
+  trust_chain: import_io_wallet_utils6.zTrustChain.optional(),
   // OPTIONAL in v1.3
-  typ: import_zod7.z.literal("oauth-client-attestation+jwt"),
-  x5c: zCertificateChain
+  typ: import_zod4.z.literal("oauth-client-attestation+jwt"),
+  x5c: import_io_wallet_utils6.zCertificateChain
   // REQUIRED in v1.3
 });
-var zWalletAttestationJwtPayloadV1_3 = import_zod7.z.looseObject({
-  ...zJwtPayload.shape,
-  cnf: import_zod7.z.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_3 = import_zod4.z.looseObject({
+  ...import_io_wallet_utils6.zJwtPayload.shape,
+  cnf: import_zod4.z.object({
+    jwk: import_io_wallet_utils6.zJwk
   }),
-  exp: import_zod7.z.number(),
-  iat: import_zod7.z.number(),
-  iss: import_zod7.z.string(),
-  nbf: import_zod7.z.number().optional(),
+  exp: import_zod4.z.number(),
+  iat: import_zod4.z.number(),
+  iss: import_zod4.z.string(),
+  nbf: import_zod4.z.number().optional(),
   // NEW in v1.3
-  status: import_zod7.z.object({
-    status_list: import_zod7.z.object({
-      idx: import_zod7.z.number().int(),
-      uri: import_zod7.z.string()
+  status: import_zod4.z.object({
+    status_list: import_zod4.z.object({
+      idx: import_zod4.z.number().int(),
+      uri: import_zod4.z.string()
     })
   }).optional(),
   // NEW in v1.3 - status object for revocation
-  sub: import_zod7.z.string(),
-  wallet_link: import_zod7.z.url().optional(),
-  wallet_name: import_zod7.z.string().optional()
+  sub: import_zod4.z.string(),
+  wallet_link: import_zod4.z.url().optional(),
+  wallet_name: import_zod4.z.string().optional()
 });
-var zWalletAttestationJwtV1_3 = import_zod7.z.string().min(1);
+var zWalletAttestationJwtV1_3 = import_zod4.z.string().min(1);
 
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
@@ -795,28 +559,29 @@ async function verifyWalletAttestationJwt2(options) {
 }
 
 // src/client-attestation/v1.4/z-wallet-attestation.ts
-var import_zod8 = require("zod");
-var zWalletAttestationJwtHeaderV1_4 = import_zod8.z.looseObject({
-  ...zJwtHeader.shape,
-  kid: import_zod8.z.string(),
-  trust_chain: zTrustChain.optional(),
-  typ: import_zod8.z.literal("oauth-client-attestation+jwt"),
-  x5c: zCertificateChain
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_zod5 = require("zod");
+var zWalletAttestationJwtHeaderV1_4 = import_zod5.z.looseObject({
+  ...import_io_wallet_utils7.zJwtHeader.shape,
+  kid: import_zod5.z.string(),
+  trust_chain: import_io_wallet_utils7.zTrustChain.optional(),
+  typ: import_zod5.z.literal("oauth-client-attestation+jwt"),
+  x5c: import_io_wallet_utils7.zCertificateChain
 });
-var zWalletAttestationJwtPayloadV1_4 = import_zod8.z.looseObject({
-  ...zJwtPayload.shape,
-  cnf: import_zod8.z.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_4 = import_zod5.z.looseObject({
+  ...import_io_wallet_utils7.zJwtPayload.shape,
+  cnf: import_zod5.z.object({
+    jwk: import_io_wallet_utils7.zJwk
   }),
-  exp: import_zod8.z.number().int(),
-  iat: import_zod8.z.number().int(),
-  iss: import_zod8.z.string(),
-  nbf: import_zod8.z.number().optional(),
-  sub: import_zod8.z.string(),
-  wallet_link: import_zod8.z.url(),
-  wallet_name: import_zod8.z.string()
+  exp: import_zod5.z.number().int(),
+  iat: import_zod5.z.number().int(),
+  iss: import_zod5.z.string(),
+  nbf: import_zod5.z.number().optional(),
+  sub: import_zod5.z.string(),
+  wallet_link: import_zod5.z.url(),
+  wallet_name: import_zod5.z.string()
 });
-var zWalletAttestationJwtV1_4 = import_zod8.z.string().min(1);
+var zWalletAttestationJwtV1_4 = import_zod5.z.string().min(1);
 
 // src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt3(options) {
@@ -828,10 +593,10 @@ async function verifyWalletAttestationJwt3(options) {
 }
 
 // src/client-attestation/wallet-attestation.ts
-var dispatchVerifyWalletAttestationJwt = (0, import_io_wallet_utils5.createVersionDispatcher)({
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
+var dispatchVerifyWalletAttestationJwt = (0, import_io_wallet_utils8.createVersionDispatcher)({
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
 });
 async function verifyWalletAttestationJwt4(options) {
   return dispatchVerifyWalletAttestationJwt(options);
@@ -847,7 +612,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   if (!walletAttestationHeader || !clientAttestationPopHeader) {
     return { valid: false };
   }
-  if (!import_oauth25.zCompactJwt.safeParse(walletAttestationHeader).success || !import_oauth25.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
+  if (!import_io_wallet_utils8.zCompactJwt.safeParse(walletAttestationHeader).success || !import_io_wallet_utils8.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
     return { valid: false };
   }
   return {
@@ -858,8 +623,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 }
 
 // src/token-dpop/create-token-dpop.ts
-var import_oauth26 = require("@openid4vc/oauth2");
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
 var import_js_base64 = require("js-base64");
 
 // src/token-dpop/dpop-utils.ts
@@ -871,29 +635,29 @@ var htuFromRequestUrl = (requestUrl) => {
 };
 
 // src/token-dpop/z-dpop.ts
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
-var import_zod9 = __toESM(require("zod"));
-var zDpopJwtPayload = import_zod9.default.looseObject({
-  ...zJwtPayload.shape,
-  ath: import_zod9.default.optional(import_zod9.default.string()),
-  htm: import_io_wallet_utils6.zHttpMethod,
-  htu: import_zod9.default.url(),
-  iat: import_zod9.default.number().int().nonnegative(),
-  jti: import_zod9.default.string().max(MAX_JTI_LENGTH)
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_zod6 = __toESM(require("zod"));
+var zDpopJwtPayload = import_zod6.default.looseObject({
+  ...import_io_wallet_utils9.zJwtPayload.shape,
+  ath: import_zod6.default.optional(import_zod6.default.string()),
+  htm: import_io_wallet_utils9.zHttpMethod,
+  htu: import_zod6.default.url(),
+  iat: import_zod6.default.number().int().nonnegative(),
+  jti: import_zod6.default.string().max(import_io_wallet_utils9.MAX_JTI_LENGTH)
 });
-var zDpopJwtHeader = import_zod9.default.looseObject({
-  ...zJwtHeader.shape,
-  jwk: zJwk,
-  typ: import_zod9.default.literal("dpop+jwt")
+var zDpopJwtHeader = import_zod6.default.looseObject({
+  ...import_io_wallet_utils9.zJwtHeader.shape,
+  jwk: import_io_wallet_utils9.zJwk,
+  typ: import_zod6.default.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
 async function createTokenDPoP(options) {
   try {
-    const ath = options.accessToken ? (0, import_io_wallet_utils7.encodeToBase64Url)(
+    const ath = options.accessToken ? (0, import_io_wallet_utils10.encodeToBase64Url)(
       await options.callbacks.hash(
-        (0, import_io_wallet_utils7.decodeUtf8String)(options.accessToken),
-        import_oauth26.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils10.decodeUtf8String)(options.accessToken),
+        import_io_wallet_utils10.HashAlgorithm.Sha256
       )
     ) : void 0;
     const jti = options.jti ?? (options.callbacks.generateRandom ? import_js_base64.Base64.fromUint8Array(
@@ -905,16 +669,16 @@ async function createTokenDPoP(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const header = (0, import_io_wallet_utils7.parseWithErrorHandling)(zDpopJwtHeader, {
+    const header = (0, import_io_wallet_utils10.parseWithErrorHandling)(zDpopJwtHeader, {
       alg: options.signer.alg,
       jwk: options.signer.publicJwk,
       typ: "dpop+jwt"
     });
-    const payload = (0, import_io_wallet_utils7.parseWithErrorHandling)(zDpopJwtPayload, {
+    const payload = (0, import_io_wallet_utils10.parseWithErrorHandling)(zDpopJwtPayload, {
       ath,
       htm: options.tokenRequest.method,
       htu: htuFromRequestUrl(options.tokenRequest.url),
-      iat: (0, import_io_wallet_utils7.dateToSeconds)(options.issuedAt),
+      iat: (0, import_io_wallet_utils10.dateToSeconds)(options.issuedAt),
       jti
     });
     return options.callbacks.signJwt(options.signer, {
@@ -922,7 +686,7 @@ async function createTokenDPoP(options) {
       payload
     });
   } catch (error) {
-    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils7.ValidationError) {
+    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils10.ValidationError) {
       throw error;
     }
     throw new CreateTokenDPoPError(
@@ -935,17 +699,17 @@ function extractDpopJwtFromHeaders(headers) {
   if (!dpopJwt) {
     return { valid: true };
   }
-  if (!import_oauth26.zCompactJwt.safeParse(dpopJwt).success) {
+  if (!import_io_wallet_utils10.zCompactJwt.safeParse(dpopJwt).success) {
     return { valid: false };
   }
   return { dpopJwt, valid: true };
 }
 
 // src/access-token/z-grant-type.ts
-var import_zod10 = require("zod");
-var zAuthorizationCodeGrantIdentifier = import_zod10.z.literal("authorization_code");
+var import_zod7 = require("zod");
+var zAuthorizationCodeGrantIdentifier = import_zod7.z.literal("authorization_code");
 var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = import_zod10.z.literal("refresh_token");
+var zRefreshTokenGrantIdentifier = import_zod7.z.literal("refresh_token");
 var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
 // src/access-token/parse-token-request.ts
@@ -956,7 +720,7 @@ function parseAccessTokenRequest(options) {
   if (!validationResult.success) {
     throw new Oauth2Error(
       `Access token request validation failed:
-${(0, import_io_wallet_utils8.formatZodError)(validationResult.error)}`
+${(0, import_io_wallet_utils11.formatZodError)(validationResult.error)}`
     );
   }
   const accessTokenRequest = validationResult.data;
@@ -1023,36 +787,36 @@ function parseSecurityHeaders(headers) {
 }
 
 // src/client-attestation/verify-client-attestation.ts
-var import_oauth28 = require("@openid4vc/oauth2");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/client-attestation-pop.ts
-var import_oauth27 = require("@openid4vc/oauth2");
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/z-client-attestation-pop.ts
-var import_zod11 = __toESM(require("zod"));
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_zod8 = __toESM(require("zod"));
 var IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES = [
   "ES256",
   "ES384",
   "ES512"
 ];
-var zItWalletClientAttestationPopJwtAlg = import_zod11.default.enum(
+var zItWalletClientAttestationPopJwtAlg = import_zod8.default.enum(
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES
 );
-var zItWalletClientAttestationPopJwtPayload = import_zod11.default.looseObject({
-  ...zJwtPayload.shape,
-  aud: import_zod11.default.string(),
-  exp: import_zod11.default.number().int().optional(),
-  iat: import_zod11.default.number().int(),
-  iss: import_zod11.default.string(),
-  jti: import_zod11.default.string().max(MAX_JTI_LENGTH),
-  nonce: import_zod11.default.string().optional()
+var zItWalletClientAttestationPopJwtPayload = import_zod8.default.looseObject({
+  ...import_io_wallet_utils12.zJwtPayload.shape,
+  aud: import_zod8.default.string(),
+  exp: import_zod8.default.number().int().optional(),
+  iat: import_zod8.default.number().int(),
+  iss: import_zod8.default.string(),
+  jti: import_zod8.default.string().max(import_io_wallet_utils12.MAX_JTI_LENGTH),
+  nonce: import_zod8.default.string().optional()
 });
-var zItWalletClientAttestationPopJwtTyp = import_zod11.default.literal(
+var zItWalletClientAttestationPopJwtTyp = import_zod8.default.literal(
   "oauth-client-attestation-pop+jwt"
 );
-var zItWalletClientAttestationPopJwtHeader = import_zod11.default.looseObject({
-  ...zJwtHeader.shape,
+var zItWalletClientAttestationPopJwtHeader = import_zod8.default.looseObject({
+  ...import_io_wallet_utils12.zJwtHeader.shape,
   typ: zItWalletClientAttestationPopJwtTyp
 });
 
@@ -1066,14 +830,14 @@ function assertSupportedClientAttestationPopAlg(alg) {
 }
 async function verifyClientAttestationPopJwt(options) {
   try {
-    const { header, payload } = decodeJwt({
+    const { header, payload } = (0, import_io_wallet_utils13.decodeJwt)({
       errorMessagePrefix: "Error decoding client attestation PoP JWT:",
       headerSchema: zItWalletClientAttestationPopJwtHeader,
       jwt: options.clientAttestationPopJwt,
       payloadSchema: zItWalletClientAttestationPopJwtPayload
     });
     assertSupportedClientAttestationPopAlg(header.alg);
-    const { signer } = await (0, import_oauth27.verifyJwt)({
+    const { signer } = await (0, import_io_wallet_utils13.verifyJwt)({
       compact: options.clientAttestationPopJwt,
       errorMessage: "client attestation pop jwt verification failed",
       expectedAudience: options.authorizationServer,
@@ -1102,7 +866,7 @@ async function verifyClientAttestationPopJwt(options) {
 }
 async function createClientAttestationPopJwt(options) {
   try {
-    const clientAttestation = decodeJwt({
+    const clientAttestation = (0, import_io_wallet_utils13.decodeJwt)({
       errorMessagePrefix: "Error decoding client attestation JWT:",
       jwt: options.clientAttestation
     });
@@ -1129,22 +893,22 @@ async function createClientAttestationPopJwt(options) {
       typ: zItWalletClientAttestationPopJwtTyp.value
     };
     const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils9.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
+    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils13.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
     if (!jti) {
       throw new Oauth2Error(
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const payload = (0, import_io_wallet_utils9.parseWithErrorHandling)(
+    const payload = (0, import_io_wallet_utils13.parseWithErrorHandling)(
       zItWalletClientAttestationPopJwtPayload,
       {
         aud: options.authorizationServer,
-        iat: (0, import_io_wallet_utils9.dateToSeconds)(issuedAt),
+        iat: (0, import_io_wallet_utils13.dateToSeconds)(issuedAt),
         iss: sub,
         jti,
-        ...options.config.itWalletSpecsVersion === import_io_wallet_utils9.ItWalletSpecsVersion.V1_0 ? {
-          exp: (0, import_io_wallet_utils9.dateToSeconds)(
-            "expiresAt" in options && options.expiresAt ? options.expiresAt : (0, import_io_wallet_utils9.addSecondsToDate)(issuedAt, 1 * 60)
+        ...options.config.itWalletSpecsVersion === import_io_wallet_utils13.ItWalletSpecsVersion.V1_0 ? {
+          exp: (0, import_io_wallet_utils13.dateToSeconds)(
+            "expiresAt" in options && options.expiresAt ? options.expiresAt : (0, import_io_wallet_utils13.addSecondsToDate)(issuedAt, 1 * 60)
           )
         } : {}
       }
@@ -1189,8 +953,8 @@ async function verifyClientAttestation(options) {
     );
   }
   if (options.clientAttestation.ensureConfirmationKeyMatchesDpopKey && options.dpopJwkThumbprint) {
-    const clientAttestationJkt = await (0, import_oauth28.calculateJwkThumbprint)({
-      hashAlgorithm: import_oauth28.HashAlgorithm.Sha256,
+    const clientAttestationJkt = await (0, import_io_wallet_utils14.calculateJwkThumbprint)({
+      hashAlgorithm: import_io_wallet_utils14.HashAlgorithm.Sha256,
       hashCallback: options.callbacks.hash,
       jwk: clientAttestation.payload.cnf.jwk
     });
@@ -1207,8 +971,7 @@ async function verifyClientAttestation(options) {
 }
 
 // src/pkce.ts
-var import_oauth29 = require("@openid4vc/oauth2");
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
 var PkceCodeChallengeMethod = {
   Plain: "plain",
   S256: "S256"
@@ -1226,7 +989,7 @@ async function createPkce(options) {
   const codeChallengeMethod = allowedCodeChallengeMethods.includes(
     PkceCodeChallengeMethod.S256
   ) ? PkceCodeChallengeMethod.S256 : PkceCodeChallengeMethod.Plain;
-  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils10.encodeToBase64Url)(await options.callbacks.generateRandom(64));
+  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils15.encodeToBase64Url)(await options.callbacks.generateRandom(64));
   return {
     codeChallenge: await calculateCodeChallenge({
       codeChallengeMethod,
@@ -1254,10 +1017,10 @@ async function calculateCodeChallenge(options) {
     return options.codeVerifier;
   }
   if (options.codeChallengeMethod === PkceCodeChallengeMethod.S256) {
-    return (0, import_io_wallet_utils10.encodeToBase64Url)(
+    return (0, import_io_wallet_utils15.encodeToBase64Url)(
       await options.hashCallback(
-        (0, import_io_wallet_utils10.decodeUtf8String)(options.codeVerifier),
-        import_oauth29.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils15.decodeUtf8String)(options.codeVerifier),
+        import_io_wallet_utils15.HashAlgorithm.Sha256
       )
     );
   }
@@ -1267,10 +1030,9 @@ async function calculateCodeChallenge(options) {
 }
 
 // src/token-dpop/verify-token-dpop.ts
-var import_oauth210 = require("@openid4vc/oauth2");
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
 async function verifyTokenDPoP(options) {
-  const { header, payload } = decodeJwt({
+  const { header, payload } = (0, import_io_wallet_utils16.decodeJwt)({
     errorMessagePrefix: "Error decoding access token DPoP JWT:",
     headerSchema: zDpopJwtHeader,
     jwt: options.dpopJwt,
@@ -1308,10 +1070,10 @@ async function verifyTokenDPoP(options) {
     );
   }
   if (options.accessToken) {
-    const expectedAth = (0, import_io_wallet_utils11.encodeToBase64Url)(
+    const expectedAth = (0, import_io_wallet_utils16.encodeToBase64Url)(
       await options.callbacks.hash(
-        (0, import_io_wallet_utils11.decodeUtf8String)(options.accessToken),
-        import_oauth210.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils16.decodeUtf8String)(options.accessToken),
+        import_io_wallet_utils16.HashAlgorithm.Sha256
       )
     );
     if (!payload.ath) {
@@ -1325,8 +1087,8 @@ async function verifyTokenDPoP(options) {
       );
     }
   }
-  const jwkThumbprint = await (0, import_oauth210.calculateJwkThumbprint)({
-    hashAlgorithm: import_oauth210.HashAlgorithm.Sha256,
+  const jwkThumbprint = await (0, import_io_wallet_utils16.calculateJwkThumbprint)({
+    hashAlgorithm: import_io_wallet_utils16.HashAlgorithm.Sha256,
     hashCallback: options.callbacks.hash,
     jwk: header.jwk
   });
@@ -1336,7 +1098,7 @@ async function verifyTokenDPoP(options) {
     );
   }
   try {
-    (0, import_io_wallet_utils11.verifyJwtIatOrThrow)({
+    (0, import_io_wallet_utils16.verifyJwtIatOrThrow)({
       iat: payload.iat,
       now: options.now
     });
@@ -1345,7 +1107,7 @@ async function verifyTokenDPoP(options) {
       throw new Oauth2Error(`Invalid iat claim in dpop JWT: ${error.message}`);
     }
   }
-  await (0, import_oauth210.verifyJwt)({
+  await (0, import_io_wallet_utils16.verifyJwt)({
     compact: options.dpopJwt,
     errorMessage: "dpop jwt verification failed",
     header,
@@ -1411,36 +1173,37 @@ async function verifyAccessTokenRequest(options) {
 }
 
 // src/authorization-request/create-authorization-request.ts
-var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-request/z-authorization-request.ts
-var import_zod12 = __toESM(require("zod"));
-var zOpenidCredentialAuthorizationDetails = import_zod12.default.object({
-  credential_configuration_id: import_zod12.default.string(),
-  type: import_zod12.default.literal("openid_credential")
+var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var import_zod9 = __toESM(require("zod"));
+var zOpenidCredentialAuthorizationDetails = import_zod9.default.object({
+  credential_configuration_id: import_zod9.default.string(),
+  type: import_zod9.default.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = import_zod12.default.object({
-  challenge_method: import_zod12.default.literal("mrtd+ias"),
-  challenge_redirect_uri: import_zod12.default.url(),
-  idphinting: import_zod12.default.url(),
-  type: import_zod12.default.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = import_zod9.default.object({
+  challenge_method: import_zod9.default.literal("mrtd+ias"),
+  challenge_redirect_uri: import_zod9.default.url(),
+  idphinting: import_zod9.default.url(),
+  type: import_zod9.default.literal("it_l2+document_proof")
 });
-var zAuthorizationRequestBaseObject = import_zod12.default.looseObject({
-  authorization_details: import_zod12.default.array(
-    import_zod12.default.discriminatedUnion("type", [
+var zAuthorizationRequestBaseObject = import_zod9.default.looseObject({
+  authorization_details: import_zod9.default.array(
+    import_zod9.default.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: import_zod12.default.string(),
-  code_challenge: import_zod12.default.string(),
-  code_challenge_method: import_zod12.default.string(),
-  issuer_state: import_zod12.default.optional(import_zod12.default.string()),
-  jti: import_zod12.default.string().max(MAX_JTI_LENGTH),
-  redirect_uri: import_zod12.default.url(),
-  response_type: import_zod12.default.string(),
-  scope: import_zod12.default.string().optional(),
-  state: import_zod12.default.string()
+  client_id: import_zod9.default.string(),
+  code_challenge: import_zod9.default.string(),
+  code_challenge_method: import_zod9.default.string(),
+  issuer_state: import_zod9.default.optional(import_zod9.default.string()),
+  jti: import_zod9.default.string().max(import_io_wallet_utils17.MAX_JTI_LENGTH),
+  redirect_uri: import_zod9.default.url(),
+  response_type: import_zod9.default.string(),
+  scope: import_zod9.default.string().optional(),
+  state: import_zod9.default.string()
 });
 var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
@@ -1450,7 +1213,7 @@ var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   }
 );
 var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
-  response_mode: import_zod12.default.string()
+  response_mode: import_zod9.default.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1459,25 +1222,25 @@ var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
   }
 );
 var zAuthorizationRequestV1_3 = zAuthorizationRequestBase;
-var zPushedAuthorizationRequestSigned = import_zod12.default.looseObject({
-  client_id: import_zod12.default.string().describe(
+var zPushedAuthorizationRequestSigned = import_zod9.default.looseObject({
+  client_id: import_zod9.default.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod12.default.string().describe(
+  pkceCodeVerifier: import_zod9.default.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: import_zod12.default.string().describe(
+  request: import_zod9.default.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => import_zod12.default.looseObject({
+var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => import_zod9.default.looseObject({
   authorizationRequest: authorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: import_zod12.default.string().describe(
+  client_id: import_zod9.default.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: import_zod12.default.string().describe(
+  pkceCodeVerifier: import_zod9.default.string().describe(
     "PKCE code verifier. Auto-generated if not provided in options."
   )
 });
@@ -1489,9 +1252,9 @@ function isPushedAuthorizationRequestSigned(par) {
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = import_zod12.default.looseObject({
-  expires_in: import_zod12.default.number().int(),
-  request_uri: import_zod12.default.string()
+var zPushedAuthorizationResponse = import_zod9.default.looseObject({
+  expires_in: import_zod9.default.number().int(),
+  request_uri: import_zod9.default.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1509,13 +1272,13 @@ async function createPushedAuthorizationRequest(options) {
     code_challenge: pkce.codeChallenge,
     code_challenge_method: pkce.codeChallengeMethod,
     ...options.issuerState !== void 0 ? { issuer_state: options.issuerState } : {},
-    jti: options.jti ?? (0, import_io_wallet_utils12.encodeToBase64Url)(
+    jti: options.jti ?? (0, import_io_wallet_utils18.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     ),
     redirect_uri: options.redirectUri,
     response_type: "code",
     scope: options.scope,
-    state: options.state ?? (0, import_io_wallet_utils12.encodeToBase64Url)(
+    state: options.state ?? (0, import_io_wallet_utils18.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     )
   };
@@ -1532,7 +1295,7 @@ async function createPushedAuthorizationRequest(options) {
       );
     }
     const iat = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils12.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils18.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
     const requestJwt = await options.callbacks.signJwt(dpop.signer, {
       header: {
         alg: dpop.signer.alg,
@@ -1541,8 +1304,8 @@ async function createPushedAuthorizationRequest(options) {
       },
       payload: {
         aud: options.audience,
-        exp: (0, import_io_wallet_utils12.dateToSeconds)(exp),
-        iat: (0, import_io_wallet_utils12.dateToSeconds)(iat),
+        exp: (0, import_io_wallet_utils18.dateToSeconds)(exp),
+        iat: (0, import_io_wallet_utils18.dateToSeconds)(iat),
         iss: dpop.signer.publicJwk.kid,
         ...authorizationRequest
       }
@@ -1560,27 +1323,27 @@ async function createPushedAuthorizationRequest(options) {
   };
 }
 function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
-  return (0, import_io_wallet_utils12.dispatchByVersion)(options.config.itWalletSpecsVersion, {
-    [import_io_wallet_utils12.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0.parse({
+  return (0, import_io_wallet_utils18.dispatchByVersion)(options.config.itWalletSpecsVersion, {
+    [import_io_wallet_utils18.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0.parse({
       ...baseAuthorizationRequest,
       response_mode: options.responseMode
     }),
-    [import_io_wallet_utils12.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3.parse(
+    [import_io_wallet_utils18.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     ),
     // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [import_io_wallet_utils12.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3.parse(
+    [import_io_wallet_utils18.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     )
   });
 }
 
 // src/authorization-request/fetch-authorization-response.ts
-var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
 async function fetchPushedAuthorizationResponse(options) {
   try {
-    const fetch = (0, import_io_wallet_utils13.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils19.createFetcher)(options.callbacks.fetch);
     const body = isPushedAuthorizationRequestSigned(
       options.pushedAuthorizationRequest
     ) ? new URLSearchParams({
@@ -1594,25 +1357,25 @@ async function fetchPushedAuthorizationResponse(options) {
       {
         body,
         headers: {
-          [import_io_wallet_utils13.HEADERS.CONTENT_TYPE]: import_io_wallet_utils13.CONTENT_TYPES.FORM_URLENCODED,
-          [import_io_wallet_utils13.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-          [import_io_wallet_utils13.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+          [import_io_wallet_utils19.HEADERS.CONTENT_TYPE]: import_io_wallet_utils19.CONTENT_TYPES.FORM_URLENCODED,
+          [import_io_wallet_utils19.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+          [import_io_wallet_utils19.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
         },
         method: "POST"
       }
     );
-    await (0, import_io_wallet_utils13.hasStatusOrThrow)(201, import_io_wallet_utils13.UnexpectedStatusCodeError)(parResponse);
+    await (0, import_io_wallet_utils19.hasStatusOrThrow)(201, import_io_wallet_utils19.UnexpectedStatusCodeError)(parResponse);
     const parResponseJson = await parResponse.json();
     const parsedParResponse = zPushedAuthorizationResponse.safeParse(parResponseJson);
     if (!parsedParResponse.success) {
-      throw new import_io_wallet_utils13.ValidationError(
+      throw new import_io_wallet_utils19.ValidationError(
         `Failed to parse pushed authorization response`,
         parsedParResponse.error
       );
     }
     return parsedParResponse.data;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils13.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils13.ValidationError) {
+    if (error instanceof import_io_wallet_utils19.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils19.ValidationError) {
       throw error;
     }
     throw new PushedAuthorizationRequestError(
@@ -1658,22 +1421,22 @@ function parseAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-pushed-authorization-request.ts
-var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
-var import_zod14 = __toESM(require("zod"));
+var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
+var import_zod11 = __toESM(require("zod"));
 
 // src/jar/fetch-jar-request-object.ts
-var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
 async function fetchJarRequestObject(options) {
   const { fetch, requestUri } = options;
   const JAR_ACCEPT_HEADER = [
-    import_io_wallet_utils14.ContentType.OAuthAuthorizationRequestJwt,
+    import_io_wallet_utils20.ContentType.OAuthAuthorizationRequestJwt,
     // Preferred: application/oauth-authz-req+jwt
-    `${import_io_wallet_utils14.ContentType.Jwt};q=0.9`,
+    `${import_io_wallet_utils20.ContentType.Jwt};q=0.9`,
     // Fallback: application/jwt
     "text/plain"
     // Final fallback: text/plain
   ].join(", ");
-  const response = await (0, import_io_wallet_utils14.createFetcher)(fetch)(requestUri, {
+  const response = await (0, import_io_wallet_utils20.createFetcher)(fetch)(requestUri, {
     headers: {
       Accept: JAR_ACCEPT_HEADER
     },
@@ -1683,7 +1446,7 @@ async function fetchJarRequestObject(options) {
       `Fetching request_object from request_uri '${requestUri}' failed`
     );
   });
-  await (0, import_io_wallet_utils14.hasStatusOrThrow)(200, import_io_wallet_utils14.UnexpectedStatusCodeError)(response);
+  await (0, import_io_wallet_utils20.hasStatusOrThrow)(200, import_io_wallet_utils20.UnexpectedStatusCodeError)(response);
   return await response.text();
 }
 
@@ -1720,25 +1483,26 @@ async function parseJarRequest(options) {
 }
 
 // src/jar/z-jar.ts
-var import_zod13 = __toESM(require("zod"));
-var zJarAuthorizationRequest = import_zod13.default.looseObject({
-  client_id: import_zod13.default.optional(import_zod13.default.string()),
-  request: import_zod13.default.optional(import_zod13.default.string()),
-  request_uri: import_zod13.default.url().optional()
+var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
+var import_zod10 = __toESM(require("zod"));
+var zJarAuthorizationRequest = import_zod10.default.looseObject({
+  client_id: import_zod10.default.optional(import_zod10.default.string()),
+  request: import_zod10.default.optional(import_zod10.default.string()),
+  request_uri: import_zod10.default.url().optional()
 });
-var zJarRequestObjectPayload = import_zod13.default.looseObject({
-  ...zJwtPayload.shape,
-  client_id: import_zod13.default.string()
+var zJarRequestObjectPayload = import_zod10.default.looseObject({
+  ...import_io_wallet_utils21.zJwtPayload.shape,
+  client_id: import_zod10.default.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = import_zod13.default.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = import_zod10.default.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = import_zod13.default.looseObject({
-  ...zJwtHeader.shape,
+var zJarRequestObjectHeader = import_zod10.default.looseObject({
+  ...import_io_wallet_utils21.zJwtHeader.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = import_zod13.default.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = import_zod10.default.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
 // src/authorization-request/parse-pushed-authorization-request.ts
@@ -1746,8 +1510,8 @@ async function parsePushedAuthorizationRequest(options) {
   const authorizationRequestSchema = getAuthorizationRequestSchema(
     options.config
   );
-  const parsed = (0, import_io_wallet_utils15.parseWithErrorHandling)(
-    import_zod14.default.union([authorizationRequestSchema, zJarAuthorizationRequest]),
+  const parsed = (0, import_io_wallet_utils22.parseWithErrorHandling)(
+    import_zod11.default.union([authorizationRequestSchema, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1758,7 +1522,7 @@ async function parsePushedAuthorizationRequest(options) {
       callbacks: options.callbacks,
       jarRequestParams: parsed
     });
-    const jwt = decodeJwt({
+    const jwt = (0, import_io_wallet_utils22.decodeJwt)({
       errorMessagePrefix: "Error decoding pushed authorization request JWT:",
       jwt: parsedJar.authorizationRequestJwt
     });
@@ -1768,7 +1532,7 @@ async function parsePushedAuthorizationRequest(options) {
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Invalid authorization request. Could not parse jar request payload.
-${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils22.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
     authorizationRequestJwt = parsedJar.authorizationRequestJwt;
@@ -1779,7 +1543,7 @@ ${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Error occurred during validation of pushed authorization request.
-${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils22.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
   }
@@ -1795,12 +1559,12 @@ ${(0, import_io_wallet_utils15.formatZodError)(parsedAuthorizationRequest.error)
   };
 }
 function getAuthorizationRequestSchema(config) {
-  return (0, import_io_wallet_utils15.dispatchByVersion)(config.itWalletSpecsVersion, {
-    [import_io_wallet_utils15.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0,
-    [import_io_wallet_utils15.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3,
+  return (0, import_io_wallet_utils22.dispatchByVersion)(config.itWalletSpecsVersion, {
+    [import_io_wallet_utils22.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0,
+    [import_io_wallet_utils22.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3,
     // V1_4 reuses V1_3 PAR schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [import_io_wallet_utils15.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3
+    [import_io_wallet_utils22.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3
   });
 }
 
@@ -1848,18 +1612,20 @@ async function verifyAuthorizationRequestDpop(options, request, callbacks, now)
   };
 }
 
+// src/authorization-request/verify-pushed-authorization-request.ts
+var import_io_wallet_utils24 = require("@pagopa/io-wallet-utils");
+
 // src/jar/verify-jar-request.ts
-var import_oauth211 = require("@openid4vc/oauth2");
-var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils23 = require("@pagopa/io-wallet-utils");
 async function verifyJarRequest(options) {
   const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
-  const requestObjectIsEncrypted = import_oauth211.zCompactJwe.safeParse(
+  const requestObjectIsEncrypted = import_io_wallet_utils23.zCompactJwe.safeParse(
     authorizationRequestJwt
   ).success;
   if (requestObjectIsEncrypted) {
     throw new Oauth2Error("Encrypted JWE request objects are not supported.");
   }
-  const requestIsSigned = import_oauth211.zCompactJwt.safeParse(
+  const requestIsSigned = import_io_wallet_utils23.zCompactJwt.safeParse(
     authorizationRequestJwt
   ).success;
   if (!requestIsSigned) {
@@ -1912,15 +1678,15 @@ async function verifyJarRequest(options) {
 }
 async function verifyJarRequestObject(options) {
   const { authorizationRequestJwt, callbacks, jwtSigner } = options;
-  const jwt = decodeJwt({
+  const jwt = (0, import_io_wallet_utils23.decodeJwt)({
     errorMessagePrefix: "Error decoding JAR authorization request JWT:",
     jwt: authorizationRequestJwt
   });
-  const authorizationRequestPayload = (0, import_io_wallet_utils16.parseWithErrorHandling)(
+  const authorizationRequestPayload = (0, import_io_wallet_utils23.parseWithErrorHandling)(
     zJarRequestObjectPayload,
     jwt.payload
   );
-  const { signer } = await (0, import_oauth211.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils23.verifyJwt)({
     compact: authorizationRequestJwt,
     header: jwt.header,
     payload: authorizationRequestPayload,
@@ -1953,7 +1719,7 @@ async function verifyPushedAuthorizationRequest(options) {
   let jar;
   if (options.authorizationRequestJwt) {
     if (requireSigned) {
-      const decoded = decodeJwt({
+      const decoded = (0, import_io_wallet_utils24.decodeJwt)({
         errorMessagePrefix: "Error decoding pushed authorization request JWT:",
         jwt: options.authorizationRequestJwt.jwt
       });
@@ -2042,10 +1808,10 @@ function clientAuthenticationWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils26 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/jwk-thumbprint.ts
-var import_oauth212 = require("@openid4vc/oauth2");
+var import_io_wallet_utils25 = require("@pagopa/io-wallet-utils");
 var SUPPORTED_KTY = ["RSA", "EC"];
 var calculateDpopJwkThumbprint = (options) => {
   if (!SUPPORTED_KTY.includes(
@@ -2055,8 +1821,8 @@ var calculateDpopJwkThumbprint = (options) => {
       `Unsupported JWK key type "${options.dpopJwkPublic.kty}" for thumbprint computation. Supported types: ${SUPPORTED_KTY.join(", ")}.`
     );
   }
-  return (0, import_oauth212.calculateJwkThumbprint)({
-    hashAlgorithm: import_oauth212.HashAlgorithm.Sha256,
+  return (0, import_io_wallet_utils25.calculateJwkThumbprint)({
+    hashAlgorithm: import_io_wallet_utils25.HashAlgorithm.Sha256,
     hashCallback: options.callbacks.hash,
     jwk: options.dpopJwkPublic
   });
@@ -2067,12 +1833,12 @@ var createWalletAttestationJwt = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils17.addSecondsToDate)(iat, 3600);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils26.addSecondsToDate)(iat, 3600);
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils17.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils17.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils26.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils26.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
       ...options.walletLink && { wallet_link: options.walletLink },
@@ -2089,7 +1855,7 @@ var createWalletAttestationJwt = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    (0, import_io_wallet_utils26.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_0,
       jwt: result.jwt,
@@ -2097,7 +1863,7 @@ var createWalletAttestationJwt = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils17.ValidationError) {
+    if (error instanceof import_io_wallet_utils26.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -2107,23 +1873,23 @@ var createWalletAttestationJwt = async (options) => {
 };
 
 // src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils27 = require("@pagopa/io-wallet-utils");
 var createWalletAttestationJwt2 = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils18.addSecondsToDate)(iat, 3600);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils27.addSecondsToDate)(iat, 3600);
     if (options.nbf && options.nbf >= exp) {
-      throw new import_io_wallet_utils18.ValidationError("nbf must be before exp");
+      throw new import_io_wallet_utils27.ValidationError("nbf must be before exp");
     }
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils18.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils18.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils27.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils27.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
-      ...options.nbf && { nbf: (0, import_io_wallet_utils18.dateToSeconds)(options.nbf) },
+      ...options.nbf && { nbf: (0, import_io_wallet_utils27.dateToSeconds)(options.nbf) },
       ...options.status && { status: options.status },
       ...options.walletLink && { wallet_link: options.walletLink },
       ...options.walletName && { wallet_name: options.walletName }
@@ -2142,7 +1908,7 @@ var createWalletAttestationJwt2 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    (0, import_io_wallet_utils27.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_3,
       jwt: result.jwt,
@@ -2150,7 +1916,7 @@ var createWalletAttestationJwt2 = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils18.ValidationError) {
+    if (error instanceof import_io_wallet_utils27.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -2160,33 +1926,33 @@ var createWalletAttestationJwt2 = async (options) => {
 };
 
 // src/client-attestation/v1.4/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils28 = require("@pagopa/io-wallet-utils");
 var DEFAULT_EXPIRATION_SECONDS = 3600;
 var MAX_EXPIRATION_SECONDS = 86400;
 var createWalletAttestationJwt3 = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils19.addSecondsToDate)(iat, DEFAULT_EXPIRATION_SECONDS);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils28.addSecondsToDate)(iat, DEFAULT_EXPIRATION_SECONDS);
     if (exp <= iat) {
-      throw new import_io_wallet_utils19.ValidationError("exp must be after iat");
+      throw new import_io_wallet_utils28.ValidationError("exp must be after iat");
     }
-    if (exp > (0, import_io_wallet_utils19.addSecondsToDate)(iat, MAX_EXPIRATION_SECONDS)) {
-      throw new import_io_wallet_utils19.ValidationError("exp must not be more than 24 hours after iat");
+    if (exp > (0, import_io_wallet_utils28.addSecondsToDate)(iat, MAX_EXPIRATION_SECONDS)) {
+      throw new import_io_wallet_utils28.ValidationError("exp must not be more than 24 hours after iat");
     }
     if (options.nbf && options.nbf >= exp) {
-      throw new import_io_wallet_utils19.ValidationError("nbf must be before exp");
+      throw new import_io_wallet_utils28.ValidationError("nbf must be before exp");
     }
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils19.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils19.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils28.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils28.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
       wallet_link: options.walletLink,
       wallet_name: options.walletName,
-      ...options.nbf && { nbf: (0, import_io_wallet_utils19.dateToSeconds)(options.nbf) }
+      ...options.nbf && { nbf: (0, import_io_wallet_utils28.dateToSeconds)(options.nbf) }
     };
     const header = {
       alg: options.signer.alg,
@@ -2201,7 +1967,7 @@ var createWalletAttestationJwt3 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    (0, import_io_wallet_utils28.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_4,
       jwt: result.jwt,
@@ -2209,7 +1975,7 @@ var createWalletAttestationJwt3 = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils19.ValidationError) {
+    if (error instanceof import_io_wallet_utils28.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -2218,17 +1984,8 @@ var createWalletAttestationJwt3 = async (options) => {
   }
 };
 
-// src/common/jwt/z-jwe.ts
-var import_zod15 = require("zod");
-var zCompactJwe2 = import_zod15.z.string().regex(
-  /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
-  {
-    message: "Not a valid compact jwe"
-  }
-);
-
 // src/jar/create-jar-request.ts
-var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils29 = require("@pagopa/io-wallet-utils");
 async function createJarRequest(options) {
   const {
     authorizationRequestHeader,
@@ -2246,8 +2003,8 @@ async function createJarRequest(options) {
     payload: {
       ...options.additionalJwtPayload,
       ...authorizationRequestPayload,
-      exp: (0, import_io_wallet_utils20.dateToSeconds)((0, import_io_wallet_utils20.addSecondsToDate)(now, options.expiresInSeconds)),
-      iat: (0, import_io_wallet_utils20.dateToSeconds)(now)
+      exp: (0, import_io_wallet_utils29.dateToSeconds)((0, import_io_wallet_utils29.addSecondsToDate)(now, options.expiresInSeconds)),
+      iat: (0, import_io_wallet_utils29.dateToSeconds)(now)
     }
   });
   authorizationRequestJwt = jwt;
@@ -2275,6 +2032,7 @@ async function createJarRequest(options) {
 }
 
 // src/jarm-form-post-jwt.ts
+var import_io_wallet_utils30 = require("@pagopa/io-wallet-utils");
 var getJwtFromFormPost = async (options) => {
   const inputRegex = /<input[^<>]*>/gi;
   const nameRegex = /name="response"/gi;
@@ -2289,7 +2047,7 @@ var getJwtFromFormPost = async (options) => {
         const responseJwt = matchValue[1];
         if (responseJwt) {
           const jwt = responseJwt.replace(lineExpressionRegex, "");
-          const decodedJwt = decodeJwt({
+          const decodedJwt = (0, import_io_wallet_utils30.decodeJwt)({
             errorMessagePrefix: "Error decoding JARM form post JWT:",
             jwt,
             payloadSchema: options.schema
@@ -2311,73 +2069,73 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils31 = require("@pagopa/io-wallet-utils");
 
 // src/mrtd-pop/z-mrtd-pop.ts
-var import_zod16 = __toESM(require("zod"));
-var zMrtdChallengeJwtHeader = import_zod16.default.looseObject({
-  alg: import_zod16.default.string(),
-  kid: import_zod16.default.string(),
-  typ: import_zod16.default.literal("mrtd-ias+jwt")
+var import_zod12 = __toESM(require("zod"));
+var zMrtdChallengeJwtHeader = import_zod12.default.looseObject({
+  alg: import_zod12.default.string(),
+  kid: import_zod12.default.string(),
+  typ: import_zod12.default.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = import_zod16.default.looseObject({
-  aud: import_zod16.default.string(),
-  exp: import_zod16.default.number(),
-  htm: import_zod16.default.literal("POST"),
-  htu: import_zod16.default.url(),
-  iat: import_zod16.default.number(),
-  iss: import_zod16.default.string(),
-  mrtd_auth_session: import_zod16.default.string(),
-  mrtd_pop_jwt_nonce: import_zod16.default.string(),
-  state: import_zod16.default.string(),
-  status: import_zod16.default.literal("require_interaction"),
-  type: import_zod16.default.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = import_zod12.default.looseObject({
+  aud: import_zod12.default.string(),
+  exp: import_zod12.default.number(),
+  htm: import_zod12.default.literal("POST"),
+  htu: import_zod12.default.url(),
+  iat: import_zod12.default.number(),
+  iss: import_zod12.default.string(),
+  mrtd_auth_session: import_zod12.default.string(),
+  mrtd_pop_jwt_nonce: import_zod12.default.string(),
+  state: import_zod12.default.string(),
+  status: import_zod12.default.literal("require_interaction"),
+  type: import_zod12.default.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = import_zod16.default.looseObject({
-  alg: import_zod16.default.string(),
-  kid: import_zod16.default.string(),
-  typ: import_zod16.default.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = import_zod12.default.looseObject({
+  alg: import_zod12.default.string(),
+  kid: import_zod12.default.string(),
+  typ: import_zod12.default.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = import_zod16.default.looseObject({
-  aud: import_zod16.default.string(),
-  challenge: import_zod16.default.string(),
-  exp: import_zod16.default.number(),
-  htm: import_zod16.default.literal("POST"),
-  htu: import_zod16.default.url(),
-  iat: import_zod16.default.number(),
-  iss: import_zod16.default.string(),
-  mrtd_pop_nonce: import_zod16.default.string(),
-  mrz: import_zod16.default.string().optional()
+var zMrtdPopInitResponseJwtPayload = import_zod12.default.looseObject({
+  aud: import_zod12.default.string(),
+  challenge: import_zod12.default.string(),
+  exp: import_zod12.default.number(),
+  htm: import_zod12.default.literal("POST"),
+  htu: import_zod12.default.url(),
+  iat: import_zod12.default.number(),
+  iss: import_zod12.default.string(),
+  mrtd_pop_nonce: import_zod12.default.string(),
+  mrz: import_zod12.default.string().optional()
 });
-var zMrtdData = import_zod16.default.looseObject({
-  dg1: import_zod16.default.string(),
-  dg11: import_zod16.default.string(),
-  sod_mrtd: import_zod16.default.string()
+var zMrtdData = import_zod12.default.looseObject({
+  dg1: import_zod12.default.string(),
+  dg11: import_zod12.default.string(),
+  sod_mrtd: import_zod12.default.string()
 });
-var zIasData = import_zod16.default.looseObject({
-  challenge_signed: import_zod16.default.string(),
-  ias_pk: import_zod16.default.string(),
-  sod_ias: import_zod16.default.string()
+var zIasData = import_zod12.default.looseObject({
+  challenge_signed: import_zod12.default.string(),
+  ias_pk: import_zod12.default.string(),
+  sod_ias: import_zod12.default.string()
 });
-var zMrtdValidationJwtHeader = import_zod16.default.looseObject({
-  alg: import_zod16.default.string(),
-  kid: import_zod16.default.string(),
-  typ: import_zod16.default.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = import_zod12.default.looseObject({
+  alg: import_zod12.default.string(),
+  kid: import_zod12.default.string(),
+  typ: import_zod12.default.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = import_zod16.default.looseObject({
-  aud: import_zod16.default.string(),
-  document_type: import_zod16.default.literal("cie"),
-  exp: import_zod16.default.number(),
+var zMrtdValidationJwtPayload = import_zod12.default.looseObject({
+  aud: import_zod12.default.string(),
+  document_type: import_zod12.default.literal("cie"),
+  exp: import_zod12.default.number(),
   ias: zIasData,
-  iat: import_zod16.default.number(),
-  iss: import_zod16.default.string(),
+  iat: import_zod12.default.number(),
+  iss: import_zod12.default.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = import_zod16.default.looseObject({
-  mrtd_val_pop_nonce: import_zod16.default.string(),
-  redirect_uri: import_zod16.default.url(),
-  status: import_zod16.default.literal("require_interaction"),
-  type: import_zod16.default.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = import_zod12.default.looseObject({
+  mrtd_val_pop_nonce: import_zod12.default.string(),
+  redirect_uri: import_zod12.default.url(),
+  status: import_zod12.default.literal("require_interaction"),
+  type: import_zod12.default.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2388,13 +2146,13 @@ async function createMrtdValidationJwt(options) {
     if (!kid) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
-    const iat = (0, import_io_wallet_utils21.dateToSeconds)(options.issuedAt);
-    const header = (0, import_io_wallet_utils21.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
+    const iat = (0, import_io_wallet_utils31.dateToSeconds)(options.issuedAt);
+    const header = (0, import_io_wallet_utils31.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
       typ: "mrtd-ias+jwt"
     });
-    const payload = (0, import_io_wallet_utils21.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
+    const payload = (0, import_io_wallet_utils31.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
       aud: options.audience,
       document_type: "cie",
       exp: iat + JWT_EXPIRY_SECONDS2,
@@ -2427,37 +2185,36 @@ async function createMrtdValidationJwt(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-init.ts
-var import_oauth213 = require("@openid4vc/oauth2");
-var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils32 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopInit(options) {
   try {
-    const fetch = (0, import_io_wallet_utils22.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils32.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popInitEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
         mrtd_pop_jwt_nonce: options.mrtdPopJwtNonce
       }),
       headers: {
-        [import_io_wallet_utils22.HEADERS.CONTENT_TYPE]: import_io_wallet_utils22.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils22.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils32.HEADERS.CONTENT_TYPE]: import_io_wallet_utils32.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils32.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils32.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils22.hasStatusOrThrow)(202, import_io_wallet_utils22.UnexpectedStatusCodeError)(response);
+    await (0, import_io_wallet_utils32.hasStatusOrThrow)(202, import_io_wallet_utils32.UnexpectedStatusCodeError)(response);
     const responseJwt = await response.text();
-    const jwt = decodeJwt({
+    const jwt = (0, import_io_wallet_utils32.decodeJwt)({
       errorMessagePrefix: "Error decoding MRTD PoP init response JWT:",
       headerSchema: zMrtdPopInitResponseJwtHeader,
       jwt: responseJwt,
       payloadSchema: zMrtdPopInitResponseJwtPayload
     });
-    const { signer } = await (0, import_oauth213.verifyJwt)({
+    const { signer } = await (0, import_io_wallet_utils32.verifyJwt)({
       compact: responseJwt,
       errorMessage: "Error verifying MRTD PoP init response JWT",
       header: jwt.header,
       payload: jwt.payload,
-      signer: options.signer ?? (0, import_oauth213.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
+      signer: options.signer ?? (0, import_io_wallet_utils32.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
       verifyJwtCallback: options.callbacks.verifyJwt
     });
     return {
@@ -2468,7 +2225,7 @@ async function fetchMrtdPopInit(options) {
       signer
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils22.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils22.ValidationError) {
+    if (error instanceof import_io_wallet_utils32.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils32.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2478,10 +2235,10 @@ async function fetchMrtdPopInit(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-verify.ts
-var import_io_wallet_utils23 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils33 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopVerify(options) {
   try {
-    const fetch = (0, import_io_wallet_utils23.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils33.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popVerifyEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
@@ -2489,14 +2246,14 @@ async function fetchMrtdPopVerify(options) {
         mrtd_validation_jwt: options.mrtdValidationJwt
       }),
       headers: {
-        [import_io_wallet_utils23.HEADERS.CONTENT_TYPE]: import_io_wallet_utils23.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils23.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils23.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils33.HEADERS.CONTENT_TYPE]: import_io_wallet_utils33.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils33.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils33.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils23.hasStatusOrThrow)(202, import_io_wallet_utils23.UnexpectedStatusCodeError)(response);
-    const parsed = (0, import_io_wallet_utils23.parseWithErrorHandling)(
+    await (0, import_io_wallet_utils33.hasStatusOrThrow)(202, import_io_wallet_utils33.UnexpectedStatusCodeError)(response);
+    const parsed = (0, import_io_wallet_utils33.parseWithErrorHandling)(
       zMrtdPopVerifyResponse,
       await response.json(),
       "Failed to parse MRTD PoP verify response"
@@ -2506,7 +2263,7 @@ async function fetchMrtdPopVerify(options) {
       redirectUri: parsed.redirect_uri
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils23.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils23.ValidationError) {
+    if (error instanceof import_io_wallet_utils33.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils33.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2516,7 +2273,7 @@ async function fetchMrtdPopVerify(options) {
 }
 
 // src/mrtd-pop/parse-mrtd-challenge.ts
-var import_oauth214 = require("@openid4vc/oauth2");
+var import_io_wallet_utils34 = require("@pagopa/io-wallet-utils");
 function parseMrtdChallenge(options) {
   const url = new URL(options.redirectUrl);
   const challengeJwt = url.searchParams.get("challenge_info");
@@ -2525,12 +2282,12 @@ function parseMrtdChallenge(options) {
       "Missing 'challenge_info' query parameter in redirect URL"
     );
   }
-  if (!import_oauth214.zCompactJwt.safeParse(challengeJwt).success) {
+  if (!import_io_wallet_utils34.zCompactJwt.safeParse(challengeJwt).success) {
     throw new MrtdPopError(
       "Invalid JWT format in 'challenge_info' query parameter"
     );
   }
-  const { header, payload } = decodeJwt({
+  const { header, payload } = (0, import_io_wallet_utils34.decodeJwt)({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2540,10 +2297,10 @@ function parseMrtdChallenge(options) {
 }
 
 // src/mrtd-pop/verify-mrtd-challenge.ts
-var import_oauth215 = require("@openid4vc/oauth2");
+var import_io_wallet_utils35 = require("@pagopa/io-wallet-utils");
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
-  const jwt = decodeJwt({
+  const jwt = (0, import_io_wallet_utils35.decodeJwt)({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2555,31 +2312,25 @@ async function verifyMrtdChallenge(options) {
     );
   }
   const payload = jwt.payload;
-  const { signer } = await (0, import_oauth215.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils35.verifyJwt)({
     compact: challengeJwt,
     errorMessage: "Error verifying MRTD challenge JWT",
     header: jwt.header,
     payload,
-    signer: options.signer ?? (0, import_oauth215.jwtSignerFromJwt)({ header: jwt.header, payload }),
+    signer: options.signer ?? (0, import_io_wallet_utils35.jwtSignerFromJwt)({ header: jwt.header, payload }),
     verifyJwtCallback: callbacks.verifyJwt
   });
   return { header: jwt.header, payload: jwt.payload, signer };
 }
-
-// src/index.ts
-var import_oauth216 = require("@openid4vc/oauth2");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ClientAttestationError,
   CreateTokenDPoPError,
   CreateTokenResponseError,
   FetchTokenResponseError,
-  HashAlgorithm,
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
-  MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
-  Oauth2JwtParseError,
   PkceCodeChallengeMethod,
   PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod,
@@ -2597,8 +2348,6 @@ var import_oauth216 = require("@openid4vc/oauth2");
   createWalletAttestationJwtV1_0,
   createWalletAttestationJwtV1_3,
   createWalletAttestationJwtV1_4,
-  decodeJwt,
-  decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders,
   extractDpopJwtFromHeaders,
   fetchJarRequestObject,
@@ -2613,7 +2362,6 @@ var import_oauth216 = require("@openid4vc/oauth2");
   isPushedAuthorizationRequestSigned,
   isPushedAuthorizationRequestUnsigned,
   jwtAuthorizationRequestJwtHeaderTyp,
-  jwtHeaderFromJwtSigner,
   parseAccessTokenRequest,
   parseAuthorizationRequest,
   parseJarRequest,
@@ -2628,7 +2376,6 @@ var import_oauth216 = require("@openid4vc/oauth2");
   verifyClientAttestation,
   verifyClientAttestationPopJwt,
   verifyJarRequest,
-  verifyJwt,
   verifyMrtdChallenge,
   verifyPkce,
   verifyPushedAuthorizationRequest,
@@ -2641,13 +2388,9 @@ var import_oauth216 = require("@openid4vc/oauth2");
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
   zAccessTokenResponse,
-  zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
   zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3,
-  zCertificateChain,
-  zCompactJwe,
-  zCompactJwt,
   zDpopJwtHeader,
   zDpopJwtPayload,
   zItWalletClientAttestationPopJwtAlg,
@@ -2657,11 +2400,6 @@ var import_oauth216 = require("@openid4vc/oauth2");
   zJarAuthorizationRequest,
   zJarRequestObjectHeader,
   zJarRequestObjectPayload,
-  zJwk,
-  zJwkSet,
-  zJwtConfirmationPayload,
-  zJwtHeader,
-  zJwtPayload,
   zMrtdChallengeJwtHeader,
   zMrtdChallengeJwtPayload,
   zMrtdPopInitResponseJwtHeader,
@@ -2677,7 +2415,6 @@ var import_oauth216 = require("@openid4vc/oauth2");
   zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload,
   zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain,
   zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3,
   zWalletAttestationJwtHeaderV1_4,