@pagopa/io-wallet-oauth2 1.5.8 → 2.0.0-launchpad

package/dist/index.mjs

@@ -10,180 +10,20 @@ var createTokenRequest = async (options) => ({
 // src/access-token/create-token-response.ts
 import {
   HashAlgorithm,
-  calculateJwkThumbprint
-} from "@openid4vc/oauth2";
-import {
   addSecondsToDate,
+  calculateJwkThumbprint,
   dateToSeconds,
-  parseWithErrorHandling as parseWithErrorHandling2
-} from "@pagopa/io-wallet-utils";
-
-// src/common/jwt/decode-jwt-header.ts
-import { Oauth2JwtParseError } from "@openid4vc/oauth2";
-import {
-  decodeBase64,
-  encodeToUtf8String,
-  formatError,
-  parseWithErrorHandling,
-  stringToJsonWithErrorHandling
+  jwtHeaderFromJwtSigner,
+  parseWithErrorHandling
 } from "@pagopa/io-wallet-utils";
 
-// src/common/jwt/z-jwt.ts
-import z3 from "zod";
-
-// src/common/jwk/z-jwk.ts
-import z2 from "zod";
-
-// src/common/z-common.ts
-import z from "zod";
-var zTrustChain = z.tuple([z.string()], z.string());
-var zCertificateChain = z.array(z.string()).nonempty();
-var zAlgValueNotNone = z.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
-
-// src/common/jwk/z-jwk.ts
-var zJwk = z2.looseObject({
-  alg: z2.optional(z2.string()),
-  crv: z2.optional(z2.string()),
-  d: z2.optional(z2.string()),
-  dp: z2.optional(z2.string()),
-  dq: z2.optional(z2.string()),
-  e: z2.optional(z2.string()),
-  ext: z2.optional(z2.boolean()),
-  k: z2.optional(z2.string()),
-  key_ops: z2.optional(z2.array(z2.string())),
-  kid: z2.optional(z2.string()),
-  kty: z2.string(),
-  n: z2.optional(z2.string()),
-  oth: z2.optional(
-    z2.array(
-      z2.looseObject({
-        d: z2.optional(z2.string()),
-        r: z2.optional(z2.string()),
-        t: z2.optional(z2.string())
-      })
-    )
-  ),
-  p: z2.optional(z2.string()),
-  q: z2.optional(z2.string()),
-  qi: z2.optional(z2.string()),
-  use: z2.optional(z2.string()),
-  x: z2.optional(z2.string()),
-  x5c: z2.optional(zCertificateChain),
-  x5t: z2.optional(z2.string()),
-  "x5t#S256": z2.optional(z2.string()),
-  x5u: z2.optional(z2.string()),
-  y: z2.optional(z2.string())
-});
-var zJwkSet = z2.looseObject({ keys: z2.array(zJwk) });
-
-// src/common/jwt/z-jwt.ts
-var MAX_JTI_LENGTH = 256;
-var zCompactJwt = z3.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
-  message: "Not a valid compact jwt"
-});
-var zJwtConfirmationPayload = z3.looseObject({
-  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
-  jkt: z3.string().optional(),
-  jwk: zJwk.optional()
-});
-var zJwtPayload = z3.looseObject({
-  aud: z3.string().optional(),
-  cnf: zJwtConfirmationPayload.optional(),
-  exp: z3.number().int().optional(),
-  iat: z3.number().int().optional(),
-  iss: z3.string().optional(),
-  jti: z3.string().max(MAX_JTI_LENGTH).optional(),
-  nbf: z3.number().int().optional(),
-  nonce: z3.string().optional(),
-  // Reserved for status parameters
-  status: z3.record(z3.string(), z3.any()).optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional()
-});
-var zJwtHeader = z3.looseObject({
-  alg: zAlgValueNotNone,
-  jwk: zJwk.optional(),
-  kid: z3.string().optional(),
-  // Reserved for OpenID Federation
-  trust_chain: zTrustChain.optional(),
-  typ: z3.string().optional(),
-  x5c: zCertificateChain.optional()
-});
-
-// src/common/jwt/decode-jwt-header.ts
-function decodeJwtHeader(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length <= 2) {
-    throw new Oauth2JwtParseError(
-      formatError(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const [headerPart] = jwtParts;
-  let headerJson;
-  try {
-    headerJson = stringToJsonWithErrorHandling(
-      encodeToUtf8String(decodeBase64(headerPart)),
-      formatError(
-        "Unable to parse jwt header to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new Oauth2JwtParseError(
-      formatError(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const header = parseWithErrorHandling(
-    options.headerSchema ?? zJwtHeader,
-    headerJson,
-    formatError("Invalid JWT header", options.errorMessagePrefix)
-  );
-  return {
-    header
-  };
-}
-function jwtHeaderFromJwtSigner(signer) {
-  if (signer.method === "did") {
-    return {
-      alg: signer.alg,
-      kid: signer.didUrl
-    };
-  }
-  if (signer.method === "federation") {
-    return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain
-    };
-  }
-  if (signer.method === "jwk") {
-    return {
-      alg: signer.alg,
-      jwk: signer.publicJwk
-    };
-  }
-  if (signer.method === "x5c") {
-    return {
-      alg: signer.alg,
-      kid: signer.kid,
-      trust_chain: signer.trustChain,
-      x5c: signer.x5c
-    };
-  }
-  return { alg: signer.alg };
-}
-
 // src/errors.ts
 var Oauth2Error = class extends Error {
   statusCode;
   constructor(message, options) {
-    super(message, options);
+    const errorMessage = message ?? "Unknown error occurred.";
+    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${String(options.cause)}` : "";
+    super(`${errorMessage}${causeMessage}`, options);
     this.name = "Oauth2Error";
     this.statusCode = options?.statusCode;
   }
@@ -234,70 +74,75 @@ var ClientAttestationError = class extends Oauth2Error {
 };
 
 // src/access-token/z-token.ts
-import { z as z4 } from "zod";
-var zAccessTokenRequest = z4.discriminatedUnion("grant_type", [
-  z4.object({
-    code: z4.string().nonempty(),
-    code_verifier: z4.string().nonempty(),
-    grant_type: z4.literal("authorization_code"),
-    redirect_uri: z4.string().nonempty()
+import {
+  MAX_JTI_LENGTH,
+  zJwtHeader,
+  zJwtPayload
+} from "@pagopa/io-wallet-utils";
+import { z } from "zod";
+var zAccessTokenRequest = z.discriminatedUnion("grant_type", [
+  z.object({
+    code: z.string().nonempty(),
+    code_verifier: z.string().nonempty(),
+    grant_type: z.literal("authorization_code"),
+    redirect_uri: z.string().nonempty()
   }),
-  z4.object({
-    grant_type: z4.literal("refresh_token"),
-    refresh_token: z4.string().nonempty(),
-    scope: z4.string().optional()
+  z.object({
+    grant_type: z.literal("refresh_token"),
+    refresh_token: z.string().nonempty(),
+    scope: z.string().optional()
   })
 ]);
-var zAccessTokenResponse = z4.looseObject({
-  access_token: z4.string(),
-  authorization_details: z4.array(
-    z4.looseObject({
-      credential_configuration_id: z4.optional(z4.string()),
-      credential_identifiers: z4.optional(z4.array(z4.string())),
-      type: z4.literal("openid_credential")
+var zAccessTokenResponse = z.looseObject({
+  access_token: z.string(),
+  authorization_details: z.array(
+    z.looseObject({
+      credential_configuration_id: z.optional(z.string()),
+      credential_identifiers: z.optional(z.array(z.string())),
+      type: z.literal("openid_credential")
     })
   ).optional(),
-  expires_in: z4.optional(z4.number().int()),
-  refresh_token: z4.optional(z4.string()),
-  token_type: z4.union([z4.literal("Bearer"), z4.literal("DPoP")])
+  expires_in: z.optional(z.number().int()),
+  refresh_token: z.optional(z.string()),
+  token_type: z.union([z.literal("Bearer"), z.literal("DPoP")])
 });
-var zAccessTokenProfileJwtHeader = z4.looseObject({
+var zAccessTokenProfileJwtHeader = z.looseObject({
   ...zJwtHeader.shape,
-  typ: z4.enum(["application/at+jwt", "at+jwt"])
+  typ: z.enum(["application/at+jwt", "at+jwt"])
 });
-var zAccessTokenProfileJwtPayload = z4.looseObject({
+var zAccessTokenProfileJwtPayload = z.looseObject({
   ...zJwtPayload.shape,
-  aud: z4.string(),
-  client_id: z4.string(),
-  cnf: z4.object({
-    jkt: z4.string()
+  aud: z.string(),
+  client_id: z.string(),
+  cnf: z.object({
+    jkt: z.string()
   }).optional(),
-  exp: z4.number(),
-  iat: z4.number(),
-  iss: z4.string(),
-  jti: z4.string().max(MAX_JTI_LENGTH),
-  nbf: z4.number().optional(),
-  scope: z4.string().optional(),
-  sub: z4.string()
+  exp: z.number(),
+  iat: z.number(),
+  iss: z.string(),
+  jti: z.string().max(MAX_JTI_LENGTH),
+  nbf: z.number().optional(),
+  scope: z.string().optional(),
+  sub: z.string()
 });
-var zRefreshTokenProfileJwtHeader = z4.looseObject({
+var zRefreshTokenProfileJwtHeader = z.looseObject({
   ...zJwtHeader.shape,
-  kid: z4.string(),
-  typ: z4.literal("rt+jwt")
+  kid: z.string(),
+  typ: z.literal("rt+jwt")
 });
-var zRefreshTokenProfileJwtPayload = z4.looseObject({
+var zRefreshTokenProfileJwtPayload = z.looseObject({
   ...zJwtPayload.shape,
-  aud: z4.string(),
-  client_id: z4.string(),
-  cnf: z4.object({
-    jkt: z4.string()
+  aud: z.string(),
+  client_id: z.string(),
+  cnf: z.object({
+    jkt: z.string()
   }),
-  exp: z4.number().int(),
-  iat: z4.number().int(),
-  iss: z4.string(),
-  jti: z4.string().max(MAX_JTI_LENGTH),
-  nbf: z4.number().int(),
-  sub: z4.string()
+  exp: z.number().int(),
+  iat: z.number().int(),
+  iss: z.string(),
+  jti: z.string().max(MAX_JTI_LENGTH),
+  nbf: z.number().int(),
+  sub: z.string()
 });
 
 // src/access-token/create-token-response.ts
@@ -353,11 +198,11 @@ async function createAccessTokenResponse(options) {
       now,
       options.expiresInSeconds
     );
-    const header = parseWithErrorHandling2(zAccessTokenProfileJwtHeader, {
+    const header = parseWithErrorHandling(zAccessTokenProfileJwtHeader, {
       ...jwtHeaderFromJwtSigner(options.signer),
       typ: "at+jwt"
     });
-    const payload = parseWithErrorHandling2(zAccessTokenProfileJwtPayload, {
+    const payload = parseWithErrorHandling(zAccessTokenProfileJwtPayload, {
       ...options.additionalPayload,
       aud: options.audience,
       client_id: options.clientId,
@@ -382,7 +227,7 @@ async function createAccessTokenResponse(options) {
           "Unable to resolve a kid for the Refresh Token JOSE header. Provide signer.kid or a publicJwk.kid."
         );
       }
-      const refreshTokenHeader = parseWithErrorHandling2(
+      const refreshTokenHeader = parseWithErrorHandling(
         zRefreshTokenProfileJwtHeader,
         {
           alg: options.signer.alg,
@@ -390,7 +235,7 @@ async function createAccessTokenResponse(options) {
           typ: "rt+jwt"
         }
       );
-      const refreshTokenPayload = parseWithErrorHandling2(
+      const refreshTokenPayload = parseWithErrorHandling(
         zRefreshTokenProfileJwtPayload,
         {
           aud: options.authorizationServer,
@@ -415,7 +260,7 @@ async function createAccessTokenResponse(options) {
       );
       refreshToken = refreshTokenSignResult.jwt;
     }
-    const accessTokenResponse = parseWithErrorHandling2(zAccessTokenResponse, {
+    const accessTokenResponse = parseWithErrorHandling(zAccessTokenResponse, {
       ...options.additionalPayload,
       access_token: jwt,
       expires_in: options.expiresInSeconds,
@@ -441,7 +286,7 @@ import {
   ValidationError,
   createFetcher,
   hasStatusOrThrow,
-  parseWithErrorHandling as parseWithErrorHandling3
+  parseWithErrorHandling as parseWithErrorHandling2
 } from "@pagopa/io-wallet-utils";
 async function fetchTokenResponse(options) {
   try {
@@ -457,7 +302,7 @@ async function fetchTokenResponse(options) {
       method: "POST"
     });
     await hasStatusOrThrow(200, UnexpectedStatusCodeError)(tokenResponse);
-    return parseWithErrorHandling3(
+    return parseWithErrorHandling2(
       zAccessTokenResponse,
       await tokenResponse.json(),
       "Failed to parse token response"
@@ -489,98 +334,29 @@ import {
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/wallet-attestation.ts
-import { zCompactJwt as zCompactJwt2 } from "@openid4vc/oauth2";
 import {
   ItWalletSpecsVersion,
-  createVersionDispatcher
+  createVersionDispatcher,
+  zCompactJwt
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/types.ts
-import z5 from "zod";
-var zOauthClientAttestationHeader = z5.literal(
+import z2 from "zod";
+var zOauthClientAttestationHeader = z2.literal(
   "OAuth-Client-Attestation"
 );
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = z5.literal(
+var zOauthClientAttestationPopHeader = z2.literal(
   "OAuth-Client-Attestation-PoP"
 );
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
 
 // src/client-attestation/verify-wallet-attestation-jwt-base.ts
-import { jwtSignerFromJwt, verifyJwt } from "@openid4vc/oauth2";
-
-// src/common/jwt/decode-jwt.ts
-import { Oauth2JwtParseError as Oauth2JwtParseError2 } from "@openid4vc/oauth2";
 import {
-  decodeBase64 as decodeBase642,
-  encodeToUtf8String as encodeToUtf8String2,
-  formatError as formatError2,
-  parseWithErrorHandling as parseWithErrorHandling4,
-  stringToJsonWithErrorHandling as stringToJsonWithErrorHandling2
+  decodeJwt,
+  jwtSignerFromJwt,
+  verifyJwt
 } from "@pagopa/io-wallet-utils";
-function decodeJwt(options) {
-  const jwtParts = options.jwt.split(".");
-  if (jwtParts.length !== 3) {
-    throw new Oauth2JwtParseError2(
-      formatError2(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  let payloadJson;
-  try {
-    const payloadPart = jwtParts[1];
-    if (payloadPart === void 0) {
-      throw new Oauth2JwtParseError2(
-        formatError2(
-          "Unable to decode because Jwt is not a valid!",
-          options.errorMessagePrefix
-        )
-      );
-    }
-    payloadJson = stringToJsonWithErrorHandling2(
-      encodeToUtf8String2(decodeBase642(payloadPart)),
-      formatError2(
-        "Unable to parse jwt payload to JSON",
-        options.errorMessagePrefix
-      )
-    );
-  } catch (error) {
-    throw new Oauth2JwtParseError2(
-      formatError2(
-        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const signaturePart = jwtParts[2];
-  if (signaturePart === void 0) {
-    throw new Oauth2JwtParseError2(
-      formatError2(
-        "Unable to decode because Jwt is not a valid!",
-        options.errorMessagePrefix
-      )
-    );
-  }
-  const { header } = decodeJwtHeader({
-    errorMessagePrefix: options.errorMessagePrefix,
-    headerSchema: options.headerSchema,
-    jwt: options.jwt
-  });
-  const payload = parseWithErrorHandling4(
-    options.payloadSchema ?? zJwtPayload,
-    payloadJson,
-    formatError2("Invalid JWT payload", options.errorMessagePrefix)
-  );
-  return {
-    header,
-    payload,
-    signature: signaturePart
-  };
-}
-
-// src/client-attestation/verify-wallet-attestation-jwt-base.ts
 async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
   const { header, payload } = decodeJwt({
     errorMessagePrefix: "Error decoding wallet attestation JWT:",
@@ -601,27 +377,33 @@ async function verifyWalletAttestationBase(options, headerSchema, payloadSchema)
 }
 
 // src/client-attestation/v1.0/z-wallet-attestation.ts
-import { z as z6 } from "zod";
-var zWalletAttestationJwtHeaderV1_0 = z6.looseObject({
-  ...zJwtHeader.shape,
+import {
+  zJwk,
+  zJwtHeader as zJwtHeader2,
+  zJwtPayload as zJwtPayload2,
+  zTrustChain
+} from "@pagopa/io-wallet-utils";
+import { z as z3 } from "zod";
+var zWalletAttestationJwtHeaderV1_0 = z3.looseObject({
+  ...zJwtHeader2.shape,
   trust_chain: zTrustChain,
   // REQUIRED in v1.0
-  typ: z6.literal("oauth-client-attestation+jwt")
+  typ: z3.literal("oauth-client-attestation+jwt")
 });
-var zWalletAttestationJwtPayloadV1_0 = z6.looseObject({
-  ...zJwtPayload.shape,
-  aal: z6.string(),
-  cnf: z6.object({
+var zWalletAttestationJwtPayloadV1_0 = z3.looseObject({
+  ...zJwtPayload2.shape,
+  aal: z3.string(),
+  cnf: z3.object({
     jwk: zJwk
   }),
-  exp: z6.number(),
-  iat: z6.number(),
-  iss: z6.string(),
-  sub: z6.string(),
-  wallet_link: z6.url().optional(),
-  wallet_name: z6.string().optional()
+  exp: z3.number(),
+  iat: z3.number(),
+  iss: z3.string(),
+  sub: z3.string(),
+  wallet_link: z3.url().optional(),
+  wallet_name: z3.string().optional()
 });
-var zWalletAttestationJwtV1_0 = z6.string().min(1);
+var zWalletAttestationJwtV1_0 = z3.string().min(1);
 
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
@@ -633,37 +415,44 @@ async function verifyWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.3/z-wallet-attestation.ts
-import { z as z7 } from "zod";
-var zWalletAttestationJwtHeaderV1_3 = z7.looseObject({
-  ...zJwtHeader.shape,
-  trust_chain: zTrustChain.optional(),
+import {
+  zCertificateChain,
+  zJwk as zJwk2,
+  zJwtHeader as zJwtHeader3,
+  zJwtPayload as zJwtPayload3,
+  zTrustChain as zTrustChain2
+} from "@pagopa/io-wallet-utils";
+import { z as z4 } from "zod";
+var zWalletAttestationJwtHeaderV1_3 = z4.looseObject({
+  ...zJwtHeader3.shape,
+  trust_chain: zTrustChain2.optional(),
   // OPTIONAL in v1.3
-  typ: z7.literal("oauth-client-attestation+jwt"),
+  typ: z4.literal("oauth-client-attestation+jwt"),
   x5c: zCertificateChain
   // REQUIRED in v1.3
 });
-var zWalletAttestationJwtPayloadV1_3 = z7.looseObject({
-  ...zJwtPayload.shape,
-  cnf: z7.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_3 = z4.looseObject({
+  ...zJwtPayload3.shape,
+  cnf: z4.object({
+    jwk: zJwk2
   }),
-  exp: z7.number(),
-  iat: z7.number(),
-  iss: z7.string(),
-  nbf: z7.number().optional(),
+  exp: z4.number(),
+  iat: z4.number(),
+  iss: z4.string(),
+  nbf: z4.number().optional(),
   // NEW in v1.3
-  status: z7.object({
-    status_list: z7.object({
-      idx: z7.number().int(),
-      uri: z7.string()
+  status: z4.object({
+    status_list: z4.object({
+      idx: z4.number().int(),
+      uri: z4.string()
     })
   }).optional(),
   // NEW in v1.3 - status object for revocation
-  sub: z7.string(),
-  wallet_link: z7.url().optional(),
-  wallet_name: z7.string().optional()
+  sub: z4.string(),
+  wallet_link: z4.url().optional(),
+  wallet_name: z4.string().optional()
 });
-var zWalletAttestationJwtV1_3 = z7.string().min(1);
+var zWalletAttestationJwtV1_3 = z4.string().min(1);
 
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
@@ -675,28 +464,35 @@ async function verifyWalletAttestationJwt2(options) {
 }
 
 // src/client-attestation/v1.4/z-wallet-attestation.ts
-import { z as z8 } from "zod";
-var zWalletAttestationJwtHeaderV1_4 = z8.looseObject({
-  ...zJwtHeader.shape,
-  kid: z8.string(),
-  trust_chain: zTrustChain.optional(),
-  typ: z8.literal("oauth-client-attestation+jwt"),
-  x5c: zCertificateChain
+import {
+  zCertificateChain as zCertificateChain2,
+  zJwk as zJwk3,
+  zJwtHeader as zJwtHeader4,
+  zJwtPayload as zJwtPayload4,
+  zTrustChain as zTrustChain3
+} from "@pagopa/io-wallet-utils";
+import { z as z5 } from "zod";
+var zWalletAttestationJwtHeaderV1_4 = z5.looseObject({
+  ...zJwtHeader4.shape,
+  kid: z5.string(),
+  trust_chain: zTrustChain3.optional(),
+  typ: z5.literal("oauth-client-attestation+jwt"),
+  x5c: zCertificateChain2
 });
-var zWalletAttestationJwtPayloadV1_4 = z8.looseObject({
-  ...zJwtPayload.shape,
-  cnf: z8.object({
-    jwk: zJwk
+var zWalletAttestationJwtPayloadV1_4 = z5.looseObject({
+  ...zJwtPayload4.shape,
+  cnf: z5.object({
+    jwk: zJwk3
   }),
-  exp: z8.number().int(),
-  iat: z8.number().int(),
-  iss: z8.string(),
-  nbf: z8.number().optional(),
-  sub: z8.string(),
-  wallet_link: z8.url(),
-  wallet_name: z8.string()
+  exp: z5.number().int(),
+  iat: z5.number().int(),
+  iss: z5.string(),
+  nbf: z5.number().optional(),
+  sub: z5.string(),
+  wallet_link: z5.url(),
+  wallet_name: z5.string()
 });
-var zWalletAttestationJwtV1_4 = z8.string().min(1);
+var zWalletAttestationJwtV1_4 = z5.string().min(1);
 
 // src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt3(options) {
@@ -727,7 +523,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   if (!walletAttestationHeader || !clientAttestationPopHeader) {
     return { valid: false };
   }
-  if (!zCompactJwt2.safeParse(walletAttestationHeader).success || !zCompactJwt2.safeParse(clientAttestationPopHeader).success) {
+  if (!zCompactJwt.safeParse(walletAttestationHeader).success || !zCompactJwt.safeParse(clientAttestationPopHeader).success) {
     return { valid: false };
   }
   return {
@@ -740,14 +536,12 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 // src/token-dpop/create-token-dpop.ts
 import {
   HashAlgorithm as HashAlgorithm2,
-  zCompactJwt as zCompactJwt3
-} from "@openid4vc/oauth2";
-import {
   ValidationError as ValidationError2,
   dateToSeconds as dateToSeconds2,
   decodeUtf8String,
   encodeToBase64Url,
-  parseWithErrorHandling as parseWithErrorHandling5
+  parseWithErrorHandling as parseWithErrorHandling3,
+  zCompactJwt as zCompactJwt2
 } from "@pagopa/io-wallet-utils";
 import { Base64 } from "js-base64";
 
@@ -760,20 +554,26 @@ var htuFromRequestUrl = (requestUrl) => {
 };
 
 // src/token-dpop/z-dpop.ts
-import { zHttpMethod } from "@pagopa/io-wallet-utils";
-import z9 from "zod";
-var zDpopJwtPayload = z9.looseObject({
-  ...zJwtPayload.shape,
-  ath: z9.optional(z9.string()),
+import {
+  MAX_JTI_LENGTH as MAX_JTI_LENGTH2,
+  zHttpMethod,
+  zJwk as zJwk4,
+  zJwtHeader as zJwtHeader5,
+  zJwtPayload as zJwtPayload5
+} from "@pagopa/io-wallet-utils";
+import z6 from "zod";
+var zDpopJwtPayload = z6.looseObject({
+  ...zJwtPayload5.shape,
+  ath: z6.optional(z6.string()),
   htm: zHttpMethod,
-  htu: z9.url(),
-  iat: z9.number().int().nonnegative(),
-  jti: z9.string().max(MAX_JTI_LENGTH)
+  htu: z6.url(),
+  iat: z6.number().int().nonnegative(),
+  jti: z6.string().max(MAX_JTI_LENGTH2)
 });
-var zDpopJwtHeader = z9.looseObject({
-  ...zJwtHeader.shape,
-  jwk: zJwk,
-  typ: z9.literal("dpop+jwt")
+var zDpopJwtHeader = z6.looseObject({
+  ...zJwtHeader5.shape,
+  jwk: zJwk4,
+  typ: z6.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
@@ -794,12 +594,12 @@ async function createTokenDPoP(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const header = parseWithErrorHandling5(zDpopJwtHeader, {
+    const header = parseWithErrorHandling3(zDpopJwtHeader, {
       alg: options.signer.alg,
       jwk: options.signer.publicJwk,
       typ: "dpop+jwt"
     });
-    const payload = parseWithErrorHandling5(zDpopJwtPayload, {
+    const payload = parseWithErrorHandling3(zDpopJwtPayload, {
       ath,
       htm: options.tokenRequest.method,
       htu: htuFromRequestUrl(options.tokenRequest.url),
@@ -824,17 +624,17 @@ function extractDpopJwtFromHeaders(headers) {
   if (!dpopJwt) {
     return { valid: true };
   }
-  if (!zCompactJwt3.safeParse(dpopJwt).success) {
+  if (!zCompactJwt2.safeParse(dpopJwt).success) {
     return { valid: false };
   }
   return { dpopJwt, valid: true };
 }
 
 // src/access-token/z-grant-type.ts
-import { z as z10 } from "zod";
-var zAuthorizationCodeGrantIdentifier = z10.literal("authorization_code");
+import { z as z7 } from "zod";
+var zAuthorizationCodeGrantIdentifier = z7.literal("authorization_code");
 var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = z10.literal("refresh_token");
+var zRefreshTokenGrantIdentifier = z7.literal("refresh_token");
 var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
 // src/access-token/parse-token-request.ts
@@ -915,42 +715,48 @@ function parseSecurityHeaders(headers) {
 import {
   HashAlgorithm as HashAlgorithm3,
   calculateJwkThumbprint as calculateJwkThumbprint2
-} from "@openid4vc/oauth2";
+} from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/client-attestation-pop.ts
-import { verifyJwt as verifyJwt2 } from "@openid4vc/oauth2";
 import {
   ItWalletSpecsVersion as ItWalletSpecsVersion2,
   addSecondsToDate as addSecondsToDate2,
   dateToSeconds as dateToSeconds3,
+  decodeJwt as decodeJwt2,
   encodeToBase64Url as encodeToBase64Url2,
-  parseWithErrorHandling as parseWithErrorHandling6
+  parseWithErrorHandling as parseWithErrorHandling4,
+  verifyJwt as verifyJwt2
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/z-client-attestation-pop.ts
-import z11 from "zod";
+import {
+  MAX_JTI_LENGTH as MAX_JTI_LENGTH3,
+  zJwtHeader as zJwtHeader6,
+  zJwtPayload as zJwtPayload6
+} from "@pagopa/io-wallet-utils";
+import z8 from "zod";
 var IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES = [
   "ES256",
   "ES384",
   "ES512"
 ];
-var zItWalletClientAttestationPopJwtAlg = z11.enum(
+var zItWalletClientAttestationPopJwtAlg = z8.enum(
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES
 );
-var zItWalletClientAttestationPopJwtPayload = z11.looseObject({
-  ...zJwtPayload.shape,
-  aud: z11.string(),
-  exp: z11.number().int().optional(),
-  iat: z11.number().int(),
-  iss: z11.string(),
-  jti: z11.string().max(MAX_JTI_LENGTH),
-  nonce: z11.string().optional()
+var zItWalletClientAttestationPopJwtPayload = z8.looseObject({
+  ...zJwtPayload6.shape,
+  aud: z8.string(),
+  exp: z8.number().int().optional(),
+  iat: z8.number().int(),
+  iss: z8.string(),
+  jti: z8.string().max(MAX_JTI_LENGTH3),
+  nonce: z8.string().optional()
 });
-var zItWalletClientAttestationPopJwtTyp = z11.literal(
+var zItWalletClientAttestationPopJwtTyp = z8.literal(
   "oauth-client-attestation-pop+jwt"
 );
-var zItWalletClientAttestationPopJwtHeader = z11.looseObject({
-  ...zJwtHeader.shape,
+var zItWalletClientAttestationPopJwtHeader = z8.looseObject({
+  ...zJwtHeader6.shape,
   typ: zItWalletClientAttestationPopJwtTyp
 });
 
@@ -964,7 +770,7 @@ function assertSupportedClientAttestationPopAlg(alg) {
 }
 async function verifyClientAttestationPopJwt(options) {
   try {
-    const { header, payload } = decodeJwt({
+    const { header, payload } = decodeJwt2({
       errorMessagePrefix: "Error decoding client attestation PoP JWT:",
       headerSchema: zItWalletClientAttestationPopJwtHeader,
       jwt: options.clientAttestationPopJwt,
@@ -1000,7 +806,7 @@ async function verifyClientAttestationPopJwt(options) {
 }
 async function createClientAttestationPopJwt(options) {
   try {
-    const clientAttestation = decodeJwt({
+    const clientAttestation = decodeJwt2({
       errorMessagePrefix: "Error decoding client attestation JWT:",
       jwt: options.clientAttestation
     });
@@ -1033,7 +839,7 @@ async function createClientAttestationPopJwt(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const payload = parseWithErrorHandling6(
+    const payload = parseWithErrorHandling4(
       zItWalletClientAttestationPopJwtPayload,
       {
         aud: options.authorizationServer,
@@ -1106,9 +912,10 @@ async function verifyClientAttestation(options) {
 
 // src/pkce.ts
 import {
-  HashAlgorithm as HashAlgorithm4
-} from "@openid4vc/oauth2";
-import { decodeUtf8String as decodeUtf8String2, encodeToBase64Url as encodeToBase64Url3 } from "@pagopa/io-wallet-utils";
+  HashAlgorithm as HashAlgorithm4,
+  decodeUtf8String as decodeUtf8String2,
+  encodeToBase64Url as encodeToBase64Url3
+} from "@pagopa/io-wallet-utils";
 var PkceCodeChallengeMethod = {
   Plain: "plain",
   S256: "S256"
@@ -1170,15 +977,14 @@ async function calculateCodeChallenge(options) {
 import {
   HashAlgorithm as HashAlgorithm5,
   calculateJwkThumbprint as calculateJwkThumbprint3,
-  verifyJwt as verifyJwt3
-} from "@openid4vc/oauth2";
-import {
+  decodeJwt as decodeJwt3,
   decodeUtf8String as decodeUtf8String3,
   encodeToBase64Url as encodeToBase64Url4,
+  verifyJwt as verifyJwt3,
   verifyJwtIatOrThrow
 } from "@pagopa/io-wallet-utils";
 async function verifyTokenDPoP(options) {
-  const { header, payload } = decodeJwt({
+  const { header, payload } = decodeJwt3({
     errorMessagePrefix: "Error decoding access token DPoP JWT:",
     headerSchema: zDpopJwtHeader,
     jwt: options.dpopJwt,
@@ -1328,33 +1134,34 @@ import {
 } from "@pagopa/io-wallet-utils";
 
 // src/authorization-request/z-authorization-request.ts
-import z12 from "zod";
-var zOpenidCredentialAuthorizationDetails = z12.object({
-  credential_configuration_id: z12.string(),
-  type: z12.literal("openid_credential")
+import { MAX_JTI_LENGTH as MAX_JTI_LENGTH4 } from "@pagopa/io-wallet-utils";
+import z9 from "zod";
+var zOpenidCredentialAuthorizationDetails = z9.object({
+  credential_configuration_id: z9.string(),
+  type: z9.literal("openid_credential")
 });
-var zItL2DocumentProofAuthorizationDetails = z12.object({
-  challenge_method: z12.literal("mrtd+ias"),
-  challenge_redirect_uri: z12.url(),
-  idphinting: z12.url(),
-  type: z12.literal("it_l2+document_proof")
+var zItL2DocumentProofAuthorizationDetails = z9.object({
+  challenge_method: z9.literal("mrtd+ias"),
+  challenge_redirect_uri: z9.url(),
+  idphinting: z9.url(),
+  type: z9.literal("it_l2+document_proof")
 });
-var zAuthorizationRequestBaseObject = z12.looseObject({
-  authorization_details: z12.array(
-    z12.discriminatedUnion("type", [
+var zAuthorizationRequestBaseObject = z9.looseObject({
+  authorization_details: z9.array(
+    z9.discriminatedUnion("type", [
       zOpenidCredentialAuthorizationDetails,
       zItL2DocumentProofAuthorizationDetails
     ])
   ).optional(),
-  client_id: z12.string(),
-  code_challenge: z12.string(),
-  code_challenge_method: z12.string(),
-  issuer_state: z12.optional(z12.string()),
-  jti: z12.string().max(MAX_JTI_LENGTH),
-  redirect_uri: z12.url(),
-  response_type: z12.string(),
-  scope: z12.string().optional(),
-  state: z12.string()
+  client_id: z9.string(),
+  code_challenge: z9.string(),
+  code_challenge_method: z9.string(),
+  issuer_state: z9.optional(z9.string()),
+  jti: z9.string().max(MAX_JTI_LENGTH4),
+  redirect_uri: z9.url(),
+  response_type: z9.string(),
+  scope: z9.string().optional(),
+  state: z9.string()
 });
 var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
@@ -1364,7 +1171,7 @@ var zAuthorizationRequestBase = zAuthorizationRequestBaseObject.refine(
   }
 );
 var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
-  response_mode: z12.string()
+  response_mode: z9.string()
 }).refine(
   (data) => data.authorization_details !== void 0 || data.scope !== void 0,
   {
@@ -1373,25 +1180,25 @@ var zAuthorizationRequestV1_0 = zAuthorizationRequestBaseObject.extend({
   }
 );
 var zAuthorizationRequestV1_3 = zAuthorizationRequestBase;
-var zPushedAuthorizationRequestSigned = z12.looseObject({
-  client_id: z12.string().describe(
+var zPushedAuthorizationRequestSigned = z9.looseObject({
+  client_id: z9.string().describe(
     "MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation."
   ),
-  pkceCodeVerifier: z12.string().describe(
+  pkceCodeVerifier: z9.string().describe(
     "Code verifier for PKCE. If not provided in CreatePushedAuthorizationRequestOptions, SDK will generate one."
   ),
-  request: z12.string().describe(
+  request: z9.string().describe(
     "It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Attestation MUST be used for signing the Request Object."
   )
 });
-var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => z12.looseObject({
+var zPushedAuthorizationRequestUnsignedBase = (authorizationRequest) => z9.looseObject({
   authorizationRequest: authorizationRequest.describe(
     "The authorization request parameters as a plain object. Used when require_signed_request_object is false."
   ),
-  client_id: z12.string().describe(
+  client_id: z9.string().describe(
     "Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation."
   ),
-  pkceCodeVerifier: z12.string().describe(
+  pkceCodeVerifier: z9.string().describe(
     "PKCE code verifier. Auto-generated if not provided in options."
   )
 });
@@ -1403,9 +1210,9 @@ function isPushedAuthorizationRequestSigned(par) {
 function isPushedAuthorizationRequestUnsigned(par) {
   return "authorizationRequest" in par;
 }
-var zPushedAuthorizationResponse = z12.looseObject({
-  expires_in: z12.number().int(),
-  request_uri: z12.string()
+var zPushedAuthorizationResponse = z9.looseObject({
+  expires_in: z9.number().int(),
+  request_uri: z9.string()
 });
 
 // src/authorization-request/create-authorization-request.ts
@@ -1581,11 +1388,12 @@ function parseAuthorizationRequest(options) {
 // src/authorization-request/parse-pushed-authorization-request.ts
 import {
   ItWalletSpecsVersion as ItWalletSpecsVersion4,
+  decodeJwt as decodeJwt4,
   dispatchByVersion as dispatchByVersion2,
   formatZodError as formatZodError2,
-  parseWithErrorHandling as parseWithErrorHandling7
+  parseWithErrorHandling as parseWithErrorHandling5
 } from "@pagopa/io-wallet-utils";
-import z14 from "zod";
+import z11 from "zod";
 
 // src/jar/fetch-jar-request-object.ts
 import {
@@ -1651,25 +1459,26 @@ async function parseJarRequest(options) {
 }
 
 // src/jar/z-jar.ts
-import z13 from "zod";
-var zJarAuthorizationRequest = z13.looseObject({
-  client_id: z13.optional(z13.string()),
-  request: z13.optional(z13.string()),
-  request_uri: z13.url().optional()
+import { zJwtHeader as zJwtHeader7, zJwtPayload as zJwtPayload7 } from "@pagopa/io-wallet-utils";
+import z10 from "zod";
+var zJarAuthorizationRequest = z10.looseObject({
+  client_id: z10.optional(z10.string()),
+  request: z10.optional(z10.string()),
+  request_uri: z10.url().optional()
 });
-var zJarRequestObjectPayload = z13.looseObject({
-  ...zJwtPayload.shape,
-  client_id: z13.string()
+var zJarRequestObjectPayload = z10.looseObject({
+  ...zJwtPayload7.shape,
+  client_id: z10.string()
 });
-var zSignedAuthorizationRequestJwtHeaderTyp = z13.literal(
+var zSignedAuthorizationRequestJwtHeaderTyp = z10.literal(
   "oauth-authz-req+jwt"
 );
-var zJarRequestObjectHeader = z13.looseObject({
-  ...zJwtHeader.shape,
+var zJarRequestObjectHeader = z10.looseObject({
+  ...zJwtHeader7.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
-var zJwtAuthorizationRequestJwtHeaderTyp = z13.literal("jwt");
+var zJwtAuthorizationRequestJwtHeaderTyp = z10.literal("jwt");
 var jwtAuthorizationRequestJwtHeaderTyp = zJwtAuthorizationRequestJwtHeaderTyp.value;
 
 // src/authorization-request/parse-pushed-authorization-request.ts
@@ -1677,8 +1486,8 @@ async function parsePushedAuthorizationRequest(options) {
   const authorizationRequestSchema = getAuthorizationRequestSchema(
     options.config
   );
-  const parsed = parseWithErrorHandling7(
-    z14.union([authorizationRequestSchema, zJarAuthorizationRequest]),
+  const parsed = parseWithErrorHandling5(
+    z11.union([authorizationRequestSchema, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
   );
@@ -1689,7 +1498,7 @@ async function parsePushedAuthorizationRequest(options) {
       callbacks: options.callbacks,
       jarRequestParams: parsed
     });
-    const jwt = decodeJwt({
+    const jwt = decodeJwt4({
       errorMessagePrefix: "Error decoding pushed authorization request JWT:",
       jwt: parsedJar.authorizationRequestJwt
     });
@@ -1779,13 +1588,17 @@ async function verifyAuthorizationRequestDpop(options, request, callbacks, now)
   };
 }
 
+// src/authorization-request/verify-pushed-authorization-request.ts
+import { decodeJwt as decodeJwt6 } from "@pagopa/io-wallet-utils";
+
 // src/jar/verify-jar-request.ts
 import {
+  decodeJwt as decodeJwt5,
+  parseWithErrorHandling as parseWithErrorHandling6,
   verifyJwt as verifyJwt4,
   zCompactJwe,
-  zCompactJwt as zCompactJwt4
-} from "@openid4vc/oauth2";
-import { parseWithErrorHandling as parseWithErrorHandling8 } from "@pagopa/io-wallet-utils";
+  zCompactJwt as zCompactJwt3
+} from "@pagopa/io-wallet-utils";
 async function verifyJarRequest(options) {
   const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
   const requestObjectIsEncrypted = zCompactJwe.safeParse(
@@ -1794,7 +1607,7 @@ async function verifyJarRequest(options) {
   if (requestObjectIsEncrypted) {
     throw new Oauth2Error("Encrypted JWE request objects are not supported.");
   }
-  const requestIsSigned = zCompactJwt4.safeParse(
+  const requestIsSigned = zCompactJwt3.safeParse(
     authorizationRequestJwt
   ).success;
   if (!requestIsSigned) {
@@ -1847,11 +1660,11 @@ async function verifyJarRequest(options) {
 }
 async function verifyJarRequestObject(options) {
   const { authorizationRequestJwt, callbacks, jwtSigner } = options;
-  const jwt = decodeJwt({
+  const jwt = decodeJwt5({
     errorMessagePrefix: "Error decoding JAR authorization request JWT:",
     jwt: authorizationRequestJwt
   });
-  const authorizationRequestPayload = parseWithErrorHandling8(
+  const authorizationRequestPayload = parseWithErrorHandling6(
     zJarRequestObjectPayload,
     jwt.payload
   );
@@ -1888,7 +1701,7 @@ async function verifyPushedAuthorizationRequest(options) {
   let jar;
   if (options.authorizationRequestJwt) {
     if (requireSigned) {
-      const decoded = decodeJwt({
+      const decoded = decodeJwt6({
         errorMessagePrefix: "Error decoding pushed authorization request JWT:",
         jwt: options.authorizationRequestJwt.jwt
       });
@@ -1980,14 +1793,15 @@ function clientAuthenticationWalletAttestationJwt(options) {
 import {
   ValidationError as ValidationError4,
   addSecondsToDate as addSecondsToDate4,
-  dateToSeconds as dateToSeconds5
+  dateToSeconds as dateToSeconds5,
+  decodeJwt as decodeJwt7
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/jwk-thumbprint.ts
 import {
   HashAlgorithm as HashAlgorithm6,
   calculateJwkThumbprint as calculateJwkThumbprint4
-} from "@openid4vc/oauth2";
+} from "@pagopa/io-wallet-utils";
 var SUPPORTED_KTY = ["RSA", "EC"];
 var calculateDpopJwkThumbprint = (options) => {
   if (!SUPPORTED_KTY.includes(
@@ -2031,7 +1845,7 @@ var createWalletAttestationJwt = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    decodeJwt7({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_0,
       jwt: result.jwt,
@@ -2052,7 +1866,8 @@ var createWalletAttestationJwt = async (options) => {
 import {
   ValidationError as ValidationError5,
   addSecondsToDate as addSecondsToDate5,
-  dateToSeconds as dateToSeconds6
+  dateToSeconds as dateToSeconds6,
+  decodeJwt as decodeJwt8
 } from "@pagopa/io-wallet-utils";
 var createWalletAttestationJwt2 = async (options) => {
   try {
@@ -2088,7 +1903,7 @@ var createWalletAttestationJwt2 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    decodeJwt8({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_3,
       jwt: result.jwt,
@@ -2109,7 +1924,8 @@ var createWalletAttestationJwt2 = async (options) => {
 import {
   ValidationError as ValidationError6,
   addSecondsToDate as addSecondsToDate6,
-  dateToSeconds as dateToSeconds7
+  dateToSeconds as dateToSeconds7,
+  decodeJwt as decodeJwt9
 } from "@pagopa/io-wallet-utils";
 var DEFAULT_EXPIRATION_SECONDS = 3600;
 var MAX_EXPIRATION_SECONDS = 86400;
@@ -2151,7 +1967,7 @@ var createWalletAttestationJwt3 = async (options) => {
       header,
       payload
     });
-    decodeJwt({
+    decodeJwt9({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_4,
       jwt: result.jwt,
@@ -2168,17 +1984,11 @@ var createWalletAttestationJwt3 = async (options) => {
   }
 };
 
-// src/common/jwt/z-jwe.ts
-import { z as z15 } from "zod";
-var zCompactJwe2 = z15.string().regex(
-  /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
-  {
-    message: "Not a valid compact jwe"
-  }
-);
-
 // src/jar/create-jar-request.ts
-import { addSecondsToDate as addSecondsToDate7, dateToSeconds as dateToSeconds8 } from "@pagopa/io-wallet-utils";
+import {
+  addSecondsToDate as addSecondsToDate7,
+  dateToSeconds as dateToSeconds8
+} from "@pagopa/io-wallet-utils";
 async function createJarRequest(options) {
   const {
     authorizationRequestHeader,
@@ -2225,6 +2035,7 @@ async function createJarRequest(options) {
 }
 
 // src/jarm-form-post-jwt.ts
+import { decodeJwt as decodeJwt10 } from "@pagopa/io-wallet-utils";
 var getJwtFromFormPost = async (options) => {
   const inputRegex = /<input[^<>]*>/gi;
   const nameRegex = /name="response"/gi;
@@ -2239,7 +2050,7 @@ var getJwtFromFormPost = async (options) => {
         const responseJwt = matchValue[1];
         if (responseJwt) {
           const jwt = responseJwt.replace(lineExpressionRegex, "");
-          const decodedJwt = decodeJwt({
+          const decodedJwt = decodeJwt10({
             errorMessagePrefix: "Error decoding JARM form post JWT:",
             jwt,
             payloadSchema: options.schema
@@ -2261,73 +2072,76 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-import { dateToSeconds as dateToSeconds9, parseWithErrorHandling as parseWithErrorHandling9 } from "@pagopa/io-wallet-utils";
+import {
+  dateToSeconds as dateToSeconds9,
+  parseWithErrorHandling as parseWithErrorHandling7
+} from "@pagopa/io-wallet-utils";
 
 // src/mrtd-pop/z-mrtd-pop.ts
-import z16 from "zod";
-var zMrtdChallengeJwtHeader = z16.looseObject({
-  alg: z16.string(),
-  kid: z16.string(),
-  typ: z16.literal("mrtd-ias+jwt")
+import z12 from "zod";
+var zMrtdChallengeJwtHeader = z12.looseObject({
+  alg: z12.string(),
+  kid: z12.string(),
+  typ: z12.literal("mrtd-ias+jwt")
 });
-var zMrtdChallengeJwtPayload = z16.looseObject({
-  aud: z16.string(),
-  exp: z16.number(),
-  htm: z16.literal("POST"),
-  htu: z16.url(),
-  iat: z16.number(),
-  iss: z16.string(),
-  mrtd_auth_session: z16.string(),
-  mrtd_pop_jwt_nonce: z16.string(),
-  state: z16.string(),
-  status: z16.literal("require_interaction"),
-  type: z16.literal("mrtd+ias")
+var zMrtdChallengeJwtPayload = z12.looseObject({
+  aud: z12.string(),
+  exp: z12.number(),
+  htm: z12.literal("POST"),
+  htu: z12.url(),
+  iat: z12.number(),
+  iss: z12.string(),
+  mrtd_auth_session: z12.string(),
+  mrtd_pop_jwt_nonce: z12.string(),
+  state: z12.string(),
+  status: z12.literal("require_interaction"),
+  type: z12.literal("mrtd+ias")
 });
-var zMrtdPopInitResponseJwtHeader = z16.looseObject({
-  alg: z16.string(),
-  kid: z16.string(),
-  typ: z16.literal("mrtd-ias-pop+jwt")
+var zMrtdPopInitResponseJwtHeader = z12.looseObject({
+  alg: z12.string(),
+  kid: z12.string(),
+  typ: z12.literal("mrtd-ias-pop+jwt")
 });
-var zMrtdPopInitResponseJwtPayload = z16.looseObject({
-  aud: z16.string(),
-  challenge: z16.string(),
-  exp: z16.number(),
-  htm: z16.literal("POST"),
-  htu: z16.url(),
-  iat: z16.number(),
-  iss: z16.string(),
-  mrtd_pop_nonce: z16.string(),
-  mrz: z16.string().optional()
+var zMrtdPopInitResponseJwtPayload = z12.looseObject({
+  aud: z12.string(),
+  challenge: z12.string(),
+  exp: z12.number(),
+  htm: z12.literal("POST"),
+  htu: z12.url(),
+  iat: z12.number(),
+  iss: z12.string(),
+  mrtd_pop_nonce: z12.string(),
+  mrz: z12.string().optional()
 });
-var zMrtdData = z16.looseObject({
-  dg1: z16.string(),
-  dg11: z16.string(),
-  sod_mrtd: z16.string()
+var zMrtdData = z12.looseObject({
+  dg1: z12.string(),
+  dg11: z12.string(),
+  sod_mrtd: z12.string()
 });
-var zIasData = z16.looseObject({
-  challenge_signed: z16.string(),
-  ias_pk: z16.string(),
-  sod_ias: z16.string()
+var zIasData = z12.looseObject({
+  challenge_signed: z12.string(),
+  ias_pk: z12.string(),
+  sod_ias: z12.string()
 });
-var zMrtdValidationJwtHeader = z16.looseObject({
-  alg: z16.string(),
-  kid: z16.string(),
-  typ: z16.literal("mrtd-ias+jwt")
+var zMrtdValidationJwtHeader = z12.looseObject({
+  alg: z12.string(),
+  kid: z12.string(),
+  typ: z12.literal("mrtd-ias+jwt")
 });
-var zMrtdValidationJwtPayload = z16.looseObject({
-  aud: z16.string(),
-  document_type: z16.literal("cie"),
-  exp: z16.number(),
+var zMrtdValidationJwtPayload = z12.looseObject({
+  aud: z12.string(),
+  document_type: z12.literal("cie"),
+  exp: z12.number(),
   ias: zIasData,
-  iat: z16.number(),
-  iss: z16.string(),
+  iat: z12.number(),
+  iss: z12.string(),
   mrtd: zMrtdData
 });
-var zMrtdPopVerifyResponse = z16.looseObject({
-  mrtd_val_pop_nonce: z16.string(),
-  redirect_uri: z16.url(),
-  status: z16.literal("require_interaction"),
-  type: z16.literal("redirect_to_web")
+var zMrtdPopVerifyResponse = z12.looseObject({
+  mrtd_val_pop_nonce: z12.string(),
+  redirect_uri: z12.url(),
+  status: z12.literal("require_interaction"),
+  type: z12.literal("redirect_to_web")
 });
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
@@ -2339,12 +2153,12 @@ async function createMrtdValidationJwt(options) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
     const iat = dateToSeconds9(options.issuedAt);
-    const header = parseWithErrorHandling9(zMrtdValidationJwtHeader, {
+    const header = parseWithErrorHandling7(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
       typ: "mrtd-ias+jwt"
     });
-    const payload = parseWithErrorHandling9(zMrtdValidationJwtPayload, {
+    const payload = parseWithErrorHandling7(zMrtdValidationJwtPayload, {
       aud: options.audience,
       document_type: "cie",
       exp: iat + JWT_EXPIRY_SECONDS2,
@@ -2377,17 +2191,16 @@ async function createMrtdValidationJwt(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-init.ts
-import {
-  jwtSignerFromJwt as jwtSignerFromJwt2,
-  verifyJwt as verifyJwt5
-} from "@openid4vc/oauth2";
 import {
   CONTENT_TYPES as CONTENT_TYPES3,
   HEADERS as HEADERS3,
   UnexpectedStatusCodeError as UnexpectedStatusCodeError4,
   ValidationError as ValidationError7,
   createFetcher as createFetcher4,
-  hasStatusOrThrow as hasStatusOrThrow4
+  decodeJwt as decodeJwt11,
+  hasStatusOrThrow as hasStatusOrThrow4,
+  jwtSignerFromJwt as jwtSignerFromJwt2,
+  verifyJwt as verifyJwt5
 } from "@pagopa/io-wallet-utils";
 async function fetchMrtdPopInit(options) {
   try {
@@ -2406,7 +2219,7 @@ async function fetchMrtdPopInit(options) {
     });
     await hasStatusOrThrow4(202, UnexpectedStatusCodeError4)(response);
     const responseJwt = await response.text();
-    const jwt = decodeJwt({
+    const jwt = decodeJwt11({
       errorMessagePrefix: "Error decoding MRTD PoP init response JWT:",
       headerSchema: zMrtdPopInitResponseJwtHeader,
       jwt: responseJwt,
@@ -2445,7 +2258,7 @@ import {
   ValidationError as ValidationError8,
   createFetcher as createFetcher5,
   hasStatusOrThrow as hasStatusOrThrow5,
-  parseWithErrorHandling as parseWithErrorHandling10
+  parseWithErrorHandling as parseWithErrorHandling8
 } from "@pagopa/io-wallet-utils";
 async function fetchMrtdPopVerify(options) {
   try {
@@ -2464,7 +2277,7 @@ async function fetchMrtdPopVerify(options) {
       method: "POST"
     });
     await hasStatusOrThrow5(202, UnexpectedStatusCodeError5)(response);
-    const parsed = parseWithErrorHandling10(
+    const parsed = parseWithErrorHandling8(
       zMrtdPopVerifyResponse,
       await response.json(),
       "Failed to parse MRTD PoP verify response"
@@ -2484,7 +2297,7 @@ async function fetchMrtdPopVerify(options) {
 }
 
 // src/mrtd-pop/parse-mrtd-challenge.ts
-import { zCompactJwt as zCompactJwt5 } from "@openid4vc/oauth2";
+import { decodeJwt as decodeJwt12, zCompactJwt as zCompactJwt4 } from "@pagopa/io-wallet-utils";
 function parseMrtdChallenge(options) {
   const url = new URL(options.redirectUrl);
   const challengeJwt = url.searchParams.get("challenge_info");
@@ -2493,12 +2306,12 @@ function parseMrtdChallenge(options) {
       "Missing 'challenge_info' query parameter in redirect URL"
     );
   }
-  if (!zCompactJwt5.safeParse(challengeJwt).success) {
+  if (!zCompactJwt4.safeParse(challengeJwt).success) {
     throw new MrtdPopError(
       "Invalid JWT format in 'challenge_info' query parameter"
     );
   }
-  const { header, payload } = decodeJwt({
+  const { header, payload } = decodeJwt12({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2509,12 +2322,13 @@ function parseMrtdChallenge(options) {
 
 // src/mrtd-pop/verify-mrtd-challenge.ts
 import {
+  decodeJwt as decodeJwt13,
   jwtSignerFromJwt as jwtSignerFromJwt3,
   verifyJwt as verifyJwt6
-} from "@openid4vc/oauth2";
+} from "@pagopa/io-wallet-utils";
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
-  const jwt = decodeJwt({
+  const jwt = decodeJwt13({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2536,24 +2350,14 @@ async function verifyMrtdChallenge(options) {
   });
   return { header: jwt.header, payload: jwt.payload, signer };
 }
-
-// src/index.ts
-import {
-  HashAlgorithm as HashAlgorithm7,
-  Oauth2JwtParseError as Oauth2JwtParseError3,
-  verifyJwt as verifyJwt7
-} from "@openid4vc/oauth2";
 export {
   ClientAttestationError,
   CreateTokenDPoPError,
   CreateTokenResponseError,
   FetchTokenResponseError,
-  HashAlgorithm7 as HashAlgorithm,
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES,
-  MAX_JTI_LENGTH,
   MrtdPopError,
   Oauth2Error,
-  Oauth2JwtParseError3 as Oauth2JwtParseError,
   PkceCodeChallengeMethod,
   PushedAuthorizationRequestError,
   SupportedClientAuthenticationMethod,
@@ -2571,8 +2375,6 @@ export {
   createWalletAttestationJwt as createWalletAttestationJwtV1_0,
   createWalletAttestationJwt2 as createWalletAttestationJwtV1_3,
   createWalletAttestationJwt3 as createWalletAttestationJwtV1_4,
-  decodeJwt,
-  decodeJwtHeader,
   extractClientAttestationJwtsFromHeaders,
   extractDpopJwtFromHeaders,
   fetchJarRequestObject,
@@ -2587,7 +2389,6 @@ export {
   isPushedAuthorizationRequestSigned,
   isPushedAuthorizationRequestUnsigned,
   jwtAuthorizationRequestJwtHeaderTyp,
-  jwtHeaderFromJwtSigner,
   parseAccessTokenRequest,
   parseAuthorizationRequest,
   parseJarRequest,
@@ -2602,7 +2403,6 @@ export {
   verifyClientAttestation,
   verifyClientAttestationPopJwt,
   verifyJarRequest,
-  verifyJwt7 as verifyJwt,
   verifyMrtdChallenge,
   verifyPkce,
   verifyPushedAuthorizationRequest,
@@ -2615,13 +2415,9 @@ export {
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
   zAccessTokenResponse,
-  zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
   zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3,
-  zCertificateChain,
-  zCompactJwe2 as zCompactJwe,
-  zCompactJwt,
   zDpopJwtHeader,
   zDpopJwtPayload,
   zItWalletClientAttestationPopJwtAlg,
@@ -2631,11 +2427,6 @@ export {
   zJarAuthorizationRequest,
   zJarRequestObjectHeader,
   zJarRequestObjectPayload,
-  zJwk,
-  zJwkSet,
-  zJwtConfirmationPayload,
-  zJwtHeader,
-  zJwtPayload,
   zMrtdChallengeJwtHeader,
   zMrtdChallengeJwtPayload,
   zMrtdPopInitResponseJwtHeader,
@@ -2651,7 +2442,6 @@ export {
   zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload,
   zSignedAuthorizationRequestJwtHeaderTyp,
-  zTrustChain,
   zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3,
   zWalletAttestationJwtHeaderV1_4,