@pagopa/io-wallet-oid4vci 1.4.2 → 1.5.0

package/dist/index.js

@@ -59,8 +59,14 @@ __export(index_exports, {
   verifyAuthorizationResponseFormPostJWT: () => verifyAuthorizationResponseFormPostJWT,
   verifyCredentialRequestJwtProof: () => verifyCredentialRequestJwtProof,
   verifyKeyAttestationJwt: () => verifyKeyAttestationJwt,
+  zAuthorizationCodeGrantV1_3: () => zAuthorizationCodeGrantV1_3,
+  zAuthorizationCodeGrantV1_4: () => zAuthorizationCodeGrantV1_4,
   zAuthorizationResponse: () => zAuthorizationResponse,
   zCredentialObject: () => zCredentialObject,
+  zCredentialOfferGrantsV1_3: () => zCredentialOfferGrantsV1_3,
+  zCredentialOfferGrantsV1_4: () => zCredentialOfferGrantsV1_4,
+  zCredentialOfferV1_3: () => zCredentialOfferV1_3,
+  zCredentialOfferV1_4: () => zCredentialOfferV1_4,
   zCredentialRequestV1_0: () => zCredentialRequestV1_0,
   zCredentialRequestV1_3: () => zCredentialRequestV1_3,
   zCredentialResponseEncryption: () => zCredentialResponseEncryption,
@@ -272,7 +278,8 @@ async function sendAuthorizationResponseAndExtractCode(options) {
 }
 
 // src/credential-offer/extract-grant-details.ts
-function extractGrantDetails(credentialOffer) {
+var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
+function requireAuthorizationCodeGrant(credentialOffer) {
   if (!credentialOffer.grants) {
     throw new CredentialOfferError("No grants found in credential offer");
   }
@@ -280,6 +287,10 @@ function extractGrantDetails(credentialOffer) {
   if (!authCodeGrant) {
     throw new CredentialOfferError("authorization_code grant not found");
   }
+  return authCodeGrant;
+}
+function extractGrantDetailsV1_3(options) {
+  const authCodeGrant = requireAuthorizationCodeGrant(options.credentialOffer);
   return {
     authorizationCodeGrant: {
       authorizationServer: authCodeGrant.authorization_server,
@@ -289,10 +300,37 @@ function extractGrantDetails(credentialOffer) {
     grantType: "authorization_code"
   };
 }
+function extractGrantDetailsV1_4(options) {
+  const authCodeGrant = requireAuthorizationCodeGrant(options.credentialOffer);
+  return {
+    authorizationCodeGrant: {
+      authorizationServer: authCodeGrant.authorization_server,
+      issuerState: authCodeGrant.issuer_state
+    },
+    grantType: "authorization_code"
+  };
+}
+var dispatchExtractGrantDetails = (0, import_io_wallet_utils2.createVersionDispatcher)({
+  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_0]: () => {
+    throw new import_io_wallet_utils2.ItWalletSpecsVersionError(
+      "extractGrantDetails",
+      import_io_wallet_utils2.ItWalletSpecsVersion.V1_0,
+      [import_io_wallet_utils2.ItWalletSpecsVersion.V1_3, import_io_wallet_utils2.ItWalletSpecsVersion.V1_4]
+    );
+  },
+  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_3]: (o) => extractGrantDetailsV1_3(o),
+  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_4]: (o) => extractGrantDetailsV1_4(o)
+});
+function extractGrantDetails(options) {
+  return dispatchExtractGrantDetails(options);
+}
 
 // src/credential-offer/z-credential-offer.ts
+var import_zod4 = require("zod");
+
+// src/credential-offer/v1.3/z-credential-offer.ts
 var import_zod2 = require("zod");
-var zAuthorizationCodeGrant = import_zod2.z.object({
+var zAuthorizationCodeGrantV1_3 = import_zod2.z.object({
   /**
    * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
    * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
@@ -310,14 +348,14 @@ var zAuthorizationCodeGrant = import_zod2.z.object({
    */
   scope: import_zod2.z.string()
 });
-var zCredentialOfferGrants = import_zod2.z.object({
+var zCredentialOfferGrantsV1_3 = import_zod2.z.object({
   /**
    * REQUIRED. Authorization Code grant details.
    * IT-Wallet v1.3 only supports authorization_code grant.
    */
-  authorization_code: zAuthorizationCodeGrant
+  authorization_code: zAuthorizationCodeGrantV1_3
 });
-var zCredentialOffer = import_zod2.z.object({
+var zCredentialOfferV1_3 = import_zod2.z.object({
   /**
    * REQUIRED. Array of credential configuration identifiers.
    * References the types of credentials offered as defined in the Credential Issuer metadata.
@@ -332,24 +370,66 @@ var zCredentialOffer = import_zod2.z.object({
    * REQUIRED. Grant information for the credential offer.
    * IT-Wallet v1.3 requires authorization_code grant.
    */
-  grants: zCredentialOfferGrants
+  grants: zCredentialOfferGrantsV1_3
+});
+
+// src/credential-offer/v1.4/z-credential-offer.ts
+var import_zod3 = require("zod");
+var zAuthorizationCodeGrantV1_4 = import_zod3.z.object({
+  /**
+   * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
+   * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
+   * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
+   */
+  authorization_server: import_zod3.z.url().optional(),
+  /**
+   * OPTIONAL. String value representing the issuer state.
+   * Used to correlate the authorization request with the credential offer.
+   */
+  issuer_state: import_zod3.z.string().optional()
+});
+var zCredentialOfferGrantsV1_4 = import_zod3.z.object({
+  /**
+   * REQUIRED. Authorization Code grant details.
+   * IT-Wallet v1.4 only supports authorization_code grant.
+   */
+  authorization_code: zAuthorizationCodeGrantV1_4
+});
+var zCredentialOfferV1_4 = import_zod3.z.object({
+  /**
+   * REQUIRED. Array of credential configuration identifiers.
+   * References the types of credentials offered as defined in the Credential Issuer metadata.
+   */
+  credential_configuration_ids: import_zod3.z.array(import_zod3.z.string()).min(1),
+  /**
+   * REQUIRED. HTTPS URL of the Credential Issuer.
+   * The Credential Issuer from which the wallet will request credentials.
+   */
+  credential_issuer: import_zod3.z.url(),
+  /**
+   * REQUIRED. Grant information for the credential offer.
+   * IT-Wallet v1.4 requires authorization_code grant.
+   */
+  grants: zCredentialOfferGrantsV1_4
 });
-var zCredentialOfferUri = import_zod2.z.object({
+
+// src/credential-offer/z-credential-offer.ts
+var zCredentialOfferUri = import_zod4.z.object({
   /**
    * OPTIONAL. Inline credential offer JSON (by value).
    * URL-encoded JSON string containing the credential offer.
    */
-  credential_offer: import_zod2.z.string().optional(),
+  credential_offer: import_zod4.z.string().optional(),
   /**
    * OPTIONAL. URL pointing to the credential offer JSON (by reference).
    * HTTPS URL where the credential offer can be fetched.
    */
-  credential_offer_uri: import_zod2.z.url().optional(),
+  credential_offer_uri: import_zod4.z.url().optional(),
   /**
    * URL scheme used for the credential offer.
    * Determines the invocation method.
    */
-  scheme: import_zod2.z.enum(["openid-credential-offer", "haip-vci", "https"])
+  scheme: import_zod4.z.enum(["openid-credential-offer", "haip-vci", "https"])
 }).refine((data) => data.credential_offer || data.credential_offer_uri, {
   message: "Either credential_offer or credential_offer_uri must be present"
 });
@@ -387,34 +467,48 @@ async function parseCredentialOfferUri(options) {
 }
 
 // src/credential-offer/resolve-credential-offer.ts
-var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
+function parseCredentialOfferForVersion(config, data) {
+  switch (config.itWalletSpecsVersion) {
+    case import_io_wallet_utils3.ItWalletSpecsVersion.V1_3:
+      return zCredentialOfferV1_3.parse(data);
+    case import_io_wallet_utils3.ItWalletSpecsVersion.V1_4:
+      return zCredentialOfferV1_4.parse(data);
+    default:
+      throw new import_io_wallet_utils3.ItWalletSpecsVersionError(
+        "resolveCredentialOffer",
+        config.itWalletSpecsVersion,
+        [import_io_wallet_utils3.ItWalletSpecsVersion.V1_3, import_io_wallet_utils3.ItWalletSpecsVersion.V1_4]
+      );
+  }
+}
 async function resolveCredentialOffer(options) {
-  const { callbacks, credentialOffer } = options;
+  const { callbacks, config, credentialOffer } = options;
   try {
     if (credentialOffer.startsWith("openid-credential-offer://") || credentialOffer.startsWith("haip-vci://") || credentialOffer.startsWith("https://")) {
       const parsed = await parseCredentialOfferUri({ uri: credentialOffer });
       if (parsed.credential_offer) {
         const decoded = decodeURIComponent(parsed.credential_offer);
         const offerJson2 = JSON.parse(decoded);
-        return zCredentialOffer.parse(offerJson2);
+        return parseCredentialOfferForVersion(config, offerJson2);
       }
       if (parsed.credential_offer_uri) {
-        const fetch = (0, import_io_wallet_utils2.createFetcher)(callbacks.fetch);
+        const fetch = (0, import_io_wallet_utils3.createFetcher)(callbacks.fetch);
         const response = await fetch(parsed.credential_offer_uri, {
           headers: {
             Accept: "application/json"
           },
           method: "GET"
         });
-        await (0, import_io_wallet_utils2.hasStatusOrThrow)(200, import_io_wallet_utils2.UnexpectedStatusCodeError)(response);
+        await (0, import_io_wallet_utils3.hasStatusOrThrow)(200, import_io_wallet_utils3.UnexpectedStatusCodeError)(response);
         const offerJson2 = await response.json();
-        return zCredentialOffer.parse(offerJson2);
+        return parseCredentialOfferForVersion(config, offerJson2);
       }
     }
     const offerJson = JSON.parse(credentialOffer);
-    return zCredentialOffer.parse(offerJson);
+    return parseCredentialOfferForVersion(config, offerJson);
   } catch (error) {
-    if (error instanceof CredentialOfferError || error instanceof import_io_wallet_utils2.UnexpectedStatusCodeError) {
+    if (error instanceof CredentialOfferError || error instanceof import_io_wallet_utils3.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils3.ItWalletSpecsVersionError) {
       throw error;
     }
     throw new CredentialOfferError(
@@ -424,8 +518,34 @@ async function resolveCredentialOffer(options) {
 }
 
 // src/credential-offer/validate-credential-offer.ts
-async function validateCredentialOffer(options) {
-  const { credentialIssuerMetadata, credentialOffer } = options;
+var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+function assertAuthorizationServerAllowed(authorizationServer, authorizationServers) {
+  if (!authorizationServer) {
+    if (authorizationServers && authorizationServers.length > 1) {
+      throw new CredentialOfferError(
+        "authorization_server is REQUIRED when Credential Issuer uses multiple Authorization Servers"
+      );
+    }
+    return;
+  }
+  if (!authorizationServers) {
+    throw new CredentialOfferError(
+      "credential offer specified an `authorization_server` but issuer metadata doesn't contain `authorization_servers`"
+    );
+  }
+  if (authorizationServers.length === 1) {
+    throw new CredentialOfferError(
+      "credential offer specified an `authorization_server` but issuer metadata's `authorization_servers` contains only an element"
+    );
+  }
+  if (!authorizationServers.includes(authorizationServer)) {
+    throw new CredentialOfferError(
+      `authorization_server '${authorizationServer}' does not match Credential Issuer metadata. Valid servers: ${authorizationServers.join(", ")}`
+    );
+  }
+}
+function validateBaseCredentialOffer(options) {
+  const { credentialIssuerMetadata, credentialOffer, versionLabel } = options;
   if (!credentialOffer.credential_issuer.startsWith("https://")) {
     throw new CredentialOfferError("credential_issuer must be an HTTPS URL");
   }
@@ -435,53 +555,72 @@ async function validateCredentialOffer(options) {
     );
   }
   if (!credentialOffer.grants) {
-    throw new CredentialOfferError("grants is REQUIRED for IT-Wallet v1.3");
+    throw new CredentialOfferError(
+      `grants is REQUIRED for IT-Wallet ${versionLabel}`
+    );
   }
   const authCodeGrant = credentialOffer.grants.authorization_code;
   if (!authCodeGrant) {
     throw new CredentialOfferError(
-      "authorization_code grant is REQUIRED for IT-Wallet v1.3"
+      `authorization_code grant is REQUIRED for IT-Wallet ${versionLabel}`
     );
   }
-  if (!authCodeGrant.scope) {
+  assertAuthorizationServerAllowed(
+    authCodeGrant.authorization_server,
+    credentialIssuerMetadata?.authorization_servers
+  );
+}
+async function validateCredentialOfferV1_3(options) {
+  validateBaseCredentialOffer({
+    credentialIssuerMetadata: options.credentialIssuerMetadata,
+    credentialOffer: options.credentialOffer,
+    versionLabel: "v1.3"
+  });
+  if (!options.credentialOffer.grants.authorization_code.scope) {
     throw new CredentialOfferError("authorization_code.scope is REQUIRED");
   }
-  if (credentialIssuerMetadata?.authorization_servers) {
-    const authServers = credentialIssuerMetadata.authorization_servers;
-    if (authServers.length > 1 && !authCodeGrant.authorization_server) {
-      throw new CredentialOfferError(
-        "authorization_server is REQUIRED when Credential Issuer uses multiple Authorization Servers"
-      );
-    }
-    if (authCodeGrant.authorization_server) {
-      if (!authServers.includes(authCodeGrant.authorization_server)) {
-        throw new CredentialOfferError(
-          `authorization_server '${authCodeGrant.authorization_server}' does not match Credential Issuer metadata. Valid servers: ${authServers.join(", ")}`
-        );
-      }
-    }
-  }
+}
+async function validateCredentialOfferV1_4(options) {
+  validateBaseCredentialOffer({
+    credentialIssuerMetadata: options.credentialIssuerMetadata,
+    credentialOffer: options.credentialOffer,
+    versionLabel: "v1.4"
+  });
+}
+var dispatchValidateCredentialOffer = (0, import_io_wallet_utils4.createVersionDispatcher)({
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_0]: () => {
+    throw new import_io_wallet_utils4.ItWalletSpecsVersionError(
+      "validateCredentialOffer",
+      import_io_wallet_utils4.ItWalletSpecsVersion.V1_0,
+      [import_io_wallet_utils4.ItWalletSpecsVersion.V1_3, import_io_wallet_utils4.ItWalletSpecsVersion.V1_4]
+    );
+  },
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_3]: (o) => validateCredentialOfferV1_3(o),
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_4]: (o) => validateCredentialOfferV1_4(o)
+});
+async function validateCredentialOffer(options) {
+  return dispatchValidateCredentialOffer(options);
 }
 
 // src/credential-request/create-credential-request.ts
-var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/v1.0/create-credential-request.ts
-var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/v1.0/z-credential.ts
-var import_zod4 = require("zod");
+var import_zod6 = require("zod");
 
 // src/credential-request/z-base-credential-request.ts
-var import_zod3 = require("zod");
-var zBaseCredentialRequest = import_zod3.z.object({
-  credential_configuration_id: import_zod3.z.string().optional().describe(
+var import_zod5 = require("zod");
+var zBaseCredentialRequest = import_zod5.z.object({
+  credential_configuration_id: import_zod5.z.string().optional().describe(
     "REQUIRED if credential_identifier param is absent. MUST NOT be used otherwise."
   ),
-  credential_identifier: import_zod3.z.string().optional().describe(
+  credential_identifier: import_zod5.z.string().optional().describe(
     "REQUIRED when Authorization Details of type openid_credential was returned. MUST NOT be used if credential_configuration_id is present."
   ),
-  transaction_id: import_zod3.z.string().optional().describe(
+  transaction_id: import_zod5.z.string().optional().describe(
     "REQUIRED only in case of deferred flow. MUST NOT be present in immediate flow."
   )
 });
@@ -503,9 +642,9 @@ function credentialRequestRefiner(data, ctx) {
 }
 
 // src/credential-request/v1.0/z-credential.ts
-var zCredentialRequestProof = import_zod4.z.object({
-  jwt: import_zod4.z.string().min(1, "JWT must not be empty"),
-  proof_type: import_zod4.z.literal("jwt")
+var zCredentialRequestProof = import_zod6.z.object({
+  jwt: import_zod6.z.string().min(1, "JWT must not be empty"),
+  proof_type: import_zod6.z.literal("jwt")
   // MUST be "jwt"
 });
 var zCredentialRequestV1_0 = zBaseCredentialRequest.extend({
@@ -528,12 +667,12 @@ var createCredentialRequest = async (options) => {
       },
       payload: {
         aud: options.issuerIdentifier,
-        iat: (0, import_io_wallet_utils3.dateToSeconds)(/* @__PURE__ */ new Date()),
+        iat: (0, import_io_wallet_utils5.dateToSeconds)(/* @__PURE__ */ new Date()),
         iss: options.clientId,
         nonce: options.nonce
       }
     });
-    return (0, import_io_wallet_utils3.parseWithErrorHandling)(zCredentialRequestV1_0, {
+    return (0, import_io_wallet_utils5.parseWithErrorHandling)(zCredentialRequestV1_0, {
       credential_identifier: options.credential_identifier,
       proof: {
         jwt: proofJwt.jwt,
@@ -541,7 +680,7 @@ var createCredentialRequest = async (options) => {
       }
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils3.ValidationError) {
+    if (error instanceof import_io_wallet_utils5.ValidationError) {
       throw error;
     }
     throw new Oid4vciError(
@@ -552,13 +691,13 @@ var createCredentialRequest = async (options) => {
 
 // src/credential-request/v1.3/create-credential-request.ts
 var import_oauth22 = require("@openid4vc/oauth2");
-var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/v1.3/z-credential.ts
-var import_zod5 = require("zod");
-var zCredentialRequestProofJwt = import_zod5.z.string().min(1, "JWT must not be empty in credential request proofs array");
-var zCredentialRequestProofs = import_zod5.z.object({
-  jwt: import_zod5.z.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
+var import_zod7 = require("zod");
+var zCredentialRequestProofJwt = import_zod7.z.string().min(1, "JWT must not be empty in credential request proofs array");
+var zCredentialRequestProofs = import_zod7.z.object({
+  jwt: import_zod7.z.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
 });
 var zCredentialRequestV1_3 = zBaseCredentialRequest.extend({
   proofs: zCredentialRequestProofs.describe(
@@ -574,16 +713,16 @@ var createCredentialRequest2 = async (options) => {
     const { maxBatchSize, signers } = options;
     const [firstSigner, ...otherSigners] = signers;
     if (!firstSigner) {
-      throw new import_io_wallet_utils4.ValidationError("At least one signer is required");
+      throw new import_io_wallet_utils6.ValidationError("At least one signer is required");
     }
     if (maxBatchSize !== void 0) {
       if (!Number.isInteger(maxBatchSize) || maxBatchSize <= 0) {
-        throw new import_io_wallet_utils4.ValidationError(
+        throw new import_io_wallet_utils6.ValidationError(
           "Invalid maxBatchSize: it must be a positive integer"
         );
       }
       if (signers.length > maxBatchSize) {
-        throw new import_io_wallet_utils4.ValidationError(
+        throw new import_io_wallet_utils6.ValidationError(
           "The number of provided signers exceeds the maximum batch size allowed"
         );
       }
@@ -601,7 +740,7 @@ var createCredentialRequest2 = async (options) => {
       );
       const uniqueThumbprints = new Set(allThumbprints);
       if (uniqueThumbprints.size !== allThumbprints.length) {
-        throw new import_io_wallet_utils4.ValidationError(
+        throw new import_io_wallet_utils6.ValidationError(
           "Found multiple signers with the same JWK: each JWT proof must be unique and linked to a different credential key pair"
         );
       }
@@ -615,7 +754,7 @@ var createCredentialRequest2 = async (options) => {
       },
       payload: {
         aud: options.issuerIdentifier,
-        iat: (0, import_io_wallet_utils4.dateToSeconds)(/* @__PURE__ */ new Date()),
+        iat: (0, import_io_wallet_utils6.dateToSeconds)(/* @__PURE__ */ new Date()),
         iss: options.clientId,
         nonce: options.nonce
       }
@@ -624,14 +763,14 @@ var createCredentialRequest2 = async (options) => {
       createProofJwt(firstSigner),
       ...otherSigners.map(createProofJwt)
     ]);
-    return (0, import_io_wallet_utils4.parseWithErrorHandling)(zCredentialRequestV1_3, {
+    return (0, import_io_wallet_utils6.parseWithErrorHandling)(zCredentialRequestV1_3, {
       credential_identifier: options.credential_identifier,
       proofs: {
         jwt: proofJwts
       }
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils4.ValidationError) {
+    if (error instanceof import_io_wallet_utils6.ValidationError) {
       throw error;
     }
     throw new Oid4vciError(
@@ -641,10 +780,10 @@ var createCredentialRequest2 = async (options) => {
 };
 
 // src/credential-request/create-credential-request.ts
-var dispatchCreateCredentialRequest = (0, import_io_wallet_utils5.createVersionDispatcher)({
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_0]: (o) => createCredentialRequest(o),
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_3]: (o) => createCredentialRequest2(o),
-  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_4]: (o) => (
+var dispatchCreateCredentialRequest = (0, import_io_wallet_utils7.createVersionDispatcher)({
+  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_0]: (o) => createCredentialRequest(o),
+  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_3]: (o) => createCredentialRequest2(o),
+  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_4]: (o) => (
     // V1_4 reuses V1_3 credential request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: credential request parameters (format, proofs, key_attestation) identical.
     createCredentialRequest2(o)
@@ -656,25 +795,25 @@ async function createCredentialRequest3(options) {
 
 // src/credential-request/parse-credential-request.ts
 var import_io_wallet_oauth23 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/z-proof-jwt.ts
 var import_io_wallet_oauth22 = require("@pagopa/io-wallet-oauth2");
-var import_zod6 = require("zod");
-var zBaseProofJwtHeader = import_zod6.z.object({
-  alg: import_zod6.z.string().min(1),
+var import_zod8 = require("zod");
+var zBaseProofJwtHeader = import_zod8.z.object({
+  alg: import_zod8.z.string().min(1),
   jwk: import_io_wallet_oauth22.zJwk,
-  typ: import_zod6.z.literal("openid4vci-proof+jwt")
+  typ: import_zod8.z.literal("openid4vci-proof+jwt")
 });
 var zProofJwtHeaderV1_0 = zBaseProofJwtHeader.loose();
 var zProofJwtHeaderV1_3 = zBaseProofJwtHeader.extend({
-  key_attestation: import_zod6.z.string().min(1)
+  key_attestation: import_zod8.z.string().min(1)
 }).loose();
-var zProofJwtPayload = import_zod6.z.looseObject({
-  aud: import_zod6.z.string().min(1),
-  iat: import_zod6.z.number(),
-  iss: import_zod6.z.string().min(1).optional(),
-  nonce: import_zod6.z.string().min(1)
+var zProofJwtPayload = import_zod8.z.looseObject({
+  aud: import_zod8.z.string().min(1),
+  iat: import_zod8.z.number(),
+  iss: import_zod8.z.string().min(1).optional(),
+  nonce: import_zod8.z.string().min(1)
 });
 
 // src/credential-request/parse-credential-request.ts
@@ -683,12 +822,12 @@ function validateExpectedValues(credentialRequest, expected) {
     return;
   }
   if (expected.credential_identifier && credentialRequest.credential_identifier !== expected.credential_identifier) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "credential_identifier does not match expected value"
     );
   }
   if (expected.credential_configuration_id && credentialRequest.credential_configuration_id !== expected.credential_configuration_id) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "credential_configuration_id does not match expected value"
     );
   }
@@ -696,12 +835,12 @@ function validateExpectedValues(credentialRequest, expected) {
 function validateTransactionContext(options) {
   const { credentialRequest, isDeferredFlow } = options;
   if (isDeferredFlow && !credentialRequest.transaction_id) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "transaction_id is required for deferred credential issuance"
     );
   }
   if (!isDeferredFlow && credentialRequest.transaction_id) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "transaction_id must not be present in immediate credential issuance flow"
     );
   }
@@ -709,27 +848,27 @@ function validateTransactionContext(options) {
 function validateProofPayloadSemantics(options) {
   const { expected, grantType, payload } = options;
   if (grantType === "authorization_code" && !payload.iss) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "Credential proof JWT payload must include iss for authorization_code grant"
     );
   }
   if (expected?.audience && payload.aud !== expected.audience) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "Credential proof JWT aud does not match expected audience"
     );
   }
   if (expected?.nonce && payload.nonce !== expected.nonce) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "Credential proof JWT nonce does not match expected nonce"
     );
   }
   if (expected?.issuer && payload.iss && payload.iss !== expected.issuer) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "Credential proof JWT iss does not match expected issuer"
     );
   }
   if (grantType === "authorization_code" && expected?.issuer && !payload.iss) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "Credential proof JWT payload is missing expected issuer (iss)"
     );
   }
@@ -739,15 +878,15 @@ function parseProofJwt(options) {
     errorMessagePrefix: "Error decoding credential request proof JWT:",
     jwt: options.jwt
   });
-  const headerValidation = options.itWalletSpecsVersion === import_io_wallet_utils6.ItWalletSpecsVersion.V1_3 || options.itWalletSpecsVersion === import_io_wallet_utils6.ItWalletSpecsVersion.V1_4 ? zProofJwtHeaderV1_3.safeParse(decoded.header) : zProofJwtHeaderV1_0.safeParse(decoded.header);
+  const headerValidation = options.itWalletSpecsVersion === import_io_wallet_utils8.ItWalletSpecsVersion.V1_3 || options.itWalletSpecsVersion === import_io_wallet_utils8.ItWalletSpecsVersion.V1_4 ? zProofJwtHeaderV1_3.safeParse(decoded.header) : zProofJwtHeaderV1_0.safeParse(decoded.header);
   if (!headerValidation.success) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "Credential proof JWT header is invalid or missing required claims"
     );
   }
   const payloadValidation = zProofJwtPayload.safeParse(decoded.payload);
   if (!payloadValidation.success) {
-    throw new import_io_wallet_utils6.ValidationError(
+    throw new import_io_wallet_utils8.ValidationError(
       "Credential proof JWT payload is invalid or missing required claims"
     );
   }
@@ -764,7 +903,27 @@ function parseProofJwt(options) {
     proofType: "jwt"
   };
 }
-function normalizeProofs(options) {
+async function validateProofJwkUniqueness(options) {
+  if (options.proofs.length <= 1) {
+    return;
+  }
+  const thumbprints = await Promise.all(
+    options.proofs.map(
+      (proof) => (0, import_io_wallet_utils8.calculateJwkThumbprint)({
+        hashAlgorithm: import_io_wallet_utils8.HashAlgorithm.Sha256,
+        hashCallback: options.callbacks.hash,
+        jwk: proof.header.jwk
+      })
+    )
+  );
+  const uniqueThumbprints = new Set(thumbprints);
+  if (uniqueThumbprints.size !== thumbprints.length) {
+    throw new import_io_wallet_utils8.ValidationError(
+      "Credential request proofs must use unique jwk header values"
+    );
+  }
+}
+async function normalizeProofs(options) {
   if ("proof" in options.credentialRequest) {
     return [
       parseProofJwt({
@@ -775,7 +934,7 @@ function normalizeProofs(options) {
       })
     ];
   }
-  return options.credentialRequest.proofs.jwt.map(
+  const proofs = options.credentialRequest.proofs.jwt.map(
     (jwt) => parseProofJwt({
       expected: options.expected,
       grantType: options.grantType,
@@ -783,14 +942,20 @@ function normalizeProofs(options) {
       jwt
     })
   );
+  await validateProofJwkUniqueness({
+    callbacks: options.callbacks,
+    proofs
+  });
+  return proofs;
 }
-function toResult(options) {
+async function toResult(options) {
   validateExpectedValues(options.credentialRequest, options.expected);
   validateTransactionContext({
     credentialRequest: options.credentialRequest,
     isDeferredFlow: options.isDeferredFlow
   });
-  const proofs = normalizeProofs({
+  const proofs = await normalizeProofs({
+    callbacks: options.callbacks,
     credentialRequest: options.credentialRequest,
     expected: options.expected,
     grantType: options.grantType,
@@ -813,7 +978,7 @@ function toResult(options) {
   };
 }
 function parseAuthorizationHeader(headers) {
-  const authorizationHeader = headers.get(import_io_wallet_utils6.HEADERS.AUTHORIZATION)?.trim();
+  const authorizationHeader = headers.get(import_io_wallet_utils8.HEADERS.AUTHORIZATION)?.trim();
   if (!authorizationHeader) {
     throw new CredentialAuthorizationHeaderError(
       "Credential request is missing required 'Authorization' header with DPoP scheme"
@@ -842,66 +1007,69 @@ function parseDpopProof(headers) {
   return extracted.dpopJwt;
 }
 function parseCredentialRequestV1_0(options) {
-  const credentialRequest = (0, import_io_wallet_utils6.parseWithErrorHandling)(
+  const credentialRequest = (0, import_io_wallet_utils8.parseWithErrorHandling)(
     zCredentialRequestV1_0,
     options.credentialRequest,
     "Invalid credential request format for ItWalletSpecsVersion 1.0"
   );
   return toResult({
     accessToken: options.accessToken,
+    callbacks: options.callbacks,
     credentialRequest,
     dpopProof: options.dpopProof,
     expected: options.expected,
     grantType: options.grantType,
     isDeferredFlow: options.isDeferredFlow,
-    itWalletSpecsVersion: import_io_wallet_utils6.ItWalletSpecsVersion.V1_0
+    itWalletSpecsVersion: import_io_wallet_utils8.ItWalletSpecsVersion.V1_0
   });
 }
 function parseCredentialRequestV1_3(options) {
-  const credentialRequest = (0, import_io_wallet_utils6.parseWithErrorHandling)(
+  const credentialRequest = (0, import_io_wallet_utils8.parseWithErrorHandling)(
     zCredentialRequestV1_3,
     options.credentialRequest,
     "Invalid credential request format for ItWalletSpecsVersion 1.3"
   );
   return toResult({
     accessToken: options.accessToken,
+    callbacks: options.callbacks,
     credentialRequest,
     dpopProof: options.dpopProof,
     expected: options.expected,
     grantType: options.grantType,
     isDeferredFlow: options.isDeferredFlow,
-    itWalletSpecsVersion: import_io_wallet_utils6.ItWalletSpecsVersion.V1_3
+    itWalletSpecsVersion: import_io_wallet_utils8.ItWalletSpecsVersion.V1_3
   });
 }
 function parseCredentialRequestV1_4(options) {
-  const credentialRequest = (0, import_io_wallet_utils6.parseWithErrorHandling)(
+  const credentialRequest = (0, import_io_wallet_utils8.parseWithErrorHandling)(
     zCredentialRequestV1_3,
     options.credentialRequest,
     "Invalid credential request format for ItWalletSpecsVersion 1.4"
   );
   return toResult({
     accessToken: options.accessToken,
+    callbacks: options.callbacks,
     credentialRequest,
     dpopProof: options.dpopProof,
     expected: options.expected,
     grantType: options.grantType,
     isDeferredFlow: options.isDeferredFlow,
-    itWalletSpecsVersion: import_io_wallet_utils6.ItWalletSpecsVersion.V1_4
+    itWalletSpecsVersion: import_io_wallet_utils8.ItWalletSpecsVersion.V1_4
     // V1_4 reuses V1_3 proof schema
   });
 }
-var dispatchParseCredentialRequest = (0, import_io_wallet_utils6.createVersionDispatcher)({
-  [import_io_wallet_utils6.ItWalletSpecsVersion.V1_0]: parseCredentialRequestV1_0,
-  [import_io_wallet_utils6.ItWalletSpecsVersion.V1_3]: parseCredentialRequestV1_3,
-  [import_io_wallet_utils6.ItWalletSpecsVersion.V1_4]: parseCredentialRequestV1_4
+var dispatchParseCredentialRequest = (0, import_io_wallet_utils8.createVersionDispatcher)({
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_0]: parseCredentialRequestV1_0,
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_3]: parseCredentialRequestV1_3,
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_4]: parseCredentialRequestV1_4
 });
-function parseCredentialRequest(options) {
+async function parseCredentialRequest(options) {
   const grantType = options.grantType ?? "authorization_code";
   const isDeferredFlow = options.isDeferredFlow ?? false;
   try {
     const accessToken = parseAuthorizationHeader(options.headers);
     const dpopProof = parseDpopProof(options.headers);
-    return dispatchParseCredentialRequest({
+    return await dispatchParseCredentialRequest({
       ...options,
       accessToken,
       dpopProof,
@@ -909,7 +1077,7 @@ function parseCredentialRequest(options) {
       isDeferredFlow
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils6.ItWalletSpecsVersionError || error instanceof import_io_wallet_oauth23.Oauth2JwtParseError || error instanceof import_io_wallet_utils6.ValidationError || error instanceof CredentialAuthorizationHeaderError || error instanceof MissingDpopProofError) {
+    if (error instanceof import_io_wallet_utils8.ItWalletSpecsVersionError || error instanceof import_io_wallet_oauth23.Oauth2JwtParseError || error instanceof import_io_wallet_utils8.ValidationError || error instanceof CredentialAuthorizationHeaderError || error instanceof MissingDpopProofError) {
       throw error;
     }
     throw new ParseCredentialRequestError(
@@ -922,44 +1090,44 @@ function parseCredentialRequest(options) {
 // src/credential-request/verify-credential-request-jwt-proof.ts
 var import_oauth24 = require("@openid4vc/oauth2");
 var import_io_wallet_oauth26 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/verify-key-attestation-jwt.ts
 var import_oauth23 = require("@openid4vc/oauth2");
 var import_io_wallet_oauth25 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
 
 // src/wallet-provider/z-key-attestation.ts
 var import_io_wallet_oauth24 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid_federation = require("@pagopa/io-wallet-oid-federation");
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
-var import_zod7 = require("zod");
-var zStatusList = import_zod7.z.object({
-  idx: import_zod7.z.number(),
-  uri: import_zod7.z.url()
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_zod9 = require("zod");
+var zStatusList = import_zod9.z.object({
+  idx: import_zod9.z.number(),
+  uri: import_zod9.z.url()
 });
-var zKeyAttestationStatus = import_zod7.z.object({
+var zKeyAttestationStatus = import_zod9.z.object({
   status_list: zStatusList
 });
-var zKeyAttestationAlg = import_io_wallet_utils7.zItwSupportedSignatureAlg;
-var zKeyAttestationHeader = import_zod7.z.object({
+var zKeyAttestationAlg = import_io_wallet_utils9.zItwSupportedSignatureAlg;
+var zKeyAttestationHeader = import_zod9.z.object({
   alg: zKeyAttestationAlg,
-  kid: import_zod7.z.string(),
+  kid: import_zod9.z.string(),
   trust_chain: import_io_wallet_oauth24.zTrustChain.optional(),
-  typ: import_zod7.z.literal("key-attestation+jwt"),
+  typ: import_zod9.z.literal("key-attestation+jwt"),
   x5c: import_io_wallet_oauth24.zCertificateChain
 });
-var zKeyAttestationPayload = import_zod7.z.object({
-  attested_keys: import_zod7.z.array(import_io_wallet_oauth24.zJwk).nonempty(),
-  certification: import_zod7.z.string().optional(),
-  exp: import_zod7.z.number(),
-  iat: import_zod7.z.number(),
-  iss: import_zod7.z.string(),
-  key_storage: import_zod7.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty(),
+var zKeyAttestationPayload = import_zod9.z.object({
+  attested_keys: import_zod9.z.array(import_io_wallet_oauth24.zJwk).nonempty(),
+  certification: import_zod9.z.string().optional(),
+  exp: import_zod9.z.number(),
+  iat: import_zod9.z.number(),
+  iss: import_zod9.z.string(),
+  key_storage: import_zod9.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty(),
   status: zKeyAttestationStatus,
-  user_authentication: import_zod7.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty()
+  user_authentication: import_zod9.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty()
 });
-var zKeyAttestationTypeHeader = import_zod7.z.literal("key-attestation+jwt");
+var zKeyAttestationTypeHeader = import_zod9.z.literal("key-attestation+jwt");
 var keyAttestationTypeHeader = zKeyAttestationTypeHeader.value;
 
 // src/credential-request/verify-key-attestation-jwt.ts
@@ -994,7 +1162,7 @@ async function verifyKeyAttestationJwt(options) {
     }
     return { header, payload, signer };
   } catch (error) {
-    if (error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils8.ValidationError || error instanceof import_oauth23.Oauth2JwtParseError) {
+    if (error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils10.ValidationError || error instanceof import_oauth23.Oauth2JwtParseError) {
       throw error;
     }
     throw new VerifyKeyAttestationJwtError(
@@ -1024,7 +1192,7 @@ async function isJwkInSet(options) {
 }
 function verifyProofJwtIatOrThrow(options) {
   try {
-    (0, import_io_wallet_utils9.verifyJwtIatOrThrow)({
+    (0, import_io_wallet_utils11.verifyJwtIatOrThrow)({
       iat: options.payload.iat,
       now: options.now
     });
@@ -1109,10 +1277,10 @@ async function verifyProofV1_3(options) {
   }
   return { header, keyAttestation: keyAttestationResult, payload, signer };
 }
-var dispatchVerifyProof = (0, import_io_wallet_utils9.createVersionDispatcher)({
-  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_0]: (o) => verifyProofV1_0(o),
-  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_3]: (o) => verifyProofV1_3(o),
-  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_4]: (o) => verifyProofV1_3(o)
+var dispatchVerifyProof = (0, import_io_wallet_utils11.createVersionDispatcher)({
+  [import_io_wallet_utils11.ItWalletSpecsVersion.V1_0]: (o) => verifyProofV1_0(o),
+  [import_io_wallet_utils11.ItWalletSpecsVersion.V1_3]: (o) => verifyProofV1_3(o),
+  [import_io_wallet_utils11.ItWalletSpecsVersion.V1_4]: (o) => verifyProofV1_3(o)
 });
 async function verifyCredentialRequestJwtProof(options) {
   try {
@@ -1124,7 +1292,7 @@ async function verifyCredentialRequestJwtProof(options) {
     }
     return await dispatchVerifyProof({ ...options, now });
   } catch (error) {
-    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils9.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils9.ValidationError || error instanceof import_io_wallet_oauth26.Oauth2JwtParseError) {
+    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils11.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils11.ValidationError || error instanceof import_io_wallet_oauth26.Oauth2JwtParseError) {
       throw error;
     }
     throw new VerifyCredentialRequestJwtProofError(
@@ -1135,36 +1303,36 @@ async function verifyCredentialRequestJwtProof(options) {
 }
 
 // src/credential-response/create-credential-response.ts
-var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.0/create-credential-response.ts
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.0/z-credential-response.ts
-var import_zod9 = require("zod");
+var import_zod11 = require("zod");
 
 // src/credential-response/z-immediate-credential-response.ts
-var import_zod8 = require("zod");
-var zCredentialObject = import_zod8.z.object({
-  credential: import_zod8.z.string()
+var import_zod10 = require("zod");
+var zCredentialObject = import_zod10.z.object({
+  credential: import_zod10.z.string()
 });
-var zImmediateCredentialResponse = import_zod8.z.strictObject({
-  credentials: import_zod8.z.array(zCredentialObject).nonempty().describe(
+var zImmediateCredentialResponse = import_zod10.z.strictObject({
+  credentials: import_zod10.z.array(zCredentialObject).nonempty().describe(
     "Conditional. Array of issued Digital Credentials as JSON objects with `credential` member containing encoded credential string. Present for immediate issuance (HTTP 200)."
   ),
-  notification_id: import_zod8.z.string().optional().describe(
+  notification_id: import_zod10.z.string().optional().describe(
     "OPTIONAL. Identifier for notification requests. Only present with credentials parameter."
   )
 });
 
 // src/credential-response/v1.0/z-credential-response.ts
-var zDeferredCredentialResponseV1_0 = import_zod9.z.strictObject({
-  lead_time: import_zod9.z.number().int().positive().describe(
+var zDeferredCredentialResponseV1_0 = import_zod11.z.strictObject({
+  lead_time: import_zod11.z.number().int().positive().describe(
     "REQUIRED if credentials is not present, otherwise it MUST NOT be present. The amount of time (in seconds) required before making a Deferred Credential Request."
   ),
-  transaction_id: import_zod9.z.string().nonempty()
+  transaction_id: import_zod11.z.string().nonempty()
 });
-var zCredentialResponseV1_0 = import_zod9.z.union([
+var zCredentialResponseV1_0 = import_zod11.z.union([
   zImmediateCredentialResponse,
   zDeferredCredentialResponseV1_0
 ]);
@@ -1172,7 +1340,7 @@ var zCredentialResponseV1_0 = import_zod9.z.union([
 // src/credential-response/v1.0/create-credential-response.ts
 function createCredentialResponseV1_0(flow) {
   if ("credentials" in flow) {
-    return (0, import_io_wallet_utils10.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils12.parseWithErrorHandling)(
       zCredentialResponseV1_0,
       {
         credentials: flow.credentials,
@@ -1183,7 +1351,7 @@ function createCredentialResponseV1_0(flow) {
       "Invalid credential response for ItWalletSpecsVersion 1.0"
     );
   }
-  return (0, import_io_wallet_utils10.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils12.parseWithErrorHandling)(
     zCredentialResponseV1_0,
     {
       lead_time: flow.leadTime,
@@ -1194,17 +1362,17 @@ function createCredentialResponseV1_0(flow) {
 }
 
 // src/credential-response/v1.3/create-credential-response.ts
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.3/z-credential-response.ts
-var import_zod10 = require("zod");
-var zDeferredCredentialResponseV1_3 = import_zod10.z.strictObject({
-  interval: import_zod10.z.number().int().positive().describe(
+var import_zod12 = require("zod");
+var zDeferredCredentialResponseV1_3 = import_zod12.z.strictObject({
+  interval: import_zod12.z.number().int().positive().describe(
     "REQUIRED if transaction_id is present, otherwise it MUST NOT be present. The amount of time (in seconds) required before making a Deferred Credential Request"
   ),
-  transaction_id: import_zod10.z.string().nonempty()
+  transaction_id: import_zod12.z.string().nonempty()
 });
-var zCredentialResponseV1_3 = import_zod10.z.union([
+var zCredentialResponseV1_3 = import_zod12.z.union([
   zImmediateCredentialResponse,
   zDeferredCredentialResponseV1_3
 ]);
@@ -1212,7 +1380,7 @@ var zCredentialResponseV1_3 = import_zod10.z.union([
 // src/credential-response/v1.3/create-credential-response.ts
 function createCredentialResponseV1_3(flow) {
   if ("credentials" in flow) {
-    return (0, import_io_wallet_utils11.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils13.parseWithErrorHandling)(
       zCredentialResponseV1_3,
       {
         credentials: flow.credentials,
@@ -1223,7 +1391,7 @@ function createCredentialResponseV1_3(flow) {
       "Invalid credential response for ItWalletSpecsVersion 1.3"
     );
   }
-  return (0, import_io_wallet_utils11.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils13.parseWithErrorHandling)(
     zCredentialResponseV1_3,
     {
       interval: flow.interval,
@@ -1234,14 +1402,14 @@ function createCredentialResponseV1_3(flow) {
 }
 
 // src/credential-response/create-credential-response.ts
-var dispatchBuildVersionedResponse = (0, import_io_wallet_utils12.createVersionDispatcher)({
-  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_0]: (o) => createCredentialResponseV1_0(
+var dispatchBuildVersionedResponse = (0, import_io_wallet_utils14.createVersionDispatcher)({
+  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_0]: (o) => createCredentialResponseV1_0(
     o.flow
   ),
-  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_3]: (o) => createCredentialResponseV1_3(
+  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_3]: (o) => createCredentialResponseV1_3(
     o.flow
   ),
-  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_4]: (o) => createCredentialResponseV1_3(
+  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_4]: (o) => createCredentialResponseV1_3(
     o.flow
     // V1_4 reuses V1_3 credential response schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: credential response parameters identical.
@@ -1266,7 +1434,7 @@ async function createCredentialResponse(options) {
     }
     return { credentialResponse, credentialResponseJwt };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils12.ValidationError || error instanceof Oid4vciError) {
+    if (error instanceof import_io_wallet_utils14.ValidationError || error instanceof Oid4vciError) {
       throw error;
     }
     throw new CreateCredentialResponseError(
@@ -1290,49 +1458,49 @@ async function encryptResponse(credentialResponse, credentialResponseEncryption,
 }
 
 // src/credential-response/fetch-credential-response.ts
-var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/z-credential-response.ts
 var import_io_wallet_oauth27 = require("@pagopa/io-wallet-oauth2");
-var import_zod11 = require("zod");
-var zCredentialResponseEncryption = import_zod11.z.looseObject({
+var import_zod13 = require("zod");
+var zCredentialResponseEncryption = import_zod13.z.looseObject({
   alg: import_io_wallet_oauth27.zAlgValueNotNone,
-  enc: import_zod11.z.string(),
+  enc: import_zod13.z.string(),
   jwk: import_io_wallet_oauth27.zJwk
 });
 
 // src/credential-response/fetch-credential-response.ts
 async function fetchCredentialResponse(options) {
   try {
-    const fetch = (0, import_io_wallet_utils13.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils15.createFetcher)(options.callbacks.fetch);
     const credentialResponse = await fetch(options.credentialEndpoint, {
       body: JSON.stringify(options.credentialRequest),
       headers: {
-        [import_io_wallet_utils13.HEADERS.AUTHORIZATION]: `DPoP ${options.accessToken}`,
-        [import_io_wallet_utils13.HEADERS.CONTENT_TYPE]: import_io_wallet_utils13.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils13.HEADERS.DPOP]: options.dPoP
+        [import_io_wallet_utils15.HEADERS.AUTHORIZATION]: `DPoP ${options.accessToken}`,
+        [import_io_wallet_utils15.HEADERS.CONTENT_TYPE]: import_io_wallet_utils15.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils15.HEADERS.DPOP]: options.dPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils13.hasStatusOrThrow)(
+    await (0, import_io_wallet_utils15.hasStatusOrThrow)(
       [200, 202],
-      import_io_wallet_utils13.UnexpectedStatusCodeError
+      import_io_wallet_utils15.UnexpectedStatusCodeError
     )(credentialResponse);
     const credentialResponseJson = await credentialResponse.json();
     if ("proof" in options.credentialRequest) {
-      return (0, import_io_wallet_utils13.parseWithErrorHandling)(
+      return (0, import_io_wallet_utils15.parseWithErrorHandling)(
         zCredentialResponseV1_0,
         credentialResponseJson,
         `Failed to parse credential response (v1.0)`
       );
     }
-    return (0, import_io_wallet_utils13.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils15.parseWithErrorHandling)(
       zCredentialResponseV1_3,
       credentialResponseJson,
       `Failed to parse credential response (v1.3)`
     );
   } catch (error) {
-    if (error instanceof import_io_wallet_utils13.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils13.ValidationError) {
+    if (error instanceof import_io_wallet_utils15.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils15.ValidationError) {
       throw error;
     }
     throw new FetchCredentialResponseError(
@@ -1344,28 +1512,34 @@ async function fetchCredentialResponse(options) {
 // src/metadata/fetch-metadata.ts
 var import_io_wallet_oauth28 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid_federation3 = require("@pagopa/io-wallet-oid-federation");
-var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
-var import_zod13 = __toESM(require("zod"));
+var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
+var import_zod15 = __toESM(require("zod"));
 
 // src/metadata/z-metadata-response.ts
 var import_io_wallet_oid_federation2 = require("@pagopa/io-wallet-oid-federation");
-var import_zod12 = require("zod");
-var zMetadataResponseV1_0 = import_zod12.z.object({
-  discoveredVia: import_zod12.z.enum(["federation"]),
+var import_zod14 = require("zod");
+var zMetadataResponseV1_0 = import_zod14.z.object({
+  discoveredVia: import_zod14.z.enum(["federation"]),
   metadata: import_io_wallet_oid_federation2.itWalletMetadataV1_0,
   openid_federation_claims: import_io_wallet_oid_federation2.itWalletEntityStatementClaimsSchema
 });
-var zMetadataResponseV1_3 = import_zod12.z.object({
-  discoveredVia: import_zod12.z.enum(["federation", "oid4vci"]),
+var zMetadataResponseV1_3 = import_zod14.z.object({
+  /**
+   * Entity statement claims of the Authorization Server, present only when the
+   * selected authorization server was resolved through a federation entity
+   * distinct from the Credential Issuer.
+   */
+  authorization_server_federation_claims: import_io_wallet_oid_federation2.itWalletEntityStatementClaimsSchema.optional(),
+  discoveredVia: import_zod14.z.enum(["federation", "oid4vci"]),
   metadata: import_io_wallet_oid_federation2.itWalletMetadataV1_3,
   openid_federation_claims: import_io_wallet_oid_federation2.itWalletEntityStatementClaimsSchema.optional()
 });
-var zMetadataResponse = import_zod12.z.union([
+var zMetadataResponse = import_zod14.z.union([
   zMetadataResponseV1_0,
   zMetadataResponseV1_3
 ]);
-var zPartialIssuerMetadata = import_zod12.z.looseObject({
-  authorization_servers: import_zod12.z.array(import_zod12.z.string()).optional()
+var zPartialIssuerMetadata = import_zod14.z.looseObject({
+  authorization_servers: import_zod14.z.tuple([import_zod14.z.url()], import_zod14.z.url()).optional()
 });
 
 // src/metadata/fetch-metadata.ts
@@ -1400,7 +1574,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
         payload
       });
       if (!result.verified) {
-        throw new import_io_wallet_utils14.ValidationError(
+        throw new import_io_wallet_utils16.ValidationError(
           "Entity statement signature verification failed"
         );
       }
@@ -1411,31 +1585,74 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
       openid_federation_claims: payload
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils14.ValidationError) {
+    if (error instanceof import_io_wallet_utils16.ValidationError) {
       throw error;
     }
     return void 0;
   }
 }
-async function fallbackDiscovery(fetch, baseUrl) {
+async function applyFederationAuthorizationServerSelection(fetch, federationResult, authorizationServer, verifyJwt4) {
+  const credentialIssuer = federationResult.metadata?.openid_credential_issuer?.credential_issuer;
+  const authorizationServers = federationResult.metadata?.openid_credential_issuer?.authorization_servers;
+  let selectedAuthorizationServer;
+  if (authorizationServer) {
+    assertAuthorizationServerAllowed(authorizationServer, authorizationServers);
+    selectedAuthorizationServer = authorizationServer;
+  } else if (authorizationServers && authorizationServers.length > 0) {
+    selectedAuthorizationServer = credentialIssuer && authorizationServers.includes(credentialIssuer) ? credentialIssuer : authorizationServers[0];
+  } else {
+    selectedAuthorizationServer = credentialIssuer;
+  }
+  if (!selectedAuthorizationServer || selectedAuthorizationServer === credentialIssuer) {
+    return federationResult;
+  }
+  const parsedSelectedAuthorizationServer = import_zod15.default.url().safeParse(selectedAuthorizationServer);
+  if (!parsedSelectedAuthorizationServer.success || !parsedSelectedAuthorizationServer.data.startsWith("https://")) {
+    throw new import_io_wallet_utils16.ValidationError(
+      "selected authorization server is not a valid HTTPS URL"
+    );
+  }
+  const authorizationServerResult = await tryFederationDiscovery(
+    fetch,
+    parsedSelectedAuthorizationServer.data,
+    verifyJwt4
+  );
+  const resolvedAuthorizationServer = authorizationServerResult?.metadata?.oauth_authorization_server;
+  if (!resolvedAuthorizationServer) {
+    throw new import_io_wallet_utils16.ValidationError(
+      `Federation discovery did not yield oauth_authorization_server metadata for authorization server '${selectedAuthorizationServer}'`
+    );
+  }
+  return {
+    ...federationResult,
+    authorization_server_federation_claims: authorizationServerResult.openid_federation_claims,
+    metadata: {
+      ...federationResult.metadata,
+      oauth_authorization_server: resolvedAuthorizationServer
+    }
+  };
+}
+async function fallbackDiscovery(fetch, baseUrl, authorizationServer) {
   const issuerUrl = new URL(
     ".well-known/openid-credential-issuer",
     ensureTrailingSlash(baseUrl)
   ).toString();
   const issuerResponse = await fetch(issuerUrl);
-  await (0, import_io_wallet_utils14.hasStatusOrThrow)(200, import_io_wallet_utils14.UnexpectedStatusCodeError)(issuerResponse);
-  const issuerJson = (0, import_io_wallet_utils14.parseWithErrorHandling)(
+  await (0, import_io_wallet_utils16.hasStatusOrThrow)(200, import_io_wallet_utils16.UnexpectedStatusCodeError)(issuerResponse);
+  const issuerJson = (0, import_io_wallet_utils16.parseWithErrorHandling)(
     zPartialIssuerMetadata,
     await issuerResponse.json(),
     "Failed to parse credential issuer metadata"
   );
   const authorizationServers = issuerJson.authorization_servers;
+  assertAuthorizationServerAllowed(authorizationServer, authorizationServers);
   let oauthAuthorizationServer;
   if (authorizationServers && authorizationServers.length > 0) {
-    const parsedUrl = import_zod13.default.url().safeParse(authorizationServers[0]);
+    const selectedAuthorizationServer = authorizationServer ?? authorizationServers[0];
+    const parsedUrl = import_zod15.default.url().safeParse(selectedAuthorizationServer);
     if (!parsedUrl.success || !parsedUrl.data.startsWith("https://")) {
-      throw new import_io_wallet_utils14.ValidationError(
-        "authorization_servers[0] is not a valid HTTPS URL"
+      throw new import_io_wallet_utils16.ValidationError(
+        "selected authorization server is not a valid HTTPS URL"
       );
     }
     const authServerUrl = new URL(
@@ -1443,7 +1660,7 @@ async function fallbackDiscovery(fetch, baseUrl) {
       ensureTrailingSlash(parsedUrl.data)
     ).toString();
     const authServerResponse = await fetch(authServerUrl);
-    await (0, import_io_wallet_utils14.hasStatusOrThrow)(200, import_io_wallet_utils14.UnexpectedStatusCodeError)(authServerResponse);
+    await (0, import_io_wallet_utils16.hasStatusOrThrow)(200, import_io_wallet_utils16.UnexpectedStatusCodeError)(authServerResponse);
     oauthAuthorizationServer = await authServerResponse.json();
   } else {
     oauthAuthorizationServer = issuerJson;
@@ -1457,7 +1674,7 @@ async function fallbackDiscovery(fetch, baseUrl) {
   };
 }
 async function fetchMetadataV1_0(options) {
-  const fetch = (0, import_io_wallet_utils14.createFetcher)(options.callbacks.fetch);
+  const fetch = (0, import_io_wallet_utils16.createFetcher)(options.callbacks.fetch);
   const federationResult = await tryFederationDiscovery(
     fetch,
     options.credentialIssuerUrl,
@@ -1468,43 +1685,52 @@ async function fetchMetadataV1_0(options) {
       `Federation discovery failed for IT Wallet v1.0; no fallback available for credentialIssuerUrl ${options.credentialIssuerUrl}`
     );
   }
-  return (0, import_io_wallet_utils14.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils16.parseWithErrorHandling)(
     zMetadataResponseV1_0,
     federationResult,
     "Failed to parse v1.0 metadata response"
   );
 }
 async function fetchMetadataV1_3(options) {
-  const fetch = (0, import_io_wallet_utils14.createFetcher)(options.callbacks.fetch);
+  const fetch = (0, import_io_wallet_utils16.createFetcher)(options.callbacks.fetch);
   const federationResult = await tryFederationDiscovery(
     fetch,
     options.credentialIssuerUrl,
     options.callbacks.verifyJwt
   );
-  const raw = federationResult ?? await fallbackDiscovery(fetch, options.credentialIssuerUrl);
-  return (0, import_io_wallet_utils14.parseWithErrorHandling)(
+  const raw = federationResult ? await applyFederationAuthorizationServerSelection(
+    fetch,
+    federationResult,
+    options.authorizationServer,
+    options.callbacks.verifyJwt
+  ) : await fallbackDiscovery(
+    fetch,
+    options.credentialIssuerUrl,
+    options.authorizationServer
+  );
+  return (0, import_io_wallet_utils16.parseWithErrorHandling)(
     zMetadataResponseV1_3,
     raw,
     "Failed to parse v1.3 metadata response"
   );
 }
-var dispatchFetchMetadata = (0, import_io_wallet_utils14.createVersionDispatcher)({
-  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_0]: (o) => fetchMetadataV1_0(o),
-  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_3]: (o) => fetchMetadataV1_3(o),
+var dispatchFetchMetadata = (0, import_io_wallet_utils16.createVersionDispatcher)({
+  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_0]: (o) => fetchMetadataV1_0(o),
+  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_3]: (o) => fetchMetadataV1_3(o),
   // V1_4 reuses V1_3 metadata schema — no breaking changes between versions.
-  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_4]: (o) => fetchMetadataV1_3(o)
+  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_4]: (o) => fetchMetadataV1_3(o)
 });
 async function fetchMetadata(options) {
   try {
-    const urlValidation = import_zod13.default.url().safeParse(options.credentialIssuerUrl);
+    const urlValidation = import_zod15.default.url().safeParse(options.credentialIssuerUrl);
     if (!urlValidation.success || !urlValidation.data.startsWith("https://")) {
-      throw new import_io_wallet_utils14.ValidationError(
+      throw new import_io_wallet_utils16.ValidationError(
         "credentialIssuerUrl must be a valid HTTPS URL"
       );
     }
     return await dispatchFetchMetadata(options);
   } catch (error) {
-    if (error instanceof import_io_wallet_utils14.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils14.ValidationError || error instanceof import_io_wallet_utils14.ItWalletSpecsVersionError || error instanceof FetchMetadataError) {
+    if (error instanceof import_io_wallet_utils16.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils16.ValidationError || error instanceof import_io_wallet_utils16.ItWalletSpecsVersionError || error instanceof CredentialOfferError || error instanceof FetchMetadataError) {
       throw error;
     }
     throw new FetchMetadataError("Unexpected error during metadata fetch", {
@@ -1515,7 +1741,7 @@ async function fetchMetadata(options) {
 
 // src/wallet-provider/WalletProvider.ts
 var import_io_wallet_oauth29 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
 function assertV1_0Options(options) {
   if (options.signer.method !== "federation") {
     throw new WalletProviderError(
@@ -1578,7 +1804,7 @@ var WalletProvider = class {
     const { signJwt } = options.callbacks;
     const now = /* @__PURE__ */ new Date();
     const issuedAt = options.issuedAt ?? now;
-    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils15.addSecondsToDate)(now, 3600 * 24 * 360);
+    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils17.addSecondsToDate)(now, 3600 * 24 * 360);
     const header = {
       alg: options.signer.alg,
       kid: options.signer.kid,
@@ -1588,8 +1814,8 @@ var WalletProvider = class {
     };
     const payload = {
       attested_keys: options.attestedKeys,
-      exp: (0, import_io_wallet_utils15.dateToSeconds)(expiresAt),
-      iat: (0, import_io_wallet_utils15.dateToSeconds)(issuedAt),
+      exp: (0, import_io_wallet_utils17.dateToSeconds)(expiresAt),
+      iat: (0, import_io_wallet_utils17.dateToSeconds)(issuedAt),
       iss: options.issuer,
       key_storage: options.keyStorage,
       status: options.status,
@@ -1679,8 +1905,8 @@ var WalletProvider = class {
    * });
    */
   async createItWalletAttestationJwt(options) {
-    return (0, import_io_wallet_utils15.dispatchByVersion)(this.specVersion, {
-      [import_io_wallet_utils15.ItWalletSpecsVersion.V1_0]: () => {
+    return (0, import_io_wallet_utils17.dispatchByVersion)(this.specVersion, {
+      [import_io_wallet_utils17.ItWalletSpecsVersion.V1_0]: () => {
         assertV1_0Options(options);
         return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_0)({
           authenticatorAssuranceLevel: options.authenticatorAssuranceLevel,
@@ -1693,7 +1919,7 @@ var WalletProvider = class {
           walletName: options.walletName
         });
       },
-      [import_io_wallet_utils15.ItWalletSpecsVersion.V1_3]: () => {
+      [import_io_wallet_utils17.ItWalletSpecsVersion.V1_3]: () => {
         assertV1_3Options(options);
         return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_3)({
           callbacks: options.callbacks,
@@ -1707,7 +1933,7 @@ var WalletProvider = class {
           walletName: options.walletName
         });
       },
-      [import_io_wallet_utils15.ItWalletSpecsVersion.V1_4]: () => {
+      [import_io_wallet_utils17.ItWalletSpecsVersion.V1_4]: () => {
         assertV1_4Options(options);
         return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_4)({
           callbacks: options.callbacks,
@@ -1755,8 +1981,14 @@ var WalletProvider = class {
   verifyAuthorizationResponseFormPostJWT,
   verifyCredentialRequestJwtProof,
   verifyKeyAttestationJwt,
+  zAuthorizationCodeGrantV1_3,
+  zAuthorizationCodeGrantV1_4,
   zAuthorizationResponse,
   zCredentialObject,
+  zCredentialOfferGrantsV1_3,
+  zCredentialOfferGrantsV1_4,
+  zCredentialOfferV1_3,
+  zCredentialOfferV1_4,
   zCredentialRequestV1_0,
   zCredentialRequestV1_3,
   zCredentialResponseEncryption,