@pagopa/io-wallet-oauth2 2.0.0-apt → 2.0.0-launchpad

package/dist/index.mjs

@@ -1,66 +1,17 @@
 // src/access-token/create-token-request.ts
-import {
-  ItWalletSpecsVersion,
-  createVersionDispatcher
-} from "@pagopa/io-wallet-utils";
-
-// src/access-token/z-grant-type.ts
-import { z } from "zod";
-var zAuthorizationCodeGrantIdentifier = z.literal("authorization_code");
-var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zPreAuthorizedCodeGrantIdentifier = z.literal(
-  "urn:ietf:params:oauth:grant-type:pre-authorized_code"
-);
-var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = z.literal("refresh_token");
-var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
-
-// src/access-token/create-token-request.ts
-var createTokenRequestV1_4 = (options) => {
-  if (options.grantType === refreshTokenGrantIdentifier) {
-    return {
-      ...options.additionalRequestPayload,
-      grant_type: refreshTokenGrantIdentifier,
-      refresh_token: options.refreshToken,
-      scope: options.scope
-    };
-  }
-  return {
-    ...options.additionalRequestPayload,
-    code: options.authorizationCode,
-    code_verifier: options.pkceCodeVerifier,
-    grant_type: authorizationCodeGrantIdentifier,
-    redirect_uri: options.redirectUri
-  };
-};
-function createTokenRequestAPTITUDE(options) {
-  if (options.grantType === preAuthorizedCodeGrantIdentifier) {
-    return {
-      ...options.additionalRequestPayload,
-      grant_type: preAuthorizedCodeGrantIdentifier,
-      "pre-authorized_code": options.preAuthorizedCode,
-      tx_code: options.txCode
-    };
-  }
-  return createTokenRequestV1_4(options);
-}
-var dispatchCreateTokenRequest = createVersionDispatcher({
-  [ItWalletSpecsVersion.APTITUDE]: (o) => createTokenRequestAPTITUDE(o),
-  [ItWalletSpecsVersion.V1_0]: (o) => createTokenRequestV1_4(o),
-  [ItWalletSpecsVersion.V1_3]: (o) => createTokenRequestV1_4(o),
-  [ItWalletSpecsVersion.V1_4]: (o) => createTokenRequestV1_4(o)
+var createTokenRequest = async (options) => ({
+  ...options.additionalRequestPayload,
+  code: options.authorizationCode,
+  code_verifier: options.pkceCodeVerifier,
+  grant_type: "authorization_code",
+  redirect_uri: options.redirectUri
 });
-function createTokenRequest(options) {
-  return dispatchCreateTokenRequest(options);
-}
 
 // src/access-token/create-token-response.ts
 import {
   HashAlgorithm,
-  ItWalletSpecsVersion as ItWalletSpecsVersion2,
   addSecondsToDate,
   calculateJwkThumbprint,
-  createVersionDispatcher as createVersionDispatcher2,
   dateToSeconds,
   jwtHeaderFromJwtSigner,
   parseWithErrorHandling
@@ -128,82 +79,70 @@ import {
   zJwtHeader,
   zJwtPayload
 } from "@pagopa/io-wallet-utils";
-import { z as z2 } from "zod";
-var zPreAuthorizedCodeTokenRequest = z2.object({
-  grant_type: zPreAuthorizedCodeGrantIdentifier,
-  "pre-authorized_code": z2.string().nonempty(),
-  tx_code: z2.string().optional()
-});
-var zAuthorizationCodeTokenRequest = z2.object({
-  code: z2.string().nonempty(),
-  code_verifier: z2.string().nonempty(),
-  grant_type: zAuthorizationCodeGrantIdentifier,
-  redirect_uri: z2.string().nonempty()
-});
-var zRefreshTokenTokenRequest = z2.object({
-  grant_type: zRefreshTokenGrantIdentifier,
-  refresh_token: z2.string().nonempty(),
-  scope: z2.string().optional()
-});
-var zAccessTokenRequest = z2.discriminatedUnion("grant_type", [
-  zAuthorizationCodeTokenRequest,
-  zRefreshTokenTokenRequest
-]);
-var zAccessTokenRequestAPTITUDE = z2.discriminatedUnion("grant_type", [
-  zAuthorizationCodeTokenRequest,
-  zRefreshTokenTokenRequest,
-  zPreAuthorizedCodeTokenRequest
+import { z } from "zod";
+var zAccessTokenRequest = z.discriminatedUnion("grant_type", [
+  z.object({
+    code: z.string().nonempty(),
+    code_verifier: z.string().nonempty(),
+    grant_type: z.literal("authorization_code"),
+    redirect_uri: z.string().nonempty()
+  }),
+  z.object({
+    grant_type: z.literal("refresh_token"),
+    refresh_token: z.string().nonempty(),
+    scope: z.string().optional()
+  })
 ]);
-var zAccessTokenResponse = z2.looseObject({
-  access_token: z2.string(),
-  authorization_details: z2.array(
-    z2.looseObject({
-      credential_configuration_id: z2.optional(z2.string()),
-      credential_identifiers: z2.optional(z2.array(z2.string())),
-      type: z2.literal("openid_credential")
+var zAccessTokenResponse = z.looseObject({
+  access_token: z.string(),
+  authorization_details: z.array(
+    z.looseObject({
+      credential_configuration_id: z.optional(z.string()),
+      credential_identifiers: z.optional(z.array(z.string())),
+      type: z.literal("openid_credential")
     })
   ).optional(),
-  expires_in: z2.optional(z2.number().int()),
-  refresh_token: z2.optional(z2.string()),
-  token_type: z2.union([z2.literal("Bearer"), z2.literal("DPoP")])
+  expires_in: z.optional(z.number().int()),
+  refresh_token: z.optional(z.string()),
+  token_type: z.union([z.literal("Bearer"), z.literal("DPoP")])
 });
-var zAccessTokenProfileJwtHeader = z2.looseObject({
+var zAccessTokenProfileJwtHeader = z.looseObject({
   ...zJwtHeader.shape,
-  typ: z2.enum(["application/at+jwt", "at+jwt"])
+  typ: z.enum(["application/at+jwt", "at+jwt"])
 });
-var zAccessTokenProfileJwtPayload = z2.looseObject({
+var zAccessTokenProfileJwtPayload = z.looseObject({
   ...zJwtPayload.shape,
-  aud: z2.string(),
-  client_id: z2.string(),
-  cnf: z2.object({
-    jkt: z2.string()
+  aud: z.string(),
+  client_id: z.string(),
+  cnf: z.object({
+    jkt: z.string()
   }).optional(),
-  exp: z2.number(),
-  iat: z2.number(),
-  iss: z2.string(),
-  jti: z2.string().max(MAX_JTI_LENGTH),
-  nbf: z2.number().optional(),
-  scope: z2.string().optional(),
-  sub: z2.string()
+  exp: z.number(),
+  iat: z.number(),
+  iss: z.string(),
+  jti: z.string().max(MAX_JTI_LENGTH),
+  nbf: z.number().optional(),
+  scope: z.string().optional(),
+  sub: z.string()
 });
-var zRefreshTokenProfileJwtHeader = z2.looseObject({
+var zRefreshTokenProfileJwtHeader = z.looseObject({
   ...zJwtHeader.shape,
-  kid: z2.string(),
-  typ: z2.literal("rt+jwt")
+  kid: z.string(),
+  typ: z.literal("rt+jwt")
 });
-var zRefreshTokenProfileJwtPayload = z2.looseObject({
+var zRefreshTokenProfileJwtPayload = z.looseObject({
   ...zJwtPayload.shape,
-  aud: z2.string(),
-  client_id: z2.string(),
-  cnf: z2.object({
-    jkt: z2.string()
+  aud: z.string(),
+  client_id: z.string(),
+  cnf: z.object({
+    jkt: z.string()
   }),
-  exp: z2.number().int(),
-  iat: z2.number().int(),
-  iss: z2.string(),
-  jti: z2.string().max(MAX_JTI_LENGTH),
-  nbf: z2.number().int(),
-  sub: z2.string()
+  exp: z.number().int(),
+  iat: z.number().int(),
+  iss: z.string(),
+  jti: z.string().max(MAX_JTI_LENGTH),
+  nbf: z.number().int(),
+  sub: z.string()
 });
 
 // src/access-token/create-token-response.ts
@@ -232,7 +171,7 @@ function resolveRefreshTokenKid(signer) {
   }
   return void 0;
 }
-async function createAccessTokenResponseV1_4(options) {
+async function createAccessTokenResponse(options) {
   try {
     const now = options.now ?? /* @__PURE__ */ new Date();
     if (options.tokenType === "DPoP" && !options.dpop) {
@@ -338,29 +277,18 @@ async function createAccessTokenResponseV1_4(options) {
     );
   }
 }
-var dispatchCreateAccessTokenResponse = createVersionDispatcher2({
-  [ItWalletSpecsVersion2.APTITUDE]: (o) => createAccessTokenResponseV1_4(o),
-  [ItWalletSpecsVersion2.V1_0]: (o) => createAccessTokenResponseV1_4(o),
-  [ItWalletSpecsVersion2.V1_3]: (o) => createAccessTokenResponseV1_4(o),
-  [ItWalletSpecsVersion2.V1_4]: (o) => createAccessTokenResponseV1_4(o)
-});
-function createAccessTokenResponse(options) {
-  return dispatchCreateAccessTokenResponse(options);
-}
 
 // src/access-token/fetch-token-response.ts
 import {
   CONTENT_TYPES,
   HEADERS,
-  ItWalletSpecsVersion as ItWalletSpecsVersion3,
   UnexpectedStatusCodeError,
   ValidationError,
   createFetcher,
-  createVersionDispatcher as createVersionDispatcher3,
   hasStatusOrThrow,
   parseWithErrorHandling as parseWithErrorHandling2
 } from "@pagopa/io-wallet-utils";
-async function fetchTokenResponseV1_4(options) {
+async function fetchTokenResponse(options) {
   try {
     const fetch = createFetcher(options.callbacks.fetch);
     const tokenResponse = await fetch(options.accessTokenEndpoint, {
@@ -399,43 +327,26 @@ function toURLSearchParams(data) {
   });
   return params;
 }
-var dispatchFetchTokenResponse = createVersionDispatcher3({
-  [ItWalletSpecsVersion3.APTITUDE]: (o) => fetchTokenResponseV1_4(o),
-  [ItWalletSpecsVersion3.V1_0]: (o) => fetchTokenResponseV1_4(
-    o
-  ),
-  [ItWalletSpecsVersion3.V1_3]: (o) => fetchTokenResponseV1_4(
-    o
-  ),
-  [ItWalletSpecsVersion3.V1_4]: (o) => fetchTokenResponseV1_4(
-    o
-  )
-});
-function fetchTokenResponse(options) {
-  return dispatchFetchTokenResponse(options);
-}
 
 // src/access-token/parse-token-request.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion5,
-  createVersionDispatcher as createVersionDispatcher5,
   formatZodError
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/wallet-attestation.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion4,
-  createVersionDispatcher as createVersionDispatcher4,
+  ItWalletSpecsVersion,
+  createVersionDispatcher,
   zCompactJwt
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/types.ts
-import z3 from "zod";
-var zOauthClientAttestationHeader = z3.literal(
+import z2 from "zod";
+var zOauthClientAttestationHeader = z2.literal(
   "OAuth-Client-Attestation"
 );
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = z3.literal(
+var zOauthClientAttestationPopHeader = z2.literal(
   "OAuth-Client-Attestation-PoP"
 );
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
@@ -472,27 +383,27 @@ import {
   zJwtPayload as zJwtPayload2,
   zTrustChain
 } from "@pagopa/io-wallet-utils";
-import { z as z4 } from "zod";
-var zWalletAttestationJwtHeaderV1_0 = z4.looseObject({
+import { z as z3 } from "zod";
+var zWalletAttestationJwtHeaderV1_0 = z3.looseObject({
   ...zJwtHeader2.shape,
   trust_chain: zTrustChain,
   // REQUIRED in v1.0
-  typ: z4.literal("oauth-client-attestation+jwt")
+  typ: z3.literal("oauth-client-attestation+jwt")
 });
-var zWalletAttestationJwtPayloadV1_0 = z4.looseObject({
+var zWalletAttestationJwtPayloadV1_0 = z3.looseObject({
   ...zJwtPayload2.shape,
-  aal: z4.string(),
-  cnf: z4.object({
+  aal: z3.string(),
+  cnf: z3.object({
     jwk: zJwk
   }),
-  exp: z4.number(),
-  iat: z4.number(),
-  iss: z4.string(),
-  sub: z4.string(),
-  wallet_link: z4.url().optional(),
-  wallet_name: z4.string().optional()
+  exp: z3.number(),
+  iat: z3.number(),
+  iss: z3.string(),
+  sub: z3.string(),
+  wallet_link: z3.url().optional(),
+  wallet_name: z3.string().optional()
 });
-var zWalletAttestationJwtV1_0 = z4.string().min(1);
+var zWalletAttestationJwtV1_0 = z3.string().min(1);
 
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
@@ -511,37 +422,37 @@ import {
   zJwtPayload as zJwtPayload3,
   zTrustChain as zTrustChain2
 } from "@pagopa/io-wallet-utils";
-import { z as z5 } from "zod";
-var zWalletAttestationJwtHeaderV1_3 = z5.looseObject({
+import { z as z4 } from "zod";
+var zWalletAttestationJwtHeaderV1_3 = z4.looseObject({
   ...zJwtHeader3.shape,
   trust_chain: zTrustChain2.optional(),
   // OPTIONAL in v1.3
-  typ: z5.literal("oauth-client-attestation+jwt"),
+  typ: z4.literal("oauth-client-attestation+jwt"),
   x5c: zCertificateChain
   // REQUIRED in v1.3
 });
-var zWalletAttestationJwtPayloadV1_3 = z5.looseObject({
+var zWalletAttestationJwtPayloadV1_3 = z4.looseObject({
   ...zJwtPayload3.shape,
-  cnf: z5.object({
+  cnf: z4.object({
     jwk: zJwk2
   }),
-  exp: z5.number(),
-  iat: z5.number(),
-  iss: z5.string(),
-  nbf: z5.number().optional(),
+  exp: z4.number(),
+  iat: z4.number(),
+  iss: z4.string(),
+  nbf: z4.number().optional(),
   // NEW in v1.3
-  status: z5.object({
-    status_list: z5.object({
-      idx: z5.number().int(),
-      uri: z5.string()
+  status: z4.object({
+    status_list: z4.object({
+      idx: z4.number().int(),
+      uri: z4.string()
     })
   }).optional(),
   // NEW in v1.3 - status object for revocation
-  sub: z5.string(),
-  wallet_link: z5.url().optional(),
-  wallet_name: z5.string().optional()
+  sub: z4.string(),
+  wallet_link: z4.url().optional(),
+  wallet_name: z4.string().optional()
 });
-var zWalletAttestationJwtV1_3 = z5.string().min(1);
+var zWalletAttestationJwtV1_3 = z4.string().min(1);
 
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
@@ -560,28 +471,28 @@ import {
   zJwtPayload as zJwtPayload4,
   zTrustChain as zTrustChain3
 } from "@pagopa/io-wallet-utils";
-import { z as z6 } from "zod";
-var zWalletAttestationJwtHeaderV1_4 = z6.looseObject({
+import { z as z5 } from "zod";
+var zWalletAttestationJwtHeaderV1_4 = z5.looseObject({
   ...zJwtHeader4.shape,
-  kid: z6.string(),
+  kid: z5.string(),
   trust_chain: zTrustChain3.optional(),
-  typ: z6.literal("oauth-client-attestation+jwt"),
+  typ: z5.literal("oauth-client-attestation+jwt"),
   x5c: zCertificateChain2
 });
-var zWalletAttestationJwtPayloadV1_4 = z6.looseObject({
+var zWalletAttestationJwtPayloadV1_4 = z5.looseObject({
   ...zJwtPayload4.shape,
-  cnf: z6.object({
+  cnf: z5.object({
     jwk: zJwk3
   }),
-  exp: z6.number().int(),
-  iat: z6.number().int(),
-  iss: z6.string(),
-  nbf: z6.number().optional(),
-  sub: z6.string(),
-  wallet_link: z6.url(),
-  wallet_name: z6.string()
+  exp: z5.number().int(),
+  iat: z5.number().int(),
+  iss: z5.string(),
+  nbf: z5.number().optional(),
+  sub: z5.string(),
+  wallet_link: z5.url(),
+  wallet_name: z5.string()
 });
-var zWalletAttestationJwtV1_4 = z6.string().min(1);
+var zWalletAttestationJwtV1_4 = z5.string().min(1);
 
 // src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt3(options) {
@@ -593,11 +504,10 @@ async function verifyWalletAttestationJwt3(options) {
 }
 
 // src/client-attestation/wallet-attestation.ts
-var dispatchVerifyWalletAttestationJwt = createVersionDispatcher4({
-  [ItWalletSpecsVersion4.APTITUDE]: (o) => verifyWalletAttestationJwt3(o),
-  [ItWalletSpecsVersion4.V1_0]: (o) => verifyWalletAttestationJwt(o),
-  [ItWalletSpecsVersion4.V1_3]: (o) => verifyWalletAttestationJwt2(o),
-  [ItWalletSpecsVersion4.V1_4]: (o) => verifyWalletAttestationJwt3(o)
+var dispatchVerifyWalletAttestationJwt = createVersionDispatcher({
+  [ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
+  [ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
+  [ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
 });
 async function verifyWalletAttestationJwt4(options) {
   return dispatchVerifyWalletAttestationJwt(options);
@@ -651,19 +561,19 @@ import {
   zJwtHeader as zJwtHeader5,
   zJwtPayload as zJwtPayload5
 } from "@pagopa/io-wallet-utils";
-import z7 from "zod";
-var zDpopJwtPayload = z7.looseObject({
+import z6 from "zod";
+var zDpopJwtPayload = z6.looseObject({
   ...zJwtPayload5.shape,
-  ath: z7.optional(z7.string()),
+  ath: z6.optional(z6.string()),
   htm: zHttpMethod,
-  htu: z7.url(),
-  iat: z7.number().int().nonnegative(),
-  jti: z7.string().max(MAX_JTI_LENGTH2)
+  htu: z6.url(),
+  iat: z6.number().int().nonnegative(),
+  jti: z6.string().max(MAX_JTI_LENGTH2)
 });
-var zDpopJwtHeader = z7.looseObject({
+var zDpopJwtHeader = z6.looseObject({
   ...zJwtHeader5.shape,
   jwk: zJwk4,
-  typ: z7.literal("dpop+jwt")
+  typ: z6.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
@@ -720,8 +630,15 @@ function extractDpopJwtFromHeaders(headers) {
   return { dpopJwt, valid: true };
 }
 
+// src/access-token/z-grant-type.ts
+import { z as z7 } from "zod";
+var zAuthorizationCodeGrantIdentifier = z7.literal("authorization_code");
+var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
+var zRefreshTokenGrantIdentifier = z7.literal("refresh_token");
+var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
+
 // src/access-token/parse-token-request.ts
-function parseAccessTokenRequestV1_4(options) {
+function parseAccessTokenRequest(options) {
   const validationResult = zAccessTokenRequest.safeParse(
     options.accessTokenRequest
   );
@@ -742,25 +659,6 @@ ${formatZodError(validationResult.error)}`
     ...securityHeaders
   };
 }
-function parseAccessTokenRequestAPTITUDE(options) {
-  const validationResult = zAccessTokenRequestAPTITUDE.safeParse(
-    options.accessTokenRequest
-  );
-  if (!validationResult.success) {
-    throw new Oauth2Error(
-      `Access token request validation failed:
-${formatZodError(validationResult.error)}`
-    );
-  }
-  const accessTokenRequest = validationResult.data;
-  const grant = parseGrantParametersAPTITUDE(accessTokenRequest);
-  const securityHeaders = parseSecurityHeaders(options.request.headers);
-  return {
-    accessTokenRequest,
-    grant,
-    ...securityHeaders
-  };
-}
 function parseGrantParameters(accessTokenRequest) {
   if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
     return {
@@ -778,30 +676,6 @@ function parseGrantParameters(accessTokenRequest) {
     `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}'`
   );
 }
-function parseGrantParametersAPTITUDE(accessTokenRequest) {
-  if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
-    return {
-      code: accessTokenRequest.code,
-      grantType: authorizationCodeGrantIdentifier
-    };
-  }
-  if (accessTokenRequest.grant_type === refreshTokenGrantIdentifier) {
-    return {
-      grantType: refreshTokenGrantIdentifier,
-      refreshToken: accessTokenRequest.refresh_token
-    };
-  }
-  if (accessTokenRequest.grant_type === preAuthorizedCodeGrantIdentifier) {
-    return {
-      grantType: preAuthorizedCodeGrantIdentifier,
-      preAuthorizedCode: accessTokenRequest["pre-authorized_code"],
-      txCode: accessTokenRequest.tx_code
-    };
-  }
-  throw new Oauth2Error(
-    `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}', '${preAuthorizedCodeGrantIdentifier}'`
-  );
-}
 function parseSecurityHeaders(headers) {
   const extractedDpopJwt = extractDpopJwtFromHeaders(headers);
   if (!extractedDpopJwt.valid) {
@@ -836,29 +710,6 @@ function parseSecurityHeaders(headers) {
     dpop: { jwt: extractedDpopJwt.dpopJwt }
   };
 }
-var dispatchParseTokenRequest = createVersionDispatcher5({
-  [ItWalletSpecsVersion5.APTITUDE]: (o) => parseAccessTokenRequestAPTITUDE(
-    o
-  ),
-  [ItWalletSpecsVersion5.V1_0]: (o) => parseAccessTokenRequestV1_4(
-    o
-  ),
-  [ItWalletSpecsVersion5.V1_3]: (o) => parseAccessTokenRequestV1_4(
-    o
-  ),
-  [ItWalletSpecsVersion5.V1_4]: (o) => parseAccessTokenRequestV1_4(
-    o
-  )
-});
-function parseAccessTokenRequest(options) {
-  return dispatchParseTokenRequest(options);
-}
-
-// src/access-token/verify-access-token-request.ts
-import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion7,
-  createVersionDispatcher as createVersionDispatcher6
-} from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/verify-client-attestation.ts
 import {
@@ -868,7 +719,7 @@ import {
 
 // src/client-attestation/client-attestation-pop.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion6,
+  ItWalletSpecsVersion as ItWalletSpecsVersion2,
   addSecondsToDate as addSecondsToDate2,
   dateToSeconds as dateToSeconds3,
   decodeJwt as decodeJwt2,
@@ -995,7 +846,7 @@ async function createClientAttestationPopJwt(options) {
         iat: dateToSeconds3(issuedAt),
         iss: sub,
         jti,
-        ...options.config.itWalletSpecsVersion === ItWalletSpecsVersion6.V1_0 ? {
+        ...options.config.itWalletSpecsVersion === ItWalletSpecsVersion2.V1_0 ? {
           exp: dateToSeconds3(
             "expiresAt" in options && options.expiresAt ? options.expiresAt : addSecondsToDate2(issuedAt, 1 * 60)
           )
@@ -1229,7 +1080,7 @@ async function verifyTokenDPoP(options) {
 }
 
 // src/access-token/verify-access-token-request.ts
-async function verifyAccessTokenRequestV1_4(options) {
+async function verifyAccessTokenRequest(options) {
   if (options.dpop.expectedNonce === "") {
     throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
@@ -1258,44 +1109,12 @@ async function verifyAccessTokenRequestV1_4(options) {
   if (options.grant.code !== options.expectedCode) {
     throw new Oauth2Error(`Invalid 'code' provided`);
   }
-  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
-  if (!header.jwk) {
-    throw new Oauth2Error("DPoP header does not contain a JWK");
-  }
-  return {
-    clientAttestation: clientAttestationResult,
-    dpop: { jwk: header.jwk, jwkThumbprint }
-  };
-}
-async function verifyAccessTokenRequestAPTITUDE(options) {
-  if (options.dpop.expectedNonce === "") {
-    throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
-  }
-  if (!isPreAuthorizedCodeVerification(options)) {
-    await verifyPkce({
-      callbacks: options.callbacks,
-      codeChallenge: options.pkce.codeChallenge,
-      codeChallengeMethod: options.pkce.codeChallengeMethod,
-      codeVerifier: options.pkce.codeVerifier
-    });
+  if (options.codeExpiresAt) {
+    const now = options.now ?? /* @__PURE__ */ new Date();
+    if (now.getTime() > options.codeExpiresAt.getTime()) {
+      throw new Oauth2Error(`Expired 'code' provided`);
+    }
   }
-  const { header, jwkThumbprint } = await verifyTokenDPoP({
-    allowedSigningAlgs: options.dpop.allowedSigningAlgs,
-    callbacks: options.callbacks,
-    dpopJwt: options.dpop.jwt,
-    expectedNonce: options.dpop.expectedNonce,
-    now: options.now,
-    request: options.request
-  });
-  const clientAttestationResult = await verifyClientAttestation({
-    authorizationServerMetadata: options.authorizationServerMetadata,
-    callbacks: options.callbacks,
-    clientAttestation: options.clientAttestation,
-    config: options.config,
-    dpopJwkThumbprint: jwkThumbprint,
-    now: options.now
-  });
-  verifyGrantParameters(options);
   if (!header.jwk) {
     throw new Oauth2Error("DPoP header does not contain a JWK");
   }
@@ -1304,73 +1123,10 @@ async function verifyAccessTokenRequestAPTITUDE(options) {
     dpop: { jwk: header.jwk, jwkThumbprint }
   };
 }
-function isPreAuthorizedCodeVerification(options) {
-  return options.grant.grantType === preAuthorizedCodeGrantIdentifier;
-}
-function verifyGrantParameters(options) {
-  if (isPreAuthorizedCodeVerification(options)) {
-    if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) {
-      throw new Oauth2Error(`Invalid 'pre-authorized_code' provided`);
-    }
-    verifyTransactionCode(options.grant.txCode, options.expectedTxCode);
-    verifyCodeExpiration(
-      options.preAuthorizedCodeExpiresAt,
-      options.now,
-      "pre-authorized_code"
-    );
-    return;
-  }
-  if (options.grant.grantType !== authorizationCodeGrantIdentifier) {
-    throw new Oauth2Error(
-      "Only authorization_code and pre-authorized_code grants can be verified"
-    );
-  }
-  if (options.grant.code !== options.expectedCode) {
-    throw new Oauth2Error(`Invalid 'code' provided`);
-  }
-  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
-}
-function verifyTransactionCode(txCode, expectedTxCode) {
-  if (txCode === expectedTxCode) return;
-  if (expectedTxCode === void 0) {
-    throw new Oauth2Error("Request contains 'tx_code' that was not expected");
-  }
-  if (txCode === void 0) {
-    throw new Oauth2Error("Missing required 'tx_code' in request");
-  }
-  throw new Oauth2Error("Invalid 'tx_code' provided");
-}
-function verifyCodeExpiration(expiresAt, date, codeParameter) {
-  if (!expiresAt) return;
-  if (Number.isNaN(expiresAt.getTime())) {
-    throw new Oauth2Error(`Invalid expiration date for '${codeParameter}'`);
-  }
-  const now = date ?? /* @__PURE__ */ new Date();
-  if (now.getTime() > expiresAt.getTime()) {
-    throw new Oauth2Error(`Expired '${codeParameter}' provided`);
-  }
-}
-var dispatchVerifyAccessTokenRequest = createVersionDispatcher6({
-  [ItWalletSpecsVersion7.APTITUDE]: (o) => verifyAccessTokenRequestAPTITUDE(
-    o
-  ),
-  [ItWalletSpecsVersion7.V1_0]: (o) => verifyAccessTokenRequestV1_4(
-    o
-  ),
-  [ItWalletSpecsVersion7.V1_3]: (o) => verifyAccessTokenRequestV1_4(
-    o
-  ),
-  [ItWalletSpecsVersion7.V1_4]: (o) => verifyAccessTokenRequestV1_4(
-    o
-  )
-});
-function verifyAccessTokenRequest(options) {
-  return dispatchVerifyAccessTokenRequest(options);
-}
 
 // src/authorization-request/create-authorization-request.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion8,
+  ItWalletSpecsVersion as ItWalletSpecsVersion3,
   addSecondsToDate as addSecondsToDate3,
   dateToSeconds as dateToSeconds4,
   dispatchByVersion,
@@ -1526,19 +1282,16 @@ async function createPushedAuthorizationRequest(options) {
 }
 function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
   return dispatchByVersion(options.config.itWalletSpecsVersion, {
-    [ItWalletSpecsVersion8.APTITUDE]: () => zAuthorizationRequestV1_3.parse(
-      baseAuthorizationRequest
-    ),
-    [ItWalletSpecsVersion8.V1_0]: () => zAuthorizationRequestV1_0.parse({
+    [ItWalletSpecsVersion3.V1_0]: () => zAuthorizationRequestV1_0.parse({
       ...baseAuthorizationRequest,
       response_mode: options.responseMode
     }),
-    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
-    [ItWalletSpecsVersion8.V1_3]: () => zAuthorizationRequestV1_3.parse(
+    [ItWalletSpecsVersion3.V1_3]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     ),
+    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [ItWalletSpecsVersion8.V1_4]: () => zAuthorizationRequestV1_3.parse(
+    [ItWalletSpecsVersion3.V1_4]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     )
   });
@@ -1634,7 +1387,7 @@ function parseAuthorizationRequest(options) {
 
 // src/authorization-request/parse-pushed-authorization-request.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion9,
+  ItWalletSpecsVersion as ItWalletSpecsVersion4,
   decodeJwt as decodeJwt4,
   dispatchByVersion as dispatchByVersion2,
   formatZodError as formatZodError2,
@@ -1783,12 +1536,11 @@ ${formatZodError2(parsedAuthorizationRequest.error)}`
 }
 function getAuthorizationRequestSchema(config) {
   return dispatchByVersion2(config.itWalletSpecsVersion, {
-    [ItWalletSpecsVersion9.APTITUDE]: () => zAuthorizationRequestV1_3,
-    [ItWalletSpecsVersion9.V1_0]: () => zAuthorizationRequestV1_0,
+    [ItWalletSpecsVersion4.V1_0]: () => zAuthorizationRequestV1_0,
+    [ItWalletSpecsVersion4.V1_3]: () => zAuthorizationRequestV1_3,
     // V1_4 reuses V1_3 PAR schema — no breaking changes between versions.
-    [ItWalletSpecsVersion9.V1_3]: () => zAuthorizationRequestV1_3,
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [ItWalletSpecsVersion9.V1_4]: () => zAuthorizationRequestV1_3
+    [ItWalletSpecsVersion4.V1_4]: () => zAuthorizationRequestV1_3
   });
 }
 
@@ -2620,8 +2372,6 @@ export {
   createPushedAuthorizationRequest,
   createTokenDPoP,
   createTokenRequest,
-  createTokenRequestAPTITUDE,
-  createTokenRequestV1_4,
   createWalletAttestationJwt as createWalletAttestationJwtV1_0,
   createWalletAttestationJwt2 as createWalletAttestationJwtV1_3,
   createWalletAttestationJwt3 as createWalletAttestationJwtV1_4,
@@ -2644,7 +2394,6 @@ export {
   parseJarRequest,
   parseMrtdChallenge,
   parsePushedAuthorizationRequest,
-  preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier,
   signedAuthorizationRequestJwtHeaderTyp,
   toURLSearchParams,
@@ -2665,10 +2414,8 @@ export {
   zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
-  zAccessTokenRequestAPTITUDE,
   zAccessTokenResponse,
   zAuthorizationCodeGrantIdentifier,
-  zAuthorizationCodeTokenRequest,
   zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3,
   zDpopJwtHeader,
@@ -2687,8 +2434,6 @@ export {
   zMrtdPopVerifyResponse,
   zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload,
-  zPreAuthorizedCodeGrantIdentifier,
-  zPreAuthorizedCodeTokenRequest,
   zPushedAuthorizationRequestSigned,
   zPushedAuthorizationRequestUnsignedV1_0,
   zPushedAuthorizationRequestUnsignedV1_3,
@@ -2696,7 +2441,6 @@ export {
   zRefreshTokenGrantIdentifier,
   zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload,
-  zRefreshTokenTokenRequest,
   zSignedAuthorizationRequestJwtHeaderTyp,
   zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3,