@pagopa/io-wallet-oauth2 2.0.0-launchpad → 2.0.1-apt

package/dist/index.d.ts

@@ -1,152 +1,33 @@
 import * as _pagopa_io_wallet_utils from '@pagopa/io-wallet-utils';
-import { CallbackContext, Jwk, JwtSigner, RequestLike, ItWalletSpecsVersion, IoWalletSdkConfig, JwtSignerJwk, JwtPayload, FetchHeaders, RequestDpopOptions, decodeJwt, JwtSignerWithJwk, ClientAuthenticationCallback as ClientAuthenticationCallback$1, ClientAuthenticationCallbackOptions as ClientAuthenticationCallbackOptions$1, JweEncryptor, Fetch, DecodeJwtResult, HttpMethod } from '@pagopa/io-wallet-utils';
+import { IoWalletSdkConfig, ItWalletSpecsVersion, CallbackContext, Jwk, JwtSigner, RequestLike, JwtSignerJwk, JwtPayload, FetchHeaders, RequestDpopOptions, decodeJwt, JwtSignerWithJwk, ClientAuthenticationCallback as ClientAuthenticationCallback$1, ClientAuthenticationCallbackOptions as ClientAuthenticationCallbackOptions$1, JweEncryptor, Fetch, DecodeJwtResult, HttpMethod } from '@pagopa/io-wallet-utils';
 import z$1, { z } from 'zod';
 
-interface RetrieveAuthorizationCodeAccessTokenOptions {
-    /**
-     * Additional payload to include in the access token request. Items will be encoded and sent
-     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
-     */
-    additionalRequestPayload?: Record<string, unknown>;
-    /**
-     * The authorization code
-     */
-    authorizationCode: string;
-    /**
-     * Callbacks to use for requesting access token
-     */
-    callbacks: Pick<CallbackContext, "clientAuthentication" | "fetch" | "generateRandom" | "hash" | "signJwt">;
-    /**
-     * PKCE Code verifier that was used in the authorization request.
-     */
-    pkceCodeVerifier: string;
-    /**
-     * Redirect uri to include in the access token request.
-     * It MUST be set as in the Request Object.
-     */
-    redirectUri: string;
-}
-/**
- * Creates an OAuth 2.0 authorization-code access token request body.
- *
- * @param options - Access token request inputs.
- * @param options.additionalRequestPayload - Extra form fields to include in the token request.
- * @param options.authorizationCode - Authorization code received from the authorization response.
- * @param options.pkceCodeVerifier - PKCE verifier associated with the authorization request.
- * @param options.redirectUri - Redirect URI used in the authorization request.
- * @returns URL-form-encodable authorization-code grant request data.
- */
-declare const createTokenRequest: (options: RetrieveAuthorizationCodeAccessTokenOptions) => Promise<{
-    code: string;
-    code_verifier: string;
-    grant_type: "authorization_code";
-    redirect_uri: string;
-}>;
-
-interface CreateAccessTokenResponseOptions {
-    /**
-     * Additional claims copied into both the access token JWT payload and token
-     * response envelope.
-     */
-    additionalPayload?: Record<string, unknown>;
-    /**
-     * Intended recipient of the access token (`aud` claim).
-     */
-    audience: string;
-    /**
-     * Authorization server identifier (`iss` claim).
-     */
-    authorizationServer: string;
-    /**
-     * Runtime callbacks used to generate random values, compute JWK thumbprints,
-     * and sign the access token JWT.
-     */
-    callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">;
-    /**
-     * OAuth client identifier (`client_id` claim).
-     */
-    clientId: string;
-    /**
-     * DPoP public key used to bind the access token (`cnf.jkt` claim).
-     */
-    dpop?: {
-        jwk: Jwk;
-    };
-    /**
-     * Access token lifetime in seconds, used for both `exp` and `expires_in`.
-     */
-    expiresInSeconds: number;
-    /**
-     * Optional "not before" timestamp in epoch seconds (`nbf` claim).
-     */
-    nbf?: number;
-    /**
-     * Reference time used for `iat` and `exp`. Defaults to current time.
-     */
-    now?: Date;
-    /**
-     * Requests issuance of a DPoP-bound Refresh Token JWT by specifying its
-     * lifetime in seconds. The Refresh Token `exp` is set to `now +
-     * refreshTokenExpiresInSeconds` and must be later than the Access Token
-     * `exp` (`nbf` of the Refresh Token).
-     *
-     * Requires `tokenType` to be `DPoP` and `dpop` to be provided. Omit this
-     * option to keep the specification's optional Refresh Token behavior
-     * (e.g. Bearer-only PDND responses).
-     */
-    refreshTokenExpiresInSeconds?: number;
-    /**
-     * Optional scope string included in both the access token JWT payload and token
-     * response envelope.
-     */
-    scope?: string;
-    /**
-     * Signer used to produce the access token JWT.
-     */
-    signer: JwtSigner;
-    /**
-     * Subject identifier represented by the access token (`sub` claim).
-     */
-    subject: string;
-    /**
-     * Token type returned in the OAuth token response.
-     * NOTE: When using `Bearer` it is supposed to be used only for PDND Interoperability API, not for credential issuance flows.
-     */
-    tokenType: "Bearer" | "DPoP";
-}
-/**
- * Creates an OAuth 2.0 access token response where `access_token` is a signed
- * JWT access token profile (`typ=at+jwt`) and `token_type` is `DPoP` or `Bearer`.
- *
- * The JWT payload always includes `aud`, `iss`, `sub`, `client_id`, `iat`,
- * `exp`, and a random `jti`. When `dpop` is provided, `cnf.jkt` is added using
- * the SHA-256 JWK thumbprint.
- *
- * When `refreshTokenExpiresInSeconds` is provided, a DPoP-bound Refresh Token
- * JWT (`typ=rt+jwt`) is generated, signed, and returned as `refresh_token`.
- * Refresh Token issuance requires `tokenType` to be `DPoP` with a `dpop`
- * public key, and results in `nbf` equal to the Access Token `exp` and `exp`
- * later than that.
- *
- * @param options - Access token response creation options.
- * @returns OAuth token response with a signed access token JWT, and a signed Refresh Token JWT when requested.
- * @throws {CreateTokenResponseError} If DPoP binding is required but missing, if Refresh Token issuance is requested without a valid DPoP configuration or lifetime, if the signer has no resolvable `kid` for the Refresh Token, or if response creation otherwise fails, including validation failures from the generated JWT headers or payloads.
- * @throws {ValidationError} If the generated JWT header or payload fails validation.
- */
-declare function createAccessTokenResponse(options: CreateAccessTokenResponseOptions): Promise<{
-    [x: string]: unknown;
-    access_token: string;
-    token_type: "Bearer" | "DPoP";
-    authorization_details?: {
-        [x: string]: unknown;
-        type: "openid_credential";
-        credential_configuration_id?: string | undefined;
-        credential_identifiers?: string[] | undefined;
-    }[] | undefined;
-    expires_in?: number | undefined;
-    refresh_token?: string | undefined;
-}>;
+declare const zAuthorizationCodeGrantIdentifier: z.ZodLiteral<"authorization_code">;
+declare const authorizationCodeGrantIdentifier: "authorization_code";
+type AuthorizationCodeGrantIdentifier = z.infer<typeof zAuthorizationCodeGrantIdentifier>;
+declare const zPreAuthorizedCodeGrantIdentifier: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">;
+declare const preAuthorizedCodeGrantIdentifier: "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+type PreAuthorizedCodeGrantIdentifier = z.infer<typeof zPreAuthorizedCodeGrantIdentifier>;
+declare const zRefreshTokenGrantIdentifier: z.ZodLiteral<"refresh_token">;
+declare const refreshTokenGrantIdentifier: "refresh_token";
+type RefreshTokenGrantIdentifier = z.infer<typeof zRefreshTokenGrantIdentifier>;
 
+declare const zPreAuthorizedCodeTokenRequest: z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">;
+    "pre-authorized_code": z.ZodString;
+    tx_code: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const zAuthorizationCodeTokenRequest: z.ZodObject<{
+    code: z.ZodString;
+    code_verifier: z.ZodString;
+    grant_type: z.ZodLiteral<"authorization_code">;
+    redirect_uri: z.ZodString;
+}, z.core.$strip>;
+declare const zRefreshTokenTokenRequest: z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 declare const zAccessTokenRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
     code: z.ZodString;
     code_verifier: z.ZodString;
@@ -158,9 +39,27 @@ declare const zAccessTokenRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
     scope: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "grant_type">;
 type AccessTokenRequest = z.infer<typeof zAccessTokenRequest>;
+declare const zAccessTokenRequestAPTITUDE: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    code: z.ZodString;
+    code_verifier: z.ZodString;
+    grant_type: z.ZodLiteral<"authorization_code">;
+    redirect_uri: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">;
+    "pre-authorized_code": z.ZodString;
+    tx_code: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">;
+type AccessTokenRequestAPTITUDE = z.infer<typeof zAccessTokenRequestAPTITUDE>;
 type AuthorizationCodeGrantType = Extract<AccessTokenRequest, {
     grant_type: "authorization_code";
 }>;
+type PreAuthorizedCodeGrantType = Extract<AccessTokenRequestAPTITUDE, {
+    grant_type: "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+}>;
 type RefreshTokenGrantType = Extract<AccessTokenRequest, {
     grant_type: "refresh_token";
 }>;
@@ -289,16 +188,213 @@ declare const zRefreshTokenProfileJwtPayload: z.ZodObject<{
 }, z.core.$loose>;
 type RefreshTokenProfileJwtPayload = z.infer<typeof zRefreshTokenProfileJwtPayload>;
 
-interface FetchTokenResponseOptions {
+interface BaseRetrieveAccessTokenOptions {
+    /**
+     * Additional payload to include in the access token request. Items are encoded and sent
+     * using x-www-form-urlencoded format. Nested items (JSON) are stringified and url encoded.
+     * Can be used to include form fields such as client_id or authorization_details.
+     */
+    additionalRequestPayload?: Record<string, unknown>;
+    config: IoWalletSdkConfig;
+}
+interface RetrieveAccessTokenOptionsAuthCode<V extends ItWalletSpecsVersion> extends BaseRetrieveAccessTokenOptions {
+    /**
+     * The authorization code
+     */
+    authorizationCode: string;
+    config: IoWalletSdkConfig<V>;
+    /** The authorization_code grant type. */
+    grantType: AuthorizationCodeGrantIdentifier;
+    /**
+     * PKCE Code verifier that was used in the authorization request.
+     */
+    pkceCodeVerifier: string;
+    /**
+     * Redirect uri to include in the access token request.
+     * It MUST be set as in the Request Object.
+     */
+    redirectUri: string;
+}
+interface RetrieveAccessTokenOptionsPreAuthorizedCode extends BaseRetrieveAccessTokenOptions {
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
+    /** The pre_authorized_code grant type. */
+    grantType: PreAuthorizedCodeGrantIdentifier;
+    /** The pre-authorized code received in the credential offer. */
+    preAuthorizedCode: string;
+    /** Required when the credential offer contains a tx_code object. */
+    txCode?: string;
+}
+interface RetrieveAccessTokenOptionsRefreshToken<V extends ItWalletSpecsVersion> extends BaseRetrieveAccessTokenOptions {
+    config: IoWalletSdkConfig<V>;
+    /** The refresh_token grant type. */
+    grantType: RefreshTokenGrantIdentifier;
+    /** The refresh token received in the credential offer. */
+    refreshToken: string;
+    /** The refresh token OPTIONAL scope. */
+    scope?: string;
+}
+type RetrieveAccessTokenOptionsShared<V extends ItWalletSpecsVersion> = RetrieveAccessTokenOptionsAuthCode<V> | RetrieveAccessTokenOptionsRefreshToken<V>;
+type RetrieveAccessTokenOptions = RetrieveAccessTokenOptionsShared<ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4>;
+type RetrieveAccessTokenOptionsAPTITUDE = RetrieveAccessTokenOptionsPreAuthorizedCode | RetrieveAccessTokenOptionsShared<ItWalletSpecsVersion.APTITUDE>;
+type CreateTokenRequestOptions = RetrieveAccessTokenOptions | RetrieveAccessTokenOptionsAPTITUDE;
+type CreateTokenRequestReturnType = AuthorizationCodeGrantType | PreAuthorizedCodeGrantType | RefreshTokenGrantType;
+declare const createTokenRequestV1_4: <V extends ItWalletSpecsVersion>(options: RetrieveAccessTokenOptionsShared<V>) => {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    scope: string | undefined;
+} | {
+    code: string;
+    code_verifier: string;
+    grant_type: "authorization_code";
+    redirect_uri: string;
+};
+declare function createTokenRequestAPTITUDE(options: RetrieveAccessTokenOptionsAPTITUDE): CreateTokenRequestReturnType;
+/**
+ * Creates an authorization-code or pre-authorized_code access token request body.
+ *
+ * Authorization-code requests retain the existing default grant and require PKCE
+ * and a redirect URI.
+ *
+ *  * * Version Differences:
+ * - v1.4: only support authorization_code grant type.
+ * - APTITUDE: add support for pre-authorized_code grant type. Pre Authorized
+ *   requests use preAuthorizedCode and optional txCode, without PKCE or a redirect URI.
+ *
+ * @param options - Access token request inputs and version config.
+ * @param options.config - The IoWalletSdkConfig instance to use.
+ * @param options.grantType - The grant type to use.
+ * @param options.additionalRequestPayload - Extra form fields to include in the token request.
+ *
+ * **authorization_code grant type parameters:**
+ * @param options.authorizationCode - Authorization code received from the authorization response.
+ * @param options.pkceCodeVerifier - PKCE verifier associated with the authorization request.
+ * @param options.redirectUri - Redirect URI used in the authorization request.
+ *
+ * **refresh_token grant type parameters (APTITUDE only):**
+ * @param options.refreshToken - Refresh token.
+ * @param options.scope - The refresh token OPTIONAL scope.
+ *
+ * **pre-authorized_code grant type parameters (APTITUDE only):**
+ * @param options.preAuthorizedCode - Pre-authorized code received in the credential offer.
+ * @param options.txCode - Transaction code required when the credential offer contains a `tx_code` object.
+ *
+ * @returns URL-form-encodable grant request data.
+ */
+declare function createTokenRequest(options: RetrieveAccessTokenOptions): AuthorizationCodeGrantType | RefreshTokenGrantType;
+declare function createTokenRequest(options: RetrieveAccessTokenOptionsAPTITUDE): AuthorizationCodeGrantType | PreAuthorizedCodeGrantType | RefreshTokenGrantType;
+declare function createTokenRequest(options: CreateTokenRequestOptions): CreateTokenRequestReturnType;
+
+interface CreateAccessTokenResponseOptions {
+    /**
+     * Additional claims copied into both the access token JWT payload and token
+     * response envelope.
+     */
+    additionalPayload?: Record<string, unknown>;
+    /**
+     * Intended recipient of the access token (`aud` claim).
+     */
+    audience: string;
+    /**
+     * Authorization server identifier (`iss` claim).
+     */
+    authorizationServer: string;
+    /**
+     * Runtime callbacks used to generate random values, compute JWK thumbprints,
+     * and sign the access token JWT.
+     */
+    callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">;
+    /**
+     * OAuth client identifier (`client_id` claim).
+     */
+    clientId: string;
+    config: IoWalletSdkConfig;
+    /**
+     * DPoP public key used to bind the access token (`cnf.jkt` claim).
+     */
+    dpop?: {
+        jwk: Jwk;
+    };
+    /**
+     * Access token lifetime in seconds, used for both `exp` and `expires_in`.
+     */
+    expiresInSeconds: number;
+    /**
+     * Optional "not before" timestamp in epoch seconds (`nbf` claim).
+     */
+    nbf?: number;
+    /**
+     * Reference time used for `iat` and `exp`. Defaults to current time.
+     */
+    now?: Date;
+    /**
+     * Requests issuance of a DPoP-bound Refresh Token JWT by specifying its
+     * lifetime in seconds. The Refresh Token `exp` is set to `now +
+     * refreshTokenExpiresInSeconds` and must be later than the Access Token
+     * `exp` (`nbf` of the Refresh Token).
+     *
+     * Requires `tokenType` to be `DPoP` and `dpop` to be provided. Omit this
+     * option to keep the specification's optional Refresh Token behavior
+     * (e.g. Bearer-only PDND responses).
+     */
+    refreshTokenExpiresInSeconds?: number;
+    /**
+     * Optional scope string included in both the access token JWT payload and token
+     * response envelope.
+     */
+    scope?: string;
+    /**
+     * Signer used to produce the access token JWT.
+     */
+    signer: JwtSigner;
+    /**
+     * Subject identifier represented by the access token (`sub` claim).
+     */
+    subject: string;
+    /**
+     * Token type returned in the OAuth token response.
+     * NOTE: When using `Bearer` it is supposed to be used only for PDND Interoperability API, not for credential issuance flows.
+     */
+    tokenType: "Bearer" | "DPoP";
+}
+/**
+ * Creates an OAuth 2.0 access token response where `access_token` is a signed
+ * JWT access token profile (`typ=at+jwt`) and `token_type` is `DPoP` or `Bearer`.
+ *
+ * The JWT payload always includes `aud`, `iss`, `sub`, `client_id`, `iat`,
+ * `exp`, and a random `jti`. When `dpop` is provided, `cnf.jkt` is added using
+ * the SHA-256 JWK thumbprint.
+ *
+ * When `refreshTokenExpiresInSeconds` is provided, a DPoP-bound Refresh Token
+ * JWT (`typ=rt+jwt`) is generated, signed, and returned as `refresh_token`.
+ * Refresh Token issuance requires `tokenType` to be `DPoP` with a `dpop`
+ * public key, and results in `nbf` equal to the Access Token `exp` and `exp`
+ * later than that.
+ *
+ * @param options - Access token response creation options and version config.
+ * @returns OAuth token response with a signed access token JWT, and a signed Refresh Token JWT when requested.
+ * @throws {CreateTokenResponseError} If DPoP binding is required but missing, if Refresh Token issuance is requested without a valid DPoP configuration or lifetime, if the signer has no resolvable `kid` for the Refresh Token, or if response creation otherwise fails, including validation failures from the generated JWT headers or payloads.
+ * @throws {ValidationError} If the generated JWT header or payload fails validation.
+ */
+declare function createAccessTokenResponse(options: CreateAccessTokenResponseOptions): Promise<{
+    [x: string]: unknown;
+    access_token: string;
+    token_type: "Bearer" | "DPoP";
+    authorization_details?: {
+        [x: string]: unknown;
+        type: "openid_credential";
+        credential_configuration_id?: string | undefined;
+        credential_identifiers?: string[] | undefined;
+    }[] | undefined;
+    expires_in?: number | undefined;
+    refresh_token?: string | undefined;
+}>;
+
+interface BaseFetchTokenResponseOptions {
     /**
      * The endpoint URL where the access token request will be sent
      * This should be the authorization server's token endpoint
      */
     accessTokenEndpoint: string;
-    /**
-     * The access token request payload
-     */
-    accessTokenRequest: AccessTokenRequest;
     /**
      * Callbacks to use for requesting access token
      */
@@ -308,6 +404,7 @@ interface FetchTokenResponseOptions {
      * Used for OAuth-Client-Attestation-PoP header to prove possession of the client key
      */
     clientAttestationDPoP: string;
+    config: IoWalletSdkConfig;
     /**
      * DPoP proof for the token request
      */
@@ -318,33 +415,47 @@ interface FetchTokenResponseOptions {
      */
     walletAttestation: string;
 }
-/**
- * Sends an access token request to the authorization server and returns the response
- *
- * @param options - Configuration options for the access token request
- * @returns Promise that resolves to the parsed access token response
- * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code
- * @throws {ValidationError} When the response cannot be parsed as a valid access token response
- * @throws {FetchTokenResponseError} When an unexpected error occurs during the request
- */
-declare function fetchTokenResponse(options: FetchTokenResponseOptions): Promise<AccessTokenResponse>;
+interface FetchTokenResponseOptionsShared<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4> extends BaseFetchTokenResponseOptions {
+    /**
+     * The authorization-code or refresh-token request payload.
+     */
+    accessTokenRequest: AccessTokenRequest;
+    config: IoWalletSdkConfig<V>;
+}
+interface FetchTokenResponseOptionsAPTITUDE extends BaseFetchTokenResponseOptions {
+    /**
+     * The authorization-code, pre-authorized-code or refresh-token request payload.
+     */
+    accessTokenRequest: AccessTokenRequestAPTITUDE;
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
+}
+type FetchTokenResponseOptions = FetchTokenResponseOptionsAPTITUDE | FetchTokenResponseOptionsShared;
 /**
  * Converts an access token request object into URL-encoded form parameters.
  *
  * Object values are JSON-stringified so structured extension parameters such as
  * `authorization_details` can be sent in `application/x-www-form-urlencoded` requests.
  *
+ * Version Differences:
+ * - APTITUDE: extracts `authorization_server` (OPTIONAL), `pre-authorized_code` (REQUIRED), and `tx_code` (OPTIONAL)
+ *
  * @param data - Access token request payload.
  * @returns URLSearchParams containing all defined request fields.
  */
-declare function toURLSearchParams(data: AccessTokenRequest): URLSearchParams;
-
-declare const zAuthorizationCodeGrantIdentifier: z.ZodLiteral<"authorization_code">;
-declare const authorizationCodeGrantIdentifier: "authorization_code";
-type AuthorizationCodeGrantIdentifier = z.infer<typeof zAuthorizationCodeGrantIdentifier>;
-declare const zRefreshTokenGrantIdentifier: z.ZodLiteral<"refresh_token">;
-declare const refreshTokenGrantIdentifier: "refresh_token";
-type RefreshTokenGrantIdentifier = z.infer<typeof zRefreshTokenGrantIdentifier>;
+declare function toURLSearchParams(data: FetchTokenResponseOptions["accessTokenRequest"]): URLSearchParams;
+/**
+ * Sends an access token request to the authorization server and returns the response
+ *
+ * * Version Differences:
+ * - APTITUDE: add support for pre-authorized-code grant type.
+ *
+ * @param options - Configuration options for the access token request and version config.
+ * @returns Promise that resolves to the parsed access token response
+ * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code
+ * @throws {ValidationError} When the response cannot be parsed as a valid access token response
+ * @throws {FetchTokenResponseError} When an unexpected error occurs during the request
+ */
+declare function fetchTokenResponse(options: FetchTokenResponseOptions): Promise<AccessTokenResponse>;
 
 interface ParsedAccessTokenAuthorizationCodeRequestGrant {
     code: string;
@@ -354,9 +465,14 @@ interface ParsedAccessTokenRefreshTokenRequestGrant {
     grantType: RefreshTokenGrantIdentifier;
     refreshToken: string;
 }
-type ParsedAccessTokenRequestGrant = ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
-interface ParseAccessTokenRequestResult {
-    accessTokenRequest: AccessTokenRequest;
+interface ParsedAccessTokenPreAuthorizedCodeRequestGrant {
+    grantType: PreAuthorizedCodeGrantIdentifier;
+    preAuthorizedCode: string;
+    txCode?: string;
+}
+type ParsedAccessTokenRequestGrantV1_4 = ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
+type ParsedAccessTokenRequestGrantAPTITUDE = ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenPreAuthorizedCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
+interface BaseParseAccessTokenRequestResult {
     /**
      * The client attestation jwts from the access token request headers
      */
@@ -370,33 +486,57 @@ interface ParseAccessTokenRequestResult {
     dpop: {
         jwt: string;
     };
-    grant: ParsedAccessTokenRequestGrant;
+}
+interface ParseAccessTokenRequestResultV1_4 extends BaseParseAccessTokenRequestResult {
+    accessTokenRequest: AccessTokenRequest;
+    grant: ParsedAccessTokenRequestGrantV1_4;
     /**
      * The pkce code verifier from the access token request
      */
     pkceCodeVerifier?: string;
 }
+interface ParseAccessTokenRequestResultAPTITUDE extends BaseParseAccessTokenRequestResult {
+    accessTokenRequest: AccessTokenRequestAPTITUDE;
+    grant: ParsedAccessTokenRequestGrantAPTITUDE;
+}
 interface ParseAccessTokenRequestOptions {
     /**
      * The access token request as a JSON object. Your server should decode the
      * `x-www-url-form-urlencoded` body into an object (e.g. using `bodyParser.urlEncoded()` in express)
      */
     accessTokenRequest: Record<string, unknown>;
+    config: IoWalletSdkConfig;
     request: RequestLike;
 }
+interface ParseAccessTokenRequestOptionsShared<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4> extends ParseAccessTokenRequestOptions {
+    /**
+     * The IT-Wallet specs version to use for parsing the access token request.
+     */
+    config: IoWalletSdkConfig<V>;
+}
+interface ParseAccessTokenRequestOptionsAPTITUDE extends ParseAccessTokenRequestOptions {
+    /**
+     * The IT-Wallet specs version to use for parsing the access token request.
+     */
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
+}
+type ParseAccessTokenRequestResult = ParseAccessTokenRequestResultAPTITUDE | ParseAccessTokenRequestResultV1_4;
 /**
  * Parses and validates an OAuth 2.0 access token request.
  *
  * This function performs the following steps:
  * 1. Validates the request body against the access token request schema
- * 2. Extracts and validates grant-specific parameters (authorization code or refresh token)
+ * 2. Extracts grant parameters for authorization code, pre-authorized code or refresh token
  * 3. Parses security headers (DPoP and Client Attestation JWTs)
- * 4. Extracts PKCE code verifier if present
+ * 4. Extracts PKCE code verifier if present (V1_4 only)
  *
  * Note: This function only parses and validates the structure of the request.
  * Cryptographic verification of JWTs and tokens should be performed separately.
  *
- * @param options - Configuration object containing the access token request body and HTTP request
+ * * * Version Differences:
+ * - APTITUDE: add support for pre-authorized-code grant type.
+ *
+ * @param options - Configuration object containing the access token request body and HTTP request, and version config
  * @returns Parsed access token request with typed grant parameters and extracted security headers
  * @throws {Oauth2Error} If validation fails or required parameters are missing
  *
@@ -413,6 +553,8 @@ interface ParseAccessTokenRequestOptions {
  * });
  * ```
  */
+declare function parseAccessTokenRequest<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4>(options: ParseAccessTokenRequestOptionsShared<V>): ParseAccessTokenRequestResultV1_4;
+declare function parseAccessTokenRequest(options: ParseAccessTokenRequestOptionsAPTITUDE): ParseAccessTokenRequestResultAPTITUDE;
 declare function parseAccessTokenRequest(options: ParseAccessTokenRequestOptions): ParseAccessTokenRequestResult;
 
 /**
@@ -1377,11 +1519,7 @@ interface VerifyAccessTokenRequestDpop {
      */
     jwt: string;
 }
-interface VerifyAccessTokenRequestOptions {
-    /**
-     * The access token request to verify
-     */
-    accessTokenRequest: AccessTokenRequest;
+interface BaseVerifyAccessTokenRequestOptions {
     /**
      * The authorization server metadata
      */
@@ -1394,15 +1532,29 @@ interface VerifyAccessTokenRequestOptions {
      * Options for verifying the client attestation
      */
     clientAttestation: ClientAttestationOptions;
-    /**
-     * The expiration date of the authorization code
-     */
-    codeExpiresAt?: Date;
     config: IoWalletSdkConfig;
     /**
      * The dpop verification options
      */
     dpop: VerifyAccessTokenRequestDpop;
+    /**
+     * The current time to use when verifying the JWTs.
+     * If not provided current time will be used.
+     *
+     * @default new Date()
+     */
+    now?: Date;
+    /**
+     * The HTTP request information
+     */
+    request: RequestLike;
+}
+interface VerifyAccessTokenRequestOptions<V extends ItWalletSpecsVersion = ItWalletSpecsVersion.V1_0> extends BaseVerifyAccessTokenRequestOptions {
+    /**
+     * The expiration date of the authorization code
+     */
+    codeExpiresAt?: Date;
+    config: IoWalletSdkConfig<V>;
     /**
      * The expected authorization code
      */
@@ -1411,22 +1563,25 @@ interface VerifyAccessTokenRequestOptions {
      * The parsed authorization code grant
      */
     grant: ParsedAccessTokenAuthorizationCodeRequestGrant;
-    /**
-     * The current time to use when verifying the JWTs.
-     * If not provided current time will be used.
-     *
-     * @default new Date()
-     */
-    now?: Date;
     /**
      * The pkce options including code verifier, challenge and method
      */
     pkce: VerifyAccessTokenRequestPkce;
-    /**
-     * The HTTP request information
-     */
-    request: RequestLike;
 }
+interface VerifyPreAuthorizedCodeAccessTokenRequestOptions extends BaseVerifyAccessTokenRequestOptions {
+    config: IoWalletSdkConfig<ItWalletSpecsVersion.APTITUDE>;
+    /** The pre-authorized code stored by the authorization server. */
+    expectedPreAuthorizedCode: string;
+    /** The stored transaction code, if one was required by the credential offer. */
+    expectedTxCode?: string;
+    /** The parsed pre-authorized code grant */
+    grant: ParsedAccessTokenPreAuthorizedCodeRequestGrant;
+    /** The expiration date stored with the pre-authorized code. */
+    preAuthorizedCodeExpiresAt?: Date;
+}
+type SupportedAccessTokenVerificationOptionsV1_4 = VerifyAccessTokenRequestOptions<ItWalletSpecsVersion.V1_0 | ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4>;
+type SupportedAccessTokenVerificationOptionsAPTITUDE = VerifyAccessTokenRequestOptions<ItWalletSpecsVersion.APTITUDE> | VerifyPreAuthorizedCodeAccessTokenRequestOptions;
+type SupportedAccessTokenVerificationOptions = SupportedAccessTokenVerificationOptionsAPTITUDE | SupportedAccessTokenVerificationOptionsV1_4;
 interface VerifyAccessTokenRequestResult {
     clientAttestation: {
         clientAttestation: VerifiedWalletAttestationJwt;
@@ -1442,18 +1597,26 @@ interface VerifyAccessTokenRequestResult {
     };
 }
 /**
- * Verifies an authorization code token request by validating PKCE, DPoP, and client attestation.
+ * Verifies an authorization-code or pre-authorized-code token request.
  *
- * This function performs comprehensive validation of an OAuth 2.0 authorization code token request
- * according to Italian IT-Wallet specifications, including:
- * - PKCE code verifier validation against the stored code challenge
+ * Both grants retain the SDK's IT-Wallet DPoP and client attestation requirements:
+ * - PKCE verification against the stored code challenge for authorization-code requests only
  * - DPoP proof JWT verification and JWK thumbprint extraction
  * - Client attestation JWT and attestation PoP JWT verification
- * - Authorization code validity and expiration checks
- *
- * @param options - Configuration options for token request verification
+ * - Authorization code or pre-authorized code validity and expiration checks
+ * - Transaction code verification when required by the credential offer
+ *
+ * The caller must enforce single-use redemption of codes atomically when issuing
+ * the token, and limit transaction-code attempts. This verifier does not store state.
+ * The upstream verifier allows optional DPoP and client attestation; the local
+ * implementation retains the SDK's required security checks and error types.
+ *
+ * * Version Differences:
+ * - APTITUDE: add support for pre-authorized-code grant type.
+ * *
+ * @param options - Configuration options for token request verification and version config
  * @returns A promise that resolves with verified client attestation and DPoP information
- * @throws {Oauth2Error} If the authorization code is invalid or expired
+ * @throws {Oauth2Error} If the grant code is invalid or expired, or the transaction code is missing, unexpected or invalid
  * @throws {Oauth2Error} If PKCE verification fails
  * @throws {Oauth2Error} If DPoP verification fails
  * @throws {Oauth2Error} If client attestation verification fails
@@ -1478,7 +1641,7 @@ interface VerifyAccessTokenRequestResult {
  * });
  * ```
  */
-declare function verifyAccessTokenRequest(options: VerifyAccessTokenRequestOptions): Promise<VerifyAccessTokenRequestResult>;
+declare function verifyAccessTokenRequest(options: SupportedAccessTokenVerificationOptionsAPTITUDE | SupportedAccessTokenVerificationOptionsV1_4): Promise<VerifyAccessTokenRequestResult>;
 
 declare const zAuthorizationRequestV1_0: z$1.ZodObject<{
     authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
@@ -3667,4 +3830,4 @@ declare const zDpopJwtHeader: z$1.ZodObject<{
 }, z$1.core.$loose>;
 type DpopJwtHeader = z$1.infer<typeof zDpopJwtHeader>;
 
-export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseAuthorizationServerMetadata, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, ClientAttestationError, type ClientAttestationOptions, type ItWalletClientAttestationPopJwtHeader as ClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload as ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, type CreatePushedAuthorizationRequestOptionsV1_4, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RefreshTokenProfileJwtHeader, type RefreshTokenProfileJwtPayload, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAuthorizationCodeGrantIdentifier, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zRefreshTokenProfileJwtHeader, zRefreshTokenProfileJwtPayload, zSignedAuthorizationRequestJwtHeaderTyp, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };
+export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenRequestAPTITUDE, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseAuthorizationServerMetadata, type BaseFetchTokenResponseOptions, type BaseParseAccessTokenRequestResult, type BaseRetrieveAccessTokenOptions, type BaseVerifyAccessTokenRequestOptions, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, ClientAttestationError, type ClientAttestationOptions, type ItWalletClientAttestationPopJwtHeader as ClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload as ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, type CreatePushedAuthorizationRequestOptionsV1_4, CreateTokenDPoPError, type CreateTokenDPoPOptions, type CreateTokenRequestOptions, type CreateTokenRequestReturnType, CreateTokenResponseError, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type FetchTokenResponseOptionsAPTITUDE, type FetchTokenResponseOptionsShared, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestOptionsAPTITUDE, type ParseAccessTokenRequestOptionsShared, type ParseAccessTokenRequestResult, type ParseAccessTokenRequestResultAPTITUDE, type ParseAccessTokenRequestResultV1_4, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenPreAuthorizedCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedAccessTokenRequestGrantAPTITUDE, type ParsedAccessTokenRequestGrantV1_4, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type PreAuthorizedCodeGrantType, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RefreshTokenProfileJwtHeader, type RefreshTokenProfileJwtPayload, type RetrieveAccessTokenOptions, type RetrieveAccessTokenOptionsAPTITUDE, type RetrieveAccessTokenOptionsAuthCode, type RetrieveAccessTokenOptionsPreAuthorizedCode, type RetrieveAccessTokenOptionsRefreshToken, type RetrieveAccessTokenOptionsShared, type SupportedAccessTokenVerificationOptions, type SupportedAccessTokenVerificationOptionsAPTITUDE, type SupportedAccessTokenVerificationOptionsV1_4, SupportedClientAuthenticationMethod, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPreAuthorizedCodeAccessTokenRequestOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createTokenRequestAPTITUDE, createTokenRequestV1_4, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenRequestAPTITUDE, zAccessTokenResponse, zAuthorizationCodeGrantIdentifier, zAuthorizationCodeTokenRequest, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPreAuthorizedCodeGrantIdentifier, zPreAuthorizedCodeTokenRequest, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zRefreshTokenProfileJwtHeader, zRefreshTokenProfileJwtPayload, zRefreshTokenTokenRequest, zSignedAuthorizationRequestJwtHeaderTyp, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };