@pagopa/io-wallet-oauth2 2.0.0-launchpad → 2.0.2-apt

package/dist/index.js

@@ -51,6 +51,8 @@ __export(index_exports, {
   createPushedAuthorizationRequest: () => createPushedAuthorizationRequest,
   createTokenDPoP: () => createTokenDPoP,
   createTokenRequest: () => createTokenRequest,
+  createTokenRequestAPTITUDE: () => createTokenRequestAPTITUDE,
+  createTokenRequestV1_4: () => createTokenRequestV1_4,
   createWalletAttestationJwtV1_0: () => createWalletAttestationJwt,
   createWalletAttestationJwtV1_3: () => createWalletAttestationJwt2,
   createWalletAttestationJwtV1_4: () => createWalletAttestationJwt3,
@@ -73,6 +75,7 @@ __export(index_exports, {
   parseJarRequest: () => parseJarRequest,
   parseMrtdChallenge: () => parseMrtdChallenge,
   parsePushedAuthorizationRequest: () => parsePushedAuthorizationRequest,
+  preAuthorizedCodeGrantIdentifier: () => preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier: () => refreshTokenGrantIdentifier,
   signedAuthorizationRequestJwtHeaderTyp: () => signedAuthorizationRequestJwtHeaderTyp,
   toURLSearchParams: () => toURLSearchParams,
@@ -93,8 +96,10 @@ __export(index_exports, {
   zAccessTokenProfileJwtHeader: () => zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload: () => zAccessTokenProfileJwtPayload,
   zAccessTokenRequest: () => zAccessTokenRequest,
+  zAccessTokenRequestAPTITUDE: () => zAccessTokenRequestAPTITUDE,
   zAccessTokenResponse: () => zAccessTokenResponse,
   zAuthorizationCodeGrantIdentifier: () => zAuthorizationCodeGrantIdentifier,
+  zAuthorizationCodeTokenRequest: () => zAuthorizationCodeTokenRequest,
   zAuthorizationRequestV1_0: () => zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3: () => zAuthorizationRequestV1_3,
   zDpopJwtHeader: () => zDpopJwtHeader,
@@ -113,6 +118,8 @@ __export(index_exports, {
   zMrtdPopVerifyResponse: () => zMrtdPopVerifyResponse,
   zMrtdValidationJwtHeader: () => zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload: () => zMrtdValidationJwtPayload,
+  zPreAuthorizedCodeGrantIdentifier: () => zPreAuthorizedCodeGrantIdentifier,
+  zPreAuthorizedCodeTokenRequest: () => zPreAuthorizedCodeTokenRequest,
   zPushedAuthorizationRequestSigned: () => zPushedAuthorizationRequestSigned,
   zPushedAuthorizationRequestUnsignedV1_0: () => zPushedAuthorizationRequestUnsignedV1_0,
   zPushedAuthorizationRequestUnsignedV1_3: () => zPushedAuthorizationRequestUnsignedV1_3,
@@ -120,6 +127,7 @@ __export(index_exports, {
   zRefreshTokenGrantIdentifier: () => zRefreshTokenGrantIdentifier,
   zRefreshTokenProfileJwtHeader: () => zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload: () => zRefreshTokenProfileJwtPayload,
+  zRefreshTokenTokenRequest: () => zRefreshTokenTokenRequest,
   zSignedAuthorizationRequestJwtHeaderTyp: () => zSignedAuthorizationRequestJwtHeaderTyp,
   zWalletAttestationJwtHeaderV1_0: () => zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3: () => zWalletAttestationJwtHeaderV1_3,
@@ -134,16 +142,60 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/access-token/create-token-request.ts
-var createTokenRequest = async (options) => ({
-  ...options.additionalRequestPayload,
-  code: options.authorizationCode,
-  code_verifier: options.pkceCodeVerifier,
-  grant_type: "authorization_code",
-  redirect_uri: options.redirectUri
+var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
+
+// src/access-token/z-grant-type.ts
+var import_zod = require("zod");
+var zAuthorizationCodeGrantIdentifier = import_zod.z.literal("authorization_code");
+var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
+var zPreAuthorizedCodeGrantIdentifier = import_zod.z.literal(
+  "urn:ietf:params:oauth:grant-type:pre-authorized_code"
+);
+var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
+var zRefreshTokenGrantIdentifier = import_zod.z.literal("refresh_token");
+var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
+
+// src/access-token/create-token-request.ts
+var createTokenRequestV1_4 = (options) => {
+  if (options.grantType === refreshTokenGrantIdentifier) {
+    return {
+      ...options.additionalRequestPayload,
+      grant_type: refreshTokenGrantIdentifier,
+      refresh_token: options.refreshToken,
+      scope: options.scope
+    };
+  }
+  return {
+    ...options.additionalRequestPayload,
+    code: options.authorizationCode,
+    code_verifier: options.pkceCodeVerifier,
+    grant_type: authorizationCodeGrantIdentifier,
+    redirect_uri: options.redirectUri
+  };
+};
+function createTokenRequestAPTITUDE(options) {
+  if (options.grantType === preAuthorizedCodeGrantIdentifier) {
+    return {
+      ...options.additionalRequestPayload,
+      grant_type: preAuthorizedCodeGrantIdentifier,
+      "pre-authorized_code": options.preAuthorizedCode,
+      tx_code: options.txCode
+    };
+  }
+  return createTokenRequestV1_4(options);
+}
+var dispatchCreateTokenRequest = (0, import_io_wallet_utils.createVersionDispatcher)({
+  [import_io_wallet_utils.ItWalletSpecsVersion.APTITUDE]: (o) => createTokenRequestAPTITUDE(o),
+  [import_io_wallet_utils.ItWalletSpecsVersion.V1_0]: (o) => createTokenRequestV1_4(o),
+  [import_io_wallet_utils.ItWalletSpecsVersion.V1_3]: (o) => createTokenRequestV1_4(o),
+  [import_io_wallet_utils.ItWalletSpecsVersion.V1_4]: (o) => createTokenRequestV1_4(o)
 });
+function createTokenRequest(options) {
+  return dispatchCreateTokenRequest(options);
+}
 
 // src/access-token/create-token-response.ts
-var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
 
 // src/errors.ts
 var Oauth2Error = class extends Error {
@@ -202,71 +254,83 @@ var ClientAttestationError = class extends Oauth2Error {
 };
 
 // src/access-token/z-token.ts
-var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
-var import_zod = require("zod");
-var zAccessTokenRequest = import_zod.z.discriminatedUnion("grant_type", [
-  import_zod.z.object({
-    code: import_zod.z.string().nonempty(),
-    code_verifier: import_zod.z.string().nonempty(),
-    grant_type: import_zod.z.literal("authorization_code"),
-    redirect_uri: import_zod.z.string().nonempty()
-  }),
-  import_zod.z.object({
-    grant_type: import_zod.z.literal("refresh_token"),
-    refresh_token: import_zod.z.string().nonempty(),
-    scope: import_zod.z.string().optional()
-  })
+var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
+var import_zod2 = require("zod");
+var zPreAuthorizedCodeTokenRequest = import_zod2.z.object({
+  grant_type: zPreAuthorizedCodeGrantIdentifier,
+  "pre-authorized_code": import_zod2.z.string().nonempty(),
+  tx_code: import_zod2.z.string().optional()
+});
+var zAuthorizationCodeTokenRequest = import_zod2.z.object({
+  code: import_zod2.z.string().nonempty(),
+  code_verifier: import_zod2.z.string().nonempty(),
+  grant_type: zAuthorizationCodeGrantIdentifier,
+  redirect_uri: import_zod2.z.string().nonempty()
+});
+var zRefreshTokenTokenRequest = import_zod2.z.object({
+  grant_type: zRefreshTokenGrantIdentifier,
+  refresh_token: import_zod2.z.string().nonempty(),
+  scope: import_zod2.z.string().optional()
+});
+var zAccessTokenRequest = import_zod2.z.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest
 ]);
-var zAccessTokenResponse = import_zod.z.looseObject({
-  access_token: import_zod.z.string(),
-  authorization_details: import_zod.z.array(
-    import_zod.z.looseObject({
-      credential_configuration_id: import_zod.z.optional(import_zod.z.string()),
-      credential_identifiers: import_zod.z.optional(import_zod.z.array(import_zod.z.string())),
-      type: import_zod.z.literal("openid_credential")
+var zAccessTokenRequestAPTITUDE = import_zod2.z.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest,
+  zPreAuthorizedCodeTokenRequest
+]);
+var zAccessTokenResponse = import_zod2.z.looseObject({
+  access_token: import_zod2.z.string(),
+  authorization_details: import_zod2.z.array(
+    import_zod2.z.looseObject({
+      credential_configuration_id: import_zod2.z.optional(import_zod2.z.string()),
+      credential_identifiers: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string())),
+      type: import_zod2.z.literal("openid_credential")
     })
   ).optional(),
-  expires_in: import_zod.z.optional(import_zod.z.number().int()),
-  refresh_token: import_zod.z.optional(import_zod.z.string()),
-  token_type: import_zod.z.union([import_zod.z.literal("Bearer"), import_zod.z.literal("DPoP")])
+  expires_in: import_zod2.z.optional(import_zod2.z.number().int()),
+  refresh_token: import_zod2.z.optional(import_zod2.z.string()),
+  token_type: import_zod2.z.union([import_zod2.z.literal("Bearer"), import_zod2.z.literal("DPoP")])
 });
-var zAccessTokenProfileJwtHeader = import_zod.z.looseObject({
-  ...import_io_wallet_utils.zJwtHeader.shape,
-  typ: import_zod.z.enum(["application/at+jwt", "at+jwt"])
+var zAccessTokenProfileJwtHeader = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtHeader.shape,
+  typ: import_zod2.z.enum(["application/at+jwt", "at+jwt"])
 });
-var zAccessTokenProfileJwtPayload = import_zod.z.looseObject({
-  ...import_io_wallet_utils.zJwtPayload.shape,
-  aud: import_zod.z.string(),
-  client_id: import_zod.z.string(),
-  cnf: import_zod.z.object({
-    jkt: import_zod.z.string()
+var zAccessTokenProfileJwtPayload = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtPayload.shape,
+  aud: import_zod2.z.string(),
+  client_id: import_zod2.z.string(),
+  cnf: import_zod2.z.object({
+    jkt: import_zod2.z.string()
   }).optional(),
-  exp: import_zod.z.number(),
-  iat: import_zod.z.number(),
-  iss: import_zod.z.string(),
-  jti: import_zod.z.string().max(import_io_wallet_utils.MAX_JTI_LENGTH),
-  nbf: import_zod.z.number().optional(),
-  scope: import_zod.z.string().optional(),
-  sub: import_zod.z.string()
+  exp: import_zod2.z.number(),
+  iat: import_zod2.z.number(),
+  iss: import_zod2.z.string(),
+  jti: import_zod2.z.string().max(import_io_wallet_utils2.MAX_JTI_LENGTH),
+  nbf: import_zod2.z.number().optional(),
+  scope: import_zod2.z.string().optional(),
+  sub: import_zod2.z.string()
 });
-var zRefreshTokenProfileJwtHeader = import_zod.z.looseObject({
-  ...import_io_wallet_utils.zJwtHeader.shape,
-  kid: import_zod.z.string(),
-  typ: import_zod.z.literal("rt+jwt")
+var zRefreshTokenProfileJwtHeader = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtHeader.shape,
+  kid: import_zod2.z.string(),
+  typ: import_zod2.z.literal("rt+jwt")
 });
-var zRefreshTokenProfileJwtPayload = import_zod.z.looseObject({
-  ...import_io_wallet_utils.zJwtPayload.shape,
-  aud: import_zod.z.string(),
-  client_id: import_zod.z.string(),
-  cnf: import_zod.z.object({
-    jkt: import_zod.z.string()
+var zRefreshTokenProfileJwtPayload = import_zod2.z.looseObject({
+  ...import_io_wallet_utils2.zJwtPayload.shape,
+  aud: import_zod2.z.string(),
+  client_id: import_zod2.z.string(),
+  cnf: import_zod2.z.object({
+    jkt: import_zod2.z.string()
   }),
-  exp: import_zod.z.number().int(),
-  iat: import_zod.z.number().int(),
-  iss: import_zod.z.string(),
-  jti: import_zod.z.string().max(import_io_wallet_utils.MAX_JTI_LENGTH),
-  nbf: import_zod.z.number().int(),
-  sub: import_zod.z.string()
+  exp: import_zod2.z.number().int(),
+  iat: import_zod2.z.number().int(),
+  iss: import_zod2.z.string(),
+  jti: import_zod2.z.string().max(import_io_wallet_utils2.MAX_JTI_LENGTH),
+  nbf: import_zod2.z.number().int(),
+  sub: import_zod2.z.string()
 });
 
 // src/access-token/create-token-response.ts
@@ -295,7 +359,7 @@ function resolveRefreshTokenKid(signer) {
   }
   return void 0;
 }
-async function createAccessTokenResponse(options) {
+async function createAccessTokenResponseV1_4(options) {
   try {
     const now = options.now ?? /* @__PURE__ */ new Date();
     if (options.tokenType === "DPoP" && !options.dpop) {
@@ -313,26 +377,26 @@ async function createAccessTokenResponse(options) {
         `refreshTokenExpiresInSeconds (${options.refreshTokenExpiresInSeconds}) must be greater than expiresInSeconds (${options.expiresInSeconds}) so the Refresh Token remains usable after the Access Token expires.`
       );
     }
-    const dpopJkt = options.dpop ? await (0, import_io_wallet_utils2.calculateJwkThumbprint)({
-      hashAlgorithm: import_io_wallet_utils2.HashAlgorithm.Sha256,
+    const dpopJkt = options.dpop ? await (0, import_io_wallet_utils3.calculateJwkThumbprint)({
+      hashAlgorithm: import_io_wallet_utils3.HashAlgorithm.Sha256,
       hashCallback: options.callbacks.hash,
       jwk: options.dpop.jwk
     }) : void 0;
-    const accessTokenExpiresAt = (0, import_io_wallet_utils2.addSecondsToDate)(
+    const accessTokenExpiresAt = (0, import_io_wallet_utils3.addSecondsToDate)(
       now,
       options.expiresInSeconds
     );
-    const header = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
-      ...(0, import_io_wallet_utils2.jwtHeaderFromJwtSigner)(options.signer),
+    const header = (0, import_io_wallet_utils3.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
+      ...(0, import_io_wallet_utils3.jwtHeaderFromJwtSigner)(options.signer),
       typ: "at+jwt"
     });
-    const payload = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
+    const payload = (0, import_io_wallet_utils3.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
       ...options.additionalPayload,
       aud: options.audience,
       client_id: options.clientId,
       cnf: dpopJkt ? { jkt: dpopJkt } : void 0,
-      exp: (0, import_io_wallet_utils2.dateToSeconds)(accessTokenExpiresAt),
-      iat: (0, import_io_wallet_utils2.dateToSeconds)(now),
+      exp: (0, import_io_wallet_utils3.dateToSeconds)(accessTokenExpiresAt),
+      iat: (0, import_io_wallet_utils3.dateToSeconds)(now),
       iss: options.authorizationServer,
       jti: await generateUuidV4(options.callbacks.generateRandom),
       nbf: options.nbf,
@@ -351,7 +415,7 @@ async function createAccessTokenResponse(options) {
           "Unable to resolve a kid for the Refresh Token JOSE header. Provide signer.kid or a publicJwk.kid."
         );
       }
-      const refreshTokenHeader = (0, import_io_wallet_utils2.parseWithErrorHandling)(
+      const refreshTokenHeader = (0, import_io_wallet_utils3.parseWithErrorHandling)(
         zRefreshTokenProfileJwtHeader,
         {
           alg: options.signer.alg,
@@ -359,19 +423,19 @@ async function createAccessTokenResponse(options) {
           typ: "rt+jwt"
         }
       );
-      const refreshTokenPayload = (0, import_io_wallet_utils2.parseWithErrorHandling)(
+      const refreshTokenPayload = (0, import_io_wallet_utils3.parseWithErrorHandling)(
         zRefreshTokenProfileJwtPayload,
         {
           aud: options.authorizationServer,
           client_id: options.clientId,
           cnf: { jkt: dpopJkt },
-          exp: (0, import_io_wallet_utils2.dateToSeconds)(
-            (0, import_io_wallet_utils2.addSecondsToDate)(now, options.refreshTokenExpiresInSeconds)
+          exp: (0, import_io_wallet_utils3.dateToSeconds)(
+            (0, import_io_wallet_utils3.addSecondsToDate)(now, options.refreshTokenExpiresInSeconds)
           ),
-          iat: (0, import_io_wallet_utils2.dateToSeconds)(now),
+          iat: (0, import_io_wallet_utils3.dateToSeconds)(now),
           iss: options.authorizationServer,
           jti: await generateUuidV4(options.callbacks.generateRandom),
-          nbf: (0, import_io_wallet_utils2.dateToSeconds)(accessTokenExpiresAt),
+          nbf: (0, import_io_wallet_utils3.dateToSeconds)(accessTokenExpiresAt),
           sub: options.subject
         }
       );
@@ -384,7 +448,7 @@ async function createAccessTokenResponse(options) {
       );
       refreshToken = refreshTokenSignResult.jwt;
     }
-    const accessTokenResponse = (0, import_io_wallet_utils2.parseWithErrorHandling)(zAccessTokenResponse, {
+    const accessTokenResponse = (0, import_io_wallet_utils3.parseWithErrorHandling)(zAccessTokenResponse, {
       ...options.additionalPayload,
       access_token: jwt,
       expires_in: options.expiresInSeconds,
@@ -401,30 +465,39 @@ async function createAccessTokenResponse(options) {
     );
   }
 }
+var dispatchCreateAccessTokenResponse = (0, import_io_wallet_utils3.createVersionDispatcher)({
+  [import_io_wallet_utils3.ItWalletSpecsVersion.APTITUDE]: (o) => createAccessTokenResponseV1_4(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_0]: (o) => createAccessTokenResponseV1_4(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_3]: (o) => createAccessTokenResponseV1_4(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_4]: (o) => createAccessTokenResponseV1_4(o)
+});
+function createAccessTokenResponse(options) {
+  return dispatchCreateAccessTokenResponse(options);
+}
 
 // src/access-token/fetch-token-response.ts
-var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
-async function fetchTokenResponse(options) {
+var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+async function fetchTokenResponseV1_4(options) {
   try {
-    const fetch = (0, import_io_wallet_utils3.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils4.createFetcher)(options.callbacks.fetch);
     const tokenResponse = await fetch(options.accessTokenEndpoint, {
       body: toURLSearchParams(options.accessTokenRequest),
       headers: {
-        [import_io_wallet_utils3.HEADERS.CONTENT_TYPE]: import_io_wallet_utils3.CONTENT_TYPES.FORM_URLENCODED,
-        [import_io_wallet_utils3.HEADERS.DPOP]: options.dPoP,
-        [import_io_wallet_utils3.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils3.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils4.HEADERS.CONTENT_TYPE]: import_io_wallet_utils4.CONTENT_TYPES.FORM_URLENCODED,
+        [import_io_wallet_utils4.HEADERS.DPOP]: options.dPoP,
+        [import_io_wallet_utils4.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils4.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils3.hasStatusOrThrow)(200, import_io_wallet_utils3.UnexpectedStatusCodeError)(tokenResponse);
-    return (0, import_io_wallet_utils3.parseWithErrorHandling)(
+    await (0, import_io_wallet_utils4.hasStatusOrThrow)(200, import_io_wallet_utils4.UnexpectedStatusCodeError)(tokenResponse);
+    return (0, import_io_wallet_utils4.parseWithErrorHandling)(
       zAccessTokenResponse,
       await tokenResponse.json(),
       "Failed to parse token response"
     );
   } catch (error) {
-    if (error instanceof import_io_wallet_utils3.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils3.ValidationError) {
+    if (error instanceof import_io_wallet_utils4.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils4.ValidationError) {
       throw error;
     }
     throw new FetchTokenResponseError(
@@ -443,68 +516,83 @@ function toURLSearchParams(data) {
   });
   return params;
 }
+var dispatchFetchTokenResponse = (0, import_io_wallet_utils4.createVersionDispatcher)({
+  [import_io_wallet_utils4.ItWalletSpecsVersion.APTITUDE]: (o) => fetchTokenResponseV1_4(o),
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_0]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_3]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_4]: (o) => fetchTokenResponseV1_4(
+    o
+  )
+});
+function fetchTokenResponse(options) {
+  return dispatchFetchTokenResponse(options);
+}
 
 // src/access-token/parse-token-request.ts
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/wallet-attestation.ts
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/types.ts
-var import_zod2 = __toESM(require("zod"));
-var zOauthClientAttestationHeader = import_zod2.default.literal(
+var import_zod3 = __toESM(require("zod"));
+var zOauthClientAttestationHeader = import_zod3.default.literal(
   "OAuth-Client-Attestation"
 );
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = import_zod2.default.literal(
+var zOauthClientAttestationPopHeader = import_zod3.default.literal(
   "OAuth-Client-Attestation-PoP"
 );
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
 
 // src/client-attestation/verify-wallet-attestation-jwt-base.ts
-var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
 async function verifyWalletAttestationBase(options, headerSchema, payloadSchema) {
-  const { header, payload } = (0, import_io_wallet_utils4.decodeJwt)({
+  const { header, payload } = (0, import_io_wallet_utils5.decodeJwt)({
     errorMessagePrefix: "Error decoding wallet attestation JWT:",
     headerSchema,
     jwt: options.walletAttestationJwt,
     payloadSchema
   });
-  const { signer } = await (0, import_io_wallet_utils4.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils5.verifyJwt)({
     compact: options.walletAttestationJwt,
     errorMessage: "wallet attestation verification failed.",
     header,
     now: options.now,
     payload,
-    signer: (0, import_io_wallet_utils4.jwtSignerFromJwt)({ header, payload }),
+    signer: (0, import_io_wallet_utils5.jwtSignerFromJwt)({ header, payload }),
     verifyJwtCallback: options.callbacks.verifyJwt
   });
   return { header, payload, signer };
 }
 
 // src/client-attestation/v1.0/z-wallet-attestation.ts
-var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
-var import_zod3 = require("zod");
-var zWalletAttestationJwtHeaderV1_0 = import_zod3.z.looseObject({
-  ...import_io_wallet_utils5.zJwtHeader.shape,
-  trust_chain: import_io_wallet_utils5.zTrustChain,
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
+var import_zod4 = require("zod");
+var zWalletAttestationJwtHeaderV1_0 = import_zod4.z.looseObject({
+  ...import_io_wallet_utils6.zJwtHeader.shape,
+  trust_chain: import_io_wallet_utils6.zTrustChain,
   // REQUIRED in v1.0
-  typ: import_zod3.z.literal("oauth-client-attestation+jwt")
+  typ: import_zod4.z.literal("oauth-client-attestation+jwt")
 });
-var zWalletAttestationJwtPayloadV1_0 = import_zod3.z.looseObject({
-  ...import_io_wallet_utils5.zJwtPayload.shape,
-  aal: import_zod3.z.string(),
-  cnf: import_zod3.z.object({
-    jwk: import_io_wallet_utils5.zJwk
+var zWalletAttestationJwtPayloadV1_0 = import_zod4.z.looseObject({
+  ...import_io_wallet_utils6.zJwtPayload.shape,
+  aal: import_zod4.z.string(),
+  cnf: import_zod4.z.object({
+    jwk: import_io_wallet_utils6.zJwk
   }),
-  exp: import_zod3.z.number(),
-  iat: import_zod3.z.number(),
-  iss: import_zod3.z.string(),
-  sub: import_zod3.z.string(),
-  wallet_link: import_zod3.z.url().optional(),
-  wallet_name: import_zod3.z.string().optional()
+  exp: import_zod4.z.number(),
+  iat: import_zod4.z.number(),
+  iss: import_zod4.z.string(),
+  sub: import_zod4.z.string(),
+  wallet_link: import_zod4.z.url().optional(),
+  wallet_name: import_zod4.z.string().optional()
 });
-var zWalletAttestationJwtV1_0 = import_zod3.z.string().min(1);
+var zWalletAttestationJwtV1_0 = import_zod4.z.string().min(1);
 
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
@@ -516,38 +604,38 @@ async function verifyWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.3/z-wallet-attestation.ts
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
-var import_zod4 = require("zod");
-var zWalletAttestationJwtHeaderV1_3 = import_zod4.z.looseObject({
-  ...import_io_wallet_utils6.zJwtHeader.shape,
-  trust_chain: import_io_wallet_utils6.zTrustChain.optional(),
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_zod5 = require("zod");
+var zWalletAttestationJwtHeaderV1_3 = import_zod5.z.looseObject({
+  ...import_io_wallet_utils7.zJwtHeader.shape,
+  trust_chain: import_io_wallet_utils7.zTrustChain.optional(),
   // OPTIONAL in v1.3
-  typ: import_zod4.z.literal("oauth-client-attestation+jwt"),
-  x5c: import_io_wallet_utils6.zCertificateChain
+  typ: import_zod5.z.literal("oauth-client-attestation+jwt"),
+  x5c: import_io_wallet_utils7.zCertificateChain
   // REQUIRED in v1.3
 });
-var zWalletAttestationJwtPayloadV1_3 = import_zod4.z.looseObject({
-  ...import_io_wallet_utils6.zJwtPayload.shape,
-  cnf: import_zod4.z.object({
-    jwk: import_io_wallet_utils6.zJwk
+var zWalletAttestationJwtPayloadV1_3 = import_zod5.z.looseObject({
+  ...import_io_wallet_utils7.zJwtPayload.shape,
+  cnf: import_zod5.z.object({
+    jwk: import_io_wallet_utils7.zJwk
   }),
-  exp: import_zod4.z.number(),
-  iat: import_zod4.z.number(),
-  iss: import_zod4.z.string(),
-  nbf: import_zod4.z.number().optional(),
+  exp: import_zod5.z.number(),
+  iat: import_zod5.z.number(),
+  iss: import_zod5.z.string(),
+  nbf: import_zod5.z.number().optional(),
   // NEW in v1.3
-  status: import_zod4.z.object({
-    status_list: import_zod4.z.object({
-      idx: import_zod4.z.number().int(),
-      uri: import_zod4.z.string()
+  status: import_zod5.z.object({
+    status_list: import_zod5.z.object({
+      idx: import_zod5.z.number().int(),
+      uri: import_zod5.z.string()
     })
   }).optional(),
   // NEW in v1.3 - status object for revocation
-  sub: import_zod4.z.string(),
-  wallet_link: import_zod4.z.url().optional(),
-  wallet_name: import_zod4.z.string().optional()
+  sub: import_zod5.z.string(),
+  wallet_link: import_zod5.z.url().optional(),
+  wallet_name: import_zod5.z.string().optional()
 });
-var zWalletAttestationJwtV1_3 = import_zod4.z.string().min(1);
+var zWalletAttestationJwtV1_3 = import_zod5.z.string().min(1);
 
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
@@ -559,29 +647,29 @@ async function verifyWalletAttestationJwt2(options) {
 }
 
 // src/client-attestation/v1.4/z-wallet-attestation.ts
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
-var import_zod5 = require("zod");
-var zWalletAttestationJwtHeaderV1_4 = import_zod5.z.looseObject({
-  ...import_io_wallet_utils7.zJwtHeader.shape,
-  kid: import_zod5.z.string(),
-  trust_chain: import_io_wallet_utils7.zTrustChain.optional(),
-  typ: import_zod5.z.literal("oauth-client-attestation+jwt"),
-  x5c: import_io_wallet_utils7.zCertificateChain
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_zod6 = require("zod");
+var zWalletAttestationJwtHeaderV1_4 = import_zod6.z.looseObject({
+  ...import_io_wallet_utils8.zJwtHeader.shape,
+  kid: import_zod6.z.string(),
+  trust_chain: import_io_wallet_utils8.zTrustChain.optional(),
+  typ: import_zod6.z.literal("oauth-client-attestation+jwt"),
+  x5c: import_io_wallet_utils8.zCertificateChain
 });
-var zWalletAttestationJwtPayloadV1_4 = import_zod5.z.looseObject({
-  ...import_io_wallet_utils7.zJwtPayload.shape,
-  cnf: import_zod5.z.object({
-    jwk: import_io_wallet_utils7.zJwk
+var zWalletAttestationJwtPayloadV1_4 = import_zod6.z.looseObject({
+  ...import_io_wallet_utils8.zJwtPayload.shape,
+  cnf: import_zod6.z.object({
+    jwk: import_io_wallet_utils8.zJwk
   }),
-  exp: import_zod5.z.number().int(),
-  iat: import_zod5.z.number().int(),
-  iss: import_zod5.z.string(),
-  nbf: import_zod5.z.number().optional(),
-  sub: import_zod5.z.string(),
-  wallet_link: import_zod5.z.url(),
-  wallet_name: import_zod5.z.string()
+  exp: import_zod6.z.number().int(),
+  iat: import_zod6.z.number().int(),
+  iss: import_zod6.z.string(),
+  nbf: import_zod6.z.number().optional(),
+  sub: import_zod6.z.string(),
+  wallet_link: import_zod6.z.url(),
+  wallet_name: import_zod6.z.string()
 });
-var zWalletAttestationJwtV1_4 = import_zod5.z.string().min(1);
+var zWalletAttestationJwtV1_4 = import_zod6.z.string().min(1);
 
 // src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt3(options) {
@@ -593,10 +681,11 @@ async function verifyWalletAttestationJwt3(options) {
 }
 
 // src/client-attestation/wallet-attestation.ts
-var dispatchVerifyWalletAttestationJwt = (0, import_io_wallet_utils8.createVersionDispatcher)({
-  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
-  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
-  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
+var dispatchVerifyWalletAttestationJwt = (0, import_io_wallet_utils9.createVersionDispatcher)({
+  [import_io_wallet_utils9.ItWalletSpecsVersion.APTITUDE]: (o) => verifyWalletAttestationJwt3(o),
+  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
+  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
+  [import_io_wallet_utils9.ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
 });
 async function verifyWalletAttestationJwt4(options) {
   return dispatchVerifyWalletAttestationJwt(options);
@@ -612,7 +701,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
   if (!walletAttestationHeader || !clientAttestationPopHeader) {
     return { valid: false };
   }
-  if (!import_io_wallet_utils8.zCompactJwt.safeParse(walletAttestationHeader).success || !import_io_wallet_utils8.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
+  if (!import_io_wallet_utils9.zCompactJwt.safeParse(walletAttestationHeader).success || !import_io_wallet_utils9.zCompactJwt.safeParse(clientAttestationPopHeader).success) {
     return { valid: false };
   }
   return {
@@ -623,7 +712,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 }
 
 // src/token-dpop/create-token-dpop.ts
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
 var import_js_base64 = require("js-base64");
 
 // src/token-dpop/dpop-utils.ts
@@ -635,29 +724,29 @@ var htuFromRequestUrl = (requestUrl) => {
 };
 
 // src/token-dpop/z-dpop.ts
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
-var import_zod6 = __toESM(require("zod"));
-var zDpopJwtPayload = import_zod6.default.looseObject({
-  ...import_io_wallet_utils9.zJwtPayload.shape,
-  ath: import_zod6.default.optional(import_zod6.default.string()),
-  htm: import_io_wallet_utils9.zHttpMethod,
-  htu: import_zod6.default.url(),
-  iat: import_zod6.default.number().int().nonnegative(),
-  jti: import_zod6.default.string().max(import_io_wallet_utils9.MAX_JTI_LENGTH)
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_zod7 = __toESM(require("zod"));
+var zDpopJwtPayload = import_zod7.default.looseObject({
+  ...import_io_wallet_utils10.zJwtPayload.shape,
+  ath: import_zod7.default.optional(import_zod7.default.string()),
+  htm: import_io_wallet_utils10.zHttpMethod,
+  htu: import_zod7.default.url(),
+  iat: import_zod7.default.number().int().nonnegative(),
+  jti: import_zod7.default.string().max(import_io_wallet_utils10.MAX_JTI_LENGTH)
 });
-var zDpopJwtHeader = import_zod6.default.looseObject({
-  ...import_io_wallet_utils9.zJwtHeader.shape,
-  jwk: import_io_wallet_utils9.zJwk,
-  typ: import_zod6.default.literal("dpop+jwt")
+var zDpopJwtHeader = import_zod7.default.looseObject({
+  ...import_io_wallet_utils10.zJwtHeader.shape,
+  jwk: import_io_wallet_utils10.zJwk,
+  typ: import_zod7.default.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
 async function createTokenDPoP(options) {
   try {
-    const ath = options.accessToken ? (0, import_io_wallet_utils10.encodeToBase64Url)(
+    const ath = options.accessToken ? (0, import_io_wallet_utils11.encodeToBase64Url)(
       await options.callbacks.hash(
-        (0, import_io_wallet_utils10.decodeUtf8String)(options.accessToken),
-        import_io_wallet_utils10.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils11.decodeUtf8String)(options.accessToken),
+        import_io_wallet_utils11.HashAlgorithm.Sha256
       )
     ) : void 0;
     const jti = options.jti ?? (options.callbacks.generateRandom ? import_js_base64.Base64.fromUint8Array(
@@ -669,16 +758,16 @@ async function createTokenDPoP(options) {
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const header = (0, import_io_wallet_utils10.parseWithErrorHandling)(zDpopJwtHeader, {
+    const header = (0, import_io_wallet_utils11.parseWithErrorHandling)(zDpopJwtHeader, {
       alg: options.signer.alg,
       jwk: options.signer.publicJwk,
       typ: "dpop+jwt"
     });
-    const payload = (0, import_io_wallet_utils10.parseWithErrorHandling)(zDpopJwtPayload, {
+    const payload = (0, import_io_wallet_utils11.parseWithErrorHandling)(zDpopJwtPayload, {
       ath,
       htm: options.tokenRequest.method,
       htu: htuFromRequestUrl(options.tokenRequest.url),
-      iat: (0, import_io_wallet_utils10.dateToSeconds)(options.issuedAt),
+      iat: (0, import_io_wallet_utils11.dateToSeconds)(options.issuedAt),
       jti
     });
     return options.callbacks.signJwt(options.signer, {
@@ -686,7 +775,7 @@ async function createTokenDPoP(options) {
       payload
     });
   } catch (error) {
-    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils10.ValidationError) {
+    if (error instanceof CreateTokenDPoPError || error instanceof import_io_wallet_utils11.ValidationError) {
       throw error;
     }
     throw new CreateTokenDPoPError(
@@ -699,28 +788,21 @@ function extractDpopJwtFromHeaders(headers) {
   if (!dpopJwt) {
     return { valid: true };
   }
-  if (!import_io_wallet_utils10.zCompactJwt.safeParse(dpopJwt).success) {
+  if (!import_io_wallet_utils11.zCompactJwt.safeParse(dpopJwt).success) {
     return { valid: false };
   }
   return { dpopJwt, valid: true };
 }
 
-// src/access-token/z-grant-type.ts
-var import_zod7 = require("zod");
-var zAuthorizationCodeGrantIdentifier = import_zod7.z.literal("authorization_code");
-var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = import_zod7.z.literal("refresh_token");
-var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
-
 // src/access-token/parse-token-request.ts
-function parseAccessTokenRequest(options) {
+function parseAccessTokenRequestV1_4(options) {
   const validationResult = zAccessTokenRequest.safeParse(
     options.accessTokenRequest
   );
   if (!validationResult.success) {
     throw new Oauth2Error(
       `Access token request validation failed:
-${(0, import_io_wallet_utils11.formatZodError)(validationResult.error)}`
+${(0, import_io_wallet_utils12.formatZodError)(validationResult.error)}`
     );
   }
   const accessTokenRequest = validationResult.data;
@@ -734,6 +816,25 @@ ${(0, import_io_wallet_utils11.formatZodError)(validationResult.error)}`
     ...securityHeaders
   };
 }
+function parseAccessTokenRequestAPTITUDE(options) {
+  const validationResult = zAccessTokenRequestAPTITUDE.safeParse(
+    options.accessTokenRequest
+  );
+  if (!validationResult.success) {
+    throw new Oauth2Error(
+      `Access token request validation failed:
+${(0, import_io_wallet_utils12.formatZodError)(validationResult.error)}`
+    );
+  }
+  const accessTokenRequest = validationResult.data;
+  const grant = parseGrantParametersAPTITUDE(accessTokenRequest);
+  const securityHeaders = parseSecurityHeaders(options.request.headers);
+  return {
+    accessTokenRequest,
+    grant,
+    ...securityHeaders
+  };
+}
 function parseGrantParameters(accessTokenRequest) {
   if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
     return {
@@ -751,6 +852,30 @@ function parseGrantParameters(accessTokenRequest) {
     `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}'`
   );
 }
+function parseGrantParametersAPTITUDE(accessTokenRequest) {
+  if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
+    return {
+      code: accessTokenRequest.code,
+      grantType: authorizationCodeGrantIdentifier
+    };
+  }
+  if (accessTokenRequest.grant_type === refreshTokenGrantIdentifier) {
+    return {
+      grantType: refreshTokenGrantIdentifier,
+      refreshToken: accessTokenRequest.refresh_token
+    };
+  }
+  if (accessTokenRequest.grant_type === preAuthorizedCodeGrantIdentifier) {
+    return {
+      grantType: preAuthorizedCodeGrantIdentifier,
+      preAuthorizedCode: accessTokenRequest["pre-authorized_code"],
+      txCode: accessTokenRequest.tx_code
+    };
+  }
+  throw new Oauth2Error(
+    `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}', '${preAuthorizedCodeGrantIdentifier}'`
+  );
+}
 function parseSecurityHeaders(headers) {
   const extractedDpopJwt = extractDpopJwtFromHeaders(headers);
   if (!extractedDpopJwt.valid) {
@@ -785,15 +910,35 @@ function parseSecurityHeaders(headers) {
     dpop: { jwt: extractedDpopJwt.dpopJwt }
   };
 }
+var dispatchParseTokenRequest = (0, import_io_wallet_utils12.createVersionDispatcher)({
+  [import_io_wallet_utils12.ItWalletSpecsVersion.APTITUDE]: (o) => parseAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_0]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_3]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils12.ItWalletSpecsVersion.V1_4]: (o) => parseAccessTokenRequestV1_4(
+    o
+  )
+});
+function parseAccessTokenRequest(options) {
+  return dispatchParseTokenRequest(options);
+}
+
+// src/access-token/verify-access-token-request.ts
+var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/verify-client-attestation.ts
-var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/client-attestation-pop.ts
-var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/z-client-attestation-pop.ts
-var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
 var import_zod8 = __toESM(require("zod"));
 var IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES = [
   "ES256",
@@ -804,19 +949,19 @@ var zItWalletClientAttestationPopJwtAlg = import_zod8.default.enum(
   IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES
 );
 var zItWalletClientAttestationPopJwtPayload = import_zod8.default.looseObject({
-  ...import_io_wallet_utils12.zJwtPayload.shape,
+  ...import_io_wallet_utils13.zJwtPayload.shape,
   aud: import_zod8.default.string(),
   exp: import_zod8.default.number().int().optional(),
   iat: import_zod8.default.number().int(),
   iss: import_zod8.default.string(),
-  jti: import_zod8.default.string().max(import_io_wallet_utils12.MAX_JTI_LENGTH),
+  jti: import_zod8.default.string().max(import_io_wallet_utils13.MAX_JTI_LENGTH),
   nonce: import_zod8.default.string().optional()
 });
 var zItWalletClientAttestationPopJwtTyp = import_zod8.default.literal(
   "oauth-client-attestation-pop+jwt"
 );
 var zItWalletClientAttestationPopJwtHeader = import_zod8.default.looseObject({
-  ...import_io_wallet_utils12.zJwtHeader.shape,
+  ...import_io_wallet_utils13.zJwtHeader.shape,
   typ: zItWalletClientAttestationPopJwtTyp
 });
 
@@ -830,14 +975,14 @@ function assertSupportedClientAttestationPopAlg(alg) {
 }
 async function verifyClientAttestationPopJwt(options) {
   try {
-    const { header, payload } = (0, import_io_wallet_utils13.decodeJwt)({
+    const { header, payload } = (0, import_io_wallet_utils14.decodeJwt)({
       errorMessagePrefix: "Error decoding client attestation PoP JWT:",
       headerSchema: zItWalletClientAttestationPopJwtHeader,
       jwt: options.clientAttestationPopJwt,
       payloadSchema: zItWalletClientAttestationPopJwtPayload
     });
     assertSupportedClientAttestationPopAlg(header.alg);
-    const { signer } = await (0, import_io_wallet_utils13.verifyJwt)({
+    const { signer } = await (0, import_io_wallet_utils14.verifyJwt)({
       compact: options.clientAttestationPopJwt,
       errorMessage: "client attestation pop jwt verification failed",
       expectedAudience: options.authorizationServer,
@@ -866,7 +1011,7 @@ async function verifyClientAttestationPopJwt(options) {
 }
 async function createClientAttestationPopJwt(options) {
   try {
-    const clientAttestation = (0, import_io_wallet_utils13.decodeJwt)({
+    const clientAttestation = (0, import_io_wallet_utils14.decodeJwt)({
       errorMessagePrefix: "Error decoding client attestation JWT:",
       jwt: options.clientAttestation
     });
@@ -893,22 +1038,22 @@ async function createClientAttestationPopJwt(options) {
       typ: zItWalletClientAttestationPopJwtTyp.value
     };
     const issuedAt = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils13.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
+    const jti = options.jti ?? (options.callbacks.generateRandom ? (0, import_io_wallet_utils14.encodeToBase64Url)(await options.callbacks.generateRandom(32)) : void 0);
     if (!jti) {
       throw new Oauth2Error(
         "Error: neither a default jti nor a generateRandom callback have been provided"
       );
     }
-    const payload = (0, import_io_wallet_utils13.parseWithErrorHandling)(
+    const payload = (0, import_io_wallet_utils14.parseWithErrorHandling)(
       zItWalletClientAttestationPopJwtPayload,
       {
         aud: options.authorizationServer,
-        iat: (0, import_io_wallet_utils13.dateToSeconds)(issuedAt),
+        iat: (0, import_io_wallet_utils14.dateToSeconds)(issuedAt),
         iss: sub,
         jti,
-        ...options.config.itWalletSpecsVersion === import_io_wallet_utils13.ItWalletSpecsVersion.V1_0 ? {
-          exp: (0, import_io_wallet_utils13.dateToSeconds)(
-            "expiresAt" in options && options.expiresAt ? options.expiresAt : (0, import_io_wallet_utils13.addSecondsToDate)(issuedAt, 1 * 60)
+        ...options.config.itWalletSpecsVersion === import_io_wallet_utils14.ItWalletSpecsVersion.V1_0 ? {
+          exp: (0, import_io_wallet_utils14.dateToSeconds)(
+            "expiresAt" in options && options.expiresAt ? options.expiresAt : (0, import_io_wallet_utils14.addSecondsToDate)(issuedAt, 1 * 60)
           )
         } : {}
       }
@@ -953,8 +1098,8 @@ async function verifyClientAttestation(options) {
     );
   }
   if (options.clientAttestation.ensureConfirmationKeyMatchesDpopKey && options.dpopJwkThumbprint) {
-    const clientAttestationJkt = await (0, import_io_wallet_utils14.calculateJwkThumbprint)({
-      hashAlgorithm: import_io_wallet_utils14.HashAlgorithm.Sha256,
+    const clientAttestationJkt = await (0, import_io_wallet_utils15.calculateJwkThumbprint)({
+      hashAlgorithm: import_io_wallet_utils15.HashAlgorithm.Sha256,
       hashCallback: options.callbacks.hash,
       jwk: clientAttestation.payload.cnf.jwk
     });
@@ -971,7 +1116,7 @@ async function verifyClientAttestation(options) {
 }
 
 // src/pkce.ts
-var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
 var PkceCodeChallengeMethod = {
   Plain: "plain",
   S256: "S256"
@@ -989,7 +1134,7 @@ async function createPkce(options) {
   const codeChallengeMethod = allowedCodeChallengeMethods.includes(
     PkceCodeChallengeMethod.S256
   ) ? PkceCodeChallengeMethod.S256 : PkceCodeChallengeMethod.Plain;
-  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils15.encodeToBase64Url)(await options.callbacks.generateRandom(64));
+  const codeVerifier = options.codeVerifier ?? (0, import_io_wallet_utils16.encodeToBase64Url)(await options.callbacks.generateRandom(64));
   return {
     codeChallenge: await calculateCodeChallenge({
       codeChallengeMethod,
@@ -1017,10 +1162,10 @@ async function calculateCodeChallenge(options) {
     return options.codeVerifier;
   }
   if (options.codeChallengeMethod === PkceCodeChallengeMethod.S256) {
-    return (0, import_io_wallet_utils15.encodeToBase64Url)(
+    return (0, import_io_wallet_utils16.encodeToBase64Url)(
       await options.hashCallback(
-        (0, import_io_wallet_utils15.decodeUtf8String)(options.codeVerifier),
-        import_io_wallet_utils15.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils16.decodeUtf8String)(options.codeVerifier),
+        import_io_wallet_utils16.HashAlgorithm.Sha256
       )
     );
   }
@@ -1030,9 +1175,9 @@ async function calculateCodeChallenge(options) {
 }
 
 // src/token-dpop/verify-token-dpop.ts
-var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
 async function verifyTokenDPoP(options) {
-  const { header, payload } = (0, import_io_wallet_utils16.decodeJwt)({
+  const { header, payload } = (0, import_io_wallet_utils17.decodeJwt)({
     errorMessagePrefix: "Error decoding access token DPoP JWT:",
     headerSchema: zDpopJwtHeader,
     jwt: options.dpopJwt,
@@ -1070,10 +1215,10 @@ async function verifyTokenDPoP(options) {
     );
   }
   if (options.accessToken) {
-    const expectedAth = (0, import_io_wallet_utils16.encodeToBase64Url)(
+    const expectedAth = (0, import_io_wallet_utils17.encodeToBase64Url)(
       await options.callbacks.hash(
-        (0, import_io_wallet_utils16.decodeUtf8String)(options.accessToken),
-        import_io_wallet_utils16.HashAlgorithm.Sha256
+        (0, import_io_wallet_utils17.decodeUtf8String)(options.accessToken),
+        import_io_wallet_utils17.HashAlgorithm.Sha256
       )
     );
     if (!payload.ath) {
@@ -1087,8 +1232,8 @@ async function verifyTokenDPoP(options) {
       );
     }
   }
-  const jwkThumbprint = await (0, import_io_wallet_utils16.calculateJwkThumbprint)({
-    hashAlgorithm: import_io_wallet_utils16.HashAlgorithm.Sha256,
+  const jwkThumbprint = await (0, import_io_wallet_utils17.calculateJwkThumbprint)({
+    hashAlgorithm: import_io_wallet_utils17.HashAlgorithm.Sha256,
     hashCallback: options.callbacks.hash,
     jwk: header.jwk
   });
@@ -1098,7 +1243,7 @@ async function verifyTokenDPoP(options) {
     );
   }
   try {
-    (0, import_io_wallet_utils16.verifyJwtIatOrThrow)({
+    (0, import_io_wallet_utils17.verifyJwtIatOrThrow)({
       iat: payload.iat,
       now: options.now
     });
@@ -1107,7 +1252,7 @@ async function verifyTokenDPoP(options) {
       throw new Oauth2Error(`Invalid iat claim in dpop JWT: ${error.message}`);
     }
   }
-  await (0, import_io_wallet_utils16.verifyJwt)({
+  await (0, import_io_wallet_utils17.verifyJwt)({
     compact: options.dpopJwt,
     errorMessage: "dpop jwt verification failed",
     header,
@@ -1128,7 +1273,7 @@ async function verifyTokenDPoP(options) {
 }
 
 // src/access-token/verify-access-token-request.ts
-async function verifyAccessTokenRequest(options) {
+async function verifyAccessTokenRequestV1_4(options) {
   if (options.dpop.expectedNonce === "") {
     throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
@@ -1157,12 +1302,44 @@ async function verifyAccessTokenRequest(options) {
   if (options.grant.code !== options.expectedCode) {
     throw new Oauth2Error(`Invalid 'code' provided`);
   }
-  if (options.codeExpiresAt) {
-    const now = options.now ?? /* @__PURE__ */ new Date();
-    if (now.getTime() > options.codeExpiresAt.getTime()) {
-      throw new Oauth2Error(`Expired 'code' provided`);
-    }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+  if (!header.jwk) {
+    throw new Oauth2Error("DPoP header does not contain a JWK");
   }
+  return {
+    clientAttestation: clientAttestationResult,
+    dpop: { jwk: header.jwk, jwkThumbprint }
+  };
+}
+async function verifyAccessTokenRequestAPTITUDE(options) {
+  if (options.dpop.expectedNonce === "") {
+    throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
+  }
+  if (!isPreAuthorizedCodeVerification(options)) {
+    await verifyPkce({
+      callbacks: options.callbacks,
+      codeChallenge: options.pkce.codeChallenge,
+      codeChallengeMethod: options.pkce.codeChallengeMethod,
+      codeVerifier: options.pkce.codeVerifier
+    });
+  }
+  const { header, jwkThumbprint } = await verifyTokenDPoP({
+    allowedSigningAlgs: options.dpop.allowedSigningAlgs,
+    callbacks: options.callbacks,
+    dpopJwt: options.dpop.jwt,
+    expectedNonce: options.dpop.expectedNonce,
+    now: options.now,
+    request: options.request
+  });
+  const clientAttestationResult = await verifyClientAttestation({
+    authorizationServerMetadata: options.authorizationServerMetadata,
+    callbacks: options.callbacks,
+    clientAttestation: options.clientAttestation,
+    config: options.config,
+    dpopJwkThumbprint: jwkThumbprint,
+    now: options.now
+  });
+  verifyGrantParameters(options);
   if (!header.jwk) {
     throw new Oauth2Error("DPoP header does not contain a JWK");
   }
@@ -1171,12 +1348,75 @@ async function verifyAccessTokenRequest(options) {
     dpop: { jwk: header.jwk, jwkThumbprint }
   };
 }
+function isPreAuthorizedCodeVerification(options) {
+  return options.grant.grantType === preAuthorizedCodeGrantIdentifier;
+}
+function verifyGrantParameters(options) {
+  if (isPreAuthorizedCodeVerification(options)) {
+    if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) {
+      throw new Oauth2Error(`Invalid 'pre-authorized_code' provided`);
+    }
+    verifyTransactionCode(options.grant.txCode, options.expectedTxCode);
+    verifyCodeExpiration(
+      options.preAuthorizedCodeExpiresAt,
+      options.now,
+      "pre-authorized_code"
+    );
+    return;
+  }
+  if (options.grant.grantType !== authorizationCodeGrantIdentifier) {
+    throw new Oauth2Error(
+      "Only authorization_code and pre-authorized_code grants can be verified"
+    );
+  }
+  if (options.grant.code !== options.expectedCode) {
+    throw new Oauth2Error(`Invalid 'code' provided`);
+  }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+}
+function verifyTransactionCode(txCode, expectedTxCode) {
+  if (txCode === expectedTxCode) return;
+  if (expectedTxCode === void 0) {
+    throw new Oauth2Error("Request contains 'tx_code' that was not expected");
+  }
+  if (txCode === void 0) {
+    throw new Oauth2Error("Missing required 'tx_code' in request");
+  }
+  throw new Oauth2Error("Invalid 'tx_code' provided");
+}
+function verifyCodeExpiration(expiresAt, date, codeParameter) {
+  if (!expiresAt) return;
+  if (Number.isNaN(expiresAt.getTime())) {
+    throw new Oauth2Error(`Invalid expiration date for '${codeParameter}'`);
+  }
+  const now = date ?? /* @__PURE__ */ new Date();
+  if (now.getTime() > expiresAt.getTime()) {
+    throw new Oauth2Error(`Expired '${codeParameter}' provided`);
+  }
+}
+var dispatchVerifyAccessTokenRequest = (0, import_io_wallet_utils18.createVersionDispatcher)({
+  [import_io_wallet_utils18.ItWalletSpecsVersion.APTITUDE]: (o) => verifyAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [import_io_wallet_utils18.ItWalletSpecsVersion.V1_0]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils18.ItWalletSpecsVersion.V1_3]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [import_io_wallet_utils18.ItWalletSpecsVersion.V1_4]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  )
+});
+function verifyAccessTokenRequest(options) {
+  return dispatchVerifyAccessTokenRequest(options);
+}
 
 // src/authorization-request/create-authorization-request.ts
-var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-request/z-authorization-request.ts
-var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
 var import_zod9 = __toESM(require("zod"));
 var zOpenidCredentialAuthorizationDetails = import_zod9.default.object({
   credential_configuration_id: import_zod9.default.string(),
@@ -1199,7 +1439,7 @@ var zAuthorizationRequestBaseObject = import_zod9.default.looseObject({
   code_challenge: import_zod9.default.string(),
   code_challenge_method: import_zod9.default.string(),
   issuer_state: import_zod9.default.optional(import_zod9.default.string()),
-  jti: import_zod9.default.string().max(import_io_wallet_utils17.MAX_JTI_LENGTH),
+  jti: import_zod9.default.string().max(import_io_wallet_utils19.MAX_JTI_LENGTH),
   redirect_uri: import_zod9.default.url(),
   response_type: import_zod9.default.string(),
   scope: import_zod9.default.string().optional(),
@@ -1272,13 +1512,13 @@ async function createPushedAuthorizationRequest(options) {
     code_challenge: pkce.codeChallenge,
     code_challenge_method: pkce.codeChallengeMethod,
     ...options.issuerState !== void 0 ? { issuer_state: options.issuerState } : {},
-    jti: options.jti ?? (0, import_io_wallet_utils18.encodeToBase64Url)(
+    jti: options.jti ?? (0, import_io_wallet_utils20.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     ),
     redirect_uri: options.redirectUri,
     response_type: "code",
     scope: options.scope,
-    state: options.state ?? (0, import_io_wallet_utils18.encodeToBase64Url)(
+    state: options.state ?? (0, import_io_wallet_utils20.encodeToBase64Url)(
       await options.callbacks.generateRandom(RANDOM_BYTES_SIZE)
     )
   };
@@ -1295,7 +1535,7 @@ async function createPushedAuthorizationRequest(options) {
       );
     }
     const iat = options.issuedAt ?? /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils18.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils20.addSecondsToDate)(iat, JWT_EXPIRY_SECONDS);
     const requestJwt = await options.callbacks.signJwt(dpop.signer, {
       header: {
         alg: dpop.signer.alg,
@@ -1304,8 +1544,8 @@ async function createPushedAuthorizationRequest(options) {
       },
       payload: {
         aud: options.audience,
-        exp: (0, import_io_wallet_utils18.dateToSeconds)(exp),
-        iat: (0, import_io_wallet_utils18.dateToSeconds)(iat),
+        exp: (0, import_io_wallet_utils20.dateToSeconds)(exp),
+        iat: (0, import_io_wallet_utils20.dateToSeconds)(iat),
         iss: dpop.signer.publicJwk.kid,
         ...authorizationRequest
       }
@@ -1323,27 +1563,30 @@ async function createPushedAuthorizationRequest(options) {
   };
 }
 function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
-  return (0, import_io_wallet_utils18.dispatchByVersion)(options.config.itWalletSpecsVersion, {
-    [import_io_wallet_utils18.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0.parse({
+  return (0, import_io_wallet_utils20.dispatchByVersion)(options.config.itWalletSpecsVersion, {
+    [import_io_wallet_utils20.ItWalletSpecsVersion.APTITUDE]: () => zAuthorizationRequestV1_3.parse(
+      baseAuthorizationRequest
+    ),
+    [import_io_wallet_utils20.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0.parse({
       ...baseAuthorizationRequest,
       response_mode: options.responseMode
     }),
-    [import_io_wallet_utils18.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3.parse(
+    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
+    [import_io_wallet_utils20.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     ),
-    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [import_io_wallet_utils18.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3.parse(
+    [import_io_wallet_utils20.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     )
   });
 }
 
 // src/authorization-request/fetch-authorization-response.ts
-var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
 async function fetchPushedAuthorizationResponse(options) {
   try {
-    const fetch = (0, import_io_wallet_utils19.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils21.createFetcher)(options.callbacks.fetch);
     const body = isPushedAuthorizationRequestSigned(
       options.pushedAuthorizationRequest
     ) ? new URLSearchParams({
@@ -1357,25 +1600,25 @@ async function fetchPushedAuthorizationResponse(options) {
       {
         body,
         headers: {
-          [import_io_wallet_utils19.HEADERS.CONTENT_TYPE]: import_io_wallet_utils19.CONTENT_TYPES.FORM_URLENCODED,
-          [import_io_wallet_utils19.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-          [import_io_wallet_utils19.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+          [import_io_wallet_utils21.HEADERS.CONTENT_TYPE]: import_io_wallet_utils21.CONTENT_TYPES.FORM_URLENCODED,
+          [import_io_wallet_utils21.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+          [import_io_wallet_utils21.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
         },
         method: "POST"
       }
     );
-    await (0, import_io_wallet_utils19.hasStatusOrThrow)(201, import_io_wallet_utils19.UnexpectedStatusCodeError)(parResponse);
+    await (0, import_io_wallet_utils21.hasStatusOrThrow)(201, import_io_wallet_utils21.UnexpectedStatusCodeError)(parResponse);
     const parResponseJson = await parResponse.json();
     const parsedParResponse = zPushedAuthorizationResponse.safeParse(parResponseJson);
     if (!parsedParResponse.success) {
-      throw new import_io_wallet_utils19.ValidationError(
+      throw new import_io_wallet_utils21.ValidationError(
         `Failed to parse pushed authorization response`,
         parsedParResponse.error
       );
     }
     return parsedParResponse.data;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils19.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils19.ValidationError) {
+    if (error instanceof import_io_wallet_utils21.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils21.ValidationError) {
       throw error;
     }
     throw new PushedAuthorizationRequestError(
@@ -1421,22 +1664,22 @@ function parseAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-pushed-authorization-request.ts
-var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils24 = require("@pagopa/io-wallet-utils");
 var import_zod11 = __toESM(require("zod"));
 
 // src/jar/fetch-jar-request-object.ts
-var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils22 = require("@pagopa/io-wallet-utils");
 async function fetchJarRequestObject(options) {
   const { fetch, requestUri } = options;
   const JAR_ACCEPT_HEADER = [
-    import_io_wallet_utils20.ContentType.OAuthAuthorizationRequestJwt,
+    import_io_wallet_utils22.ContentType.OAuthAuthorizationRequestJwt,
     // Preferred: application/oauth-authz-req+jwt
-    `${import_io_wallet_utils20.ContentType.Jwt};q=0.9`,
+    `${import_io_wallet_utils22.ContentType.Jwt};q=0.9`,
     // Fallback: application/jwt
     "text/plain"
     // Final fallback: text/plain
   ].join(", ");
-  const response = await (0, import_io_wallet_utils20.createFetcher)(fetch)(requestUri, {
+  const response = await (0, import_io_wallet_utils22.createFetcher)(fetch)(requestUri, {
     headers: {
       Accept: JAR_ACCEPT_HEADER
     },
@@ -1446,7 +1689,7 @@ async function fetchJarRequestObject(options) {
       `Fetching request_object from request_uri '${requestUri}' failed`
     );
   });
-  await (0, import_io_wallet_utils20.hasStatusOrThrow)(200, import_io_wallet_utils20.UnexpectedStatusCodeError)(response);
+  await (0, import_io_wallet_utils22.hasStatusOrThrow)(200, import_io_wallet_utils22.UnexpectedStatusCodeError)(response);
   return await response.text();
 }
 
@@ -1483,7 +1726,7 @@ async function parseJarRequest(options) {
 }
 
 // src/jar/z-jar.ts
-var import_io_wallet_utils21 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils23 = require("@pagopa/io-wallet-utils");
 var import_zod10 = __toESM(require("zod"));
 var zJarAuthorizationRequest = import_zod10.default.looseObject({
   client_id: import_zod10.default.optional(import_zod10.default.string()),
@@ -1491,14 +1734,14 @@ var zJarAuthorizationRequest = import_zod10.default.looseObject({
   request_uri: import_zod10.default.url().optional()
 });
 var zJarRequestObjectPayload = import_zod10.default.looseObject({
-  ...import_io_wallet_utils21.zJwtPayload.shape,
+  ...import_io_wallet_utils23.zJwtPayload.shape,
   client_id: import_zod10.default.string()
 });
 var zSignedAuthorizationRequestJwtHeaderTyp = import_zod10.default.literal(
   "oauth-authz-req+jwt"
 );
 var zJarRequestObjectHeader = import_zod10.default.looseObject({
-  ...import_io_wallet_utils21.zJwtHeader.shape,
+  ...import_io_wallet_utils23.zJwtHeader.shape,
   typ: zSignedAuthorizationRequestJwtHeaderTyp
 });
 var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
@@ -1510,7 +1753,7 @@ async function parsePushedAuthorizationRequest(options) {
   const authorizationRequestSchema = getAuthorizationRequestSchema(
     options.config
   );
-  const parsed = (0, import_io_wallet_utils22.parseWithErrorHandling)(
+  const parsed = (0, import_io_wallet_utils24.parseWithErrorHandling)(
     import_zod11.default.union([authorizationRequestSchema, zJarAuthorizationRequest]),
     options.authorizationRequest,
     "Invalid authorization request. Could not parse authorization request or jar."
@@ -1522,7 +1765,7 @@ async function parsePushedAuthorizationRequest(options) {
       callbacks: options.callbacks,
       jarRequestParams: parsed
     });
-    const jwt = (0, import_io_wallet_utils22.decodeJwt)({
+    const jwt = (0, import_io_wallet_utils24.decodeJwt)({
       errorMessagePrefix: "Error decoding pushed authorization request JWT:",
       jwt: parsedJar.authorizationRequestJwt
     });
@@ -1532,7 +1775,7 @@ async function parsePushedAuthorizationRequest(options) {
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Invalid authorization request. Could not parse jar request payload.
-${(0, import_io_wallet_utils22.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils24.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
     authorizationRequestJwt = parsedJar.authorizationRequestJwt;
@@ -1543,7 +1786,7 @@ ${(0, import_io_wallet_utils22.formatZodError)(parsedAuthorizationRequest.error)
     if (!parsedAuthorizationRequest.success) {
       throw new Oauth2Error(
         `Error occurred during validation of pushed authorization request.
-${(0, import_io_wallet_utils22.formatZodError)(parsedAuthorizationRequest.error)}`
+${(0, import_io_wallet_utils24.formatZodError)(parsedAuthorizationRequest.error)}`
       );
     }
   }
@@ -1559,12 +1802,13 @@ ${(0, import_io_wallet_utils22.formatZodError)(parsedAuthorizationRequest.error)
   };
 }
 function getAuthorizationRequestSchema(config) {
-  return (0, import_io_wallet_utils22.dispatchByVersion)(config.itWalletSpecsVersion, {
-    [import_io_wallet_utils22.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0,
-    [import_io_wallet_utils22.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3,
+  return (0, import_io_wallet_utils24.dispatchByVersion)(config.itWalletSpecsVersion, {
+    [import_io_wallet_utils24.ItWalletSpecsVersion.APTITUDE]: () => zAuthorizationRequestV1_3,
+    [import_io_wallet_utils24.ItWalletSpecsVersion.V1_0]: () => zAuthorizationRequestV1_0,
     // V1_4 reuses V1_3 PAR schema — no breaking changes between versions.
+    [import_io_wallet_utils24.ItWalletSpecsVersion.V1_3]: () => zAuthorizationRequestV1_3,
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [import_io_wallet_utils22.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3
+    [import_io_wallet_utils24.ItWalletSpecsVersion.V1_4]: () => zAuthorizationRequestV1_3
   });
 }
 
@@ -1613,19 +1857,19 @@ async function verifyAuthorizationRequestDpop(options, request, callbacks, now)
 }
 
 // src/authorization-request/verify-pushed-authorization-request.ts
-var import_io_wallet_utils24 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils26 = require("@pagopa/io-wallet-utils");
 
 // src/jar/verify-jar-request.ts
-var import_io_wallet_utils23 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils25 = require("@pagopa/io-wallet-utils");
 async function verifyJarRequest(options) {
   const { authorizationRequestJwt, callbacks, jarRequestParams, jwtSigner } = options;
-  const requestObjectIsEncrypted = import_io_wallet_utils23.zCompactJwe.safeParse(
+  const requestObjectIsEncrypted = import_io_wallet_utils25.zCompactJwe.safeParse(
     authorizationRequestJwt
   ).success;
   if (requestObjectIsEncrypted) {
     throw new Oauth2Error("Encrypted JWE request objects are not supported.");
   }
-  const requestIsSigned = import_io_wallet_utils23.zCompactJwt.safeParse(
+  const requestIsSigned = import_io_wallet_utils25.zCompactJwt.safeParse(
     authorizationRequestJwt
   ).success;
   if (!requestIsSigned) {
@@ -1678,15 +1922,15 @@ async function verifyJarRequest(options) {
 }
 async function verifyJarRequestObject(options) {
   const { authorizationRequestJwt, callbacks, jwtSigner } = options;
-  const jwt = (0, import_io_wallet_utils23.decodeJwt)({
+  const jwt = (0, import_io_wallet_utils25.decodeJwt)({
     errorMessagePrefix: "Error decoding JAR authorization request JWT:",
     jwt: authorizationRequestJwt
   });
-  const authorizationRequestPayload = (0, import_io_wallet_utils23.parseWithErrorHandling)(
+  const authorizationRequestPayload = (0, import_io_wallet_utils25.parseWithErrorHandling)(
     zJarRequestObjectPayload,
     jwt.payload
   );
-  const { signer } = await (0, import_io_wallet_utils23.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils25.verifyJwt)({
     compact: authorizationRequestJwt,
     header: jwt.header,
     payload: authorizationRequestPayload,
@@ -1719,7 +1963,7 @@ async function verifyPushedAuthorizationRequest(options) {
   let jar;
   if (options.authorizationRequestJwt) {
     if (requireSigned) {
-      const decoded = (0, import_io_wallet_utils24.decodeJwt)({
+      const decoded = (0, import_io_wallet_utils26.decodeJwt)({
         errorMessagePrefix: "Error decoding pushed authorization request JWT:",
         jwt: options.authorizationRequestJwt.jwt
       });
@@ -1808,10 +2052,10 @@ function clientAuthenticationWalletAttestationJwt(options) {
 }
 
 // src/client-attestation/v1.0/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils26 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils28 = require("@pagopa/io-wallet-utils");
 
 // src/client-attestation/jwk-thumbprint.ts
-var import_io_wallet_utils25 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils27 = require("@pagopa/io-wallet-utils");
 var SUPPORTED_KTY = ["RSA", "EC"];
 var calculateDpopJwkThumbprint = (options) => {
   if (!SUPPORTED_KTY.includes(
@@ -1821,8 +2065,8 @@ var calculateDpopJwkThumbprint = (options) => {
       `Unsupported JWK key type "${options.dpopJwkPublic.kty}" for thumbprint computation. Supported types: ${SUPPORTED_KTY.join(", ")}.`
     );
   }
-  return (0, import_io_wallet_utils25.calculateJwkThumbprint)({
-    hashAlgorithm: import_io_wallet_utils25.HashAlgorithm.Sha256,
+  return (0, import_io_wallet_utils27.calculateJwkThumbprint)({
+    hashAlgorithm: import_io_wallet_utils27.HashAlgorithm.Sha256,
     hashCallback: options.callbacks.hash,
     jwk: options.dpopJwkPublic
   });
@@ -1833,12 +2077,12 @@ var createWalletAttestationJwt = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils26.addSecondsToDate)(iat, 3600);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils28.addSecondsToDate)(iat, 3600);
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils26.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils26.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils28.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils28.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
       ...options.walletLink && { wallet_link: options.walletLink },
@@ -1855,7 +2099,7 @@ var createWalletAttestationJwt = async (options) => {
       header,
       payload
     });
-    (0, import_io_wallet_utils26.decodeJwt)({
+    (0, import_io_wallet_utils28.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_0,
       jwt: result.jwt,
@@ -1863,7 +2107,7 @@ var createWalletAttestationJwt = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils26.ValidationError) {
+    if (error instanceof import_io_wallet_utils28.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -1873,23 +2117,23 @@ var createWalletAttestationJwt = async (options) => {
 };
 
 // src/client-attestation/v1.3/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils27 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils29 = require("@pagopa/io-wallet-utils");
 var createWalletAttestationJwt2 = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils27.addSecondsToDate)(iat, 3600);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils29.addSecondsToDate)(iat, 3600);
     if (options.nbf && options.nbf >= exp) {
-      throw new import_io_wallet_utils27.ValidationError("nbf must be before exp");
+      throw new import_io_wallet_utils29.ValidationError("nbf must be before exp");
     }
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils27.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils27.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils29.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils29.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
-      ...options.nbf && { nbf: (0, import_io_wallet_utils27.dateToSeconds)(options.nbf) },
+      ...options.nbf && { nbf: (0, import_io_wallet_utils29.dateToSeconds)(options.nbf) },
       ...options.status && { status: options.status },
       ...options.walletLink && { wallet_link: options.walletLink },
       ...options.walletName && { wallet_name: options.walletName }
@@ -1908,7 +2152,7 @@ var createWalletAttestationJwt2 = async (options) => {
       header,
       payload
     });
-    (0, import_io_wallet_utils27.decodeJwt)({
+    (0, import_io_wallet_utils29.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_3,
       jwt: result.jwt,
@@ -1916,7 +2160,7 @@ var createWalletAttestationJwt2 = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils27.ValidationError) {
+    if (error instanceof import_io_wallet_utils29.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -1926,33 +2170,33 @@ var createWalletAttestationJwt2 = async (options) => {
 };
 
 // src/client-attestation/v1.4/create-wallet-attestation-jwt.ts
-var import_io_wallet_utils28 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils30 = require("@pagopa/io-wallet-utils");
 var DEFAULT_EXPIRATION_SECONDS = 3600;
 var MAX_EXPIRATION_SECONDS = 86400;
 var createWalletAttestationJwt3 = async (options) => {
   try {
     const { signJwt } = options.callbacks;
     const iat = /* @__PURE__ */ new Date();
-    const exp = options.expiresAt ?? (0, import_io_wallet_utils28.addSecondsToDate)(iat, DEFAULT_EXPIRATION_SECONDS);
+    const exp = options.expiresAt ?? (0, import_io_wallet_utils30.addSecondsToDate)(iat, DEFAULT_EXPIRATION_SECONDS);
     if (exp <= iat) {
-      throw new import_io_wallet_utils28.ValidationError("exp must be after iat");
+      throw new import_io_wallet_utils30.ValidationError("exp must be after iat");
     }
-    if (exp > (0, import_io_wallet_utils28.addSecondsToDate)(iat, MAX_EXPIRATION_SECONDS)) {
-      throw new import_io_wallet_utils28.ValidationError("exp must not be more than 24 hours after iat");
+    if (exp > (0, import_io_wallet_utils30.addSecondsToDate)(iat, MAX_EXPIRATION_SECONDS)) {
+      throw new import_io_wallet_utils30.ValidationError("exp must not be more than 24 hours after iat");
     }
     if (options.nbf && options.nbf >= exp) {
-      throw new import_io_wallet_utils28.ValidationError("nbf must be before exp");
+      throw new import_io_wallet_utils30.ValidationError("nbf must be before exp");
     }
     const dpopJwkThumbprint = await calculateDpopJwkThumbprint(options);
     const payload = {
       cnf: { jwk: options.dpopJwkPublic },
-      exp: (0, import_io_wallet_utils28.dateToSeconds)(exp),
-      iat: (0, import_io_wallet_utils28.dateToSeconds)(iat),
+      exp: (0, import_io_wallet_utils30.dateToSeconds)(exp),
+      iat: (0, import_io_wallet_utils30.dateToSeconds)(iat),
       iss: options.issuer,
       sub: dpopJwkThumbprint,
       wallet_link: options.walletLink,
       wallet_name: options.walletName,
-      ...options.nbf && { nbf: (0, import_io_wallet_utils28.dateToSeconds)(options.nbf) }
+      ...options.nbf && { nbf: (0, import_io_wallet_utils30.dateToSeconds)(options.nbf) }
     };
     const header = {
       alg: options.signer.alg,
@@ -1967,7 +2211,7 @@ var createWalletAttestationJwt3 = async (options) => {
       header,
       payload
     });
-    (0, import_io_wallet_utils28.decodeJwt)({
+    (0, import_io_wallet_utils30.decodeJwt)({
       errorMessagePrefix: "Error decoding wallet attestation JWT:",
       headerSchema: zWalletAttestationJwtHeaderV1_4,
       jwt: result.jwt,
@@ -1975,7 +2219,7 @@ var createWalletAttestationJwt3 = async (options) => {
     });
     return result.jwt;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils28.ValidationError) {
+    if (error instanceof import_io_wallet_utils30.ValidationError) {
       throw error;
     }
     throw new ClientAttestationError(
@@ -1985,7 +2229,7 @@ var createWalletAttestationJwt3 = async (options) => {
 };
 
 // src/jar/create-jar-request.ts
-var import_io_wallet_utils29 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils31 = require("@pagopa/io-wallet-utils");
 async function createJarRequest(options) {
   const {
     authorizationRequestHeader,
@@ -2003,8 +2247,8 @@ async function createJarRequest(options) {
     payload: {
       ...options.additionalJwtPayload,
       ...authorizationRequestPayload,
-      exp: (0, import_io_wallet_utils29.dateToSeconds)((0, import_io_wallet_utils29.addSecondsToDate)(now, options.expiresInSeconds)),
-      iat: (0, import_io_wallet_utils29.dateToSeconds)(now)
+      exp: (0, import_io_wallet_utils31.dateToSeconds)((0, import_io_wallet_utils31.addSecondsToDate)(now, options.expiresInSeconds)),
+      iat: (0, import_io_wallet_utils31.dateToSeconds)(now)
     }
   });
   authorizationRequestJwt = jwt;
@@ -2032,7 +2276,7 @@ async function createJarRequest(options) {
 }
 
 // src/jarm-form-post-jwt.ts
-var import_io_wallet_utils30 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils32 = require("@pagopa/io-wallet-utils");
 var getJwtFromFormPost = async (options) => {
   const inputRegex = /<input[^<>]*>/gi;
   const nameRegex = /name="response"/gi;
@@ -2047,7 +2291,7 @@ var getJwtFromFormPost = async (options) => {
         const responseJwt = matchValue[1];
         if (responseJwt) {
           const jwt = responseJwt.replace(lineExpressionRegex, "");
-          const decodedJwt = (0, import_io_wallet_utils30.decodeJwt)({
+          const decodedJwt = (0, import_io_wallet_utils32.decodeJwt)({
             errorMessagePrefix: "Error decoding JARM form post JWT:",
             jwt,
             payloadSchema: options.schema
@@ -2069,7 +2313,7 @@ var getJwtFromFormPost = async (options) => {
 };
 
 // src/mrtd-pop/create-mrtd-validation-jwt.ts
-var import_io_wallet_utils31 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils33 = require("@pagopa/io-wallet-utils");
 
 // src/mrtd-pop/z-mrtd-pop.ts
 var import_zod12 = __toESM(require("zod"));
@@ -2146,13 +2390,13 @@ async function createMrtdValidationJwt(options) {
     if (!kid) {
       throw new MrtdPopError("Signer must have a publicJwk.kid property");
     }
-    const iat = (0, import_io_wallet_utils31.dateToSeconds)(options.issuedAt);
-    const header = (0, import_io_wallet_utils31.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
+    const iat = (0, import_io_wallet_utils33.dateToSeconds)(options.issuedAt);
+    const header = (0, import_io_wallet_utils33.parseWithErrorHandling)(zMrtdValidationJwtHeader, {
       alg: options.signer.alg,
       kid,
       typ: "mrtd-ias+jwt"
     });
-    const payload = (0, import_io_wallet_utils31.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
+    const payload = (0, import_io_wallet_utils33.parseWithErrorHandling)(zMrtdValidationJwtPayload, {
       aud: options.audience,
       document_type: "cie",
       exp: iat + JWT_EXPIRY_SECONDS2,
@@ -2185,36 +2429,36 @@ async function createMrtdValidationJwt(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-init.ts
-var import_io_wallet_utils32 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils34 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopInit(options) {
   try {
-    const fetch = (0, import_io_wallet_utils32.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils34.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popInitEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
         mrtd_pop_jwt_nonce: options.mrtdPopJwtNonce
       }),
       headers: {
-        [import_io_wallet_utils32.HEADERS.CONTENT_TYPE]: import_io_wallet_utils32.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils32.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils32.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils34.HEADERS.CONTENT_TYPE]: import_io_wallet_utils34.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils34.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils34.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils32.hasStatusOrThrow)(202, import_io_wallet_utils32.UnexpectedStatusCodeError)(response);
+    await (0, import_io_wallet_utils34.hasStatusOrThrow)(202, import_io_wallet_utils34.UnexpectedStatusCodeError)(response);
     const responseJwt = await response.text();
-    const jwt = (0, import_io_wallet_utils32.decodeJwt)({
+    const jwt = (0, import_io_wallet_utils34.decodeJwt)({
       errorMessagePrefix: "Error decoding MRTD PoP init response JWT:",
       headerSchema: zMrtdPopInitResponseJwtHeader,
       jwt: responseJwt,
       payloadSchema: zMrtdPopInitResponseJwtPayload
     });
-    const { signer } = await (0, import_io_wallet_utils32.verifyJwt)({
+    const { signer } = await (0, import_io_wallet_utils34.verifyJwt)({
       compact: responseJwt,
       errorMessage: "Error verifying MRTD PoP init response JWT",
       header: jwt.header,
       payload: jwt.payload,
-      signer: options.signer ?? (0, import_io_wallet_utils32.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
+      signer: options.signer ?? (0, import_io_wallet_utils34.jwtSignerFromJwt)({ header: jwt.header, payload: jwt.payload }),
       verifyJwtCallback: options.callbacks.verifyJwt
     });
     return {
@@ -2225,7 +2469,7 @@ async function fetchMrtdPopInit(options) {
       signer
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils32.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils32.ValidationError) {
+    if (error instanceof import_io_wallet_utils34.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils34.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2235,10 +2479,10 @@ async function fetchMrtdPopInit(options) {
 }
 
 // src/mrtd-pop/fetch-mrtd-pop-verify.ts
-var import_io_wallet_utils33 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils35 = require("@pagopa/io-wallet-utils");
 async function fetchMrtdPopVerify(options) {
   try {
-    const fetch = (0, import_io_wallet_utils33.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils35.createFetcher)(options.callbacks.fetch);
     const response = await fetch(options.popVerifyEndpoint, {
       body: JSON.stringify({
         mrtd_auth_session: options.mrtdAuthSession,
@@ -2246,14 +2490,14 @@ async function fetchMrtdPopVerify(options) {
         mrtd_validation_jwt: options.mrtdValidationJwt
       }),
       headers: {
-        [import_io_wallet_utils33.HEADERS.CONTENT_TYPE]: import_io_wallet_utils33.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils33.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
-        [import_io_wallet_utils33.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
+        [import_io_wallet_utils35.HEADERS.CONTENT_TYPE]: import_io_wallet_utils35.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils35.HEADERS.OAUTH_CLIENT_ATTESTATION]: options.walletAttestation,
+        [import_io_wallet_utils35.HEADERS.OAUTH_CLIENT_ATTESTATION_POP]: options.clientAttestationDPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils33.hasStatusOrThrow)(202, import_io_wallet_utils33.UnexpectedStatusCodeError)(response);
-    const parsed = (0, import_io_wallet_utils33.parseWithErrorHandling)(
+    await (0, import_io_wallet_utils35.hasStatusOrThrow)(202, import_io_wallet_utils35.UnexpectedStatusCodeError)(response);
+    const parsed = (0, import_io_wallet_utils35.parseWithErrorHandling)(
       zMrtdPopVerifyResponse,
       await response.json(),
       "Failed to parse MRTD PoP verify response"
@@ -2263,7 +2507,7 @@ async function fetchMrtdPopVerify(options) {
       redirectUri: parsed.redirect_uri
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils33.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils33.ValidationError) {
+    if (error instanceof import_io_wallet_utils35.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils35.ValidationError) {
       throw error;
     }
     throw new MrtdPopError(
@@ -2273,7 +2517,7 @@ async function fetchMrtdPopVerify(options) {
 }
 
 // src/mrtd-pop/parse-mrtd-challenge.ts
-var import_io_wallet_utils34 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils36 = require("@pagopa/io-wallet-utils");
 function parseMrtdChallenge(options) {
   const url = new URL(options.redirectUrl);
   const challengeJwt = url.searchParams.get("challenge_info");
@@ -2282,12 +2526,12 @@ function parseMrtdChallenge(options) {
       "Missing 'challenge_info' query parameter in redirect URL"
     );
   }
-  if (!import_io_wallet_utils34.zCompactJwt.safeParse(challengeJwt).success) {
+  if (!import_io_wallet_utils36.zCompactJwt.safeParse(challengeJwt).success) {
     throw new MrtdPopError(
       "Invalid JWT format in 'challenge_info' query parameter"
     );
   }
-  const { header, payload } = (0, import_io_wallet_utils34.decodeJwt)({
+  const { header, payload } = (0, import_io_wallet_utils36.decodeJwt)({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2297,10 +2541,10 @@ function parseMrtdChallenge(options) {
 }
 
 // src/mrtd-pop/verify-mrtd-challenge.ts
-var import_io_wallet_utils35 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils37 = require("@pagopa/io-wallet-utils");
 async function verifyMrtdChallenge(options) {
   const { callbacks, challengeJwt, clientId } = options;
-  const jwt = (0, import_io_wallet_utils35.decodeJwt)({
+  const jwt = (0, import_io_wallet_utils37.decodeJwt)({
     errorMessagePrefix: "Error decoding MRTD challenge JWT:",
     headerSchema: zMrtdChallengeJwtHeader,
     jwt: challengeJwt,
@@ -2312,12 +2556,12 @@ async function verifyMrtdChallenge(options) {
     );
   }
   const payload = jwt.payload;
-  const { signer } = await (0, import_io_wallet_utils35.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils37.verifyJwt)({
     compact: challengeJwt,
     errorMessage: "Error verifying MRTD challenge JWT",
     header: jwt.header,
     payload,
-    signer: options.signer ?? (0, import_io_wallet_utils35.jwtSignerFromJwt)({ header: jwt.header, payload }),
+    signer: options.signer ?? (0, import_io_wallet_utils37.jwtSignerFromJwt)({ header: jwt.header, payload }),
     verifyJwtCallback: callbacks.verifyJwt
   });
   return { header: jwt.header, payload: jwt.payload, signer };
@@ -2345,6 +2589,8 @@ async function verifyMrtdChallenge(options) {
   createPushedAuthorizationRequest,
   createTokenDPoP,
   createTokenRequest,
+  createTokenRequestAPTITUDE,
+  createTokenRequestV1_4,
   createWalletAttestationJwtV1_0,
   createWalletAttestationJwtV1_3,
   createWalletAttestationJwtV1_4,
@@ -2367,6 +2613,7 @@ async function verifyMrtdChallenge(options) {
   parseJarRequest,
   parseMrtdChallenge,
   parsePushedAuthorizationRequest,
+  preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier,
   signedAuthorizationRequestJwtHeaderTyp,
   toURLSearchParams,
@@ -2387,8 +2634,10 @@ async function verifyMrtdChallenge(options) {
   zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
+  zAccessTokenRequestAPTITUDE,
   zAccessTokenResponse,
   zAuthorizationCodeGrantIdentifier,
+  zAuthorizationCodeTokenRequest,
   zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3,
   zDpopJwtHeader,
@@ -2407,6 +2656,8 @@ async function verifyMrtdChallenge(options) {
   zMrtdPopVerifyResponse,
   zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload,
+  zPreAuthorizedCodeGrantIdentifier,
+  zPreAuthorizedCodeTokenRequest,
   zPushedAuthorizationRequestSigned,
   zPushedAuthorizationRequestUnsignedV1_0,
   zPushedAuthorizationRequestUnsignedV1_3,
@@ -2414,6 +2665,7 @@ async function verifyMrtdChallenge(options) {
   zRefreshTokenGrantIdentifier,
   zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload,
+  zRefreshTokenTokenRequest,
   zSignedAuthorizationRequestJwtHeaderTyp,
   zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3,