@pagopa/io-wallet-oauth2 2.0.0-launchpad → 2.0.2-apt

package/dist/index.mjs

@@ -1,17 +1,66 @@
 // src/access-token/create-token-request.ts
-var createTokenRequest = async (options) => ({
-  ...options.additionalRequestPayload,
-  code: options.authorizationCode,
-  code_verifier: options.pkceCodeVerifier,
-  grant_type: "authorization_code",
-  redirect_uri: options.redirectUri
+import {
+  ItWalletSpecsVersion,
+  createVersionDispatcher
+} from "@pagopa/io-wallet-utils";
+
+// src/access-token/z-grant-type.ts
+import { z } from "zod";
+var zAuthorizationCodeGrantIdentifier = z.literal("authorization_code");
+var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
+var zPreAuthorizedCodeGrantIdentifier = z.literal(
+  "urn:ietf:params:oauth:grant-type:pre-authorized_code"
+);
+var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
+var zRefreshTokenGrantIdentifier = z.literal("refresh_token");
+var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
+
+// src/access-token/create-token-request.ts
+var createTokenRequestV1_4 = (options) => {
+  if (options.grantType === refreshTokenGrantIdentifier) {
+    return {
+      ...options.additionalRequestPayload,
+      grant_type: refreshTokenGrantIdentifier,
+      refresh_token: options.refreshToken,
+      scope: options.scope
+    };
+  }
+  return {
+    ...options.additionalRequestPayload,
+    code: options.authorizationCode,
+    code_verifier: options.pkceCodeVerifier,
+    grant_type: authorizationCodeGrantIdentifier,
+    redirect_uri: options.redirectUri
+  };
+};
+function createTokenRequestAPTITUDE(options) {
+  if (options.grantType === preAuthorizedCodeGrantIdentifier) {
+    return {
+      ...options.additionalRequestPayload,
+      grant_type: preAuthorizedCodeGrantIdentifier,
+      "pre-authorized_code": options.preAuthorizedCode,
+      tx_code: options.txCode
+    };
+  }
+  return createTokenRequestV1_4(options);
+}
+var dispatchCreateTokenRequest = createVersionDispatcher({
+  [ItWalletSpecsVersion.APTITUDE]: (o) => createTokenRequestAPTITUDE(o),
+  [ItWalletSpecsVersion.V1_0]: (o) => createTokenRequestV1_4(o),
+  [ItWalletSpecsVersion.V1_3]: (o) => createTokenRequestV1_4(o),
+  [ItWalletSpecsVersion.V1_4]: (o) => createTokenRequestV1_4(o)
 });
+function createTokenRequest(options) {
+  return dispatchCreateTokenRequest(options);
+}
 
 // src/access-token/create-token-response.ts
 import {
   HashAlgorithm,
+  ItWalletSpecsVersion as ItWalletSpecsVersion2,
   addSecondsToDate,
   calculateJwkThumbprint,
+  createVersionDispatcher as createVersionDispatcher2,
   dateToSeconds,
   jwtHeaderFromJwtSigner,
   parseWithErrorHandling
@@ -79,70 +128,82 @@ import {
   zJwtHeader,
   zJwtPayload
 } from "@pagopa/io-wallet-utils";
-import { z } from "zod";
-var zAccessTokenRequest = z.discriminatedUnion("grant_type", [
-  z.object({
-    code: z.string().nonempty(),
-    code_verifier: z.string().nonempty(),
-    grant_type: z.literal("authorization_code"),
-    redirect_uri: z.string().nonempty()
-  }),
-  z.object({
-    grant_type: z.literal("refresh_token"),
-    refresh_token: z.string().nonempty(),
-    scope: z.string().optional()
-  })
+import { z as z2 } from "zod";
+var zPreAuthorizedCodeTokenRequest = z2.object({
+  grant_type: zPreAuthorizedCodeGrantIdentifier,
+  "pre-authorized_code": z2.string().nonempty(),
+  tx_code: z2.string().optional()
+});
+var zAuthorizationCodeTokenRequest = z2.object({
+  code: z2.string().nonempty(),
+  code_verifier: z2.string().nonempty(),
+  grant_type: zAuthorizationCodeGrantIdentifier,
+  redirect_uri: z2.string().nonempty()
+});
+var zRefreshTokenTokenRequest = z2.object({
+  grant_type: zRefreshTokenGrantIdentifier,
+  refresh_token: z2.string().nonempty(),
+  scope: z2.string().optional()
+});
+var zAccessTokenRequest = z2.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest
+]);
+var zAccessTokenRequestAPTITUDE = z2.discriminatedUnion("grant_type", [
+  zAuthorizationCodeTokenRequest,
+  zRefreshTokenTokenRequest,
+  zPreAuthorizedCodeTokenRequest
 ]);
-var zAccessTokenResponse = z.looseObject({
-  access_token: z.string(),
-  authorization_details: z.array(
-    z.looseObject({
-      credential_configuration_id: z.optional(z.string()),
-      credential_identifiers: z.optional(z.array(z.string())),
-      type: z.literal("openid_credential")
+var zAccessTokenResponse = z2.looseObject({
+  access_token: z2.string(),
+  authorization_details: z2.array(
+    z2.looseObject({
+      credential_configuration_id: z2.optional(z2.string()),
+      credential_identifiers: z2.optional(z2.array(z2.string())),
+      type: z2.literal("openid_credential")
     })
   ).optional(),
-  expires_in: z.optional(z.number().int()),
-  refresh_token: z.optional(z.string()),
-  token_type: z.union([z.literal("Bearer"), z.literal("DPoP")])
+  expires_in: z2.optional(z2.number().int()),
+  refresh_token: z2.optional(z2.string()),
+  token_type: z2.union([z2.literal("Bearer"), z2.literal("DPoP")])
 });
-var zAccessTokenProfileJwtHeader = z.looseObject({
+var zAccessTokenProfileJwtHeader = z2.looseObject({
   ...zJwtHeader.shape,
-  typ: z.enum(["application/at+jwt", "at+jwt"])
+  typ: z2.enum(["application/at+jwt", "at+jwt"])
 });
-var zAccessTokenProfileJwtPayload = z.looseObject({
+var zAccessTokenProfileJwtPayload = z2.looseObject({
   ...zJwtPayload.shape,
-  aud: z.string(),
-  client_id: z.string(),
-  cnf: z.object({
-    jkt: z.string()
+  aud: z2.string(),
+  client_id: z2.string(),
+  cnf: z2.object({
+    jkt: z2.string()
   }).optional(),
-  exp: z.number(),
-  iat: z.number(),
-  iss: z.string(),
-  jti: z.string().max(MAX_JTI_LENGTH),
-  nbf: z.number().optional(),
-  scope: z.string().optional(),
-  sub: z.string()
+  exp: z2.number(),
+  iat: z2.number(),
+  iss: z2.string(),
+  jti: z2.string().max(MAX_JTI_LENGTH),
+  nbf: z2.number().optional(),
+  scope: z2.string().optional(),
+  sub: z2.string()
 });
-var zRefreshTokenProfileJwtHeader = z.looseObject({
+var zRefreshTokenProfileJwtHeader = z2.looseObject({
   ...zJwtHeader.shape,
-  kid: z.string(),
-  typ: z.literal("rt+jwt")
+  kid: z2.string(),
+  typ: z2.literal("rt+jwt")
 });
-var zRefreshTokenProfileJwtPayload = z.looseObject({
+var zRefreshTokenProfileJwtPayload = z2.looseObject({
   ...zJwtPayload.shape,
-  aud: z.string(),
-  client_id: z.string(),
-  cnf: z.object({
-    jkt: z.string()
+  aud: z2.string(),
+  client_id: z2.string(),
+  cnf: z2.object({
+    jkt: z2.string()
   }),
-  exp: z.number().int(),
-  iat: z.number().int(),
-  iss: z.string(),
-  jti: z.string().max(MAX_JTI_LENGTH),
-  nbf: z.number().int(),
-  sub: z.string()
+  exp: z2.number().int(),
+  iat: z2.number().int(),
+  iss: z2.string(),
+  jti: z2.string().max(MAX_JTI_LENGTH),
+  nbf: z2.number().int(),
+  sub: z2.string()
 });
 
 // src/access-token/create-token-response.ts
@@ -171,7 +232,7 @@ function resolveRefreshTokenKid(signer) {
   }
   return void 0;
 }
-async function createAccessTokenResponse(options) {
+async function createAccessTokenResponseV1_4(options) {
   try {
     const now = options.now ?? /* @__PURE__ */ new Date();
     if (options.tokenType === "DPoP" && !options.dpop) {
@@ -277,18 +338,29 @@ async function createAccessTokenResponse(options) {
     );
   }
 }
+var dispatchCreateAccessTokenResponse = createVersionDispatcher2({
+  [ItWalletSpecsVersion2.APTITUDE]: (o) => createAccessTokenResponseV1_4(o),
+  [ItWalletSpecsVersion2.V1_0]: (o) => createAccessTokenResponseV1_4(o),
+  [ItWalletSpecsVersion2.V1_3]: (o) => createAccessTokenResponseV1_4(o),
+  [ItWalletSpecsVersion2.V1_4]: (o) => createAccessTokenResponseV1_4(o)
+});
+function createAccessTokenResponse(options) {
+  return dispatchCreateAccessTokenResponse(options);
+}
 
 // src/access-token/fetch-token-response.ts
 import {
   CONTENT_TYPES,
   HEADERS,
+  ItWalletSpecsVersion as ItWalletSpecsVersion3,
   UnexpectedStatusCodeError,
   ValidationError,
   createFetcher,
+  createVersionDispatcher as createVersionDispatcher3,
   hasStatusOrThrow,
   parseWithErrorHandling as parseWithErrorHandling2
 } from "@pagopa/io-wallet-utils";
-async function fetchTokenResponse(options) {
+async function fetchTokenResponseV1_4(options) {
   try {
     const fetch = createFetcher(options.callbacks.fetch);
     const tokenResponse = await fetch(options.accessTokenEndpoint, {
@@ -327,26 +399,43 @@ function toURLSearchParams(data) {
   });
   return params;
 }
+var dispatchFetchTokenResponse = createVersionDispatcher3({
+  [ItWalletSpecsVersion3.APTITUDE]: (o) => fetchTokenResponseV1_4(o),
+  [ItWalletSpecsVersion3.V1_0]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion3.V1_3]: (o) => fetchTokenResponseV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion3.V1_4]: (o) => fetchTokenResponseV1_4(
+    o
+  )
+});
+function fetchTokenResponse(options) {
+  return dispatchFetchTokenResponse(options);
+}
 
 // src/access-token/parse-token-request.ts
 import {
+  ItWalletSpecsVersion as ItWalletSpecsVersion5,
+  createVersionDispatcher as createVersionDispatcher5,
   formatZodError
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/wallet-attestation.ts
 import {
-  ItWalletSpecsVersion,
-  createVersionDispatcher,
+  ItWalletSpecsVersion as ItWalletSpecsVersion4,
+  createVersionDispatcher as createVersionDispatcher4,
   zCompactJwt
 } from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/types.ts
-import z2 from "zod";
-var zOauthClientAttestationHeader = z2.literal(
+import z3 from "zod";
+var zOauthClientAttestationHeader = z3.literal(
   "OAuth-Client-Attestation"
 );
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zOauthClientAttestationPopHeader = z2.literal(
+var zOauthClientAttestationPopHeader = z3.literal(
   "OAuth-Client-Attestation-PoP"
 );
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
@@ -383,27 +472,27 @@ import {
   zJwtPayload as zJwtPayload2,
   zTrustChain
 } from "@pagopa/io-wallet-utils";
-import { z as z3 } from "zod";
-var zWalletAttestationJwtHeaderV1_0 = z3.looseObject({
+import { z as z4 } from "zod";
+var zWalletAttestationJwtHeaderV1_0 = z4.looseObject({
   ...zJwtHeader2.shape,
   trust_chain: zTrustChain,
   // REQUIRED in v1.0
-  typ: z3.literal("oauth-client-attestation+jwt")
+  typ: z4.literal("oauth-client-attestation+jwt")
 });
-var zWalletAttestationJwtPayloadV1_0 = z3.looseObject({
+var zWalletAttestationJwtPayloadV1_0 = z4.looseObject({
   ...zJwtPayload2.shape,
-  aal: z3.string(),
-  cnf: z3.object({
+  aal: z4.string(),
+  cnf: z4.object({
     jwk: zJwk
   }),
-  exp: z3.number(),
-  iat: z3.number(),
-  iss: z3.string(),
-  sub: z3.string(),
-  wallet_link: z3.url().optional(),
-  wallet_name: z3.string().optional()
+  exp: z4.number(),
+  iat: z4.number(),
+  iss: z4.string(),
+  sub: z4.string(),
+  wallet_link: z4.url().optional(),
+  wallet_name: z4.string().optional()
 });
-var zWalletAttestationJwtV1_0 = z3.string().min(1);
+var zWalletAttestationJwtV1_0 = z4.string().min(1);
 
 // src/client-attestation/v1.0/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt(options) {
@@ -422,37 +511,37 @@ import {
   zJwtPayload as zJwtPayload3,
   zTrustChain as zTrustChain2
 } from "@pagopa/io-wallet-utils";
-import { z as z4 } from "zod";
-var zWalletAttestationJwtHeaderV1_3 = z4.looseObject({
+import { z as z5 } from "zod";
+var zWalletAttestationJwtHeaderV1_3 = z5.looseObject({
   ...zJwtHeader3.shape,
   trust_chain: zTrustChain2.optional(),
   // OPTIONAL in v1.3
-  typ: z4.literal("oauth-client-attestation+jwt"),
+  typ: z5.literal("oauth-client-attestation+jwt"),
   x5c: zCertificateChain
   // REQUIRED in v1.3
 });
-var zWalletAttestationJwtPayloadV1_3 = z4.looseObject({
+var zWalletAttestationJwtPayloadV1_3 = z5.looseObject({
   ...zJwtPayload3.shape,
-  cnf: z4.object({
+  cnf: z5.object({
     jwk: zJwk2
   }),
-  exp: z4.number(),
-  iat: z4.number(),
-  iss: z4.string(),
-  nbf: z4.number().optional(),
+  exp: z5.number(),
+  iat: z5.number(),
+  iss: z5.string(),
+  nbf: z5.number().optional(),
   // NEW in v1.3
-  status: z4.object({
-    status_list: z4.object({
-      idx: z4.number().int(),
-      uri: z4.string()
+  status: z5.object({
+    status_list: z5.object({
+      idx: z5.number().int(),
+      uri: z5.string()
     })
   }).optional(),
   // NEW in v1.3 - status object for revocation
-  sub: z4.string(),
-  wallet_link: z4.url().optional(),
-  wallet_name: z4.string().optional()
+  sub: z5.string(),
+  wallet_link: z5.url().optional(),
+  wallet_name: z5.string().optional()
 });
-var zWalletAttestationJwtV1_3 = z4.string().min(1);
+var zWalletAttestationJwtV1_3 = z5.string().min(1);
 
 // src/client-attestation/v1.3/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt2(options) {
@@ -471,28 +560,28 @@ import {
   zJwtPayload as zJwtPayload4,
   zTrustChain as zTrustChain3
 } from "@pagopa/io-wallet-utils";
-import { z as z5 } from "zod";
-var zWalletAttestationJwtHeaderV1_4 = z5.looseObject({
+import { z as z6 } from "zod";
+var zWalletAttestationJwtHeaderV1_4 = z6.looseObject({
   ...zJwtHeader4.shape,
-  kid: z5.string(),
+  kid: z6.string(),
   trust_chain: zTrustChain3.optional(),
-  typ: z5.literal("oauth-client-attestation+jwt"),
+  typ: z6.literal("oauth-client-attestation+jwt"),
   x5c: zCertificateChain2
 });
-var zWalletAttestationJwtPayloadV1_4 = z5.looseObject({
+var zWalletAttestationJwtPayloadV1_4 = z6.looseObject({
   ...zJwtPayload4.shape,
-  cnf: z5.object({
+  cnf: z6.object({
     jwk: zJwk3
   }),
-  exp: z5.number().int(),
-  iat: z5.number().int(),
-  iss: z5.string(),
-  nbf: z5.number().optional(),
-  sub: z5.string(),
-  wallet_link: z5.url(),
-  wallet_name: z5.string()
+  exp: z6.number().int(),
+  iat: z6.number().int(),
+  iss: z6.string(),
+  nbf: z6.number().optional(),
+  sub: z6.string(),
+  wallet_link: z6.url(),
+  wallet_name: z6.string()
 });
-var zWalletAttestationJwtV1_4 = z5.string().min(1);
+var zWalletAttestationJwtV1_4 = z6.string().min(1);
 
 // src/client-attestation/v1.4/verify-wallet-attestation-jwt.ts
 async function verifyWalletAttestationJwt3(options) {
@@ -504,10 +593,11 @@ async function verifyWalletAttestationJwt3(options) {
 }
 
 // src/client-attestation/wallet-attestation.ts
-var dispatchVerifyWalletAttestationJwt = createVersionDispatcher({
-  [ItWalletSpecsVersion.V1_0]: (o) => verifyWalletAttestationJwt(o),
-  [ItWalletSpecsVersion.V1_3]: (o) => verifyWalletAttestationJwt2(o),
-  [ItWalletSpecsVersion.V1_4]: (o) => verifyWalletAttestationJwt3(o)
+var dispatchVerifyWalletAttestationJwt = createVersionDispatcher4({
+  [ItWalletSpecsVersion4.APTITUDE]: (o) => verifyWalletAttestationJwt3(o),
+  [ItWalletSpecsVersion4.V1_0]: (o) => verifyWalletAttestationJwt(o),
+  [ItWalletSpecsVersion4.V1_3]: (o) => verifyWalletAttestationJwt2(o),
+  [ItWalletSpecsVersion4.V1_4]: (o) => verifyWalletAttestationJwt3(o)
 });
 async function verifyWalletAttestationJwt4(options) {
   return dispatchVerifyWalletAttestationJwt(options);
@@ -561,19 +651,19 @@ import {
   zJwtHeader as zJwtHeader5,
   zJwtPayload as zJwtPayload5
 } from "@pagopa/io-wallet-utils";
-import z6 from "zod";
-var zDpopJwtPayload = z6.looseObject({
+import z7 from "zod";
+var zDpopJwtPayload = z7.looseObject({
   ...zJwtPayload5.shape,
-  ath: z6.optional(z6.string()),
+  ath: z7.optional(z7.string()),
   htm: zHttpMethod,
-  htu: z6.url(),
-  iat: z6.number().int().nonnegative(),
-  jti: z6.string().max(MAX_JTI_LENGTH2)
+  htu: z7.url(),
+  iat: z7.number().int().nonnegative(),
+  jti: z7.string().max(MAX_JTI_LENGTH2)
 });
-var zDpopJwtHeader = z6.looseObject({
+var zDpopJwtHeader = z7.looseObject({
   ...zJwtHeader5.shape,
   jwk: zJwk4,
-  typ: z6.literal("dpop+jwt")
+  typ: z7.literal("dpop+jwt")
 });
 
 // src/token-dpop/create-token-dpop.ts
@@ -630,15 +720,8 @@ function extractDpopJwtFromHeaders(headers) {
   return { dpopJwt, valid: true };
 }
 
-// src/access-token/z-grant-type.ts
-import { z as z7 } from "zod";
-var zAuthorizationCodeGrantIdentifier = z7.literal("authorization_code");
-var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = z7.literal("refresh_token");
-var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
-
 // src/access-token/parse-token-request.ts
-function parseAccessTokenRequest(options) {
+function parseAccessTokenRequestV1_4(options) {
   const validationResult = zAccessTokenRequest.safeParse(
     options.accessTokenRequest
   );
@@ -659,6 +742,25 @@ ${formatZodError(validationResult.error)}`
     ...securityHeaders
   };
 }
+function parseAccessTokenRequestAPTITUDE(options) {
+  const validationResult = zAccessTokenRequestAPTITUDE.safeParse(
+    options.accessTokenRequest
+  );
+  if (!validationResult.success) {
+    throw new Oauth2Error(
+      `Access token request validation failed:
+${formatZodError(validationResult.error)}`
+    );
+  }
+  const accessTokenRequest = validationResult.data;
+  const grant = parseGrantParametersAPTITUDE(accessTokenRequest);
+  const securityHeaders = parseSecurityHeaders(options.request.headers);
+  return {
+    accessTokenRequest,
+    grant,
+    ...securityHeaders
+  };
+}
 function parseGrantParameters(accessTokenRequest) {
   if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
     return {
@@ -676,6 +778,30 @@ function parseGrantParameters(accessTokenRequest) {
     `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}'`
   );
 }
+function parseGrantParametersAPTITUDE(accessTokenRequest) {
+  if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
+    return {
+      code: accessTokenRequest.code,
+      grantType: authorizationCodeGrantIdentifier
+    };
+  }
+  if (accessTokenRequest.grant_type === refreshTokenGrantIdentifier) {
+    return {
+      grantType: refreshTokenGrantIdentifier,
+      refreshToken: accessTokenRequest.refresh_token
+    };
+  }
+  if (accessTokenRequest.grant_type === preAuthorizedCodeGrantIdentifier) {
+    return {
+      grantType: preAuthorizedCodeGrantIdentifier,
+      preAuthorizedCode: accessTokenRequest["pre-authorized_code"],
+      txCode: accessTokenRequest.tx_code
+    };
+  }
+  throw new Oauth2Error(
+    `Unsupported grant type. Supported types are: '${authorizationCodeGrantIdentifier}', '${refreshTokenGrantIdentifier}', '${preAuthorizedCodeGrantIdentifier}'`
+  );
+}
 function parseSecurityHeaders(headers) {
   const extractedDpopJwt = extractDpopJwtFromHeaders(headers);
   if (!extractedDpopJwt.valid) {
@@ -710,6 +836,29 @@ function parseSecurityHeaders(headers) {
     dpop: { jwt: extractedDpopJwt.dpopJwt }
   };
 }
+var dispatchParseTokenRequest = createVersionDispatcher5({
+  [ItWalletSpecsVersion5.APTITUDE]: (o) => parseAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [ItWalletSpecsVersion5.V1_0]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion5.V1_3]: (o) => parseAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion5.V1_4]: (o) => parseAccessTokenRequestV1_4(
+    o
+  )
+});
+function parseAccessTokenRequest(options) {
+  return dispatchParseTokenRequest(options);
+}
+
+// src/access-token/verify-access-token-request.ts
+import {
+  ItWalletSpecsVersion as ItWalletSpecsVersion7,
+  createVersionDispatcher as createVersionDispatcher6
+} from "@pagopa/io-wallet-utils";
 
 // src/client-attestation/verify-client-attestation.ts
 import {
@@ -719,7 +868,7 @@ import {
 
 // src/client-attestation/client-attestation-pop.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion2,
+  ItWalletSpecsVersion as ItWalletSpecsVersion6,
   addSecondsToDate as addSecondsToDate2,
   dateToSeconds as dateToSeconds3,
   decodeJwt as decodeJwt2,
@@ -846,7 +995,7 @@ async function createClientAttestationPopJwt(options) {
         iat: dateToSeconds3(issuedAt),
         iss: sub,
         jti,
-        ...options.config.itWalletSpecsVersion === ItWalletSpecsVersion2.V1_0 ? {
+        ...options.config.itWalletSpecsVersion === ItWalletSpecsVersion6.V1_0 ? {
           exp: dateToSeconds3(
             "expiresAt" in options && options.expiresAt ? options.expiresAt : addSecondsToDate2(issuedAt, 1 * 60)
           )
@@ -1080,7 +1229,7 @@ async function verifyTokenDPoP(options) {
 }
 
 // src/access-token/verify-access-token-request.ts
-async function verifyAccessTokenRequest(options) {
+async function verifyAccessTokenRequestV1_4(options) {
   if (options.dpop.expectedNonce === "") {
     throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
@@ -1109,12 +1258,44 @@ async function verifyAccessTokenRequest(options) {
   if (options.grant.code !== options.expectedCode) {
     throw new Oauth2Error(`Invalid 'code' provided`);
   }
-  if (options.codeExpiresAt) {
-    const now = options.now ?? /* @__PURE__ */ new Date();
-    if (now.getTime() > options.codeExpiresAt.getTime()) {
-      throw new Oauth2Error(`Expired 'code' provided`);
-    }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+  if (!header.jwk) {
+    throw new Oauth2Error("DPoP header does not contain a JWK");
+  }
+  return {
+    clientAttestation: clientAttestationResult,
+    dpop: { jwk: header.jwk, jwkThumbprint }
+  };
+}
+async function verifyAccessTokenRequestAPTITUDE(options) {
+  if (options.dpop.expectedNonce === "") {
+    throw new Oauth2Error(`Invalid 'dpop.expectedNonce' provided`);
   }
+  if (!isPreAuthorizedCodeVerification(options)) {
+    await verifyPkce({
+      callbacks: options.callbacks,
+      codeChallenge: options.pkce.codeChallenge,
+      codeChallengeMethod: options.pkce.codeChallengeMethod,
+      codeVerifier: options.pkce.codeVerifier
+    });
+  }
+  const { header, jwkThumbprint } = await verifyTokenDPoP({
+    allowedSigningAlgs: options.dpop.allowedSigningAlgs,
+    callbacks: options.callbacks,
+    dpopJwt: options.dpop.jwt,
+    expectedNonce: options.dpop.expectedNonce,
+    now: options.now,
+    request: options.request
+  });
+  const clientAttestationResult = await verifyClientAttestation({
+    authorizationServerMetadata: options.authorizationServerMetadata,
+    callbacks: options.callbacks,
+    clientAttestation: options.clientAttestation,
+    config: options.config,
+    dpopJwkThumbprint: jwkThumbprint,
+    now: options.now
+  });
+  verifyGrantParameters(options);
   if (!header.jwk) {
     throw new Oauth2Error("DPoP header does not contain a JWK");
   }
@@ -1123,10 +1304,73 @@ async function verifyAccessTokenRequest(options) {
     dpop: { jwk: header.jwk, jwkThumbprint }
   };
 }
+function isPreAuthorizedCodeVerification(options) {
+  return options.grant.grantType === preAuthorizedCodeGrantIdentifier;
+}
+function verifyGrantParameters(options) {
+  if (isPreAuthorizedCodeVerification(options)) {
+    if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) {
+      throw new Oauth2Error(`Invalid 'pre-authorized_code' provided`);
+    }
+    verifyTransactionCode(options.grant.txCode, options.expectedTxCode);
+    verifyCodeExpiration(
+      options.preAuthorizedCodeExpiresAt,
+      options.now,
+      "pre-authorized_code"
+    );
+    return;
+  }
+  if (options.grant.grantType !== authorizationCodeGrantIdentifier) {
+    throw new Oauth2Error(
+      "Only authorization_code and pre-authorized_code grants can be verified"
+    );
+  }
+  if (options.grant.code !== options.expectedCode) {
+    throw new Oauth2Error(`Invalid 'code' provided`);
+  }
+  verifyCodeExpiration(options.codeExpiresAt, options.now, "code");
+}
+function verifyTransactionCode(txCode, expectedTxCode) {
+  if (txCode === expectedTxCode) return;
+  if (expectedTxCode === void 0) {
+    throw new Oauth2Error("Request contains 'tx_code' that was not expected");
+  }
+  if (txCode === void 0) {
+    throw new Oauth2Error("Missing required 'tx_code' in request");
+  }
+  throw new Oauth2Error("Invalid 'tx_code' provided");
+}
+function verifyCodeExpiration(expiresAt, date, codeParameter) {
+  if (!expiresAt) return;
+  if (Number.isNaN(expiresAt.getTime())) {
+    throw new Oauth2Error(`Invalid expiration date for '${codeParameter}'`);
+  }
+  const now = date ?? /* @__PURE__ */ new Date();
+  if (now.getTime() > expiresAt.getTime()) {
+    throw new Oauth2Error(`Expired '${codeParameter}' provided`);
+  }
+}
+var dispatchVerifyAccessTokenRequest = createVersionDispatcher6({
+  [ItWalletSpecsVersion7.APTITUDE]: (o) => verifyAccessTokenRequestAPTITUDE(
+    o
+  ),
+  [ItWalletSpecsVersion7.V1_0]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion7.V1_3]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  ),
+  [ItWalletSpecsVersion7.V1_4]: (o) => verifyAccessTokenRequestV1_4(
+    o
+  )
+});
+function verifyAccessTokenRequest(options) {
+  return dispatchVerifyAccessTokenRequest(options);
+}
 
 // src/authorization-request/create-authorization-request.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion3,
+  ItWalletSpecsVersion as ItWalletSpecsVersion8,
   addSecondsToDate as addSecondsToDate3,
   dateToSeconds as dateToSeconds4,
   dispatchByVersion,
@@ -1282,16 +1526,19 @@ async function createPushedAuthorizationRequest(options) {
 }
 function parseAuthorizationRequestByVersion(options, baseAuthorizationRequest) {
   return dispatchByVersion(options.config.itWalletSpecsVersion, {
-    [ItWalletSpecsVersion3.V1_0]: () => zAuthorizationRequestV1_0.parse({
+    [ItWalletSpecsVersion8.APTITUDE]: () => zAuthorizationRequestV1_3.parse(
+      baseAuthorizationRequest
+    ),
+    [ItWalletSpecsVersion8.V1_0]: () => zAuthorizationRequestV1_0.parse({
       ...baseAuthorizationRequest,
       response_mode: options.responseMode
     }),
-    [ItWalletSpecsVersion3.V1_3]: () => zAuthorizationRequestV1_3.parse(
+    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
+    [ItWalletSpecsVersion8.V1_3]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     ),
-    // V1_4 reuses V1_3 authorization request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [ItWalletSpecsVersion3.V1_4]: () => zAuthorizationRequestV1_3.parse(
+    [ItWalletSpecsVersion8.V1_4]: () => zAuthorizationRequestV1_3.parse(
       baseAuthorizationRequest
     )
   });
@@ -1387,7 +1634,7 @@ function parseAuthorizationRequest(options) {
 
 // src/authorization-request/parse-pushed-authorization-request.ts
 import {
-  ItWalletSpecsVersion as ItWalletSpecsVersion4,
+  ItWalletSpecsVersion as ItWalletSpecsVersion9,
   decodeJwt as decodeJwt4,
   dispatchByVersion as dispatchByVersion2,
   formatZodError as formatZodError2,
@@ -1536,11 +1783,12 @@ ${formatZodError2(parsedAuthorizationRequest.error)}`
 }
 function getAuthorizationRequestSchema(config) {
   return dispatchByVersion2(config.itWalletSpecsVersion, {
-    [ItWalletSpecsVersion4.V1_0]: () => zAuthorizationRequestV1_0,
-    [ItWalletSpecsVersion4.V1_3]: () => zAuthorizationRequestV1_3,
+    [ItWalletSpecsVersion9.APTITUDE]: () => zAuthorizationRequestV1_3,
+    [ItWalletSpecsVersion9.V1_0]: () => zAuthorizationRequestV1_0,
     // V1_4 reuses V1_3 PAR schema — no breaking changes between versions.
+    [ItWalletSpecsVersion9.V1_3]: () => zAuthorizationRequestV1_3,
     // Verified against compare/1.3.3...1.4.1: authorization request parameters identical.
-    [ItWalletSpecsVersion4.V1_4]: () => zAuthorizationRequestV1_3
+    [ItWalletSpecsVersion9.V1_4]: () => zAuthorizationRequestV1_3
   });
 }
 
@@ -2372,6 +2620,8 @@ export {
   createPushedAuthorizationRequest,
   createTokenDPoP,
   createTokenRequest,
+  createTokenRequestAPTITUDE,
+  createTokenRequestV1_4,
   createWalletAttestationJwt as createWalletAttestationJwtV1_0,
   createWalletAttestationJwt2 as createWalletAttestationJwtV1_3,
   createWalletAttestationJwt3 as createWalletAttestationJwtV1_4,
@@ -2394,6 +2644,7 @@ export {
   parseJarRequest,
   parseMrtdChallenge,
   parsePushedAuthorizationRequest,
+  preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier,
   signedAuthorizationRequestJwtHeaderTyp,
   toURLSearchParams,
@@ -2414,8 +2665,10 @@ export {
   zAccessTokenProfileJwtHeader,
   zAccessTokenProfileJwtPayload,
   zAccessTokenRequest,
+  zAccessTokenRequestAPTITUDE,
   zAccessTokenResponse,
   zAuthorizationCodeGrantIdentifier,
+  zAuthorizationCodeTokenRequest,
   zAuthorizationRequestV1_0,
   zAuthorizationRequestV1_3,
   zDpopJwtHeader,
@@ -2434,6 +2687,8 @@ export {
   zMrtdPopVerifyResponse,
   zMrtdValidationJwtHeader,
   zMrtdValidationJwtPayload,
+  zPreAuthorizedCodeGrantIdentifier,
+  zPreAuthorizedCodeTokenRequest,
   zPushedAuthorizationRequestSigned,
   zPushedAuthorizationRequestUnsignedV1_0,
   zPushedAuthorizationRequestUnsignedV1_3,
@@ -2441,6 +2696,7 @@ export {
   zRefreshTokenGrantIdentifier,
   zRefreshTokenProfileJwtHeader,
   zRefreshTokenProfileJwtPayload,
+  zRefreshTokenTokenRequest,
   zSignedAuthorizationRequestJwtHeaderTyp,
   zWalletAttestationJwtHeaderV1_0,
   zWalletAttestationJwtHeaderV1_3,