@pagopa/io-wallet-oid4vci 1.5.7 → 2.0.0-apt

package/dist/index.js

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  CREDENTIAL_OFFER_GRANTS: () => CREDENTIAL_OFFER_GRANTS,
   CreateCredentialResponseError: () => CreateCredentialResponseError,
   CredentialAuthorizationHeaderError: () => CredentialAuthorizationHeaderError,
   CredentialOfferError: () => CredentialOfferError,
@@ -95,7 +96,7 @@ module.exports = __toCommonJS(index_exports);
 // src/authorization-response/complete-authorization.ts
 var import_io_wallet_oauth2 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid4vp = require("@pagopa/io-wallet-oid4vp");
-var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
 
 // src/errors.ts
 var Oid4vciError = class extends Error {
@@ -184,7 +185,7 @@ var CredentialAuthorizationHeaderError = class extends Oid4vciError {
 };
 
 // src/authorization-response/verify-authorization-response.ts
-var import_oauth2 = require("@openid4vc/oauth2");
+var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
 async function verifyAuthorizationResponse(options) {
   if (options.authorizationResponse.iss !== options.iss)
     throw new Oid4vciError(
@@ -199,12 +200,12 @@ async function verifyAuthorizationResponse(options) {
 async function verifyAuthorizationResponseFormPostJWT(options) {
   try {
     const decodedJwt = options.authorizationResponseDecoded;
-    await (0, import_oauth2.verifyJwt)({
+    await (0, import_io_wallet_utils.verifyJwt)({
       compact: options.authorizationResponseCompact,
       errorMessage: "Error verifying JWT signature",
       header: decodedJwt.header,
       payload: decodedJwt.payload,
-      signer: options.signer ?? (0, import_oauth2.jwtSignerFromJwt)({
+      signer: options.signer ?? (0, import_io_wallet_utils.jwtSignerFromJwt)({
         header: decodedJwt.header,
         payload: decodedJwt.payload
       }),
@@ -234,18 +235,18 @@ var zAuthorizationResponse = import_zod.default.object({
 // src/authorization-response/complete-authorization.ts
 async function completeAuthorization(options) {
   try {
-    const fetch = (0, import_io_wallet_utils.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils2.createFetcher)(options.callbacks.fetch);
     const authorizationResponseResult = await fetch(options.response_uri);
-    await (0, import_io_wallet_utils.hasStatusOrThrow)(
+    await (0, import_io_wallet_utils2.hasStatusOrThrow)(
       200,
-      import_io_wallet_utils.UnexpectedStatusCodeError
+      import_io_wallet_utils2.UnexpectedStatusCodeError
     )(authorizationResponseResult);
     return await (0, import_io_wallet_oauth2.getJwtFromFormPost)({
       formData: await authorizationResponseResult.text(),
       schema: zAuthorizationResponse
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils.ValidationError || error instanceof Oid4vciError) {
+    if (error instanceof import_io_wallet_utils2.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils2.ValidationError || error instanceof Oid4vciError) {
       throw error;
     }
     throw new Oid4vciError(
@@ -276,7 +277,7 @@ async function sendAuthorizationResponseAndExtractCode(options) {
       state: options.state
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils.ValidationError || error instanceof Oid4vciError) {
+    if (error instanceof import_io_wallet_utils2.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils2.ValidationError || error instanceof Oid4vciError) {
       throw error;
     }
     throw new Oid4vciError(
@@ -285,8 +286,93 @@ async function sendAuthorizationResponseAndExtractCode(options) {
   }
 }
 
+// src/credential-offer/APTITUDE/z-credential-offer.ts
+var import_zod2 = require("zod");
+var zTxCodePreAuthorizedCodeGrantAPTITUDE = import_zod2.z.object({
+  /**
+   * OPTIONAL. String containing guidance for the Holder
+   * of the Wallet on how to obtain the Transaction Code.
+   */
+  description: import_zod2.z.string().max(300).optional(),
+  /**
+   * OPTIONAL. String specifying the input character set.
+   * Possible values are numeric (only digits) and text (any characters).
+   * The default is numeric.
+   */
+  input_mode: import_zod2.z.enum(["numeric", "digit"]).optional(),
+  /**
+   * OPTIONAL. Integer specifying the length of the Transaction Code.
+   */
+  length: import_zod2.z.number().optional()
+});
+var zAuthorizationCodeGrantAPTITUDE = import_zod2.z.object({
+  /**
+   * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
+   * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
+   * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
+   */
+  authorization_server: import_zod2.z.url().optional(),
+  /**
+   * OPTIONAL. String value representing the issuer state.
+   * Used to correlate the authorization request with the credential offer.
+   */
+  issuer_state: import_zod2.z.string().optional()
+});
+var zPreAuthorizedCodeGrantAPTITUDE = import_zod2.z.object({
+  /**
+   * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
+   * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
+   * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
+   */
+  authorization_server: import_zod2.z.url().optional(),
+  /**
+   * REQUIRED. The code representing the Credential Issuer's authorization for
+   * the Wallet to obtain Credentials of a certain type
+   */
+  "pre-authorized_code": import_zod2.z.string(),
+  /**
+   * OPTIONAL. Object indicating that a Transaction Code is required if present, even if empty.
+   * It describes the requirements for a Transaction Code, which the Authorization Server expects
+   * the End-User to present along with the Token Request in a Pre-Authorized Code Flow.
+   * If the Authorization Server does not expect a Transaction Code, this object is absent;
+   */
+  tx_code: zTxCodePreAuthorizedCodeGrantAPTITUDE.optional()
+});
+var zCredentialOfferGrantsAPTITUDE = import_zod2.z.object({
+  /**
+   * OPTIONAL. Authorization Code grant details.
+   */
+  authorization_code: zAuthorizationCodeGrantAPTITUDE.optional(),
+  /**
+   * OPTIONAL. Pre-Authorized Code grant details.
+   */
+  "urn:ietf:params:oauth:grant-type:pre-authorized_code": zPreAuthorizedCodeGrantAPTITUDE.optional()
+});
+var zCredentialOfferAPTITUDE = import_zod2.z.object({
+  /**
+   * REQUIRED. Array of credential configuration identifiers.
+   * References the types of credentials offered as defined in the Credential Issuer metadata.
+   */
+  credential_configuration_ids: import_zod2.z.array(import_zod2.z.string()).min(1),
+  /**
+   * REQUIRED. HTTPS URL of the Credential Issuer.
+   * The Credential Issuer from which the wallet will request credentials.
+   */
+  credential_issuer: import_zod2.z.url(),
+  /**
+   * REQUIRED. Grant information for the credential offer.
+   * IT-Wallet v1.4 requires authorization_code or pre-auhorized code grant.
+   */
+  grants: zCredentialOfferGrantsAPTITUDE
+});
+var CREDENTIAL_OFFER_GRANTS = /* @__PURE__ */ ((CREDENTIAL_OFFER_GRANTS2) => {
+  CREDENTIAL_OFFER_GRANTS2["AUTHORIZATION_CODE"] = "authorization_code";
+  CREDENTIAL_OFFER_GRANTS2["PREAUTHORIZED_CODE"] = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+  return CREDENTIAL_OFFER_GRANTS2;
+})(CREDENTIAL_OFFER_GRANTS || {});
+
 // src/credential-offer/extract-grant-details.ts
-var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
 function requireAuthorizationCodeGrant(credentialOffer) {
   if (!credentialOffer.grants) {
     throw new CredentialOfferError("No grants found in credential offer");
@@ -297,83 +383,120 @@ function requireAuthorizationCodeGrant(credentialOffer) {
   }
   return authCodeGrant;
 }
+function requireAuthorizationCodeOrPreAuthorizedCodeGrant(credentialOffer) {
+  if (!credentialOffer.grants) {
+    throw new CredentialOfferError("No grants found in credential offer");
+  }
+  const grants = credentialOffer.grants;
+  if (!grants["authorization_code" /* AUTHORIZATION_CODE */] && !grants["urn:ietf:params:oauth:grant-type:pre-authorized_code" /* PREAUTHORIZED_CODE */]) {
+    throw new CredentialOfferError(
+      "either one of authorization_code or pre-authorized code grant is required"
+    );
+  }
+  return grants;
+}
 function extractGrantDetailsV1_3(options) {
   const authCodeGrant = requireAuthorizationCodeGrant(options.credentialOffer);
   return {
-    authorizationCodeGrant: {
+    ["authorization_code" /* AUTHORIZATION_CODE */]: {
       authorizationServer: authCodeGrant.authorization_server,
       issuerState: authCodeGrant.issuer_state,
       scope: authCodeGrant.scope
-    },
-    grantType: "authorization_code"
+    }
   };
 }
 function extractGrantDetailsV1_4(options) {
   const authCodeGrant = requireAuthorizationCodeGrant(options.credentialOffer);
   return {
-    authorizationCodeGrant: {
+    ["authorization_code" /* AUTHORIZATION_CODE */]: {
       authorizationServer: authCodeGrant.authorization_server,
       issuerState: authCodeGrant.issuer_state
+    }
+  };
+}
+function extractGrantDetailsAPTITUDE(options) {
+  const grants = requireAuthorizationCodeOrPreAuthorizedCodeGrant(
+    options.credentialOffer
+  );
+  const authorizationCodeGrant = grants["authorization_code" /* AUTHORIZATION_CODE */];
+  const preAuthorizedCodeGrant = grants["urn:ietf:params:oauth:grant-type:pre-authorized_code" /* PREAUTHORIZED_CODE */];
+  return {
+    ...authorizationCodeGrant && {
+      ["authorization_code" /* AUTHORIZATION_CODE */]: {
+        authorizationServer: authorizationCodeGrant.authorization_server,
+        issuerState: authorizationCodeGrant.issuer_state
+      }
     },
-    grantType: "authorization_code"
+    ...preAuthorizedCodeGrant && {
+      ["urn:ietf:params:oauth:grant-type:pre-authorized_code" /* PREAUTHORIZED_CODE */]: {
+        authorizationServer: preAuthorizedCodeGrant.authorization_server,
+        preAuthorizedCode: preAuthorizedCodeGrant["pre-authorized_code"],
+        txCode: preAuthorizedCodeGrant.tx_code
+      }
+    }
   };
 }
-var dispatchExtractGrantDetails = (0, import_io_wallet_utils2.createVersionDispatcher)({
-  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_0]: () => {
-    throw new import_io_wallet_utils2.ItWalletSpecsVersionError(
+var dispatchExtractGrantDetails = (0, import_io_wallet_utils3.createVersionDispatcher)({
+  [import_io_wallet_utils3.ItWalletSpecsVersion.APTITUDE]: (o) => extractGrantDetailsAPTITUDE(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_0]: () => {
+    throw new import_io_wallet_utils3.ItWalletSpecsVersionError(
       "extractGrantDetails",
-      import_io_wallet_utils2.ItWalletSpecsVersion.V1_0,
-      [import_io_wallet_utils2.ItWalletSpecsVersion.V1_3, import_io_wallet_utils2.ItWalletSpecsVersion.V1_4]
+      import_io_wallet_utils3.ItWalletSpecsVersion.V1_0,
+      [
+        import_io_wallet_utils3.ItWalletSpecsVersion.V1_3,
+        import_io_wallet_utils3.ItWalletSpecsVersion.V1_4,
+        import_io_wallet_utils3.ItWalletSpecsVersion.APTITUDE
+      ]
     );
   },
-  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_3]: (o) => extractGrantDetailsV1_3(o),
-  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_4]: (o) => extractGrantDetailsV1_4(o)
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_3]: (o) => extractGrantDetailsV1_3(o),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_4]: (o) => extractGrantDetailsV1_4(o)
 });
 function extractGrantDetails(options) {
   return dispatchExtractGrantDetails(options);
 }
 
 // src/credential-offer/z-credential-offer.ts
-var import_zod4 = require("zod");
+var import_zod5 = require("zod");
 
 // src/credential-offer/v1.3/z-credential-offer.ts
-var import_zod2 = require("zod");
-var zAuthorizationCodeGrantV1_3 = import_zod2.z.object({
+var import_zod3 = require("zod");
+var zAuthorizationCodeGrantV1_3 = import_zod3.z.object({
   /**
    * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
    * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
    * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
    */
-  authorization_server: import_zod2.z.url().optional(),
+  authorization_server: import_zod3.z.url().optional(),
   /**
    * OPTIONAL. String value representing the issuer state.
    * Used to correlate the authorization request with the credential offer.
    */
-  issuer_state: import_zod2.z.string().optional(),
+  issuer_state: import_zod3.z.string().optional(),
   /**
    * REQUIRED. OAuth 2.0 scope value.
    * Defines the scope of access requested by the credential offer.
    */
-  scope: import_zod2.z.string()
+  scope: import_zod3.z.string()
 });
-var zCredentialOfferGrantsV1_3 = import_zod2.z.object({
+var zCredentialOfferGrantsV1_3 = import_zod3.z.object({
   /**
    * REQUIRED. Authorization Code grant details.
    * IT-Wallet v1.3 only supports authorization_code grant.
    */
   authorization_code: zAuthorizationCodeGrantV1_3
 });
-var zCredentialOfferV1_3 = import_zod2.z.object({
+var zCredentialOfferV1_3 = import_zod3.z.object({
   /**
    * REQUIRED. Array of credential configuration identifiers.
    * References the types of credentials offered as defined in the Credential Issuer metadata.
    */
-  credential_configuration_ids: import_zod2.z.array(import_zod2.z.string()).min(1),
+  credential_configuration_ids: import_zod3.z.array(import_zod3.z.string()).min(1),
   /**
    * REQUIRED. HTTPS URL of the Credential Issuer.
    * The Credential Issuer from which the wallet will request credentials.
    */
-  credential_issuer: import_zod2.z.url(),
+  credential_issuer: import_zod3.z.url(),
   /**
    * REQUIRED. Grant information for the credential offer.
    * IT-Wallet v1.3 requires authorization_code grant.
@@ -382,38 +505,38 @@ var zCredentialOfferV1_3 = import_zod2.z.object({
 });
 
 // src/credential-offer/v1.4/z-credential-offer.ts
-var import_zod3 = require("zod");
-var zAuthorizationCodeGrantV1_4 = import_zod3.z.object({
+var import_zod4 = require("zod");
+var zAuthorizationCodeGrantV1_4 = import_zod4.z.object({
   /**
    * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
    * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
    * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
    */
-  authorization_server: import_zod3.z.url().optional(),
+  authorization_server: import_zod4.z.url().optional(),
   /**
    * OPTIONAL. String value representing the issuer state.
    * Used to correlate the authorization request with the credential offer.
    */
-  issuer_state: import_zod3.z.string().optional()
+  issuer_state: import_zod4.z.string().optional()
 });
-var zCredentialOfferGrantsV1_4 = import_zod3.z.object({
+var zCredentialOfferGrantsV1_4 = import_zod4.z.object({
   /**
    * REQUIRED. Authorization Code grant details.
    * IT-Wallet v1.4 only supports authorization_code grant.
    */
   authorization_code: zAuthorizationCodeGrantV1_4
 });
-var zCredentialOfferV1_4 = import_zod3.z.object({
+var zCredentialOfferV1_4 = import_zod4.z.object({
   /**
    * REQUIRED. Array of credential configuration identifiers.
    * References the types of credentials offered as defined in the Credential Issuer metadata.
    */
-  credential_configuration_ids: import_zod3.z.array(import_zod3.z.string()).min(1),
+  credential_configuration_ids: import_zod4.z.array(import_zod4.z.string()).min(1),
   /**
    * REQUIRED. HTTPS URL of the Credential Issuer.
    * The Credential Issuer from which the wallet will request credentials.
    */
-  credential_issuer: import_zod3.z.url(),
+  credential_issuer: import_zod4.z.url(),
   /**
    * REQUIRED. Grant information for the credential offer.
    * IT-Wallet v1.4 requires authorization_code grant.
@@ -422,22 +545,22 @@ var zCredentialOfferV1_4 = import_zod3.z.object({
 });
 
 // src/credential-offer/z-credential-offer.ts
-var zCredentialOfferUri = import_zod4.z.object({
+var zCredentialOfferUri = import_zod5.z.object({
   /**
    * OPTIONAL. Inline credential offer JSON (by value).
    * URL-encoded JSON string containing the credential offer.
    */
-  credential_offer: import_zod4.z.string().optional(),
+  credential_offer: import_zod5.z.string().optional(),
   /**
    * OPTIONAL. URL pointing to the credential offer JSON (by reference).
    * HTTPS URL where the credential offer can be fetched.
    */
-  credential_offer_uri: import_zod4.z.url().optional(),
+  credential_offer_uri: import_zod5.z.url().optional(),
   /**
    * URL scheme used for the credential offer.
    * Determines the invocation method.
    */
-  scheme: import_zod4.z.enum(["openid-credential-offer", "haip-vci", "https"])
+  scheme: import_zod5.z.enum(["openid-credential-offer", "haip-vci", "https"])
 }).refine((data) => data.credential_offer || data.credential_offer_uri, {
   message: "Either credential_offer or credential_offer_uri must be present"
 });
@@ -475,18 +598,24 @@ async function parseCredentialOfferUri(options) {
 }
 
 // src/credential-offer/resolve-credential-offer.ts
-var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
 function parseCredentialOfferForVersion(config, data) {
   switch (config.itWalletSpecsVersion) {
-    case import_io_wallet_utils3.ItWalletSpecsVersion.V1_3:
+    case import_io_wallet_utils4.ItWalletSpecsVersion.V1_3:
       return zCredentialOfferV1_3.parse(data);
-    case import_io_wallet_utils3.ItWalletSpecsVersion.V1_4:
+    case import_io_wallet_utils4.ItWalletSpecsVersion.V1_4:
       return zCredentialOfferV1_4.parse(data);
+    case import_io_wallet_utils4.ItWalletSpecsVersion.APTITUDE:
+      return zCredentialOfferAPTITUDE.parse(data);
     default:
-      throw new import_io_wallet_utils3.ItWalletSpecsVersionError(
+      throw new import_io_wallet_utils4.ItWalletSpecsVersionError(
         "resolveCredentialOffer",
         config.itWalletSpecsVersion,
-        [import_io_wallet_utils3.ItWalletSpecsVersion.V1_3, import_io_wallet_utils3.ItWalletSpecsVersion.V1_4]
+        [
+          import_io_wallet_utils4.ItWalletSpecsVersion.V1_3,
+          import_io_wallet_utils4.ItWalletSpecsVersion.V1_4,
+          import_io_wallet_utils4.ItWalletSpecsVersion.APTITUDE
+        ]
       );
   }
 }
@@ -501,14 +630,14 @@ async function resolveCredentialOffer(options) {
         return parseCredentialOfferForVersion(config, offerJson2);
       }
       if (parsed.credential_offer_uri) {
-        const fetch = (0, import_io_wallet_utils3.createFetcher)(callbacks.fetch);
+        const fetch = (0, import_io_wallet_utils4.createFetcher)(callbacks.fetch);
         const response = await fetch(parsed.credential_offer_uri, {
           headers: {
             Accept: "application/json"
           },
           method: "GET"
         });
-        await (0, import_io_wallet_utils3.hasStatusOrThrow)(200, import_io_wallet_utils3.UnexpectedStatusCodeError)(response);
+        await (0, import_io_wallet_utils4.hasStatusOrThrow)(200, import_io_wallet_utils4.UnexpectedStatusCodeError)(response);
         const offerJson2 = await response.json();
         return parseCredentialOfferForVersion(config, offerJson2);
       }
@@ -516,7 +645,7 @@ async function resolveCredentialOffer(options) {
     const offerJson = JSON.parse(credentialOffer);
     return parseCredentialOfferForVersion(config, offerJson);
   } catch (error) {
-    if (error instanceof CredentialOfferError || error instanceof import_io_wallet_utils3.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils3.ItWalletSpecsVersionError) {
+    if (error instanceof CredentialOfferError || error instanceof import_io_wallet_utils4.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils4.ItWalletSpecsVersionError) {
       throw error;
     }
     throw new CredentialOfferError(
@@ -526,7 +655,7 @@ async function resolveCredentialOffer(options) {
 }
 
 // src/credential-offer/validate-credential-offer.ts
-var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
 function assertAuthorizationServerAllowed(authorizationServer, authorizationServers) {
   if (!authorizationServer) {
     if (authorizationServers && authorizationServers.length > 1) {
@@ -553,7 +682,7 @@ function assertAuthorizationServerAllowed(authorizationServer, authorizationServ
   }
 }
 function validateBaseCredentialOffer(options) {
-  const { credentialIssuerMetadata, credentialOffer, versionLabel } = options;
+  const { credentialOffer, versionLabel } = options;
   if (!credentialOffer.credential_issuer.startsWith("https://")) {
     throw new CredentialOfferError("credential_issuer must be an HTTPS URL");
   }
@@ -567,6 +696,11 @@ function validateBaseCredentialOffer(options) {
       `grants is REQUIRED for IT-Wallet ${versionLabel}`
     );
   }
+}
+async function validateCredentialOfferV1_3(options) {
+  const versionLabel = "v1.3";
+  const { credentialIssuerMetadata, credentialOffer } = options;
+  validateBaseCredentialOffer({ credentialOffer, versionLabel });
   const authCodeGrant = credentialOffer.grants.authorization_code;
   if (!authCodeGrant) {
     throw new CredentialOfferError(
@@ -577,58 +711,85 @@ function validateBaseCredentialOffer(options) {
     authCodeGrant.authorization_server,
     credentialIssuerMetadata?.authorization_servers
   );
-}
-async function validateCredentialOfferV1_3(options) {
-  validateBaseCredentialOffer({
-    credentialIssuerMetadata: options.credentialIssuerMetadata,
-    credentialOffer: options.credentialOffer,
-    versionLabel: "v1.3"
-  });
   if (!options.credentialOffer.grants.authorization_code.scope) {
     throw new CredentialOfferError("authorization_code.scope is REQUIRED");
   }
 }
 async function validateCredentialOfferV1_4(options) {
-  validateBaseCredentialOffer({
-    credentialIssuerMetadata: options.credentialIssuerMetadata,
-    credentialOffer: options.credentialOffer,
-    versionLabel: "v1.4"
-  });
+  const versionLabel = "v1.4";
+  const { credentialIssuerMetadata, credentialOffer } = options;
+  validateBaseCredentialOffer({ credentialOffer, versionLabel });
+  const authCodeGrant = credentialOffer.grants.authorization_code;
+  if (!authCodeGrant) {
+    throw new CredentialOfferError(
+      `authorization_code grant is REQUIRED for IT-Wallet ${versionLabel}`
+    );
+  }
+  assertAuthorizationServerAllowed(
+    authCodeGrant.authorization_server,
+    credentialIssuerMetadata?.authorization_servers
+  );
 }
-var dispatchValidateCredentialOffer = (0, import_io_wallet_utils4.createVersionDispatcher)({
-  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_0]: () => {
-    throw new import_io_wallet_utils4.ItWalletSpecsVersionError(
+async function validateCredentialOfferAPTITUDE(options) {
+  const versionLabel = "APTITUDE";
+  const {
+    credentialIssuerMetadata,
+    credentialOffer,
+    grantType = "authorization_code" /* AUTHORIZATION_CODE */
+  } = options;
+  validateBaseCredentialOffer({ credentialOffer, versionLabel });
+  const grant = credentialOffer.grants[grantType];
+  if (!grant) {
+    throw new CredentialOfferError(
+      `${grantType} grant as specified is REQUIRED for IT-Wallet ${versionLabel}`
+    );
+  }
+  assertAuthorizationServerAllowed(
+    grant.authorization_server,
+    credentialIssuerMetadata?.authorization_servers
+  );
+}
+var dispatchValidateCredentialOffer = (0, import_io_wallet_utils5.createVersionDispatcher)({
+  [import_io_wallet_utils5.ItWalletSpecsVersion.APTITUDE]: (o) => validateCredentialOfferAPTITUDE(
+    o
+  ),
+  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_0]: () => {
+    throw new import_io_wallet_utils5.ItWalletSpecsVersionError(
       "validateCredentialOffer",
-      import_io_wallet_utils4.ItWalletSpecsVersion.V1_0,
-      [import_io_wallet_utils4.ItWalletSpecsVersion.V1_3, import_io_wallet_utils4.ItWalletSpecsVersion.V1_4]
+      import_io_wallet_utils5.ItWalletSpecsVersion.V1_0,
+      [
+        import_io_wallet_utils5.ItWalletSpecsVersion.V1_3,
+        import_io_wallet_utils5.ItWalletSpecsVersion.V1_4,
+        import_io_wallet_utils5.ItWalletSpecsVersion.APTITUDE
+      ]
     );
   },
-  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_3]: (o) => validateCredentialOfferV1_3(o),
-  [import_io_wallet_utils4.ItWalletSpecsVersion.V1_4]: (o) => validateCredentialOfferV1_4(o)
+  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_3]: (o) => validateCredentialOfferV1_3(o),
+  [import_io_wallet_utils5.ItWalletSpecsVersion.V1_4]: (o) => validateCredentialOfferV1_4(o)
 });
 async function validateCredentialOffer(options) {
   return dispatchValidateCredentialOffer(options);
 }
 
 // src/credential-request/create-credential-request.ts
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/v1.0/create-credential-request.ts
-var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/v1.0/z-credential.ts
-var import_zod6 = require("zod");
+var import_zod7 = require("zod");
 
 // src/credential-request/z-base-credential-request.ts
-var import_zod5 = require("zod");
-var zBaseCredentialRequest = import_zod5.z.object({
-  credential_configuration_id: import_zod5.z.string().optional().describe(
+var import_zod6 = require("zod");
+var zBaseCredentialRequest = import_zod6.z.object({
+  credential_configuration_id: import_zod6.z.string().optional().describe(
     "REQUIRED if credential_identifier param is absent. MUST NOT be used otherwise."
   ),
-  credential_identifier: import_zod5.z.string().optional().describe(
+  credential_identifier: import_zod6.z.string().optional().describe(
     "REQUIRED when Authorization Details of type openid_credential was returned. MUST NOT be used if credential_configuration_id is present."
   ),
-  transaction_id: import_zod5.z.string().optional().describe(
+  transaction_id: import_zod6.z.string().optional().describe(
     "REQUIRED only in case of deferred flow. MUST NOT be present in immediate flow."
   )
 });
@@ -650,9 +811,9 @@ function credentialRequestRefiner(data, ctx) {
 }
 
 // src/credential-request/v1.0/z-credential.ts
-var zCredentialRequestProof = import_zod6.z.object({
-  jwt: import_zod6.z.string().min(1, "JWT must not be empty"),
-  proof_type: import_zod6.z.literal("jwt")
+var zCredentialRequestProof = import_zod7.z.object({
+  jwt: import_zod7.z.string().min(1, "JWT must not be empty"),
+  proof_type: import_zod7.z.literal("jwt")
   // MUST be "jwt"
 });
 var zCredentialRequestV1_0 = zBaseCredentialRequest.extend({
@@ -675,12 +836,12 @@ var createCredentialRequest = async (options) => {
       },
       payload: {
         aud: options.issuerIdentifier,
-        iat: (0, import_io_wallet_utils5.dateToSeconds)(/* @__PURE__ */ new Date()),
+        iat: (0, import_io_wallet_utils6.dateToSeconds)(/* @__PURE__ */ new Date()),
         iss: options.clientId,
         nonce: options.nonce
       }
     });
-    return (0, import_io_wallet_utils5.parseWithErrorHandling)(zCredentialRequestV1_0, {
+    return (0, import_io_wallet_utils6.parseWithErrorHandling)(zCredentialRequestV1_0, {
       credential_identifier: options.credential_identifier,
       proof: {
         jwt: proofJwt.jwt,
@@ -688,7 +849,7 @@ var createCredentialRequest = async (options) => {
       }
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils5.ValidationError) {
+    if (error instanceof import_io_wallet_utils6.ValidationError) {
       throw error;
     }
     throw new Oid4vciError(
@@ -698,14 +859,13 @@ var createCredentialRequest = async (options) => {
 };
 
 // src/credential-request/v1.3/create-credential-request.ts
-var import_oauth22 = require("@openid4vc/oauth2");
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/v1.3/z-credential.ts
-var import_zod7 = require("zod");
-var zCredentialRequestProofJwt = import_zod7.z.string().min(1, "JWT must not be empty in credential request proofs array");
-var zCredentialRequestProofs = import_zod7.z.object({
-  jwt: import_zod7.z.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
+var import_zod8 = require("zod");
+var zCredentialRequestProofJwt = import_zod8.z.string().min(1, "JWT must not be empty in credential request proofs array");
+var zCredentialRequestProofs = import_zod8.z.object({
+  jwt: import_zod8.z.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
 });
 var zCredentialRequestV1_3 = zBaseCredentialRequest.extend({
   proofs: zCredentialRequestProofs.describe(
@@ -721,16 +881,16 @@ var createCredentialRequest2 = async (options) => {
     const { maxBatchSize, signers } = options;
     const [firstSigner, ...otherSigners] = signers;
     if (!firstSigner) {
-      throw new import_io_wallet_utils6.ValidationError("At least one signer is required");
+      throw new import_io_wallet_utils7.ValidationError("At least one signer is required");
     }
     if (maxBatchSize !== void 0) {
       if (!Number.isInteger(maxBatchSize) || maxBatchSize <= 0) {
-        throw new import_io_wallet_utils6.ValidationError(
+        throw new import_io_wallet_utils7.ValidationError(
           "Invalid maxBatchSize: it must be a positive integer"
         );
       }
       if (signers.length > maxBatchSize) {
-        throw new import_io_wallet_utils6.ValidationError(
+        throw new import_io_wallet_utils7.ValidationError(
           "The number of provided signers exceeds the maximum batch size allowed"
         );
       }
@@ -739,8 +899,8 @@ var createCredentialRequest2 = async (options) => {
     if (signers.length > 1) {
       const allThumbprints = await Promise.all(
         signers.map(
-          (signer) => (0, import_oauth22.calculateJwkThumbprint)({
-            hashAlgorithm: import_oauth22.HashAlgorithm.Sha256,
+          (signer) => (0, import_io_wallet_utils7.calculateJwkThumbprint)({
+            hashAlgorithm: import_io_wallet_utils7.HashAlgorithm.Sha256,
             hashCallback: hash,
             jwk: signer.publicJwk
           })
@@ -748,7 +908,7 @@ var createCredentialRequest2 = async (options) => {
       );
       const uniqueThumbprints = new Set(allThumbprints);
       if (uniqueThumbprints.size !== allThumbprints.length) {
-        throw new import_io_wallet_utils6.ValidationError(
+        throw new import_io_wallet_utils7.ValidationError(
           "Found multiple signers with the same JWK: each JWT proof must be unique and linked to a different credential key pair"
         );
       }
@@ -762,7 +922,7 @@ var createCredentialRequest2 = async (options) => {
       },
       payload: {
         aud: options.issuerIdentifier,
-        iat: (0, import_io_wallet_utils6.dateToSeconds)(/* @__PURE__ */ new Date()),
+        iat: (0, import_io_wallet_utils7.dateToSeconds)(/* @__PURE__ */ new Date()),
         iss: options.clientId,
         nonce: options.nonce
       }
@@ -771,14 +931,14 @@ var createCredentialRequest2 = async (options) => {
       createProofJwt(firstSigner),
       ...otherSigners.map(createProofJwt)
     ]);
-    return (0, import_io_wallet_utils6.parseWithErrorHandling)(zCredentialRequestV1_3, {
+    return (0, import_io_wallet_utils7.parseWithErrorHandling)(zCredentialRequestV1_3, {
       credential_identifier: options.credential_identifier,
       proofs: {
         jwt: proofJwts
       }
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils6.ValidationError) {
+    if (error instanceof import_io_wallet_utils7.ValidationError) {
       throw error;
     }
     throw new Oid4vciError(
@@ -788,10 +948,11 @@ var createCredentialRequest2 = async (options) => {
 };
 
 // src/credential-request/create-credential-request.ts
-var dispatchCreateCredentialRequest = (0, import_io_wallet_utils7.createVersionDispatcher)({
-  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_0]: (o) => createCredentialRequest(o),
-  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_3]: (o) => createCredentialRequest2(o),
-  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_4]: (o) => (
+var dispatchCreateCredentialRequest = (0, import_io_wallet_utils8.createVersionDispatcher)({
+  [import_io_wallet_utils8.ItWalletSpecsVersion.APTITUDE]: (o) => createCredentialRequest2(o),
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_0]: (o) => createCredentialRequest(o),
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_3]: (o) => createCredentialRequest2(o),
+  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_4]: (o) => (
     // V1_4 reuses V1_3 credential request schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: credential request parameters (format, proofs, key_attestation) identical.
     createCredentialRequest2(o)
@@ -802,26 +963,26 @@ async function createCredentialRequest3(options) {
 }
 
 // src/credential-request/parse-credential-request.ts
-var import_io_wallet_oauth23 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_oauth22 = require("@pagopa/io-wallet-oauth2");
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/z-proof-jwt.ts
-var import_io_wallet_oauth22 = require("@pagopa/io-wallet-oauth2");
-var import_zod8 = require("zod");
-var zBaseProofJwtHeader = import_zod8.z.object({
-  alg: import_zod8.z.string().min(1),
-  jwk: import_io_wallet_oauth22.zJwk,
-  typ: import_zod8.z.literal("openid4vci-proof+jwt")
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_zod9 = require("zod");
+var zBaseProofJwtHeader = import_zod9.z.object({
+  alg: import_zod9.z.string().min(1),
+  jwk: import_io_wallet_utils9.zJwk,
+  typ: import_zod9.z.literal("openid4vci-proof+jwt")
 });
 var zProofJwtHeaderV1_0 = zBaseProofJwtHeader.loose();
 var zProofJwtHeaderV1_3 = zBaseProofJwtHeader.extend({
-  key_attestation: import_zod8.z.string().min(1)
+  key_attestation: import_zod9.z.string().min(1)
 }).loose();
-var zProofJwtPayload = import_zod8.z.looseObject({
-  aud: import_zod8.z.string().min(1),
-  iat: import_zod8.z.number(),
-  iss: import_zod8.z.string().min(1).optional(),
-  nonce: import_zod8.z.string().min(1)
+var zProofJwtPayload = import_zod9.z.looseObject({
+  aud: import_zod9.z.string().min(1),
+  iat: import_zod9.z.number(),
+  iss: import_zod9.z.string().min(1).optional(),
+  nonce: import_zod9.z.string().min(1)
 });
 
 // src/credential-request/parse-credential-request.ts
@@ -830,12 +991,12 @@ function validateExpectedValues(credentialRequest, expected) {
     return;
   }
   if (expected.credential_identifier && credentialRequest.credential_identifier !== expected.credential_identifier) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "credential_identifier does not match expected value"
     );
   }
   if (expected.credential_configuration_id && credentialRequest.credential_configuration_id !== expected.credential_configuration_id) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "credential_configuration_id does not match expected value"
     );
   }
@@ -843,12 +1004,12 @@ function validateExpectedValues(credentialRequest, expected) {
 function validateTransactionContext(options) {
   const { credentialRequest, isDeferredFlow } = options;
   if (isDeferredFlow && !credentialRequest.transaction_id) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "transaction_id is required for deferred credential issuance"
     );
   }
   if (!isDeferredFlow && credentialRequest.transaction_id) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "transaction_id must not be present in immediate credential issuance flow"
     );
   }
@@ -856,45 +1017,45 @@ function validateTransactionContext(options) {
 function validateProofPayloadSemantics(options) {
   const { expected, grantType, payload } = options;
   if (grantType === "authorization_code" && !payload.iss) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential proof JWT payload must include iss for authorization_code grant"
     );
   }
   if (expected?.audience && payload.aud !== expected.audience) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential proof JWT aud does not match expected audience"
     );
   }
   if (expected?.nonce && payload.nonce !== expected.nonce) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential proof JWT nonce does not match expected nonce"
     );
   }
   if (expected?.issuer && payload.iss && payload.iss !== expected.issuer) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential proof JWT iss does not match expected issuer"
     );
   }
   if (grantType === "authorization_code" && expected?.issuer && !payload.iss) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential proof JWT payload is missing expected issuer (iss)"
     );
   }
 }
 function parseProofJwt(options) {
-  const decoded = (0, import_io_wallet_oauth23.decodeJwt)({
+  const decoded = (0, import_io_wallet_utils10.decodeJwt)({
     errorMessagePrefix: "Error decoding credential request proof JWT:",
     jwt: options.jwt
   });
-  const headerValidation = options.itWalletSpecsVersion === import_io_wallet_utils8.ItWalletSpecsVersion.V1_3 || options.itWalletSpecsVersion === import_io_wallet_utils8.ItWalletSpecsVersion.V1_4 ? zProofJwtHeaderV1_3.safeParse(decoded.header) : zProofJwtHeaderV1_0.safeParse(decoded.header);
+  const headerValidation = options.itWalletSpecsVersion === import_io_wallet_utils10.ItWalletSpecsVersion.V1_3 || options.itWalletSpecsVersion === import_io_wallet_utils10.ItWalletSpecsVersion.V1_4 ? zProofJwtHeaderV1_3.safeParse(decoded.header) : zProofJwtHeaderV1_0.safeParse(decoded.header);
   if (!headerValidation.success) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential proof JWT header is invalid or missing required claims"
     );
   }
   const payloadValidation = zProofJwtPayload.safeParse(decoded.payload);
   if (!payloadValidation.success) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential proof JWT payload is invalid or missing required claims"
     );
   }
@@ -917,8 +1078,8 @@ async function validateProofJwkUniqueness(options) {
   }
   const thumbprints = await Promise.all(
     options.proofs.map(
-      (proof) => (0, import_io_wallet_utils8.calculateJwkThumbprint)({
-        hashAlgorithm: import_io_wallet_utils8.HashAlgorithm.Sha256,
+      (proof) => (0, import_io_wallet_utils10.calculateJwkThumbprint)({
+        hashAlgorithm: import_io_wallet_utils10.HashAlgorithm.Sha256,
         hashCallback: options.callbacks.hash,
         jwk: proof.header.jwk
       })
@@ -926,7 +1087,7 @@ async function validateProofJwkUniqueness(options) {
   );
   const uniqueThumbprints = new Set(thumbprints);
   if (uniqueThumbprints.size !== thumbprints.length) {
-    throw new import_io_wallet_utils8.ValidationError(
+    throw new import_io_wallet_utils10.ValidationError(
       "Credential request proofs must use unique jwk header values"
     );
   }
@@ -986,7 +1147,7 @@ async function toResult(options) {
   };
 }
 function parseAuthorizationHeader(headers) {
-  const authorizationHeader = headers.get(import_io_wallet_utils8.HEADERS.AUTHORIZATION)?.trim();
+  const authorizationHeader = headers.get(import_io_wallet_utils10.HEADERS.AUTHORIZATION)?.trim();
   if (!authorizationHeader) {
     throw new CredentialAuthorizationHeaderError(
       "Credential request is missing required 'Authorization' header with DPoP scheme"
@@ -1001,7 +1162,7 @@ function parseAuthorizationHeader(headers) {
   return token;
 }
 function parseDpopProof(headers) {
-  const extracted = (0, import_io_wallet_oauth23.extractDpopJwtFromHeaders)(headers);
+  const extracted = (0, import_io_wallet_oauth22.extractDpopJwtFromHeaders)(headers);
   if (!extracted.valid) {
     throw new InvalidDpopProofError(
       "Credential request contains a 'DPoP' header, but the value is not a valid JWT format"
@@ -1013,7 +1174,7 @@ function parseDpopProof(headers) {
   return extracted.dpopJwt;
 }
 function parseCredentialRequestV1_0(options) {
-  const credentialRequest = (0, import_io_wallet_utils8.parseWithErrorHandling)(
+  const credentialRequest = (0, import_io_wallet_utils10.parseWithErrorHandling)(
     zCredentialRequestV1_0,
     options.credentialRequest,
     "Invalid credential request format for ItWalletSpecsVersion 1.0"
@@ -1026,11 +1187,11 @@ function parseCredentialRequestV1_0(options) {
     expected: options.expected,
     grantType: options.grantType,
     isDeferredFlow: options.isDeferredFlow,
-    itWalletSpecsVersion: import_io_wallet_utils8.ItWalletSpecsVersion.V1_0
+    itWalletSpecsVersion: import_io_wallet_utils10.ItWalletSpecsVersion.V1_0
   });
 }
 function parseCredentialRequestV1_3(options) {
-  const credentialRequest = (0, import_io_wallet_utils8.parseWithErrorHandling)(
+  const credentialRequest = (0, import_io_wallet_utils10.parseWithErrorHandling)(
     zCredentialRequestV1_3,
     options.credentialRequest,
     "Invalid credential request format for ItWalletSpecsVersion 1.3"
@@ -1043,11 +1204,11 @@ function parseCredentialRequestV1_3(options) {
     expected: options.expected,
     grantType: options.grantType,
     isDeferredFlow: options.isDeferredFlow,
-    itWalletSpecsVersion: import_io_wallet_utils8.ItWalletSpecsVersion.V1_3
+    itWalletSpecsVersion: import_io_wallet_utils10.ItWalletSpecsVersion.V1_3
   });
 }
 function parseCredentialRequestV1_4(options) {
-  const credentialRequest = (0, import_io_wallet_utils8.parseWithErrorHandling)(
+  const credentialRequest = (0, import_io_wallet_utils10.parseWithErrorHandling)(
     zCredentialRequestV1_3,
     options.credentialRequest,
     "Invalid credential request format for ItWalletSpecsVersion 1.4"
@@ -1060,14 +1221,32 @@ function parseCredentialRequestV1_4(options) {
     expected: options.expected,
     grantType: options.grantType,
     isDeferredFlow: options.isDeferredFlow,
-    itWalletSpecsVersion: import_io_wallet_utils8.ItWalletSpecsVersion.V1_4
+    itWalletSpecsVersion: import_io_wallet_utils10.ItWalletSpecsVersion.V1_4
     // V1_4 reuses V1_3 proof schema
   });
 }
-var dispatchParseCredentialRequest = (0, import_io_wallet_utils8.createVersionDispatcher)({
-  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_0]: parseCredentialRequestV1_0,
-  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_3]: parseCredentialRequestV1_3,
-  [import_io_wallet_utils8.ItWalletSpecsVersion.V1_4]: parseCredentialRequestV1_4
+function parseCredentialRequestAPTITUDE(options) {
+  const credentialRequest = (0, import_io_wallet_utils10.parseWithErrorHandling)(
+    zCredentialRequestV1_3,
+    options.credentialRequest,
+    "Invalid credential request format for ItWalletSpecsVersion APTITUDE"
+  );
+  return toResult({
+    accessToken: options.accessToken,
+    callbacks: options.callbacks,
+    credentialRequest,
+    dpopProof: options.dpopProof,
+    expected: options.expected,
+    grantType: options.grantType,
+    isDeferredFlow: options.isDeferredFlow,
+    itWalletSpecsVersion: import_io_wallet_utils10.ItWalletSpecsVersion.APTITUDE
+  });
+}
+var dispatchParseCredentialRequest = (0, import_io_wallet_utils10.createVersionDispatcher)({
+  [import_io_wallet_utils10.ItWalletSpecsVersion.APTITUDE]: parseCredentialRequestAPTITUDE,
+  [import_io_wallet_utils10.ItWalletSpecsVersion.V1_0]: parseCredentialRequestV1_0,
+  [import_io_wallet_utils10.ItWalletSpecsVersion.V1_3]: parseCredentialRequestV1_3,
+  [import_io_wallet_utils10.ItWalletSpecsVersion.V1_4]: parseCredentialRequestV1_4
 });
 async function parseCredentialRequest(options) {
   const grantType = options.grantType ?? "authorization_code";
@@ -1083,7 +1262,7 @@ async function parseCredentialRequest(options) {
       isDeferredFlow
     });
   } catch (error) {
-    if (error instanceof import_io_wallet_utils8.ItWalletSpecsVersionError || error instanceof import_io_wallet_oauth23.Oauth2JwtParseError || error instanceof import_io_wallet_utils8.ValidationError || error instanceof CredentialAuthorizationHeaderError || error instanceof MissingDpopProofError || error instanceof InvalidDpopProofError) {
+    if (error instanceof import_io_wallet_utils10.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils10.JwtParseError || error instanceof import_io_wallet_utils10.ValidationError || error instanceof CredentialAuthorizationHeaderError || error instanceof MissingDpopProofError || error instanceof InvalidDpopProofError) {
       throw error;
     }
     throw new ParseCredentialRequestError(
@@ -1094,64 +1273,59 @@ async function parseCredentialRequest(options) {
 }
 
 // src/credential-request/verify-credential-request-jwt-proof.ts
-var import_oauth24 = require("@openid4vc/oauth2");
-var import_io_wallet_oauth26 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
 
 // src/credential-request/verify-key-attestation-jwt.ts
-var import_oauth23 = require("@openid4vc/oauth2");
-var import_io_wallet_oauth25 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 
 // src/wallet-provider/z-key-attestation.ts
-var import_io_wallet_oauth24 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid_federation = require("@pagopa/io-wallet-oid-federation");
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
-var import_zod9 = require("zod");
-var zStatusList = import_zod9.z.object({
-  idx: import_zod9.z.number(),
-  uri: import_zod9.z.url()
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_zod10 = require("zod");
+var zStatusList = import_zod10.z.object({
+  idx: import_zod10.z.number(),
+  uri: import_zod10.z.url()
 });
-var zKeyAttestationStatus = import_zod9.z.object({
+var zKeyAttestationStatus = import_zod10.z.object({
   status_list: zStatusList
 });
-var zKeyAttestationAlg = import_io_wallet_utils9.zItwSupportedSignatureAlg;
-var zKeyAttestationHeader = import_zod9.z.object({
+var zKeyAttestationAlg = import_io_wallet_utils11.zItwSupportedSignatureAlg;
+var zKeyAttestationHeader = import_zod10.z.object({
   alg: zKeyAttestationAlg,
-  kid: import_zod9.z.string(),
-  trust_chain: import_io_wallet_oauth24.zTrustChain.optional(),
-  typ: import_zod9.z.literal("key-attestation+jwt"),
-  x5c: import_io_wallet_oauth24.zCertificateChain
+  kid: import_zod10.z.string(),
+  trust_chain: import_io_wallet_utils11.zTrustChain.optional(),
+  typ: import_zod10.z.literal("key-attestation+jwt"),
+  x5c: import_io_wallet_utils11.zCertificateChain
 });
-var zKeyAttestationPayload = import_zod9.z.object({
-  attested_keys: import_zod9.z.array(import_io_wallet_oauth24.zJwk).nonempty(),
-  certification: import_zod9.z.string().optional(),
-  exp: import_zod9.z.number(),
-  iat: import_zod9.z.number(),
-  iss: import_zod9.z.string(),
-  key_storage: import_zod9.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty(),
+var zKeyAttestationPayload = import_zod10.z.object({
+  attested_keys: import_zod10.z.array(import_io_wallet_utils11.zJwk).nonempty(),
+  certification: import_zod10.z.string().optional(),
+  exp: import_zod10.z.number(),
+  iat: import_zod10.z.number(),
+  iss: import_zod10.z.string(),
+  key_storage: import_zod10.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty(),
   status: zKeyAttestationStatus,
-  user_authentication: import_zod9.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty()
+  user_authentication: import_zod10.z.array(import_io_wallet_oid_federation.zKeyStorageLevelV1_3).nonempty()
 });
-var zKeyAttestationTypeHeader = import_zod9.z.literal("key-attestation+jwt");
+var zKeyAttestationTypeHeader = import_zod10.z.literal("key-attestation+jwt");
 var keyAttestationTypeHeader = zKeyAttestationTypeHeader.value;
 
 // src/credential-request/verify-key-attestation-jwt.ts
 async function verifyKeyAttestationJwt(options) {
   try {
-    const { header, payload } = (0, import_io_wallet_oauth25.decodeJwt)({
+    const { header, payload } = (0, import_io_wallet_utils12.decodeJwt)({
       errorMessagePrefix: "Error decoding key attestation JWT:",
       headerSchema: zKeyAttestationHeader,
       jwt: options.keyAttestationJwt,
       payloadSchema: zKeyAttestationPayload
     });
-    const { signer } = await (0, import_oauth23.verifyJwt)({
+    const { signer } = await (0, import_io_wallet_utils12.verifyJwt)({
       compact: options.keyAttestationJwt,
       errorMessage: "Key attestation JWT verification failed.",
       header,
       now: options.now,
       payload,
-      signer: (0, import_oauth23.jwtSignerFromJwt)({ header, payload }),
+      signer: (0, import_io_wallet_utils12.jwtSignerFromJwt)({ header, payload }),
       verifyJwtCallback: options.callbacks.verifyJwt
     });
     if (options.fetchStatusList) {
@@ -1168,7 +1342,7 @@ async function verifyKeyAttestationJwt(options) {
     }
     return { header, payload, signer };
   } catch (error) {
-    if (error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils10.ValidationError || error instanceof import_oauth23.Oauth2JwtParseError) {
+    if (error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils12.ValidationError || error instanceof import_io_wallet_utils12.JwtParseError) {
       throw error;
     }
     throw new VerifyKeyAttestationJwtError(
@@ -1180,15 +1354,15 @@ async function verifyKeyAttestationJwt(options) {
 
 // src/credential-request/verify-credential-request-jwt-proof.ts
 async function isJwkInSet(options) {
-  const targetThumbprint = await (0, import_oauth24.calculateJwkThumbprint)({
-    hashAlgorithm: import_io_wallet_oauth26.HashAlgorithm.Sha256,
+  const targetThumbprint = await (0, import_io_wallet_utils13.calculateJwkThumbprint)({
+    hashAlgorithm: import_io_wallet_utils13.HashAlgorithm.Sha256,
     hashCallback: options.callbacks.hash,
     jwk: options.jwk
   });
   const thumbprints = await Promise.all(
     options.jwks.map(
-      (jwk) => (0, import_oauth24.calculateJwkThumbprint)({
-        hashAlgorithm: import_io_wallet_oauth26.HashAlgorithm.Sha256,
+      (jwk) => (0, import_io_wallet_utils13.calculateJwkThumbprint)({
+        hashAlgorithm: import_io_wallet_utils13.HashAlgorithm.Sha256,
         hashCallback: options.callbacks.hash,
         jwk
       })
@@ -1198,7 +1372,7 @@ async function isJwkInSet(options) {
 }
 function verifyProofJwtIatOrThrow(options) {
   try {
-    (0, import_io_wallet_utils11.verifyJwtIatOrThrow)({
+    (0, import_io_wallet_utils13.verifyJwtIatOrThrow)({
       iat: options.payload.iat,
       now: options.now
     });
@@ -1212,14 +1386,14 @@ function verifyProofJwtIatOrThrow(options) {
   }
 }
 async function verifyProofV1_0(options) {
-  const { header, payload } = (0, import_io_wallet_oauth26.decodeJwt)({
+  const { header, payload } = (0, import_io_wallet_utils13.decodeJwt)({
     errorMessagePrefix: "Error decoding credential request proof JWT:",
     headerSchema: zProofJwtHeaderV1_0,
     jwt: options.jwt,
     payloadSchema: zProofJwtPayload
   });
   verifyProofJwtIatOrThrow({ now: options.now, payload });
-  const { signer } = await (0, import_io_wallet_oauth26.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils13.verifyJwt)({
     compact: options.jwt,
     errorMessage: "Error verifying credential request proof jwt.",
     expectedAudience: options.credentialIssuer,
@@ -1228,20 +1402,20 @@ async function verifyProofV1_0(options) {
     header,
     now: options.now,
     payload,
-    signer: (0, import_oauth24.jwtSignerFromJwt)({ header, payload }),
+    signer: (0, import_io_wallet_utils13.jwtSignerFromJwt)({ header, payload }),
     verifyJwtCallback: options.callbacks.verifyJwt
   });
   return { header, payload, signer };
 }
 async function verifyProofV1_3(options) {
-  const { header, payload } = (0, import_io_wallet_oauth26.decodeJwt)({
+  const { header, payload } = (0, import_io_wallet_utils13.decodeJwt)({
     errorMessagePrefix: "Error decoding credential request proof JWT:",
     headerSchema: zProofJwtHeaderV1_3,
     jwt: options.jwt,
     payloadSchema: zProofJwtPayload
   });
   verifyProofJwtIatOrThrow({ now: options.now, payload });
-  const { signer } = await (0, import_io_wallet_oauth26.verifyJwt)({
+  const { signer } = await (0, import_io_wallet_utils13.verifyJwt)({
     compact: options.jwt,
     errorMessage: "Error verifying credential request proof jwt.",
     expectedAudience: options.credentialIssuer,
@@ -1250,7 +1424,7 @@ async function verifyProofV1_3(options) {
     header,
     now: options.now,
     payload,
-    signer: (0, import_oauth24.jwtSignerFromJwt)({ header, payload }),
+    signer: (0, import_io_wallet_utils13.jwtSignerFromJwt)({ header, payload }),
     verifyJwtCallback: options.callbacks.verifyJwt
   });
   if (options.trustedWalletProviderIssuers.length === 0) {
@@ -1283,10 +1457,11 @@ async function verifyProofV1_3(options) {
   }
   return { header, keyAttestation: keyAttestationResult, payload, signer };
 }
-var dispatchVerifyProof = (0, import_io_wallet_utils11.createVersionDispatcher)({
-  [import_io_wallet_utils11.ItWalletSpecsVersion.V1_0]: (o) => verifyProofV1_0(o),
-  [import_io_wallet_utils11.ItWalletSpecsVersion.V1_3]: (o) => verifyProofV1_3(o),
-  [import_io_wallet_utils11.ItWalletSpecsVersion.V1_4]: (o) => verifyProofV1_3(o)
+var dispatchVerifyProof = (0, import_io_wallet_utils13.createVersionDispatcher)({
+  [import_io_wallet_utils13.ItWalletSpecsVersion.APTITUDE]: (o) => verifyProofV1_3(o),
+  [import_io_wallet_utils13.ItWalletSpecsVersion.V1_0]: (o) => verifyProofV1_0(o),
+  [import_io_wallet_utils13.ItWalletSpecsVersion.V1_3]: (o) => verifyProofV1_3(o),
+  [import_io_wallet_utils13.ItWalletSpecsVersion.V1_4]: (o) => verifyProofV1_3(o)
 });
 async function verifyCredentialRequestJwtProof(options) {
   try {
@@ -1298,7 +1473,7 @@ async function verifyCredentialRequestJwtProof(options) {
     }
     return await dispatchVerifyProof({ ...options, now });
   } catch (error) {
-    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils11.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils11.ValidationError || error instanceof import_io_wallet_oauth26.Oauth2JwtParseError) {
+    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof import_io_wallet_utils13.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils13.ValidationError || error instanceof import_io_wallet_utils13.JwtParseError) {
       throw error;
     }
     throw new VerifyCredentialRequestJwtProofError(
@@ -1309,36 +1484,36 @@ async function verifyCredentialRequestJwtProof(options) {
 }
 
 // src/credential-response/create-credential-response.ts
-var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.0/create-credential-response.ts
-var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.0/z-credential-response.ts
-var import_zod11 = require("zod");
+var import_zod12 = require("zod");
 
 // src/credential-response/z-immediate-credential-response.ts
-var import_zod10 = require("zod");
-var zCredentialObject = import_zod10.z.object({
-  credential: import_zod10.z.string()
+var import_zod11 = require("zod");
+var zCredentialObject = import_zod11.z.object({
+  credential: import_zod11.z.string()
 });
-var zImmediateCredentialResponse = import_zod10.z.strictObject({
-  credentials: import_zod10.z.array(zCredentialObject).nonempty().describe(
+var zImmediateCredentialResponse = import_zod11.z.strictObject({
+  credentials: import_zod11.z.array(zCredentialObject).nonempty().describe(
     "Conditional. Array of issued Digital Credentials as JSON objects with `credential` member containing encoded credential string. Present for immediate issuance (HTTP 200)."
   ),
-  notification_id: import_zod10.z.string().optional().describe(
+  notification_id: import_zod11.z.string().optional().describe(
     "OPTIONAL. Identifier for notification requests. Only present with credentials parameter."
   )
 });
 
 // src/credential-response/v1.0/z-credential-response.ts
-var zDeferredCredentialResponseV1_0 = import_zod11.z.strictObject({
-  lead_time: import_zod11.z.number().int().positive().describe(
+var zDeferredCredentialResponseV1_0 = import_zod12.z.strictObject({
+  lead_time: import_zod12.z.number().int().positive().describe(
     "REQUIRED if credentials is not present, otherwise it MUST NOT be present. The amount of time (in seconds) required before making a Deferred Credential Request."
   ),
-  transaction_id: import_zod11.z.string().nonempty()
+  transaction_id: import_zod12.z.string().nonempty()
 });
-var zCredentialResponseV1_0 = import_zod11.z.union([
+var zCredentialResponseV1_0 = import_zod12.z.union([
   zImmediateCredentialResponse,
   zDeferredCredentialResponseV1_0
 ]);
@@ -1346,7 +1521,7 @@ var zCredentialResponseV1_0 = import_zod11.z.union([
 // src/credential-response/v1.0/create-credential-response.ts
 function createCredentialResponseV1_0(flow) {
   if ("credentials" in flow) {
-    return (0, import_io_wallet_utils12.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils14.parseWithErrorHandling)(
       zCredentialResponseV1_0,
       {
         credentials: flow.credentials,
@@ -1357,7 +1532,7 @@ function createCredentialResponseV1_0(flow) {
       "Invalid credential response for ItWalletSpecsVersion 1.0"
     );
   }
-  return (0, import_io_wallet_utils12.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils14.parseWithErrorHandling)(
     zCredentialResponseV1_0,
     {
       lead_time: flow.leadTime,
@@ -1368,17 +1543,17 @@ function createCredentialResponseV1_0(flow) {
 }
 
 // src/credential-response/v1.3/create-credential-response.ts
-var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/v1.3/z-credential-response.ts
-var import_zod12 = require("zod");
-var zDeferredCredentialResponseV1_3 = import_zod12.z.strictObject({
-  interval: import_zod12.z.number().int().positive().describe(
+var import_zod13 = require("zod");
+var zDeferredCredentialResponseV1_3 = import_zod13.z.strictObject({
+  interval: import_zod13.z.number().int().positive().describe(
     "REQUIRED if transaction_id is present, otherwise it MUST NOT be present. The amount of time (in seconds) required before making a Deferred Credential Request"
   ),
-  transaction_id: import_zod12.z.string().nonempty()
+  transaction_id: import_zod13.z.string().nonempty()
 });
-var zCredentialResponseV1_3 = import_zod12.z.union([
+var zCredentialResponseV1_3 = import_zod13.z.union([
   zImmediateCredentialResponse,
   zDeferredCredentialResponseV1_3
 ]);
@@ -1386,7 +1561,7 @@ var zCredentialResponseV1_3 = import_zod12.z.union([
 // src/credential-response/v1.3/create-credential-response.ts
 function createCredentialResponseV1_3(flow) {
   if ("credentials" in flow) {
-    return (0, import_io_wallet_utils13.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils15.parseWithErrorHandling)(
       zCredentialResponseV1_3,
       {
         credentials: flow.credentials,
@@ -1397,7 +1572,7 @@ function createCredentialResponseV1_3(flow) {
       "Invalid credential response for ItWalletSpecsVersion 1.3"
     );
   }
-  return (0, import_io_wallet_utils13.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils15.parseWithErrorHandling)(
     zCredentialResponseV1_3,
     {
       interval: flow.interval,
@@ -1408,14 +1583,17 @@ function createCredentialResponseV1_3(flow) {
 }
 
 // src/credential-response/create-credential-response.ts
-var dispatchBuildVersionedResponse = (0, import_io_wallet_utils14.createVersionDispatcher)({
-  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_0]: (o) => createCredentialResponseV1_0(
+var dispatchBuildVersionedResponse = (0, import_io_wallet_utils16.createVersionDispatcher)({
+  [import_io_wallet_utils16.ItWalletSpecsVersion.APTITUDE]: (o) => createCredentialResponseV1_3(
     o.flow
   ),
-  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_3]: (o) => createCredentialResponseV1_3(
+  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_0]: (o) => createCredentialResponseV1_0(
     o.flow
   ),
-  [import_io_wallet_utils14.ItWalletSpecsVersion.V1_4]: (o) => createCredentialResponseV1_3(
+  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_3]: (o) => createCredentialResponseV1_3(
+    o.flow
+  ),
+  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_4]: (o) => createCredentialResponseV1_3(
     o.flow
     // V1_4 reuses V1_3 credential response schema — no breaking changes between versions.
     // Verified against compare/1.3.3...1.4.1: credential response parameters identical.
@@ -1440,7 +1618,7 @@ async function createCredentialResponse(options) {
     }
     return { credentialResponse, credentialResponseJwt };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils14.ValidationError || error instanceof Oid4vciError) {
+    if (error instanceof import_io_wallet_utils16.ValidationError || error instanceof Oid4vciError) {
       throw error;
     }
     throw new CreateCredentialResponseError(
@@ -1464,49 +1642,49 @@ async function encryptResponse(credentialResponse, credentialResponseEncryption,
 }
 
 // src/credential-response/fetch-credential-response.ts
-var import_io_wallet_utils15 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils18 = require("@pagopa/io-wallet-utils");
 
 // src/credential-response/z-credential-response.ts
-var import_io_wallet_oauth27 = require("@pagopa/io-wallet-oauth2");
-var import_zod13 = require("zod");
-var zCredentialResponseEncryption = import_zod13.z.looseObject({
-  alg: import_io_wallet_oauth27.zAlgValueNotNone,
-  enc: import_zod13.z.string(),
-  jwk: import_io_wallet_oauth27.zJwk
+var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var import_zod14 = require("zod");
+var zCredentialResponseEncryption = import_zod14.z.looseObject({
+  alg: import_io_wallet_utils17.zAlgValueNotNone,
+  enc: import_zod14.z.string(),
+  jwk: import_io_wallet_utils17.zJwk
 });
 
 // src/credential-response/fetch-credential-response.ts
 async function fetchCredentialResponse(options) {
   try {
-    const fetch = (0, import_io_wallet_utils15.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils18.createFetcher)(options.callbacks.fetch);
     const credentialResponse = await fetch(options.credentialEndpoint, {
       body: JSON.stringify(options.credentialRequest),
       headers: {
-        [import_io_wallet_utils15.HEADERS.AUTHORIZATION]: `DPoP ${options.accessToken}`,
-        [import_io_wallet_utils15.HEADERS.CONTENT_TYPE]: import_io_wallet_utils15.CONTENT_TYPES.JSON,
-        [import_io_wallet_utils15.HEADERS.DPOP]: options.dPoP
+        [import_io_wallet_utils18.HEADERS.AUTHORIZATION]: `DPoP ${options.accessToken}`,
+        [import_io_wallet_utils18.HEADERS.CONTENT_TYPE]: import_io_wallet_utils18.CONTENT_TYPES.JSON,
+        [import_io_wallet_utils18.HEADERS.DPOP]: options.dPoP
       },
       method: "POST"
     });
-    await (0, import_io_wallet_utils15.hasStatusOrThrow)(
+    await (0, import_io_wallet_utils18.hasStatusOrThrow)(
       [200, 202],
-      import_io_wallet_utils15.UnexpectedStatusCodeError
+      import_io_wallet_utils18.UnexpectedStatusCodeError
     )(credentialResponse);
     const credentialResponseJson = await credentialResponse.json();
     if ("proof" in options.credentialRequest) {
-      return (0, import_io_wallet_utils15.parseWithErrorHandling)(
+      return (0, import_io_wallet_utils18.parseWithErrorHandling)(
         zCredentialResponseV1_0,
         credentialResponseJson,
         `Failed to parse credential response (v1.0)`
       );
     }
-    return (0, import_io_wallet_utils15.parseWithErrorHandling)(
+    return (0, import_io_wallet_utils18.parseWithErrorHandling)(
       zCredentialResponseV1_3,
       credentialResponseJson,
       `Failed to parse credential response (v1.3)`
     );
   } catch (error) {
-    if (error instanceof import_io_wallet_utils15.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils15.ValidationError) {
+    if (error instanceof import_io_wallet_utils18.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils18.ValidationError) {
       throw error;
     }
     throw new FetchCredentialResponseError(
@@ -1516,40 +1694,39 @@ async function fetchCredentialResponse(options) {
 }
 
 // src/metadata/fetch-metadata.ts
-var import_io_wallet_oauth28 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid_federation3 = require("@pagopa/io-wallet-oid-federation");
-var import_io_wallet_utils16 = require("@pagopa/io-wallet-utils");
-var import_zod15 = __toESM(require("zod"));
+var import_io_wallet_utils19 = require("@pagopa/io-wallet-utils");
+var import_zod16 = __toESM(require("zod"));
 
 // src/metadata/z-metadata-response.ts
 var import_io_wallet_oid_federation2 = require("@pagopa/io-wallet-oid-federation");
-var import_zod14 = require("zod");
-var zMetadataResponseV1_0 = import_zod14.z.object({
-  discoveredVia: import_zod14.z.enum(["federation"]),
+var import_zod15 = require("zod");
+var zMetadataResponseV1_0 = import_zod15.z.object({
+  discoveredVia: import_zod15.z.enum(["federation"]),
   metadata: import_io_wallet_oid_federation2.itWalletMetadataV1_0,
   openid_federation_claims: import_io_wallet_oid_federation2.itWalletEntityStatementClaimsSchema
 });
-var zMetadataResponseV1_3 = import_zod14.z.object({
+var zMetadataResponseV1_3 = import_zod15.z.object({
   /**
    * Entity statement claims of the Authorization Server, present only when the
    * selected authorization server was resolved through a federation entity
    * distinct from the Credential Issuer.
    */
   authorization_server_federation_claims: import_io_wallet_oid_federation2.itWalletEntityStatementClaimsSchema.optional(),
-  discoveredVia: import_zod14.z.enum(["federation", "oid4vci"]),
+  discoveredVia: import_zod15.z.enum(["federation", "oid4vci"]),
   metadata: import_io_wallet_oid_federation2.itWalletMetadataV1_3,
   openid_federation_claims: import_io_wallet_oid_federation2.itWalletEntityStatementClaimsSchema.optional()
 });
 var zMetadataResponseV1_4 = zMetadataResponseV1_3.extend({
   metadata: import_io_wallet_oid_federation2.itWalletMetadataV1_4
 });
-var zMetadataResponse = import_zod14.z.union([
+var zMetadataResponse = import_zod15.z.union([
   zMetadataResponseV1_0,
   zMetadataResponseV1_3,
   zMetadataResponseV1_4
 ]);
-var zPartialIssuerMetadata = import_zod14.z.looseObject({
-  authorization_servers: import_zod14.z.tuple([import_zod14.z.url()], import_zod14.z.url()).optional()
+var zPartialIssuerMetadata = import_zod15.z.looseObject({
+  authorization_servers: import_zod15.z.tuple([import_zod15.z.url()], import_zod15.z.url()).optional()
 });
 
 // src/metadata/fetch-metadata.ts
@@ -1567,7 +1744,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
       return void 0;
     }
     const entityStatement = await response.text();
-    const { header, payload } = (0, import_io_wallet_oauth28.decodeJwt)({
+    const { header, payload } = (0, import_io_wallet_utils19.decodeJwt)({
       errorMessagePrefix: "Error decoding entity statement JWT:",
       jwt: entityStatement,
       payloadSchema: import_io_wallet_oid_federation3.itWalletEntityStatementClaimsSchema
@@ -1584,7 +1761,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
         payload
       });
       if (!result.verified) {
-        throw new import_io_wallet_utils16.ValidationError(
+        throw new import_io_wallet_utils19.ValidationError(
           "Entity statement signature verification failed"
         );
       }
@@ -1595,7 +1772,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
       openid_federation_claims: payload
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils16.ValidationError) {
+    if (error instanceof import_io_wallet_utils19.ValidationError) {
       throw error;
     }
     return void 0;
@@ -1616,9 +1793,9 @@ async function applyFederationAuthorizationServerSelection(fetch, federationResu
   if (!selectedAuthorizationServer || selectedAuthorizationServer === credentialIssuer) {
     return federationResult;
   }
-  const parsedSelectedAuthorizationServer = import_zod15.default.url().safeParse(selectedAuthorizationServer);
+  const parsedSelectedAuthorizationServer = import_zod16.default.url().safeParse(selectedAuthorizationServer);
   if (!parsedSelectedAuthorizationServer.success || !parsedSelectedAuthorizationServer.data.startsWith("https://")) {
-    throw new import_io_wallet_utils16.ValidationError(
+    throw new import_io_wallet_utils19.ValidationError(
       "selected authorization server is not a valid HTTPS URL"
     );
   }
@@ -1628,7 +1805,7 @@ async function applyFederationAuthorizationServerSelection(fetch, federationResu
     verifyJwt4
   );
   if (!authorizationServerResult) {
-    throw new import_io_wallet_utils16.ValidationError(
+    throw new import_io_wallet_utils19.ValidationError(
       `Federation discovery did not yield OpenID Federation metadata for authorization server '${selectedAuthorizationServer}'`
     );
   }
@@ -1643,8 +1820,8 @@ async function fallbackDiscovery(fetch, baseUrl, authorizationServer) {
     ensureTrailingSlash(baseUrl)
   ).toString();
   const issuerResponse = await fetch(issuerUrl);
-  await (0, import_io_wallet_utils16.hasStatusOrThrow)(200, import_io_wallet_utils16.UnexpectedStatusCodeError)(issuerResponse);
-  const issuerJson = (0, import_io_wallet_utils16.parseWithErrorHandling)(
+  await (0, import_io_wallet_utils19.hasStatusOrThrow)(200, import_io_wallet_utils19.UnexpectedStatusCodeError)(issuerResponse);
+  const issuerJson = (0, import_io_wallet_utils19.parseWithErrorHandling)(
     zPartialIssuerMetadata,
     await issuerResponse.json(),
     "Failed to parse credential issuer metadata"
@@ -1654,9 +1831,9 @@ async function fallbackDiscovery(fetch, baseUrl, authorizationServer) {
   let oauthAuthorizationServer;
   if (authorizationServers && authorizationServers.length > 0) {
     const selectedAuthorizationServer = authorizationServer ?? authorizationServers[0];
-    const parsedUrl = import_zod15.default.url().safeParse(selectedAuthorizationServer);
+    const parsedUrl = import_zod16.default.url().safeParse(selectedAuthorizationServer);
     if (!parsedUrl.success || !parsedUrl.data.startsWith("https://")) {
-      throw new import_io_wallet_utils16.ValidationError(
+      throw new import_io_wallet_utils19.ValidationError(
         "selected authorization server is not a valid HTTPS URL"
       );
     }
@@ -1665,7 +1842,7 @@ async function fallbackDiscovery(fetch, baseUrl, authorizationServer) {
       ensureTrailingSlash(parsedUrl.data)
     ).toString();
     const authServerResponse = await fetch(authServerUrl);
-    await (0, import_io_wallet_utils16.hasStatusOrThrow)(200, import_io_wallet_utils16.UnexpectedStatusCodeError)(authServerResponse);
+    await (0, import_io_wallet_utils19.hasStatusOrThrow)(200, import_io_wallet_utils19.UnexpectedStatusCodeError)(authServerResponse);
     oauthAuthorizationServer = await authServerResponse.json();
   } else {
     oauthAuthorizationServer = issuerJson;
@@ -1679,7 +1856,7 @@ async function fallbackDiscovery(fetch, baseUrl, authorizationServer) {
   };
 }
 var fetchMetadataWithFallbackDiscovery = async (options) => {
-  const fetch = (0, import_io_wallet_utils16.createFetcher)(options.callbacks.fetch);
+  const fetch = (0, import_io_wallet_utils19.createFetcher)(options.callbacks.fetch);
   const federationResult = await tryFederationDiscovery(
     fetch,
     options.credentialIssuerUrl,
@@ -1698,7 +1875,7 @@ var fetchMetadataWithFallbackDiscovery = async (options) => {
   return raw;
 };
 async function fetchMetadataV1_0(options) {
-  const fetch = (0, import_io_wallet_utils16.createFetcher)(options.callbacks.fetch);
+  const fetch = (0, import_io_wallet_utils19.createFetcher)(options.callbacks.fetch);
   const federationResult = await tryFederationDiscovery(
     fetch,
     options.credentialIssuerUrl,
@@ -1709,7 +1886,7 @@ async function fetchMetadataV1_0(options) {
       `Federation discovery failed for IT Wallet v1.0; no fallback available for credentialIssuerUrl ${options.credentialIssuerUrl}`
     );
   }
-  return (0, import_io_wallet_utils16.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils19.parseWithErrorHandling)(
     zMetadataResponseV1_0,
     federationResult,
     "Failed to parse v1.0 metadata response"
@@ -1717,7 +1894,7 @@ async function fetchMetadataV1_0(options) {
 }
 async function fetchMetadataV1_3(options) {
   const raw = await fetchMetadataWithFallbackDiscovery(options);
-  return (0, import_io_wallet_utils16.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils19.parseWithErrorHandling)(
     zMetadataResponseV1_3,
     raw,
     "Failed to parse v1.3 metadata response"
@@ -1725,28 +1902,29 @@ async function fetchMetadataV1_3(options) {
 }
 async function fetchMetadataV1_4(options) {
   const raw = await fetchMetadataWithFallbackDiscovery(options);
-  return (0, import_io_wallet_utils16.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils19.parseWithErrorHandling)(
     zMetadataResponseV1_4,
     raw,
     "Failed to parse v1.4 metadata response"
   );
 }
-var dispatchFetchMetadata = (0, import_io_wallet_utils16.createVersionDispatcher)({
-  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_0]: (o) => fetchMetadataV1_0(o),
-  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_3]: (o) => fetchMetadataV1_3(o),
-  [import_io_wallet_utils16.ItWalletSpecsVersion.V1_4]: (o) => fetchMetadataV1_4(o)
+var dispatchFetchMetadata = (0, import_io_wallet_utils19.createVersionDispatcher)({
+  [import_io_wallet_utils19.ItWalletSpecsVersion.APTITUDE]: (o) => fetchMetadataV1_4(o),
+  [import_io_wallet_utils19.ItWalletSpecsVersion.V1_0]: (o) => fetchMetadataV1_0(o),
+  [import_io_wallet_utils19.ItWalletSpecsVersion.V1_3]: (o) => fetchMetadataV1_3(o),
+  [import_io_wallet_utils19.ItWalletSpecsVersion.V1_4]: (o) => fetchMetadataV1_4(o)
 });
 async function fetchMetadata(options) {
   try {
-    const urlValidation = import_zod15.default.url().safeParse(options.credentialIssuerUrl);
+    const urlValidation = import_zod16.default.url().safeParse(options.credentialIssuerUrl);
     if (!urlValidation.success || !urlValidation.data.startsWith("https://")) {
-      throw new import_io_wallet_utils16.ValidationError(
+      throw new import_io_wallet_utils19.ValidationError(
         "credentialIssuerUrl must be a valid HTTPS URL"
       );
     }
     return await dispatchFetchMetadata(options);
   } catch (error) {
-    if (error instanceof import_io_wallet_utils16.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils16.ValidationError || error instanceof import_io_wallet_utils16.ItWalletSpecsVersionError || error instanceof CredentialOfferError || error instanceof FetchMetadataError) {
+    if (error instanceof import_io_wallet_utils19.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils19.ValidationError || error instanceof import_io_wallet_utils19.ItWalletSpecsVersionError || error instanceof CredentialOfferError || error instanceof FetchMetadataError) {
       throw error;
     }
     throw new FetchMetadataError("Unexpected error during metadata fetch", {
@@ -1756,8 +1934,8 @@ async function fetchMetadata(options) {
 }
 
 // src/wallet-provider/WalletProvider.ts
-var import_io_wallet_oauth29 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils17 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_oauth23 = require("@pagopa/io-wallet-oauth2");
+var import_io_wallet_utils20 = require("@pagopa/io-wallet-utils");
 function assertV1_0Options(options) {
   if (options.signer.method !== "federation") {
     throw new WalletProviderError(
@@ -1815,7 +1993,7 @@ var WalletProvider = class {
     const { signJwt } = options.callbacks;
     const now = /* @__PURE__ */ new Date();
     const issuedAt = options.issuedAt ?? now;
-    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils17.addSecondsToDate)(now, 3600 * 24 * 360);
+    const expiresAt = options.expiresAt ?? (0, import_io_wallet_utils20.addSecondsToDate)(now, 3600 * 24 * 360);
     const header = {
       alg: options.signer.alg,
       kid: options.signer.kid,
@@ -1825,8 +2003,8 @@ var WalletProvider = class {
     };
     const payload = {
       attested_keys: options.attestedKeys,
-      exp: (0, import_io_wallet_utils17.dateToSeconds)(expiresAt),
-      iat: (0, import_io_wallet_utils17.dateToSeconds)(issuedAt),
+      exp: (0, import_io_wallet_utils20.dateToSeconds)(expiresAt),
+      iat: (0, import_io_wallet_utils20.dateToSeconds)(issuedAt),
       iss: options.issuer,
       key_storage: options.keyStorage,
       status: options.status,
@@ -1890,7 +2068,7 @@ var WalletProvider = class {
    *   status: { status_list: { idx: 2, uri: "https://status.example.com" } } // Optional
    * });
    *
-   * @example v1.4 - Wallet attestation with required wallet_link and wallet_name
+   * @example v1.4, APTITUDE - Wallet attestation with required wallet_link and wallet_name
    * const jwt = await provider.createItWalletAttestationJwt({
    *   callbacks: { hash: myHashCallback, signJwt: mySignJwtCallback },
    *   dpopJwkPublic: myJwk,
@@ -1908,10 +2086,22 @@ var WalletProvider = class {
    * });
    */
   async createItWalletAttestationJwt(options) {
-    return (0, import_io_wallet_utils17.dispatchByVersion)(this.specVersion, {
-      [import_io_wallet_utils17.ItWalletSpecsVersion.V1_0]: () => {
+    return (0, import_io_wallet_utils20.dispatchByVersion)(this.specVersion, {
+      [import_io_wallet_utils20.ItWalletSpecsVersion.APTITUDE]: () => {
+        assertV1_4Options(options);
+        return (0, import_io_wallet_oauth23.createWalletAttestationJwtV1_4)({
+          callbacks: options.callbacks,
+          dpopJwkPublic: options.dpopJwkPublic,
+          expiresAt: options.expiresAt,
+          issuer: options.issuer,
+          signer: options.signer,
+          walletLink: options.walletLink,
+          walletName: options.walletName
+        });
+      },
+      [import_io_wallet_utils20.ItWalletSpecsVersion.V1_0]: () => {
         assertV1_0Options(options);
-        return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_0)({
+        return (0, import_io_wallet_oauth23.createWalletAttestationJwtV1_0)({
           authenticatorAssuranceLevel: options.authenticatorAssuranceLevel,
           callbacks: options.callbacks,
           dpopJwkPublic: options.dpopJwkPublic,
@@ -1922,9 +2112,9 @@ var WalletProvider = class {
           walletName: options.walletName
         });
       },
-      [import_io_wallet_utils17.ItWalletSpecsVersion.V1_3]: () => {
+      [import_io_wallet_utils20.ItWalletSpecsVersion.V1_3]: () => {
         assertV1_3Options(options);
-        return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_3)({
+        return (0, import_io_wallet_oauth23.createWalletAttestationJwtV1_3)({
           callbacks: options.callbacks,
           dpopJwkPublic: options.dpopJwkPublic,
           expiresAt: options.expiresAt,
@@ -1936,9 +2126,9 @@ var WalletProvider = class {
           walletName: options.walletName
         });
       },
-      [import_io_wallet_utils17.ItWalletSpecsVersion.V1_4]: () => {
+      [import_io_wallet_utils20.ItWalletSpecsVersion.V1_4]: () => {
         assertV1_4Options(options);
-        return (0, import_io_wallet_oauth29.createWalletAttestationJwtV1_4)({
+        return (0, import_io_wallet_oauth23.createWalletAttestationJwtV1_4)({
           callbacks: options.callbacks,
           dpopJwkPublic: options.dpopJwkPublic,
           expiresAt: options.expiresAt,
@@ -1953,6 +2143,7 @@ var WalletProvider = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CREDENTIAL_OFFER_GRANTS,
   CreateCredentialResponseError,
   CredentialAuthorizationHeaderError,
   CredentialOfferError,