@pagopa/io-wallet-oid4vci 1.5.7 → 2.0.0-apt

package/dist/index.mjs

@@ -100,7 +100,7 @@ var CredentialAuthorizationHeaderError = class extends Oid4vciError {
 import {
   jwtSignerFromJwt,
   verifyJwt
-} from "@openid4vc/oauth2";
+} from "@pagopa/io-wallet-utils";
 async function verifyAuthorizationResponse(options) {
   if (options.authorizationResponse.iss !== options.iss)
     throw new Oid4vciError(
@@ -201,6 +201,91 @@ async function sendAuthorizationResponseAndExtractCode(options) {
   }
 }
 
+// src/credential-offer/APTITUDE/z-credential-offer.ts
+import { z as z2 } from "zod";
+var zTxCodePreAuthorizedCodeGrantAPTITUDE = z2.object({
+  /**
+   * OPTIONAL. String containing guidance for the Holder
+   * of the Wallet on how to obtain the Transaction Code.
+   */
+  description: z2.string().max(300).optional(),
+  /**
+   * OPTIONAL. String specifying the input character set.
+   * Possible values are numeric (only digits) and text (any characters).
+   * The default is numeric.
+   */
+  input_mode: z2.enum(["numeric", "digit"]).optional(),
+  /**
+   * OPTIONAL. Integer specifying the length of the Transaction Code.
+   */
+  length: z2.number().optional()
+});
+var zAuthorizationCodeGrantAPTITUDE = z2.object({
+  /**
+   * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
+   * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
+   * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
+   */
+  authorization_server: z2.url().optional(),
+  /**
+   * OPTIONAL. String value representing the issuer state.
+   * Used to correlate the authorization request with the credential offer.
+   */
+  issuer_state: z2.string().optional()
+});
+var zPreAuthorizedCodeGrantAPTITUDE = z2.object({
+  /**
+   * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
+   * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
+   * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
+   */
+  authorization_server: z2.url().optional(),
+  /**
+   * REQUIRED. The code representing the Credential Issuer's authorization for
+   * the Wallet to obtain Credentials of a certain type
+   */
+  "pre-authorized_code": z2.string(),
+  /**
+   * OPTIONAL. Object indicating that a Transaction Code is required if present, even if empty.
+   * It describes the requirements for a Transaction Code, which the Authorization Server expects
+   * the End-User to present along with the Token Request in a Pre-Authorized Code Flow.
+   * If the Authorization Server does not expect a Transaction Code, this object is absent;
+   */
+  tx_code: zTxCodePreAuthorizedCodeGrantAPTITUDE.optional()
+});
+var zCredentialOfferGrantsAPTITUDE = z2.object({
+  /**
+   * OPTIONAL. Authorization Code grant details.
+   */
+  authorization_code: zAuthorizationCodeGrantAPTITUDE.optional(),
+  /**
+   * OPTIONAL. Pre-Authorized Code grant details.
+   */
+  "urn:ietf:params:oauth:grant-type:pre-authorized_code": zPreAuthorizedCodeGrantAPTITUDE.optional()
+});
+var zCredentialOfferAPTITUDE = z2.object({
+  /**
+   * REQUIRED. Array of credential configuration identifiers.
+   * References the types of credentials offered as defined in the Credential Issuer metadata.
+   */
+  credential_configuration_ids: z2.array(z2.string()).min(1),
+  /**
+   * REQUIRED. HTTPS URL of the Credential Issuer.
+   * The Credential Issuer from which the wallet will request credentials.
+   */
+  credential_issuer: z2.url(),
+  /**
+   * REQUIRED. Grant information for the credential offer.
+   * IT-Wallet v1.4 requires authorization_code or pre-auhorized code grant.
+   */
+  grants: zCredentialOfferGrantsAPTITUDE
+});
+var CREDENTIAL_OFFER_GRANTS = /* @__PURE__ */ ((CREDENTIAL_OFFER_GRANTS2) => {
+  CREDENTIAL_OFFER_GRANTS2["AUTHORIZATION_CODE"] = "authorization_code";
+  CREDENTIAL_OFFER_GRANTS2["PREAUTHORIZED_CODE"] = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+  return CREDENTIAL_OFFER_GRANTS2;
+})(CREDENTIAL_OFFER_GRANTS || {});
+
 // src/credential-offer/extract-grant-details.ts
 import {
   ItWalletSpecsVersion,
@@ -217,33 +302,70 @@ function requireAuthorizationCodeGrant(credentialOffer) {
   }
   return authCodeGrant;
 }
+function requireAuthorizationCodeOrPreAuthorizedCodeGrant(credentialOffer) {
+  if (!credentialOffer.grants) {
+    throw new CredentialOfferError("No grants found in credential offer");
+  }
+  const grants = credentialOffer.grants;
+  if (!grants["authorization_code" /* AUTHORIZATION_CODE */] && !grants["urn:ietf:params:oauth:grant-type:pre-authorized_code" /* PREAUTHORIZED_CODE */]) {
+    throw new CredentialOfferError(
+      "either one of authorization_code or pre-authorized code grant is required"
+    );
+  }
+  return grants;
+}
 function extractGrantDetailsV1_3(options) {
   const authCodeGrant = requireAuthorizationCodeGrant(options.credentialOffer);
   return {
-    authorizationCodeGrant: {
+    ["authorization_code" /* AUTHORIZATION_CODE */]: {
       authorizationServer: authCodeGrant.authorization_server,
       issuerState: authCodeGrant.issuer_state,
       scope: authCodeGrant.scope
-    },
-    grantType: "authorization_code"
+    }
   };
 }
 function extractGrantDetailsV1_4(options) {
   const authCodeGrant = requireAuthorizationCodeGrant(options.credentialOffer);
   return {
-    authorizationCodeGrant: {
+    ["authorization_code" /* AUTHORIZATION_CODE */]: {
       authorizationServer: authCodeGrant.authorization_server,
       issuerState: authCodeGrant.issuer_state
+    }
+  };
+}
+function extractGrantDetailsAPTITUDE(options) {
+  const grants = requireAuthorizationCodeOrPreAuthorizedCodeGrant(
+    options.credentialOffer
+  );
+  const authorizationCodeGrant = grants["authorization_code" /* AUTHORIZATION_CODE */];
+  const preAuthorizedCodeGrant = grants["urn:ietf:params:oauth:grant-type:pre-authorized_code" /* PREAUTHORIZED_CODE */];
+  return {
+    ...authorizationCodeGrant && {
+      ["authorization_code" /* AUTHORIZATION_CODE */]: {
+        authorizationServer: authorizationCodeGrant.authorization_server,
+        issuerState: authorizationCodeGrant.issuer_state
+      }
     },
-    grantType: "authorization_code"
+    ...preAuthorizedCodeGrant && {
+      ["urn:ietf:params:oauth:grant-type:pre-authorized_code" /* PREAUTHORIZED_CODE */]: {
+        authorizationServer: preAuthorizedCodeGrant.authorization_server,
+        preAuthorizedCode: preAuthorizedCodeGrant["pre-authorized_code"],
+        txCode: preAuthorizedCodeGrant.tx_code
+      }
+    }
   };
 }
 var dispatchExtractGrantDetails = createVersionDispatcher({
+  [ItWalletSpecsVersion.APTITUDE]: (o) => extractGrantDetailsAPTITUDE(o),
   [ItWalletSpecsVersion.V1_0]: () => {
     throw new ItWalletSpecsVersionError(
       "extractGrantDetails",
       ItWalletSpecsVersion.V1_0,
-      [ItWalletSpecsVersion.V1_3, ItWalletSpecsVersion.V1_4]
+      [
+        ItWalletSpecsVersion.V1_3,
+        ItWalletSpecsVersion.V1_4,
+        ItWalletSpecsVersion.APTITUDE
+      ]
     );
   },
   [ItWalletSpecsVersion.V1_3]: (o) => extractGrantDetailsV1_3(o),
@@ -254,46 +376,46 @@ function extractGrantDetails(options) {
 }
 
 // src/credential-offer/z-credential-offer.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/credential-offer/v1.3/z-credential-offer.ts
-import { z as z2 } from "zod";
-var zAuthorizationCodeGrantV1_3 = z2.object({
+import { z as z3 } from "zod";
+var zAuthorizationCodeGrantV1_3 = z3.object({
   /**
    * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
    * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
    * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
    */
-  authorization_server: z2.url().optional(),
+  authorization_server: z3.url().optional(),
   /**
    * OPTIONAL. String value representing the issuer state.
    * Used to correlate the authorization request with the credential offer.
    */
-  issuer_state: z2.string().optional(),
+  issuer_state: z3.string().optional(),
   /**
    * REQUIRED. OAuth 2.0 scope value.
    * Defines the scope of access requested by the credential offer.
    */
-  scope: z2.string()
+  scope: z3.string()
 });
-var zCredentialOfferGrantsV1_3 = z2.object({
+var zCredentialOfferGrantsV1_3 = z3.object({
   /**
    * REQUIRED. Authorization Code grant details.
    * IT-Wallet v1.3 only supports authorization_code grant.
    */
   authorization_code: zAuthorizationCodeGrantV1_3
 });
-var zCredentialOfferV1_3 = z2.object({
+var zCredentialOfferV1_3 = z3.object({
   /**
    * REQUIRED. Array of credential configuration identifiers.
    * References the types of credentials offered as defined in the Credential Issuer metadata.
    */
-  credential_configuration_ids: z2.array(z2.string()).min(1),
+  credential_configuration_ids: z3.array(z3.string()).min(1),
   /**
    * REQUIRED. HTTPS URL of the Credential Issuer.
    * The Credential Issuer from which the wallet will request credentials.
    */
-  credential_issuer: z2.url(),
+  credential_issuer: z3.url(),
   /**
    * REQUIRED. Grant information for the credential offer.
    * IT-Wallet v1.3 requires authorization_code grant.
@@ -302,38 +424,38 @@ var zCredentialOfferV1_3 = z2.object({
 });
 
 // src/credential-offer/v1.4/z-credential-offer.ts
-import { z as z3 } from "zod";
-var zAuthorizationCodeGrantV1_4 = z3.object({
+import { z as z4 } from "zod";
+var zAuthorizationCodeGrantV1_4 = z4.object({
   /**
    * CONDITIONALLY REQUIRED. HTTPS URL of the Authorization Server.
    * REQUIRED only when the Credential Issuer uses multiple Authorization Servers.
    * If present, MUST match one of the authorization_servers in the Credential Issuer metadata.
    */
-  authorization_server: z3.url().optional(),
+  authorization_server: z4.url().optional(),
   /**
    * OPTIONAL. String value representing the issuer state.
    * Used to correlate the authorization request with the credential offer.
    */
-  issuer_state: z3.string().optional()
+  issuer_state: z4.string().optional()
 });
-var zCredentialOfferGrantsV1_4 = z3.object({
+var zCredentialOfferGrantsV1_4 = z4.object({
   /**
    * REQUIRED. Authorization Code grant details.
    * IT-Wallet v1.4 only supports authorization_code grant.
    */
   authorization_code: zAuthorizationCodeGrantV1_4
 });
-var zCredentialOfferV1_4 = z3.object({
+var zCredentialOfferV1_4 = z4.object({
   /**
    * REQUIRED. Array of credential configuration identifiers.
    * References the types of credentials offered as defined in the Credential Issuer metadata.
    */
-  credential_configuration_ids: z3.array(z3.string()).min(1),
+  credential_configuration_ids: z4.array(z4.string()).min(1),
   /**
    * REQUIRED. HTTPS URL of the Credential Issuer.
    * The Credential Issuer from which the wallet will request credentials.
    */
-  credential_issuer: z3.url(),
+  credential_issuer: z4.url(),
   /**
    * REQUIRED. Grant information for the credential offer.
    * IT-Wallet v1.4 requires authorization_code grant.
@@ -342,22 +464,22 @@ var zCredentialOfferV1_4 = z3.object({
 });
 
 // src/credential-offer/z-credential-offer.ts
-var zCredentialOfferUri = z4.object({
+var zCredentialOfferUri = z5.object({
   /**
    * OPTIONAL. Inline credential offer JSON (by value).
    * URL-encoded JSON string containing the credential offer.
    */
-  credential_offer: z4.string().optional(),
+  credential_offer: z5.string().optional(),
   /**
    * OPTIONAL. URL pointing to the credential offer JSON (by reference).
    * HTTPS URL where the credential offer can be fetched.
    */
-  credential_offer_uri: z4.url().optional(),
+  credential_offer_uri: z5.url().optional(),
   /**
    * URL scheme used for the credential offer.
    * Determines the invocation method.
    */
-  scheme: z4.enum(["openid-credential-offer", "haip-vci", "https"])
+  scheme: z5.enum(["openid-credential-offer", "haip-vci", "https"])
 }).refine((data) => data.credential_offer || data.credential_offer_uri, {
   message: "Either credential_offer or credential_offer_uri must be present"
 });
@@ -408,11 +530,17 @@ function parseCredentialOfferForVersion(config, data) {
       return zCredentialOfferV1_3.parse(data);
     case ItWalletSpecsVersion2.V1_4:
       return zCredentialOfferV1_4.parse(data);
+    case ItWalletSpecsVersion2.APTITUDE:
+      return zCredentialOfferAPTITUDE.parse(data);
     default:
       throw new ItWalletSpecsVersionError2(
         "resolveCredentialOffer",
         config.itWalletSpecsVersion,
-        [ItWalletSpecsVersion2.V1_3, ItWalletSpecsVersion2.V1_4]
+        [
+          ItWalletSpecsVersion2.V1_3,
+          ItWalletSpecsVersion2.V1_4,
+          ItWalletSpecsVersion2.APTITUDE
+        ]
       );
   }
 }
@@ -483,7 +611,7 @@ function assertAuthorizationServerAllowed(authorizationServer, authorizationServ
   }
 }
 function validateBaseCredentialOffer(options) {
-  const { credentialIssuerMetadata, credentialOffer, versionLabel } = options;
+  const { credentialOffer, versionLabel } = options;
   if (!credentialOffer.credential_issuer.startsWith("https://")) {
     throw new CredentialOfferError("credential_issuer must be an HTTPS URL");
   }
@@ -497,6 +625,11 @@ function validateBaseCredentialOffer(options) {
       `grants is REQUIRED for IT-Wallet ${versionLabel}`
     );
   }
+}
+async function validateCredentialOfferV1_3(options) {
+  const versionLabel = "v1.3";
+  const { credentialIssuerMetadata, credentialOffer } = options;
+  validateBaseCredentialOffer({ credentialOffer, versionLabel });
   const authCodeGrant = credentialOffer.grants.authorization_code;
   if (!authCodeGrant) {
     throw new CredentialOfferError(
@@ -507,30 +640,57 @@ function validateBaseCredentialOffer(options) {
     authCodeGrant.authorization_server,
     credentialIssuerMetadata?.authorization_servers
   );
-}
-async function validateCredentialOfferV1_3(options) {
-  validateBaseCredentialOffer({
-    credentialIssuerMetadata: options.credentialIssuerMetadata,
-    credentialOffer: options.credentialOffer,
-    versionLabel: "v1.3"
-  });
   if (!options.credentialOffer.grants.authorization_code.scope) {
     throw new CredentialOfferError("authorization_code.scope is REQUIRED");
   }
 }
 async function validateCredentialOfferV1_4(options) {
-  validateBaseCredentialOffer({
-    credentialIssuerMetadata: options.credentialIssuerMetadata,
-    credentialOffer: options.credentialOffer,
-    versionLabel: "v1.4"
-  });
+  const versionLabel = "v1.4";
+  const { credentialIssuerMetadata, credentialOffer } = options;
+  validateBaseCredentialOffer({ credentialOffer, versionLabel });
+  const authCodeGrant = credentialOffer.grants.authorization_code;
+  if (!authCodeGrant) {
+    throw new CredentialOfferError(
+      `authorization_code grant is REQUIRED for IT-Wallet ${versionLabel}`
+    );
+  }
+  assertAuthorizationServerAllowed(
+    authCodeGrant.authorization_server,
+    credentialIssuerMetadata?.authorization_servers
+  );
+}
+async function validateCredentialOfferAPTITUDE(options) {
+  const versionLabel = "APTITUDE";
+  const {
+    credentialIssuerMetadata,
+    credentialOffer,
+    grantType = "authorization_code" /* AUTHORIZATION_CODE */
+  } = options;
+  validateBaseCredentialOffer({ credentialOffer, versionLabel });
+  const grant = credentialOffer.grants[grantType];
+  if (!grant) {
+    throw new CredentialOfferError(
+      `${grantType} grant as specified is REQUIRED for IT-Wallet ${versionLabel}`
+    );
+  }
+  assertAuthorizationServerAllowed(
+    grant.authorization_server,
+    credentialIssuerMetadata?.authorization_servers
+  );
 }
 var dispatchValidateCredentialOffer = createVersionDispatcher2({
+  [ItWalletSpecsVersion3.APTITUDE]: (o) => validateCredentialOfferAPTITUDE(
+    o
+  ),
   [ItWalletSpecsVersion3.V1_0]: () => {
     throw new ItWalletSpecsVersionError3(
       "validateCredentialOffer",
       ItWalletSpecsVersion3.V1_0,
-      [ItWalletSpecsVersion3.V1_3, ItWalletSpecsVersion3.V1_4]
+      [
+        ItWalletSpecsVersion3.V1_3,
+        ItWalletSpecsVersion3.V1_4,
+        ItWalletSpecsVersion3.APTITUDE
+      ]
     );
   },
   [ItWalletSpecsVersion3.V1_3]: (o) => validateCredentialOfferV1_3(o),
@@ -554,18 +714,18 @@ import {
 } from "@pagopa/io-wallet-utils";
 
 // src/credential-request/v1.0/z-credential.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/credential-request/z-base-credential-request.ts
-import { z as z5 } from "zod";
-var zBaseCredentialRequest = z5.object({
-  credential_configuration_id: z5.string().optional().describe(
+import { z as z6 } from "zod";
+var zBaseCredentialRequest = z6.object({
+  credential_configuration_id: z6.string().optional().describe(
     "REQUIRED if credential_identifier param is absent. MUST NOT be used otherwise."
   ),
-  credential_identifier: z5.string().optional().describe(
+  credential_identifier: z6.string().optional().describe(
     "REQUIRED when Authorization Details of type openid_credential was returned. MUST NOT be used if credential_configuration_id is present."
   ),
-  transaction_id: z5.string().optional().describe(
+  transaction_id: z6.string().optional().describe(
     "REQUIRED only in case of deferred flow. MUST NOT be present in immediate flow."
   )
 });
@@ -587,9 +747,9 @@ function credentialRequestRefiner(data, ctx) {
 }
 
 // src/credential-request/v1.0/z-credential.ts
-var zCredentialRequestProof = z6.object({
-  jwt: z6.string().min(1, "JWT must not be empty"),
-  proof_type: z6.literal("jwt")
+var zCredentialRequestProof = z7.object({
+  jwt: z7.string().min(1, "JWT must not be empty"),
+  proof_type: z7.literal("jwt")
   // MUST be "jwt"
 });
 var zCredentialRequestV1_0 = zBaseCredentialRequest.extend({
@@ -637,19 +797,17 @@ var createCredentialRequest = async (options) => {
 // src/credential-request/v1.3/create-credential-request.ts
 import {
   HashAlgorithm,
-  calculateJwkThumbprint
-} from "@openid4vc/oauth2";
-import {
   ValidationError as ValidationError3,
+  calculateJwkThumbprint,
   dateToSeconds as dateToSeconds2,
   parseWithErrorHandling as parseWithErrorHandling2
 } from "@pagopa/io-wallet-utils";
 
 // src/credential-request/v1.3/z-credential.ts
-import { z as z7 } from "zod";
-var zCredentialRequestProofJwt = z7.string().min(1, "JWT must not be empty in credential request proofs array");
-var zCredentialRequestProofs = z7.object({
-  jwt: z7.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
+import { z as z8 } from "zod";
+var zCredentialRequestProofJwt = z8.string().min(1, "JWT must not be empty in credential request proofs array");
+var zCredentialRequestProofs = z8.object({
+  jwt: z8.tuple([zCredentialRequestProofJwt], zCredentialRequestProofJwt)
 });
 var zCredentialRequestV1_3 = zBaseCredentialRequest.extend({
   proofs: zCredentialRequestProofs.describe(
@@ -733,6 +891,7 @@ var createCredentialRequest2 = async (options) => {
 
 // src/credential-request/create-credential-request.ts
 var dispatchCreateCredentialRequest = createVersionDispatcher3({
+  [ItWalletSpecsVersion6.APTITUDE]: (o) => createCredentialRequest2(o),
   [ItWalletSpecsVersion6.V1_0]: (o) => createCredentialRequest(o),
   [ItWalletSpecsVersion6.V1_3]: (o) => createCredentialRequest2(o),
   [ItWalletSpecsVersion6.V1_4]: (o) => (
@@ -746,39 +905,37 @@ async function createCredentialRequest3(options) {
 }
 
 // src/credential-request/parse-credential-request.ts
-import {
-  Oauth2JwtParseError,
-  decodeJwt,
-  extractDpopJwtFromHeaders
-} from "@pagopa/io-wallet-oauth2";
+import { extractDpopJwtFromHeaders } from "@pagopa/io-wallet-oauth2";
 import {
   HEADERS,
   HashAlgorithm as HashAlgorithm2,
   ItWalletSpecsVersion as ItWalletSpecsVersion7,
   ItWalletSpecsVersionError as ItWalletSpecsVersionError4,
+  JwtParseError,
   ValidationError as ValidationError4,
   calculateJwkThumbprint as calculateJwkThumbprint2,
   createVersionDispatcher as createVersionDispatcher4,
+  decodeJwt as decodeJwt2,
   parseWithErrorHandling as parseWithErrorHandling3
 } from "@pagopa/io-wallet-utils";
 
 // src/credential-request/z-proof-jwt.ts
-import { zJwk } from "@pagopa/io-wallet-oauth2";
-import { z as z8 } from "zod";
-var zBaseProofJwtHeader = z8.object({
-  alg: z8.string().min(1),
+import { zJwk } from "@pagopa/io-wallet-utils";
+import { z as z9 } from "zod";
+var zBaseProofJwtHeader = z9.object({
+  alg: z9.string().min(1),
   jwk: zJwk,
-  typ: z8.literal("openid4vci-proof+jwt")
+  typ: z9.literal("openid4vci-proof+jwt")
 });
 var zProofJwtHeaderV1_0 = zBaseProofJwtHeader.loose();
 var zProofJwtHeaderV1_3 = zBaseProofJwtHeader.extend({
-  key_attestation: z8.string().min(1)
+  key_attestation: z9.string().min(1)
 }).loose();
-var zProofJwtPayload = z8.looseObject({
-  aud: z8.string().min(1),
-  iat: z8.number(),
-  iss: z8.string().min(1).optional(),
-  nonce: z8.string().min(1)
+var zProofJwtPayload = z9.looseObject({
+  aud: z9.string().min(1),
+  iat: z9.number(),
+  iss: z9.string().min(1).optional(),
+  nonce: z9.string().min(1)
 });
 
 // src/credential-request/parse-credential-request.ts
@@ -839,7 +996,7 @@ function validateProofPayloadSemantics(options) {
   }
 }
 function parseProofJwt(options) {
-  const decoded = decodeJwt({
+  const decoded = decodeJwt2({
     errorMessagePrefix: "Error decoding credential request proof JWT:",
     jwt: options.jwt
   });
@@ -1021,7 +1178,25 @@ function parseCredentialRequestV1_4(options) {
     // V1_4 reuses V1_3 proof schema
   });
 }
+function parseCredentialRequestAPTITUDE(options) {
+  const credentialRequest = parseWithErrorHandling3(
+    zCredentialRequestV1_3,
+    options.credentialRequest,
+    "Invalid credential request format for ItWalletSpecsVersion APTITUDE"
+  );
+  return toResult({
+    accessToken: options.accessToken,
+    callbacks: options.callbacks,
+    credentialRequest,
+    dpopProof: options.dpopProof,
+    expected: options.expected,
+    grantType: options.grantType,
+    isDeferredFlow: options.isDeferredFlow,
+    itWalletSpecsVersion: ItWalletSpecsVersion7.APTITUDE
+  });
+}
 var dispatchParseCredentialRequest = createVersionDispatcher4({
+  [ItWalletSpecsVersion7.APTITUDE]: parseCredentialRequestAPTITUDE,
   [ItWalletSpecsVersion7.V1_0]: parseCredentialRequestV1_0,
   [ItWalletSpecsVersion7.V1_3]: parseCredentialRequestV1_3,
   [ItWalletSpecsVersion7.V1_4]: parseCredentialRequestV1_4
@@ -1040,7 +1215,7 @@ async function parseCredentialRequest(options) {
       isDeferredFlow
     });
   } catch (error) {
-    if (error instanceof ItWalletSpecsVersionError4 || error instanceof Oauth2JwtParseError || error instanceof ValidationError4 || error instanceof CredentialAuthorizationHeaderError || error instanceof MissingDpopProofError || error instanceof InvalidDpopProofError) {
+    if (error instanceof ItWalletSpecsVersionError4 || error instanceof JwtParseError || error instanceof ValidationError4 || error instanceof CredentialAuthorizationHeaderError || error instanceof MissingDpopProofError || error instanceof InvalidDpopProofError) {
       throw error;
     }
     throw new ParseCredentialRequestError(
@@ -1051,67 +1226,70 @@ async function parseCredentialRequest(options) {
 }
 
 // src/credential-request/verify-credential-request-jwt-proof.ts
-import { calculateJwkThumbprint as calculateJwkThumbprint3, jwtSignerFromJwt as jwtSignerFromJwt3 } from "@openid4vc/oauth2";
 import {
   HashAlgorithm as HashAlgorithm3,
-  Oauth2JwtParseError as Oauth2JwtParseError3,
-  decodeJwt as decodeJwt3,
-  verifyJwt as verifyJwt3
-} from "@pagopa/io-wallet-oauth2";
-import {
   ItWalletSpecsVersion as ItWalletSpecsVersion8,
   ItWalletSpecsVersionError as ItWalletSpecsVersionError5,
+  JwtParseError as JwtParseError3,
   ValidationError as ValidationError6,
+  calculateJwkThumbprint as calculateJwkThumbprint3,
   createVersionDispatcher as createVersionDispatcher5,
+  decodeJwt as decodeJwt4,
+  jwtSignerFromJwt as jwtSignerFromJwt3,
+  verifyJwt as verifyJwt3,
   verifyJwtIatOrThrow
 } from "@pagopa/io-wallet-utils";
 
 // src/credential-request/verify-key-attestation-jwt.ts
 import {
-  Oauth2JwtParseError as Oauth2JwtParseError2,
+  JwtParseError as JwtParseError2,
+  ValidationError as ValidationError5,
+  decodeJwt as decodeJwt3,
   jwtSignerFromJwt as jwtSignerFromJwt2,
   verifyJwt as verifyJwt2
-} from "@openid4vc/oauth2";
-import { decodeJwt as decodeJwt2 } from "@pagopa/io-wallet-oauth2";
-import { ValidationError as ValidationError5 } from "@pagopa/io-wallet-utils";
+} from "@pagopa/io-wallet-utils";
 
 // src/wallet-provider/z-key-attestation.ts
-import { zCertificateChain, zJwk as zJwk2, zTrustChain } from "@pagopa/io-wallet-oauth2";
 import { zKeyStorageLevelV1_3 } from "@pagopa/io-wallet-oid-federation";
-import { zItwSupportedSignatureAlg } from "@pagopa/io-wallet-utils";
-import { z as z9 } from "zod";
-var zStatusList = z9.object({
-  idx: z9.number(),
-  uri: z9.url()
+import {
+  zCertificateChain,
+  zItwSupportedSignatureAlg,
+  zJwk as zJwk2,
+  zTrustChain
+} from "@pagopa/io-wallet-utils";
+import { z as z10 } from "zod";
+var zStatusList = z10.object({
+  idx: z10.number(),
+  uri: z10.url()
 });
-var zKeyAttestationStatus = z9.object({
+var zKeyAttestationStatus = z10.object({
   status_list: zStatusList
 });
 var zKeyAttestationAlg = zItwSupportedSignatureAlg;
-var zKeyAttestationHeader = z9.object({
+var zKeyAttestationHeader = z10.object({
   alg: zKeyAttestationAlg,
-  kid: z9.string(),
+  kid: z10.string(),
   trust_chain: zTrustChain.optional(),
-  typ: z9.literal("key-attestation+jwt"),
+  typ: z10.literal("key-attestation+jwt"),
   x5c: zCertificateChain
 });
-var zKeyAttestationPayload = z9.object({
-  attested_keys: z9.array(zJwk2).nonempty(),
-  certification: z9.string().optional(),
-  exp: z9.number(),
-  iat: z9.number(),
-  iss: z9.string(),
-  key_storage: z9.array(zKeyStorageLevelV1_3).nonempty(),
+var zKeyAttestationPayload = z10.object({
+  attested_keys: z10.array(zJwk2).nonempty(),
+  certification: z10.string().optional(),
+  exp: z10.number(),
+  iat: z10.number(),
+  iss: z10.string(),
+  key_storage: z10.array(zKeyStorageLevelV1_3).nonempty(),
   status: zKeyAttestationStatus,
-  user_authentication: z9.array(zKeyStorageLevelV1_3).nonempty()
+  user_authentication: z10.array(zKeyStorageLevelV1_3).nonempty()
 });
-var zKeyAttestationTypeHeader = z9.literal("key-attestation+jwt");
+var zKeyAttestationTypeHeader = z10.literal("key-attestation+jwt");
 var keyAttestationTypeHeader = zKeyAttestationTypeHeader.value;
 
 // src/credential-request/verify-key-attestation-jwt.ts
 async function verifyKeyAttestationJwt(options) {
   try {
-    const { header, payload } = decodeJwt2({
+    const { header, payload } = decodeJwt3({
       errorMessagePrefix: "Error decoding key attestation JWT:",
       headerSchema: zKeyAttestationHeader,
       jwt: options.keyAttestationJwt,
@@ -1140,7 +1318,7 @@ async function verifyKeyAttestationJwt(options) {
     }
     return { header, payload, signer };
   } catch (error) {
-    if (error instanceof VerifyKeyAttestationJwtError || error instanceof ValidationError5 || error instanceof Oauth2JwtParseError2) {
+    if (error instanceof VerifyKeyAttestationJwtError || error instanceof ValidationError5 || error instanceof JwtParseError2) {
       throw error;
     }
     throw new VerifyKeyAttestationJwtError(
@@ -1184,7 +1362,7 @@ function verifyProofJwtIatOrThrow(options) {
   }
 }
 async function verifyProofV1_0(options) {
-  const { header, payload } = decodeJwt3({
+  const { header, payload } = decodeJwt4({
     errorMessagePrefix: "Error decoding credential request proof JWT:",
     headerSchema: zProofJwtHeaderV1_0,
     jwt: options.jwt,
@@ -1206,7 +1384,7 @@ async function verifyProofV1_0(options) {
   return { header, payload, signer };
 }
 async function verifyProofV1_3(options) {
-  const { header, payload } = decodeJwt3({
+  const { header, payload } = decodeJwt4({
     errorMessagePrefix: "Error decoding credential request proof JWT:",
     headerSchema: zProofJwtHeaderV1_3,
     jwt: options.jwt,
@@ -1256,6 +1434,7 @@ async function verifyProofV1_3(options) {
   return { header, keyAttestation: keyAttestationResult, payload, signer };
 }
 var dispatchVerifyProof = createVersionDispatcher5({
+  [ItWalletSpecsVersion8.APTITUDE]: (o) => verifyProofV1_3(o),
   [ItWalletSpecsVersion8.V1_0]: (o) => verifyProofV1_0(o),
   [ItWalletSpecsVersion8.V1_3]: (o) => verifyProofV1_3(o),
   [ItWalletSpecsVersion8.V1_4]: (o) => verifyProofV1_3(o)
@@ -1270,7 +1449,7 @@ async function verifyCredentialRequestJwtProof(options) {
     }
     return await dispatchVerifyProof({ ...options, now });
   } catch (error) {
-    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof ItWalletSpecsVersionError5 || error instanceof ValidationError6 || error instanceof Oauth2JwtParseError3) {
+    if (error instanceof VerifyCredentialRequestJwtProofError || error instanceof VerifyKeyAttestationJwtError || error instanceof ItWalletSpecsVersionError5 || error instanceof ValidationError6 || error instanceof JwtParseError3) {
       throw error;
     }
     throw new VerifyCredentialRequestJwtProofError(
@@ -1291,30 +1470,30 @@ import {
 import { parseWithErrorHandling as parseWithErrorHandling4 } from "@pagopa/io-wallet-utils";
 
 // src/credential-response/v1.0/z-credential-response.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/credential-response/z-immediate-credential-response.ts
-import { z as z10 } from "zod";
-var zCredentialObject = z10.object({
-  credential: z10.string()
+import { z as z11 } from "zod";
+var zCredentialObject = z11.object({
+  credential: z11.string()
 });
-var zImmediateCredentialResponse = z10.strictObject({
-  credentials: z10.array(zCredentialObject).nonempty().describe(
+var zImmediateCredentialResponse = z11.strictObject({
+  credentials: z11.array(zCredentialObject).nonempty().describe(
     "Conditional. Array of issued Digital Credentials as JSON objects with `credential` member containing encoded credential string. Present for immediate issuance (HTTP 200)."
   ),
-  notification_id: z10.string().optional().describe(
+  notification_id: z11.string().optional().describe(
     "OPTIONAL. Identifier for notification requests. Only present with credentials parameter."
   )
 });
 
 // src/credential-response/v1.0/z-credential-response.ts
-var zDeferredCredentialResponseV1_0 = z11.strictObject({
-  lead_time: z11.number().int().positive().describe(
+var zDeferredCredentialResponseV1_0 = z12.strictObject({
+  lead_time: z12.number().int().positive().describe(
     "REQUIRED if credentials is not present, otherwise it MUST NOT be present. The amount of time (in seconds) required before making a Deferred Credential Request."
   ),
-  transaction_id: z11.string().nonempty()
+  transaction_id: z12.string().nonempty()
 });
-var zCredentialResponseV1_0 = z11.union([
+var zCredentialResponseV1_0 = z12.union([
   zImmediateCredentialResponse,
   zDeferredCredentialResponseV1_0
 ]);
@@ -1347,14 +1526,14 @@ function createCredentialResponseV1_0(flow) {
 import { parseWithErrorHandling as parseWithErrorHandling5 } from "@pagopa/io-wallet-utils";
 
 // src/credential-response/v1.3/z-credential-response.ts
-import { z as z12 } from "zod";
-var zDeferredCredentialResponseV1_3 = z12.strictObject({
-  interval: z12.number().int().positive().describe(
+import { z as z13 } from "zod";
+var zDeferredCredentialResponseV1_3 = z13.strictObject({
+  interval: z13.number().int().positive().describe(
     "REQUIRED if transaction_id is present, otherwise it MUST NOT be present. The amount of time (in seconds) required before making a Deferred Credential Request"
   ),
-  transaction_id: z12.string().nonempty()
+  transaction_id: z13.string().nonempty()
 });
-var zCredentialResponseV1_3 = z12.union([
+var zCredentialResponseV1_3 = z13.union([
   zImmediateCredentialResponse,
   zDeferredCredentialResponseV1_3
 ]);
@@ -1385,6 +1564,9 @@ function createCredentialResponseV1_3(flow) {
 
 // src/credential-response/create-credential-response.ts
 var dispatchBuildVersionedResponse = createVersionDispatcher6({
+  [ItWalletSpecsVersion9.APTITUDE]: (o) => createCredentialResponseV1_3(
+    o.flow
+  ),
   [ItWalletSpecsVersion9.V1_0]: (o) => createCredentialResponseV1_0(
     o.flow
   ),
@@ -1451,11 +1633,11 @@ import {
 } from "@pagopa/io-wallet-utils";
 
 // src/credential-response/z-credential-response.ts
-import { zAlgValueNotNone, zJwk as zJwk3 } from "@pagopa/io-wallet-oauth2";
-import { z as z13 } from "zod";
-var zCredentialResponseEncryption = z13.looseObject({
+import { zAlgValueNotNone, zJwk as zJwk3 } from "@pagopa/io-wallet-utils";
+import { z as z14 } from "zod";
+var zCredentialResponseEncryption = z14.looseObject({
   alg: zAlgValueNotNone,
-  enc: z13.string(),
+  enc: z14.string(),
   jwk: zJwk3
 });
 
@@ -1500,7 +1682,6 @@ async function fetchCredentialResponse(options) {
 }
 
 // src/metadata/fetch-metadata.ts
-import { decodeJwt as decodeJwt4 } from "@pagopa/io-wallet-oauth2";
 import { itWalletEntityStatementClaimsSchema as itWalletEntityStatementClaimsSchema2 } from "@pagopa/io-wallet-oid-federation";
 import {
   ItWalletSpecsVersion as ItWalletSpecsVersion10,
@@ -1509,10 +1690,11 @@ import {
   ValidationError as ValidationError9,
   createFetcher as createFetcher4,
   createVersionDispatcher as createVersionDispatcher7,
+  decodeJwt as decodeJwt5,
   hasStatusOrThrow as hasStatusOrThrow4,
   parseWithErrorHandling as parseWithErrorHandling7
 } from "@pagopa/io-wallet-utils";
-import z15 from "zod";
+import z16 from "zod";
 
 // src/metadata/z-metadata-response.ts
 import {
@@ -1521,33 +1703,33 @@ import {
   itWalletMetadataV1_3,
   itWalletMetadataV1_4
 } from "@pagopa/io-wallet-oid-federation";
-import { z as z14 } from "zod";
-var zMetadataResponseV1_0 = z14.object({
-  discoveredVia: z14.enum(["federation"]),
+import { z as z15 } from "zod";
+var zMetadataResponseV1_0 = z15.object({
+  discoveredVia: z15.enum(["federation"]),
   metadata: itWalletMetadataV1_0,
   openid_federation_claims: itWalletEntityStatementClaimsSchema
 });
-var zMetadataResponseV1_3 = z14.object({
+var zMetadataResponseV1_3 = z15.object({
   /**
    * Entity statement claims of the Authorization Server, present only when the
    * selected authorization server was resolved through a federation entity
    * distinct from the Credential Issuer.
    */
   authorization_server_federation_claims: itWalletEntityStatementClaimsSchema.optional(),
-  discoveredVia: z14.enum(["federation", "oid4vci"]),
+  discoveredVia: z15.enum(["federation", "oid4vci"]),
   metadata: itWalletMetadataV1_3,
   openid_federation_claims: itWalletEntityStatementClaimsSchema.optional()
 });
 var zMetadataResponseV1_4 = zMetadataResponseV1_3.extend({
   metadata: itWalletMetadataV1_4
 });
-var zMetadataResponse = z14.union([
+var zMetadataResponse = z15.union([
   zMetadataResponseV1_0,
   zMetadataResponseV1_3,
   zMetadataResponseV1_4
 ]);
-var zPartialIssuerMetadata = z14.looseObject({
-  authorization_servers: z14.tuple([z14.url()], z14.url()).optional()
+var zPartialIssuerMetadata = z15.looseObject({
+  authorization_servers: z15.tuple([z15.url()], z15.url()).optional()
 });
 
 // src/metadata/fetch-metadata.ts
@@ -1565,7 +1747,7 @@ async function tryFederationDiscovery(fetch, baseUrl, verifyJwt4) {
       return void 0;
     }
     const entityStatement = await response.text();
-    const { header, payload } = decodeJwt4({
+    const { header, payload } = decodeJwt5({
       errorMessagePrefix: "Error decoding entity statement JWT:",
       jwt: entityStatement,
       payloadSchema: itWalletEntityStatementClaimsSchema2
@@ -1614,7 +1796,7 @@ async function applyFederationAuthorizationServerSelection(fetch, federationResu
   if (!selectedAuthorizationServer || selectedAuthorizationServer === credentialIssuer) {
     return federationResult;
   }
-  const parsedSelectedAuthorizationServer = z15.url().safeParse(selectedAuthorizationServer);
+  const parsedSelectedAuthorizationServer = z16.url().safeParse(selectedAuthorizationServer);
   if (!parsedSelectedAuthorizationServer.success || !parsedSelectedAuthorizationServer.data.startsWith("https://")) {
     throw new ValidationError9(
       "selected authorization server is not a valid HTTPS URL"
@@ -1652,7 +1834,7 @@ async function fallbackDiscovery(fetch, baseUrl, authorizationServer) {
   let oauthAuthorizationServer;
   if (authorizationServers && authorizationServers.length > 0) {
     const selectedAuthorizationServer = authorizationServer ?? authorizationServers[0];
-    const parsedUrl = z15.url().safeParse(selectedAuthorizationServer);
+    const parsedUrl = z16.url().safeParse(selectedAuthorizationServer);
     if (!parsedUrl.success || !parsedUrl.data.startsWith("https://")) {
       throw new ValidationError9(
         "selected authorization server is not a valid HTTPS URL"
@@ -1730,13 +1912,14 @@ async function fetchMetadataV1_4(options) {
   );
 }
 var dispatchFetchMetadata = createVersionDispatcher7({
+  [ItWalletSpecsVersion10.APTITUDE]: (o) => fetchMetadataV1_4(o),
   [ItWalletSpecsVersion10.V1_0]: (o) => fetchMetadataV1_0(o),
   [ItWalletSpecsVersion10.V1_3]: (o) => fetchMetadataV1_3(o),
   [ItWalletSpecsVersion10.V1_4]: (o) => fetchMetadataV1_4(o)
 });
 async function fetchMetadata(options) {
   try {
-    const urlValidation = z15.url().safeParse(options.credentialIssuerUrl);
+    const urlValidation = z16.url().safeParse(options.credentialIssuerUrl);
     if (!urlValidation.success || !urlValidation.data.startsWith("https://")) {
       throw new ValidationError9(
         "credentialIssuerUrl must be a valid HTTPS URL"
@@ -1897,7 +2080,7 @@ var WalletProvider = class {
    *   status: { status_list: { idx: 2, uri: "https://status.example.com" } } // Optional
    * });
    *
-   * @example v1.4 - Wallet attestation with required wallet_link and wallet_name
+   * @example v1.4, APTITUDE - Wallet attestation with required wallet_link and wallet_name
    * const jwt = await provider.createItWalletAttestationJwt({
    *   callbacks: { hash: myHashCallback, signJwt: mySignJwtCallback },
    *   dpopJwkPublic: myJwk,
@@ -1916,6 +2099,18 @@ var WalletProvider = class {
    */
   async createItWalletAttestationJwt(options) {
     return dispatchByVersion(this.specVersion, {
+      [ItWalletSpecsVersion11.APTITUDE]: () => {
+        assertV1_4Options(options);
+        return createWalletAttestationJwtV1_4({
+          callbacks: options.callbacks,
+          dpopJwkPublic: options.dpopJwkPublic,
+          expiresAt: options.expiresAt,
+          issuer: options.issuer,
+          signer: options.signer,
+          walletLink: options.walletLink,
+          walletName: options.walletName
+        });
+      },
       [ItWalletSpecsVersion11.V1_0]: () => {
         assertV1_0Options(options);
         return createWalletAttestationJwtV1_0({
@@ -1959,6 +2154,7 @@ var WalletProvider = class {
   }
 };
 export {
+  CREDENTIAL_OFFER_GRANTS,
   CreateCredentialResponseError,
   CredentialAuthorizationHeaderError,
   CredentialOfferError,