@spec exchange_pre_authorized_code(
  String.t(),
  keyword()
) :: {:ok, AttestoClient.TokenSet.t()} | {:error, term()}

Exchange an OID4VCI pre-authorized code for an access token (urn:ietf:params:oauth:grant-type:pre-authorized_code, draft-ietf-oauth-openid4vci §6.1/§6.2) - the wallet-holder token step ahead of AttestoClient.Wallet.request_credential/3.

Required option: :token_endpoint. :client_id, :client_auth, and :req_options behave as for refresh/4 - the pre-authorized_code grant still authenticates the wallet the same way any other grant does. Pass :tx_code when the offer's grant carried a tx_code object, i.e. the end user must key in the transaction code the issuer displayed out of band.

Returns {:ok, token_set}; the ID Token, if any, is returned unverified since OID4VCI defines no binding claims for it here.

@spec refresh(GenServer.server(), term(), AttestoClient.TokenSet.t(), keyword()) ::
  {:ok, AttestoClient.RefreshResult.t()} | {:error, term()}

Refresh a token set through a single-flight coordinator.

Required options are :token_endpoint, :issuer, :client_id, and the :subject from the previously verified ID Token; :client_auth and :req_options match AttestoClient.AuthorizationCode.callback/3. The issuer is validated before the request so an ID Token returned with a rotated refresh token can always be verified rather than losing the rotation result after the response.

:client_auth also accepts {:private_key_jwt, jwk, assertion_opts} for an explicitly registered assertion algorithm, key id, audience, lifetime, time, or JWT id.

@spec revoke(
  String.t(),
  keyword()
) :: :ok | {:error, term()}

Revoke a token according to RFC 7009.

A successful 2xx response is :ok, including when the server did not know the token. Required options: :revocation_endpoint, :client_id; optional :token_type_hint, :client_auth, :req_options, and :timeout.