@openid4vc/openid4vp 0.3.0-alpha-20250307131618 → 0.3.0-alpha-20250315153009

package/dist/index.mjs

@@ -11,140 +11,48 @@ var zClientIdScheme = z.enum([
   "web-origin"
 ]);
 
-// src/jarm/jarm-auth-response/verify-jarm-auth-response.ts
+// src/jarm/jarm-authorization-response/verify-jarm-authorization-response.ts
 import {
-  Oauth2Error as Oauth2Error2,
+  Oauth2Error as Oauth2Error3,
   decodeJwt,
-  decodeJwtHeader,
   jwtSignerFromJwt,
   zCompactJwe,
   zCompactJwt,
   zJwtHeader as zJwtHeader2
 } from "@openid4vc/oauth2";
-import z3 from "zod";
-
-// src/jarm/jarm-auth-response/jarm-validate-auth-response.ts
-import { Oauth2Error } from "@openid4vc/oauth2";
-import { dateToSeconds } from "@openid4vc/utils";
-
-// src/jarm/jarm-auth-response/z-jarm-auth-response.ts
-import { zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
-import { z as z2 } from "zod";
-var zJarmHeader = z2.object({ ...zJwtHeader.shape, apu: z2.string().optional(), apv: z2.string().optional() });
-var zJarmAuthResponse = z2.object({
-  /**
-   * iss: The issuer URL of the authorization server that created the response
-   * aud: The client_id of the client the response is intended for
-   * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.
-   */
-  ...zJwtPayload.shape,
-  ...zJwtPayload.pick({ iss: true, aud: true, exp: true }).required().shape,
-  state: z2.optional(z2.string())
-}).passthrough();
-var zJarmAuthResponseEncryptedOnly = z2.object({
-  ...zJwtPayload.shape,
-  state: z2.optional(z2.string())
-}).passthrough();
-
-// src/jarm/jarm-auth-response/jarm-validate-auth-response.ts
-var jarmAuthResponseValidate = (options) => {
-  const { clientId, authorizationResponse } = options;
-  if (!zJarmAuthResponse.safeParse(authorizationResponse).success) {
-    return;
-  }
-  if (clientId !== authorizationResponse.aud) {
-    throw new Oauth2Error(
-      `Invalid 'aud' claim in JARM authorization response. Expected '${clientId}' received '${JSON.stringify(authorizationResponse.aud)}'.`
-    );
-  }
-  if (authorizationResponse.exp !== void 0 && authorizationResponse.exp < dateToSeconds()) {
-    throw new Oauth2Error("Jarm auth response is expired.");
-  }
-};
-
-// src/jarm/jarm-auth-response/verify-jarm-auth-response.ts
-var decryptJarmRequestData = async (options) => {
-  const { requestData, callbacks } = options;
-  const { header } = decodeJwtHeader({ jwt: requestData });
-  if (!header.kid) {
-    throw new Oauth2Error2('Jarm JWE is missing the protected header field "kid".');
-  }
-  const result = await callbacks.decryptJwe(requestData);
-  if (!result.decrypted) {
-    throw new Oauth2Error2("Failed to decrypt jarm auth response.");
-  }
-  return result.payload;
-};
-async function verifyJarmAuthorizationResponse(options) {
-  const { jarmAuthorizationResponseJwt, callbacks } = options;
-  const requestDataIsEncrypted = zCompactJwe.safeParse(jarmAuthorizationResponseJwt).success;
-  const decryptedRequestData = requestDataIsEncrypted ? await decryptJarmRequestData({ requestData: jarmAuthorizationResponseJwt, callbacks }) : jarmAuthorizationResponseJwt;
-  const responseIsSigned = zCompactJwt.safeParse(decryptedRequestData).success;
-  if (!requestDataIsEncrypted && !responseIsSigned) {
-    throw new Oauth2Error2("Jarm Auth Response must be either encrypted, signed, or signed and encrypted.");
-  }
-  let jarmAuthResponse;
-  if (responseIsSigned) {
-    const { header: jwsProtectedHeader, payload: jwsPayload } = decodeJwt({
-      jwt: decryptedRequestData,
-      headerSchema: z3.object({ ...zJwtHeader2.shape, kid: z3.string() })
-    });
-    const response = zJarmAuthResponse.parse(jwsPayload);
-    const jwtSigner = jwtSignerFromJwt({ header: jwsProtectedHeader, payload: jwsPayload });
-    const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {
-      compact: decryptedRequestData,
-      header: jwsProtectedHeader,
-      payload: jwsPayload
-    });
-    if (!verificationResult.verified) {
-      throw new Oauth2Error2("Jarm Auth Response is not valid.");
-    }
-    jarmAuthResponse = response;
-  } else {
-    const jsonRequestData = JSON.parse(decryptedRequestData);
-    jarmAuthResponse = zJarmAuthResponseEncryptedOnly.parse(jsonRequestData);
-  }
-  const { authorizationRequest } = await callbacks.getOpenid4vpAuthorizationRequest(jarmAuthResponse);
-  jarmAuthResponseValidate({
-    clientId: authorizationRequest.client_id,
-    authorizationResponse: jarmAuthResponse
-  });
-  const type = requestDataIsEncrypted && responseIsSigned ? "SignedEncrypted" /* SignedEncrypted */ : requestDataIsEncrypted ? "Encrypted" /* Encrypted */ : "Signed" /* Signed */;
-  const issuer = jarmAuthResponse.iss;
-  return { authorizationRequest, jarmAuthResponse, type, issuer };
-}
+import z4 from "zod";
 
 // src/jarm/metadata/z-jarm-client-metadata.ts
-import { Oauth2Error as Oauth2Error3, zAlgValueNotNone } from "@openid4vc/oauth2";
+import { Oauth2Error, zAlgValueNotNone } from "@openid4vc/oauth2";
 import { parseWithErrorHandling } from "@openid4vc/utils";
-import { z as z4 } from "zod";
-var zJarmSignOnlyClientMetadata = z4.object({
+import { z as z2 } from "zod";
+var zJarmSignOnlyClientMetadata = z2.object({
   authorization_signed_response_alg: zAlgValueNotNone,
-  authorization_encrypted_response_alg: z4.optional(z4.never()),
-  authorization_encrypted_response_enc: z4.optional(z4.never())
+  authorization_encrypted_response_alg: z2.optional(z2.never()),
+  authorization_encrypted_response_enc: z2.optional(z2.never())
 });
-var zJarmEncryptOnlyClientMetadata = z4.object({
-  authorization_signed_response_alg: z4.optional(z4.never()),
-  authorization_encrypted_response_alg: z4.string(),
-  authorization_encrypted_response_enc: z4.optional(z4.string())
+var zJarmEncryptOnlyClientMetadata = z2.object({
+  authorization_signed_response_alg: z2.optional(z2.never()),
+  authorization_encrypted_response_alg: z2.string(),
+  authorization_encrypted_response_enc: z2.optional(z2.string())
 });
-var zJarmSignEncryptClientMetadata = z4.object({
+var zJarmSignEncryptClientMetadata = z2.object({
   authorization_signed_response_alg: zJarmSignOnlyClientMetadata.shape.authorization_signed_response_alg,
   authorization_encrypted_response_alg: zJarmEncryptOnlyClientMetadata.shape.authorization_encrypted_response_alg,
   authorization_encrypted_response_enc: zJarmEncryptOnlyClientMetadata.shape.authorization_encrypted_response_enc
 });
-var zJarmClientMetadata = z4.object({
-  authorization_signed_response_alg: z4.optional(zJarmSignOnlyClientMetadata.shape.authorization_signed_response_alg),
-  authorization_encrypted_response_alg: z4.optional(
+var zJarmClientMetadata = z2.object({
+  authorization_signed_response_alg: z2.optional(zJarmSignOnlyClientMetadata.shape.authorization_signed_response_alg),
+  authorization_encrypted_response_alg: z2.optional(
     zJarmEncryptOnlyClientMetadata.shape.authorization_encrypted_response_alg
   ),
-  authorization_encrypted_response_enc: z4.optional(
+  authorization_encrypted_response_enc: z2.optional(
     zJarmEncryptOnlyClientMetadata.shape.authorization_encrypted_response_enc
   )
 });
 var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata) => {
   const parsedClientMeta = parseWithErrorHandling(
-    z4.union([zJarmEncryptOnlyClientMetadata, zJarmSignOnlyClientMetadata, zJarmSignEncryptClientMetadata]),
+    z2.union([zJarmEncryptOnlyClientMetadata, zJarmSignOnlyClientMetadata, zJarmSignEncryptClientMetadata]),
     client_metadata,
     "Invalid jarm client metadata."
   );
@@ -178,34 +86,140 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
       }
     };
   }
-  throw new Oauth2Error3("Invalid jarm client metadata. Failed to parse.");
+  throw new Oauth2Error("Invalid jarm client metadata. Failed to parse.");
 });
 
+// src/jarm/jarm-extract-jwks.ts
+function extractJwksFromClientMetadata(clientMetadata) {
+  const parsed = zJarmClientMetadataParsed.parse(clientMetadata);
+  const encryptionAlg = parsed.client_metadata.authorization_encrypted_response_enc;
+  const signingAlg = parsed.client_metadata.authorization_signed_response_alg;
+  const encJwk = clientMetadata.jwks.keys.find((key) => key.use === "enc" && key.alg === encryptionAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "enc") ?? // fallback, take first key. HAIP does not specify requirement on enc
+  clientMetadata.jwks.keys?.[0];
+  const sigJwk = clientMetadata.jwks.keys.find((key) => key.use === "sig" && key.alg === signingAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "sig") ?? // falback, take first key
+  clientMetadata.jwks.keys?.[0];
+  return { encJwk, sigJwk };
+}
+
+// src/jarm/jarm-authorization-response/jarm-validate-authorization-response.ts
+import { Oauth2Error as Oauth2Error2 } from "@openid4vc/oauth2";
+import { dateToSeconds } from "@openid4vc/utils";
+
+// src/jarm/jarm-authorization-response/z-jarm-authorization-response.ts
+import { zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
+import { z as z3 } from "zod";
+var zJarmHeader = z3.object({ ...zJwtHeader.shape, apu: z3.string().optional(), apv: z3.string().optional() });
+var zJarmAuthorizationResponse = z3.object({
+  /**
+   * iss: The issuer URL of the authorization server that created the response
+   * aud: The client_id of the client the response is intended for
+   * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.
+   */
+  ...zJwtPayload.shape,
+  ...zJwtPayload.pick({ iss: true, aud: true, exp: true }).required().shape,
+  state: z3.optional(z3.string())
+}).passthrough();
+var zJarmAuthorizationResponseEncryptedOnly = z3.object({
+  ...zJwtPayload.shape,
+  state: z3.optional(z3.string())
+}).passthrough();
+
+// src/jarm/jarm-authorization-response/jarm-validate-authorization-response.ts
+var jarmAuthorizationResponseValidate = (options) => {
+  const { expectedClientId, authorizationResponse } = options;
+  if (!zJarmAuthorizationResponse.safeParse(authorizationResponse).success) {
+    return;
+  }
+  if (expectedClientId !== authorizationResponse.aud) {
+    throw new Oauth2Error2(
+      `Invalid 'aud' claim in JARM authorization response. Expected '${expectedClientId}' received '${JSON.stringify(authorizationResponse.aud)}'.`
+    );
+  }
+  if (authorizationResponse.exp !== void 0 && authorizationResponse.exp < dateToSeconds()) {
+    throw new Oauth2Error2("Jarm auth response is expired.");
+  }
+};
+
+// src/jarm/jarm-authorization-response/verify-jarm-authorization-response.ts
+var decryptJarmAuthorizationResponseJwt = async (options) => {
+  const { jarmAuthorizationResponseJwt, callbacks, authorizationRequestPayload } = options;
+  const encryptionJwk = authorizationRequestPayload.client_metadata?.jwks ? extractJwksFromClientMetadata({
+    ...authorizationRequestPayload.client_metadata,
+    jwks: authorizationRequestPayload.client_metadata.jwks
+  }).encJwk : void 0;
+  const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, { jwk: encryptionJwk });
+  if (!result.decrypted) {
+    throw new Oauth2Error3("Failed to decrypt jarm auth response.");
+  }
+  return result.payload;
+};
+async function verifyJarmAuthorizationResponse(options) {
+  const { jarmAuthorizationResponseJwt, callbacks, expectedClientId, authorizationRequestPayload } = options;
+  const requestDataIsEncrypted = zCompactJwe.safeParse(jarmAuthorizationResponseJwt).success;
+  const decryptedRequestData = requestDataIsEncrypted ? await decryptJarmAuthorizationResponseJwt({
+    jarmAuthorizationResponseJwt,
+    callbacks,
+    authorizationRequestPayload
+  }) : jarmAuthorizationResponseJwt;
+  const responseIsSigned = zCompactJwt.safeParse(decryptedRequestData).success;
+  if (!requestDataIsEncrypted && !responseIsSigned) {
+    throw new Oauth2Error3("Jarm Auth Response must be either encrypted, signed, or signed and encrypted.");
+  }
+  let jarmAuthorizationResponse;
+  if (responseIsSigned) {
+    const { header: jwsProtectedHeader, payload: jwsPayload } = decodeJwt({
+      jwt: decryptedRequestData,
+      headerSchema: z4.object({ ...zJwtHeader2.shape, kid: z4.string() })
+    });
+    const response = zJarmAuthorizationResponse.parse(jwsPayload);
+    const jwtSigner = jwtSignerFromJwt({ header: jwsProtectedHeader, payload: jwsPayload });
+    const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {
+      compact: decryptedRequestData,
+      header: jwsProtectedHeader,
+      payload: jwsPayload
+    });
+    if (!verificationResult.verified) {
+      throw new Oauth2Error3("Jarm Auth Response is not valid.");
+    }
+    jarmAuthorizationResponse = response;
+  } else {
+    const jsonRequestData = JSON.parse(decryptedRequestData);
+    jarmAuthorizationResponse = zJarmAuthorizationResponseEncryptedOnly.parse(jsonRequestData);
+  }
+  jarmAuthorizationResponseValidate({
+    expectedClientId,
+    authorizationResponse: jarmAuthorizationResponse
+  });
+  const type = requestDataIsEncrypted && responseIsSigned ? "SignedEncrypted" /* SignedEncrypted */ : requestDataIsEncrypted ? "Encrypted" /* Encrypted */ : "Signed" /* Signed */;
+  const issuer = jarmAuthorizationResponse.iss;
+  return { jarmAuthorizationResponse, type, issuer };
+}
+
 // src/authorization-request/create-authorization-request.ts
 import { Oauth2Error as Oauth2Error4 } from "@openid4vc/oauth2";
 import { URL, URLSearchParams, objectToQueryParams, parseWithErrorHandling as parseWithErrorHandling2 } from "@openid4vc/utils";
 
-// src/jar/create-jar-auth-request.ts
+// src/jar/create-jar-authorization-request.ts
 import {
   jwtHeaderFromJwtSigner
 } from "@openid4vc/oauth2";
-async function createJarAuthRequest(options) {
-  const { jwtSigner, jweEncryptor, authRequestParams, requestUri, callbacks } = options;
-  let requestObjectJwt;
+async function createJarAuthorizationRequest(options) {
+  const { jwtSigner, jweEncryptor, authorizationRequestPayload, requestUri, callbacks } = options;
+  let authorizationRequestJwt;
   let encryptionJwk;
   const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
     header: { ...jwtHeaderFromJwtSigner(jwtSigner), typ: "oauth-authz-req+jwt" },
-    payload: { ...options.additionalJwtPayload, ...authRequestParams }
+    payload: { ...options.additionalJwtPayload, ...authorizationRequestPayload }
   });
-  requestObjectJwt = jwt;
+  authorizationRequestJwt = jwt;
   if (jweEncryptor) {
-    const encryptionResult = await callbacks.encryptJwe(jweEncryptor, requestObjectJwt);
-    requestObjectJwt = encryptionResult.jwe;
+    const encryptionResult = await callbacks.encryptJwe(jweEncryptor, authorizationRequestJwt);
+    authorizationRequestJwt = encryptionResult.jwe;
     encryptionJwk = encryptionResult.encryptionJwk;
   }
-  const client_id = authRequestParams.client_id;
-  const requestParams = requestUri ? { client_id, request_uri: requestUri } : { client_id, request: requestObjectJwt };
-  return { requestParams, signerJwk, encryptionJwk, requestObjectJwt };
+  const client_id = authorizationRequestPayload.client_id;
+  const jarAuthorizationRequest = requestUri ? { client_id, request_uri: requestUri } : { client_id, request: authorizationRequestJwt };
+  return { jarAuthorizationRequest, signerJwk, encryptionJwk, authorizationRequestJwt };
 }
 
 // src/authorization-request/validate-authorization-request.ts
@@ -274,20 +288,20 @@ var validateOpenid4vpAuthorizationRequestPayload = (options) => {
 // src/authorization-request/validate-authorization-request-dc-api.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes2, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError2 } from "@openid4vc/oauth2";
 var validateOpenid4vpAuthorizationRequestDcApiPayload = (options) => {
-  const { params, isJarRequest, omitOriginValidation, origin } = options;
+  const { params, isJarRequest, disableOriginValidation, origin } = options;
   if (isJarRequest && !params.expected_origins) {
     throw new Oauth2ServerErrorResponseError2({
       error: Oauth2ErrorCodes2.InvalidRequest,
       error_description: `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combinaction with jar.`
     });
   }
-  if ([params.presentation_definition, params.dcql_query].filter(Boolean).length > 1) {
+  if ([params.presentation_definition, params.dcql_query].filter(Boolean).length !== 1) {
     throw new Oauth2ServerErrorResponseError2({
       error: Oauth2ErrorCodes2.InvalidRequest,
-      error_description: "Exactly one of the following parameters MUST be present in the Authorization Request: dcql_query, presentation_definition, presentation_definition_uri, or a scope value representing a Presentation Definition."
+      error_description: "Exactly one of the following parameters MUST be present in the Authorization Request: dcql_query or presentation_definition"
     });
   }
-  if (params.expected_origins && !omitOriginValidation) {
+  if (params.expected_origins && !disableOriginValidation) {
     if (!origin) {
       throw new Oauth2ServerErrorResponseError2({
         error: Oauth2ErrorCodes2.InvalidRequest,
@@ -371,7 +385,8 @@ var zOpenid4vpAuthorizationRequestDcApi = zOpenid4vpAuthorizationRequest.pick({
   presentation_definition: true,
   client_metadata: true,
   transaction_data: true,
-  dcql_query: true
+  dcql_query: true,
+  trust_chain: true
 }).extend({
   client_id: z8.optional(z8.string()),
   expected_origins: z8.array(z8.string()).optional(),
@@ -392,64 +407,67 @@ function isOpenid4vpAuthorizationRequestDcApi(request) {
 
 // src/authorization-request/create-authorization-request.ts
 async function createOpenid4vpAuthorizationRequest(options) {
-  const { jar, scheme = "openid4vp://", requestPayload, wallet, callbacks } = options;
+  const { jar, scheme = "openid4vp://", wallet, callbacks } = options;
   let additionalJwtPayload;
-  let authRequestParams;
-  if (isOpenid4vpAuthorizationRequestDcApi(requestPayload)) {
-    authRequestParams = parseWithErrorHandling2(
+  let authorizationRequestPayload;
+  if (isOpenid4vpAuthorizationRequestDcApi(options.authorizationRequestPayload)) {
+    authorizationRequestPayload = parseWithErrorHandling2(
       zOpenid4vpAuthorizationRequestDcApi,
-      requestPayload,
+      options.authorizationRequestPayload,
       "Invalid authorization request. Could not parse openid4vp dc_api authorization request."
     );
-    if (jar && !authRequestParams.expected_origins) {
+    if (jar && !authorizationRequestPayload.expected_origins) {
       throw new Oauth2Error4(
         `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combination with jar.`
       );
     }
     validateOpenid4vpAuthorizationRequestDcApiPayload({
-      params: authRequestParams,
+      params: authorizationRequestPayload,
       isJarRequest: Boolean(jar),
-      omitOriginValidation: true
+      disableOriginValidation: true
     });
   } else {
-    authRequestParams = parseWithErrorHandling2(
+    authorizationRequestPayload = parseWithErrorHandling2(
       zOpenid4vpAuthorizationRequest,
-      requestPayload,
+      options.authorizationRequestPayload,
       "Invalid authorization request. Could not parse openid4vp authorization request."
     );
-    validateOpenid4vpAuthorizationRequestPayload({ params: authRequestParams, walletVerificationOptions: wallet });
+    validateOpenid4vpAuthorizationRequestPayload({
+      params: authorizationRequestPayload,
+      walletVerificationOptions: wallet
+    });
   }
   if (jar) {
     if (!jar.additionalJwtPayload?.aud) {
       additionalJwtPayload = { ...jar.additionalJwtPayload, aud: jar.requestUri };
     }
-  }
-  if (jar) {
-    const jarResult = await createJarAuthRequest({
+    const jarResult = await createJarAuthorizationRequest({
       ...jar,
-      authRequestParams: requestPayload,
+      authorizationRequestPayload,
       additionalJwtPayload,
       callbacks
     });
     const url2 = new URL(scheme);
     url2.search = `?${new URLSearchParams([
       ...url2.searchParams.entries(),
-      ...objectToQueryParams(jarResult.requestParams).entries()
+      ...objectToQueryParams(jarResult.jarAuthorizationRequest).entries()
     ]).toString()}`;
     return {
-      authRequestObject: jarResult.requestParams,
-      authRequest: url2.toString(),
+      authorizationRequestPayload,
+      authorizationRequestObject: jarResult.jarAuthorizationRequest,
+      authorizationRequest: url2.toString(),
       jar: { ...jar, ...jarResult }
     };
   }
   const url = new URL(scheme);
   url.search = `?${new URLSearchParams([
     ...url.searchParams.entries(),
-    ...objectToQueryParams(requestPayload).entries()
+    ...objectToQueryParams(authorizationRequestPayload).entries()
   ]).toString()}`;
   return {
-    authRequestObject: requestPayload,
-    authRequest: url.toString(),
+    authorizationRequestPayload,
+    authorizationRequestObject: authorizationRequestPayload,
+    authorizationRequest: url.toString(),
     jar: void 0
   };
 }
@@ -460,11 +478,11 @@ import { URL as URL2 } from "@openid4vc/utils";
 import { parseWithErrorHandling as parseWithErrorHandling3 } from "@openid4vc/utils";
 import z10 from "zod";
 
-// src/jar/z-jar-auth-request.ts
+// src/jar/z-jar-authorization-request.ts
 import { Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError3 } from "@openid4vc/oauth2";
 import { zHttpsUrl as zHttpsUrl4 } from "@openid4vc/utils";
 import { z as z9 } from "zod";
-var zJarAuthRequest = z9.object({
+var zJarAuthorizationRequest = z9.object({
   request: z9.optional(z9.string()),
   request_uri: z9.optional(zHttpsUrl4),
   request_uri_method: z9.optional(z9.string()),
@@ -486,7 +504,7 @@ function validateJarRequestParams(options) {
   }
   return jarRequestParams;
 }
-function isJarAuthRequest(request) {
+function isJarAuthorizationRequest(request) {
   return "request" in request || "request_uri" in request;
 }
 
@@ -509,10 +527,10 @@ function parseOpenid4vpAuthorizationRequestPayload(options) {
     params = authorizationRequest;
   }
   const parsedRequest = parseWithErrorHandling3(
-    z10.union([zOpenid4vpAuthorizationRequest, zJarAuthRequest, zOpenid4vpAuthorizationRequestDcApi]),
+    z10.union([zOpenid4vpAuthorizationRequest, zJarAuthorizationRequest, zOpenid4vpAuthorizationRequestDcApi]),
     params
   );
-  if (isJarAuthRequest(parsedRequest)) {
+  if (isJarAuthorizationRequest(parsedRequest)) {
     return {
       type: "jar",
       provided,
@@ -536,16 +554,16 @@ function parseOpenid4vpAuthorizationRequestPayload(options) {
 // src/authorization-request/resolve-authorization-request.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes9, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError10 } from "@openid4vc/oauth2";
 import { parseWithErrorHandling as parseWithErrorHandling4 } from "@openid4vc/utils";
-import z15 from "zod";
+import z14 from "zod";
 
 // src/client-identifier-scheme/parse-client-identifier-scheme.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes4, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError5, getGlobalConfig } from "@openid4vc/oauth2";
+import { URL as URL3 } from "@openid4vc/utils";
 
 // src/version.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes3, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError4 } from "@openid4vc/oauth2";
 function parseAuthorizationRequestVersion(request) {
   const requirements = [];
-  const vp_formats = request.client_metadata?.vp_formats;
   if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "w3c_dc_api" || request.response_mode === "w3c_dc_api.jwt")) {
     requirements.push(["<", 23]);
     requirements.push([">=", 21]);
@@ -606,70 +624,56 @@ function parseAuthorizationRequestVersion(request) {
 
 // src/client-identifier-scheme/parse-client-identifier-scheme.ts
 function getClientId(options) {
-  if (isOpenid4vpAuthorizationRequestDcApi(options.request)) {
+  const version = parseAuthorizationRequestVersion(options.authorizationRequestPayload);
+  if (version < 22) {
+    return getLegacyClientId(options);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(options.authorizationRequestPayload)) {
     if (!options.origin) {
       throw new Oauth2ServerErrorResponseError5({
         error: Oauth2ErrorCodes4.InvalidRequest,
         error_description: "Failed to parse client identifier. 'origin' is required for requests with response_mode 'dc_api' and 'dc_api.jwt'"
       });
     }
-    if (!options.jar || !options.request.client_id) return `web-origin:${options.origin}`;
-    return options.request.client_id;
+    if (!options.jar || !options.authorizationRequestPayload.client_id) return `web-origin:${options.origin}`;
+    return options.authorizationRequestPayload.client_id;
   }
-  return options.request.client_id;
+  return options.authorizationRequestPayload.client_id;
 }
 function getLegacyClientId(options) {
-  const legacyClientIdScheme = options.request.client_id_scheme ?? "pre-registered";
-  let clientIdScheme;
-  if (legacyClientIdScheme === "entity_id") {
-    clientIdScheme = "https";
-  } else {
-    clientIdScheme = legacyClientIdScheme;
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(options.request)) {
+  const legacyClientIdScheme = options.authorizationRequestPayload.client_id_scheme ?? "pre-registered";
+  const clientIdScheme = legacyClientIdScheme === "entity_id" ? "https" : legacyClientIdScheme;
+  if (isOpenid4vpAuthorizationRequestDcApi(options.authorizationRequestPayload)) {
     if (!options.origin) {
       throw new Oauth2ServerErrorResponseError5({
         error: Oauth2ErrorCodes4.InvalidRequest,
         error_description: "Failed to parse client identifier. 'origin' is required for requests with response_mode 'dc_api' and 'dc_api.jwt'"
       });
     }
-    if (!options.jar || !options.request.client_id) return `web-origin:${options.origin}`;
-    return `${clientIdScheme}:${options.request.client_id}`;
+    if (!options.jar || !options.authorizationRequestPayload.client_id) return `web-origin:${options.origin}`;
+    return `${clientIdScheme}:${options.authorizationRequestPayload.client_id}`;
   }
   if (clientIdScheme === "https" || clientIdScheme === "did") {
-    return options.request.client_id;
+    return options.authorizationRequestPayload.client_id;
   }
   if (clientIdScheme === "pre-registered") {
-    return options.request.client_id;
+    return options.authorizationRequestPayload.client_id;
   }
-  return `${clientIdScheme}:${options.request.client_id}`;
+  return `${clientIdScheme}:${options.authorizationRequestPayload.client_id}`;
 }
 function parseClientIdentifier(options, parserConfig) {
-  const { request, jar } = options;
-  const version = parseAuthorizationRequestVersion(request);
-  if (version < 22) {
-    const legacyClientIdScheme = request.client_id_scheme ?? "pre-registered";
-    let clientIdSchem;
-    if (legacyClientIdScheme) {
-      if (legacyClientIdScheme === "entity_id") {
-        clientIdSchem = "https";
-      } else {
-        clientIdSchem = legacyClientIdScheme;
-      }
-    }
-  }
-  const isDcApiRequest = isOpenid4vpAuthorizationRequestDcApi(request);
-  const clientId = version < 22 ? getLegacyClientId(options) : getClientId(options);
+  const { authorizationRequestPayload, jar } = options;
   const parserConfigWithDefaults = {
     supportedSchemes: parserConfig?.supportedSchemes || Object.values(zClientIdScheme.options)
   };
+  const clientId = getClientId(options);
   const colonIndex = clientId.indexOf(":");
   if (colonIndex === -1) {
     return {
       scheme: "pre-registered",
       identifier: clientId,
       originalValue: clientId,
-      clientMetadata: request.client_metadata
+      clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
   const schemePart = clientId.substring(0, colonIndex);
@@ -682,12 +686,6 @@ function parseClientIdentifier(options, parserConfig) {
   }
   const scheme = schemePart;
   if (scheme === "https") {
-    if (isDcApiRequest) {
-      throw new Oauth2ServerErrorResponseError5({
-        error: Oauth2ErrorCodes4.InvalidRequest,
-        error_description: `The client identifier scheme 'https' is not supported when using the dc_api response mode.`
-      });
-    }
     if (!clientId.startsWith("https://") && !(getGlobalConfig().allowInsecureUrls && clientId.startsWith("http://"))) {
       throw new Oauth2ServerErrorResponseError5({
         error: Oauth2ErrorCodes4.InvalidRequest,
@@ -698,7 +696,7 @@ function parseClientIdentifier(options, parserConfig) {
       scheme,
       identifier: clientId,
       originalValue: clientId,
-      trustChain: request.trust_chain
+      trustChain: authorizationRequestPayload.trust_chain
     };
   }
   if (scheme === "redirect_uri") {
@@ -708,7 +706,7 @@ function parseClientIdentifier(options, parserConfig) {
         error_description: 'Using client identifier scheme "redirect_uri" the request MUST NOT be signed.'
       });
     }
-    if (isOpenid4vpAuthorizationRequestDcApi(request)) {
+    if (isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
       throw new Oauth2ServerErrorResponseError5({
         error: Oauth2ErrorCodes4.InvalidRequest,
         error_description: `The client identifier scheme 'redirect_uri' is not supported when using the dc_api response mode.`
@@ -718,7 +716,7 @@ function parseClientIdentifier(options, parserConfig) {
       scheme,
       identifier: identifierPart,
       originalValue: clientId,
-      redirectUri: request.redirect_uri ?? request.response_uri
+      redirectUri: authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri
     };
   }
   if (scheme === "did") {
@@ -784,9 +782,9 @@ function parseClientIdentifier(options, parserConfig) {
           error_description: `Invalid client identifier. One of the leaf certificates san dns names [${sanDnsNames.join(", ")}] must match the client identifier '${identifierPart}'. `
         });
       }
-      if (!isOpenid4vpAuthorizationRequestDcApi(request)) {
-        const uri = request.redirect_uri ?? request.response_uri;
-        if (!uri || getDomainFromUrl(uri) !== identifierPart) {
+      if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
+        const uri = authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri;
+        if (!uri || new URL3(uri).hostname !== identifierPart) {
           throw new Oauth2ServerErrorResponseError5({
             error: Oauth2ErrorCodes4.InvalidRequest,
             error_description: "Invalid client identifier. The fully qualified domain name of the redirect_uri value MUST match the Client Identifier without the prefix x509_san_dns."
@@ -811,8 +809,8 @@ function parseClientIdentifier(options, parserConfig) {
           error_description: `Invalid client identifier. One of the leaf certificates san uri names [${sanUriNames.join(", ")}] must match the client identifier '${identifierPart}'.`
         });
       }
-      if (!isOpenid4vpAuthorizationRequestDcApi(request)) {
-        const uri = request.redirect_uri || request.response_uri;
+      if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
+        const uri = authorizationRequestPayload.redirect_uri || authorizationRequestPayload.response_uri;
         if (!uri || uri !== identifierPart) {
           throw new Oauth2ServerErrorResponseError5({
             error: Oauth2ErrorCodes4.InvalidRequest,
@@ -833,7 +831,7 @@ function parseClientIdentifier(options, parserConfig) {
       scheme,
       identifier: identifierPart,
       originalValue: clientId,
-      clientMetadata: request.client_metadata
+      clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
   if (scheme === "verifier_attestation") {
@@ -850,39 +848,14 @@ function parseClientIdentifier(options, parserConfig) {
     originalValue: clientId
   };
 }
-function getDomainFromUrl(url) {
-  try {
-    const regex = /[#/?]/;
-    const domain = url.split("://")[1].split(regex)[0];
-    return domain;
-  } catch (error) {
-    throw new Oauth2ServerErrorResponseError5({
-      error: Oauth2ErrorCodes4.ServerError,
-      error_description: `Url '${url}' is not a valid URL`
-    });
-  }
-}
 
 // src/fetch-client-metadata.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes5, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError6 } from "@openid4vc/oauth2";
 import { ContentType, createZodFetcher } from "@openid4vc/utils";
-
-// src/models/z-wallet-metadata.ts
-import { z as z11 } from "zod";
-var zWalletMetadata = z11.object({
-  presentation_definition_uri_supported: z11.optional(z11.boolean()),
-  vp_formats_supported: zVpFormatsSupported,
-  client_id_schemes_supported: z11.optional(z11.array(zClientIdScheme)),
-  request_object_signing_alg_values_supported: z11.optional(z11.array(z11.string())),
-  authorization_encryption_alg_values_supported: z11.optional(z11.array(z11.string())),
-  authorization_encryption_enc_values_supported: z11.optional(z11.array(z11.string()))
-});
-
-// src/fetch-client-metadata.ts
 async function fetchClientMetadata(options) {
   const { fetch, clientMetadataUri } = options;
   const fetcher = createZodFetcher(fetch);
-  const { result, response } = await fetcher(zWalletMetadata, ContentType.Json, clientMetadataUri, {
+  const { result, response } = await fetcher(zClientMetadata, ContentType.Json, clientMetadataUri, {
     method: "GET",
     headers: {
       Accept: ContentType.Json
@@ -917,7 +890,7 @@ import {
 // src/jar/jar-request-object/fetch-jar-request-object.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes6, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError7 } from "@openid4vc/oauth2";
 import { ContentType as ContentType2, createZodFetcher as createZodFetcher2, objectToQueryParams as objectToQueryParams2 } from "@openid4vc/utils";
-import { z as z12 } from "zod";
+import { z as z11 } from "zod";
 async function fetchJarRequestObject(options) {
   const { requestUri, clientIdentifierScheme, method, wallet, fetch } = options;
   const fetcher = createZodFetcher2(fetch);
@@ -926,10 +899,10 @@ async function fetchJarRequestObject(options) {
     const { request_object_signing_alg_values_supported, ...rest } = requestBody.wallet_metadata;
     requestBody = { ...requestBody, wallet_metadata: { ...rest } };
   }
-  const { result, response } = await fetcher(z12.string(), ContentType2.OAuthRequestObjectJwt, requestUri, {
+  const { result, response } = await fetcher(z11.string(), ContentType2.OAuthAuthorizationRequestJwt, requestUri, {
     method,
     headers: {
-      Accept: `${ContentType2.OAuthRequestObjectJwt}, ${ContentType2.Jwt};q=0.9`,
+      Accept: `${ContentType2.OAuthAuthorizationRequestJwt}, ${ContentType2.Jwt};q=0.9`,
       "Content-Type": ContentType2.XWwwFormUrlencoded
     },
     body: method === "POST" ? objectToQueryParams2(wallet.metadata ?? {}) : void 0
@@ -951,10 +924,10 @@ async function fetchJarRequestObject(options) {
 
 // src/jar/jar-request-object/z-jar-request-object.ts
 import { zJwtPayload as zJwtPayload2 } from "@openid4vc/oauth2";
-import { z as z13 } from "zod";
-var zJarRequestObjectPayload = z13.object({
+import { z as z12 } from "zod";
+var zJarRequestObjectPayload = z12.object({
   ...zJwtPayload2.shape,
-  client_id: z13.string()
+  client_id: z12.string()
 }).passthrough();
 
 // src/jar/handle-jar-request/verify-jar-request.ts
@@ -985,17 +958,17 @@ async function verifyJarRequest(options) {
       error_description: "Jar Request Object is not a valid JWS."
     });
   }
-  const { authRequestParams, signer } = await verifyJarRequestObject({
+  const { authorizationRequestParams, signer } = await verifyJarRequestObject({
     decryptedRequestObject,
     callbacks
   });
-  if (!authRequestParams.client_id) {
+  if (!authorizationRequestParams.client_id) {
     throw new Oauth2ServerErrorResponseError8({
       error: Oauth2ErrorCodes7.InvalidRequestObject,
       error_description: 'Jar Request Object is missing the required "client_id" field.'
     });
   }
-  if (jarRequestParams.client_id !== authRequestParams.client_id) {
+  if (jarRequestParams.client_id !== authorizationRequestParams.client_id) {
     throw new Oauth2ServerErrorResponseError8({
       error: Oauth2ErrorCodes7.InvalidRequest,
       error_description: "client_id does not match the request object client_id."
@@ -1003,7 +976,7 @@ async function verifyJarRequest(options) {
   }
   return {
     sendBy,
-    authRequestParams,
+    authorizationRequestParams,
     signer,
     decryptionJwk
   };
@@ -1044,7 +1017,7 @@ async function verifyJarRequestObject(options) {
       error_description: `Invalid Jar Request Object typ header. Expected "oauth-authz-req+jwt", received "${jwt.header.typ}".`
     });
   }
-  return { authRequestParams: jwt.payload, signer };
+  return { authorizationRequestParams: jwt.payload, signer };
 }
 
 // src/transaction-data/parse-transaction-data.ts
@@ -1052,13 +1025,13 @@ import { Oauth2ErrorCodes as Oauth2ErrorCodes8, Oauth2ServerErrorResponseError a
 import { decodeBase64, encodeToUtf8String, parseIfJson } from "@openid4vc/utils";
 
 // src/transaction-data/z-transaction-data.ts
-import { z as z14 } from "zod";
-var zTransactionEntry = z14.object({
-  type: z14.string(),
-  credential_ids: z14.array(z14.string()).nonempty(),
-  transaction_data_hashes_alg: z14.array(z14.string()).optional()
+import { z as z13 } from "zod";
+var zTransactionEntry = z13.object({
+  type: z13.string(),
+  credential_ids: z13.array(z13.string()).nonempty(),
+  transaction_data_hashes_alg: z13.array(z13.string()).optional()
 });
-var zTransactionData = z14.array(zTransactionEntry);
+var zTransactionData = z13.array(zTransactionEntry);
 
 // src/transaction-data/parse-transaction-data.ts
 function parseTransactionData(options) {
@@ -1080,87 +1053,93 @@ function parseTransactionData(options) {
 
 // src/authorization-request/resolve-authorization-request.ts
 async function resolveOpenid4vpAuthorizationRequest(options) {
-  const { requestPayload, wallet, callbacks, origin, omitOriginValidation } = options;
-  let authRequestPayload;
+  const { wallet, callbacks, origin, disableOriginValidation } = options;
+  let authorizationRequestPayload;
   const parsed = parseWithErrorHandling4(
-    z15.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest, zJarAuthRequest]),
-    requestPayload,
+    z14.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest, zJarAuthorizationRequest]),
+    options.authorizationRequestPayload,
     "Invalid authorization request. Could not parse openid4vp authorization request as openid4vp or jar auth request."
   );
   let jar;
-  if (isJarAuthRequest(parsed)) {
+  if (isJarAuthorizationRequest(parsed)) {
     jar = await verifyJarRequest({ jarRequestParams: parsed, callbacks, wallet });
-    const parsedJarAuthRequestPayload = parseWithErrorHandling4(
-      z15.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest]),
-      jar.authRequestParams,
+    const parsedJarAuthorizationRequestPayload = parseWithErrorHandling4(
+      z14.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest]),
+      jar.authorizationRequestParams,
       "Invalid authorization request. Could not parse jar request payload as openid4vp auth request."
     );
-    authRequestPayload = validateOpenId4vpPayload({
-      requestPayload: parsedJarAuthRequestPayload,
+    authorizationRequestPayload = validateOpenId4vpAuthorizationRequestPayload({
+      authorizationRequestPayload: parsedJarAuthorizationRequestPayload,
       wallet,
       jar: true,
       origin,
-      omitOriginValidation
+      disableOriginValidation
     });
   } else {
-    authRequestPayload = validateOpenId4vpPayload({
-      requestPayload: parsed,
+    authorizationRequestPayload = validateOpenId4vpAuthorizationRequestPayload({
+      authorizationRequestPayload: parsed,
       wallet,
       jar: false,
       origin,
-      omitOriginValidation
+      disableOriginValidation
     });
   }
-  let clientMetadata;
-  if (!isOpenid4vpAuthorizationRequestDcApi(authRequestPayload) && authRequestPayload.client_metadata_uri) {
-    clientMetadata = await fetchClientMetadata({ clientMetadataUri: authRequestPayload.client_metadata_uri });
+  let clientMetadata = authorizationRequestPayload.client_metadata;
+  if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload) && !clientMetadata && authorizationRequestPayload.client_metadata_uri) {
+    clientMetadata = await fetchClientMetadata({ clientMetadataUri: authorizationRequestPayload.client_metadata_uri });
   }
   const clientMeta = parseClientIdentifier({
-    request: { ...authRequestPayload, client_metadata: clientMetadata ?? authRequestPayload.client_metadata },
+    authorizationRequestPayload: {
+      ...authorizationRequestPayload,
+      client_metadata: clientMetadata
+    },
     jar,
     callbacks,
     origin
   });
   let pex;
   let dcql;
-  if (authRequestPayload.presentation_definition || authRequestPayload.presentation_definition_uri) {
-    if (authRequestPayload.presentation_definition_uri) {
+  if (authorizationRequestPayload.presentation_definition || authorizationRequestPayload.presentation_definition_uri) {
+    if (authorizationRequestPayload.presentation_definition_uri) {
       throw new Oauth2ServerErrorResponseError10({
         error: Oauth2ErrorCodes9.InvalidRequest,
         error_description: "Cannot fetch presentation definition from URI. Not supported."
       });
     }
     pex = {
-      presentation_definition: authRequestPayload.presentation_definition,
-      presentation_definition_uri: authRequestPayload.presentation_definition_uri
+      presentation_definition: authorizationRequestPayload.presentation_definition,
+      presentation_definition_uri: authorizationRequestPayload.presentation_definition_uri
     };
   }
-  if (authRequestPayload.dcql_query) {
-    dcql = { query: authRequestPayload.dcql_query };
+  if (authorizationRequestPayload.dcql_query) {
+    dcql = { query: authorizationRequestPayload.dcql_query };
   }
-  const transactionData = authRequestPayload.transaction_data ? parseTransactionData({ transactionData: authRequestPayload.transaction_data }) : void 0;
+  const transactionData = authorizationRequestPayload.transaction_data ? parseTransactionData({ transactionData: authorizationRequestPayload.transaction_data }) : void 0;
   return {
     transactionData,
-    requestPayload: authRequestPayload,
+    authorizationRequestPayload,
     jar,
-    client: { ...clientMeta },
+    client: clientMeta,
     pex,
     dcql
   };
 }
-function validateOpenId4vpPayload(options) {
-  const { requestPayload, wallet, jar, origin, omitOriginValidation } = options;
-  if (isOpenid4vpAuthorizationRequestDcApi(requestPayload)) {
+function validateOpenId4vpAuthorizationRequestPayload(options) {
+  const { authorizationRequestPayload, wallet, jar, origin, disableOriginValidation } = options;
+  if (isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
     validateOpenid4vpAuthorizationRequestDcApiPayload({
-      params: requestPayload,
+      params: authorizationRequestPayload,
       isJarRequest: jar,
-      omitOriginValidation,
+      disableOriginValidation,
       origin
     });
-    return requestPayload;
+    return authorizationRequestPayload;
   }
-  validateOpenid4vpAuthorizationRequestPayload({ params: requestPayload, walletVerificationOptions: wallet });
-  return requestPayload;
+  validateOpenid4vpAuthorizationRequestPayload({
+    params: authorizationRequestPayload,
+    walletVerificationOptions: wallet
+  });
+  return authorizationRequestPayload;
 }
 
 // src/authorization-response/create-authorization-response.ts
@@ -1176,49 +1155,37 @@ function addSecondsToDate(date, seconds) {
   return new Date(date.getTime() + seconds * 1e3);
 }
 
-// src/jarm/jarm-auth-response-create.ts
+// src/jarm/jarm-authorization-response-create.ts
 import {
   Oauth2Error as Oauth2Error5,
   jwtHeaderFromJwtSigner as jwtHeaderFromJwtSigner2
 } from "@openid4vc/oauth2";
-async function createJarmAuthResponse(options) {
-  const { jarmAuthResponse, jweEncryptor, jwtSigner, callbacks } = options;
+async function createJarmAuthorizationResponse(options) {
+  const { jarmAuthorizationResponse, jweEncryptor, jwtSigner, callbacks } = options;
   if (!jwtSigner && jweEncryptor) {
-    const { jwe } = await callbacks.encryptJwe(jweEncryptor, JSON.stringify(jarmAuthResponse));
-    return { jarmAuthResponseJwt: jwe };
+    const { jwe } = await callbacks.encryptJwe(jweEncryptor, JSON.stringify(jarmAuthorizationResponse));
+    return { jarmAuthorizationResponseJwt: jwe };
   }
   if (jwtSigner && !jweEncryptor) {
     const signed2 = await callbacks.signJwt(jwtSigner, {
       header: jwtHeaderFromJwtSigner2(jwtSigner),
-      payload: jarmAuthResponse
+      payload: jarmAuthorizationResponse
     });
-    return { jarmAuthResponseJwt: signed2.jwt };
+    return { jarmAuthorizationResponseJwt: signed2.jwt };
   }
   if (!jwtSigner || !jweEncryptor) {
     throw new Oauth2Error5("JWT signer and/or encryptor are required to create a JARM auth response.");
   }
   const signed = await callbacks.signJwt(jwtSigner, {
     header: jwtHeaderFromJwtSigner2(jwtSigner),
-    payload: jarmAuthResponse
+    payload: jarmAuthorizationResponse
   });
   const encrypted = await callbacks.encryptJwe(jweEncryptor, signed.jwt);
-  return { jarmAuthResponseJwt: encrypted.jwe };
-}
-
-// src/jarm/jarm-extract-jwks.ts
-function extractJwksFromClientMetadata(clientMetadata) {
-  const parsed = zJarmClientMetadataParsed.parse(clientMetadata);
-  const encryptionAlg = parsed.client_metadata.authorization_encrypted_response_enc;
-  const signingAlg = parsed.client_metadata.authorization_signed_response_alg;
-  const encJwk = clientMetadata.jwks.keys.find((key) => key.use === "enc" && key.alg === encryptionAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "enc") ?? // fallback, take first key. HAIP does not specify requirement on enc
-  clientMetadata.jwks.keys?.[0];
-  const sigJwk = clientMetadata.jwks.keys.find((key) => key.use === "sig" && key.alg === signingAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "sig") ?? // falback, take first key
-  clientMetadata.jwks.keys?.[0];
-  return { encJwk, sigJwk };
+  return { jarmAuthorizationResponseJwt: encrypted.jwe };
 }
 
 // src/jarm/jarm-response-mode.ts
-import { z as z16 } from "zod";
+import { z as z15 } from "zod";
 var jarmResponseMode = [
   "jwt",
   "query.jwt",
@@ -1227,7 +1194,7 @@ var jarmResponseMode = [
   "direct_post.jwt",
   "dc_api.jwt"
 ];
-var zJarmResponseMode = z16.enum(jarmResponseMode);
+var zJarmResponseMode = z15.enum(jarmResponseMode);
 var isJarmResponseMode = (responseMode) => {
   return jarmResponseMode.includes(responseMode);
 };
@@ -1273,37 +1240,37 @@ function jarmAssertMetadataSupported(options) {
 
 // src/authorization-response/create-authorization-response.ts
 async function createOpenid4vpAuthorizationResponse(options) {
-  const { requestPayload, jarm, callbacks } = options;
-  const responsePayload = {
-    ...options.responsePayload,
-    ..."state" in requestPayload && { state: requestPayload.state }
+  const { authorizationRequestPayload, jarm, callbacks } = options;
+  const authorizationResponsePayload = {
+    ...options.authorizationResponsePayload,
+    ..."state" in authorizationRequestPayload && { state: authorizationRequestPayload.state }
   };
-  if (requestPayload.response_mode && isJarmResponseMode(requestPayload.response_mode) && !jarm) {
+  if (authorizationRequestPayload.response_mode && isJarmResponseMode(authorizationRequestPayload.response_mode) && !jarm) {
     throw new Oauth2Error7(
-      `Missing jarm options for creating Jarm response with response mode '${requestPayload.response_mode}'`
+      `Missing jarm options for creating Jarm response with response mode '${authorizationRequestPayload.response_mode}'`
     );
   }
   if (!jarm) {
     return {
-      responsePayload
+      authorizationResponsePayload
     };
   }
-  if (!requestPayload.client_metadata) {
+  if (!authorizationRequestPayload.client_metadata) {
     throw new Oauth2Error7("Missing client metadata in the request params to assert Jarm metadata support.");
   }
-  if (!requestPayload.client_metadata.jwks) {
+  if (!authorizationRequestPayload.client_metadata.jwks) {
     throw new Oauth2ServerErrorResponseError11({
       error: Oauth2ErrorCodes10.InvalidRequest,
       error_description: "Missing JWKS in client metadata. Cannot extract encryption JWK."
     });
   }
   const supportedJarmMetadata = jarmAssertMetadataSupported({
-    clientMetadata: requestPayload.client_metadata,
+    clientMetadata: authorizationRequestPayload.client_metadata,
     serverMetadata: jarm.serverMetadata
   });
   const clientMetaJwks = extractJwksFromClientMetadata({
-    ...requestPayload.client_metadata,
-    jwks: requestPayload.client_metadata.jwks
+    ...authorizationRequestPayload.client_metadata,
+    jwks: authorizationRequestPayload.client_metadata.jwks
   });
   if (!clientMetaJwks?.encJwk) {
     throw new Oauth2ServerErrorResponseError11({
@@ -1333,17 +1300,17 @@ async function createOpenid4vpAuthorizationResponse(options) {
     };
   }
   const jarmResponsePayload = {
-    ...responsePayload,
+    ...authorizationResponsePayload,
     ...additionalJwtPayload
   };
-  const result = await createJarmAuthResponse({
-    jarmAuthResponse: jarmResponsePayload,
+  const result = await createJarmAuthorizationResponse({
+    jarmAuthorizationResponse: jarmResponsePayload,
     jwtSigner: jarm?.jwtSigner,
     jweEncryptor: jarm?.encryption && (supportedJarmMetadata.type === "encrypt" || supportedJarmMetadata.type === "sign_encrypt") ? {
       method: "jwk",
       publicJwk: clientMetaJwks.encJwk,
       apu: jarm.encryption?.nonce,
-      apv: requestPayload.nonce,
+      apv: authorizationRequestPayload.nonce,
       alg: supportedJarmMetadata.client_metadata.authorization_encrypted_response_alg,
       enc: supportedJarmMetadata.client_metadata.authorization_encrypted_response_enc
     } : void 0,
@@ -1353,8 +1320,8 @@ async function createOpenid4vpAuthorizationResponse(options) {
     }
   });
   return {
-    responsePayload: jarmResponsePayload,
-    jarm: { responseJwt: result.jarmAuthResponseJwt }
+    authorizationResponsePayload: jarmResponsePayload,
+    jarm: { responseJwt: result.jarmAuthorizationResponseJwt }
   };
 }
 
@@ -1363,17 +1330,17 @@ import { Oauth2Error as Oauth2Error9 } from "@openid4vc/oauth2";
 import { ContentType as ContentType4, defaultFetcher as defaultFetcher2 } from "@openid4vc/utils";
 import { objectToQueryParams as objectToQueryParams3 } from "@openid4vc/utils";
 
-// src/jarm/jarm-auth-response-send.ts
+// src/jarm/jarm-authorizatino-response-send.ts
 import { Oauth2Error as Oauth2Error8 } from "@openid4vc/oauth2";
-import { ContentType as ContentType3, URL as URL3, defaultFetcher } from "@openid4vc/utils";
-var jarmAuthResponseSend = (options) => {
-  const { authRequest, jarmAuthResponseJwt, callbacks } = options;
-  const responseEndpoint = authRequest.response_uri ?? authRequest.redirect_uri;
+import { ContentType as ContentType3, URL as URL4, defaultFetcher } from "@openid4vc/utils";
+var jarmAuthorizationResponseSend = (options) => {
+  const { authorizationRequestPayload, jarmAuthorizationResponseJwt, callbacks } = options;
+  const responseEndpoint = authorizationRequestPayload.response_uri ?? authorizationRequestPayload.redirect_uri;
   if (!responseEndpoint) {
     throw new Oauth2Error8(`Either 'response_uri' or 'redirect_uri' MUST  be present in the authorization request`);
   }
-  const responseEndpointUrl = new URL3(responseEndpoint);
-  return handleDirectPostJwt(responseEndpointUrl, jarmAuthResponseJwt, callbacks);
+  const responseEndpointUrl = new URL4(responseEndpoint);
+  return handleDirectPostJwt(responseEndpointUrl, jarmAuthorizationResponseJwt, callbacks);
 };
 async function handleDirectPostJwt(responseEndpoint, responseJwt, callbacks) {
   const response = await (callbacks.fetch ?? defaultFetcher)(responseEndpoint, {
@@ -1389,12 +1356,12 @@ async function handleDirectPostJwt(responseEndpoint, responseJwt, callbacks) {
 
 // src/authorization-response/submit-authorization-response.ts
 async function submitOpenid4vpAuthorizationResponse(options) {
-  const { requestPayload, responsePayload, jarm, callbacks } = options;
-  const url = requestPayload.response_uri;
+  const { authorizationRequestPayload, authorizationResponsePayload, jarm, callbacks } = options;
+  const url = authorizationRequestPayload.response_uri;
   if (jarm) {
-    return jarmAuthResponseSend({
-      authRequest: requestPayload,
-      jarmAuthResponseJwt: jarm.responseJwt,
+    return jarmAuthorizationResponseSend({
+      authorizationRequestPayload,
+      jarmAuthorizationResponseJwt: jarm.responseJwt,
       callbacks
     });
   }
@@ -1404,7 +1371,7 @@ async function submitOpenid4vpAuthorizationResponse(options) {
     );
   }
   const fetch = callbacks.fetch ?? defaultFetcher2;
-  const encodedResponse = objectToQueryParams3(responsePayload);
+  const encodedResponse = objectToQueryParams3(authorizationResponsePayload);
   const submissionResponse = await fetch(url, {
     method: "POST",
     body: encodedResponse,
@@ -1425,17 +1392,17 @@ import { Oauth2Error as Oauth2Error10 } from "@openid4vc/oauth2";
 import { parseIfJson as parseIfJson2, parseWithErrorHandling as parseWithErrorHandling5 } from "@openid4vc/utils";
 
 // src/vp-token/z-vp-token.ts
-import { z as z17 } from "zod";
-var zVpTokenPexEntry = z17.union([z17.string(), z17.record(z17.any())], {
+import { z as z16 } from "zod";
+var zVpTokenPexEntry = z16.union([z16.string(), z16.record(z16.any())], {
   message: "pex vp_token entry must be a string or object"
 });
-var zVpTokenPex = z17.union(
-  [zVpTokenPexEntry, z17.array(zVpTokenPexEntry).nonempty("Must have at least entry in vp_token array")],
+var zVpTokenPex = z16.union(
+  [zVpTokenPexEntry, z16.array(zVpTokenPexEntry).nonempty("Must have at least entry in vp_token array")],
   {
     message: "pex vp_token must be a string, object or array of strings and objects"
   }
 );
-var zVpTokenDcql = z17.record(z17.union([z17.string(), z17.record(z17.any())]), {
+var zVpTokenDcql = z16.record(z16.union([z16.string(), z16.record(z16.any())]), {
   message: "dcql vp_token must be an object with keys referencing the dcql credential query id, and values the encoded (string or object) presentation"
 });
 var zVpToken = zVpTokenDcql.or(zVpTokenPex);
@@ -1459,39 +1426,39 @@ function parseDcqlVpToken(vpToken) {
 
 // src/authorization-response/validate-authorization-response.ts
 function validateOpenid4vpAuthorizationResponsePayload(options) {
-  const { requestPayload, responsePayload } = options;
-  if ("state" in requestPayload && requestPayload.state !== responsePayload.state) {
+  const { authorizationRequestPayload, authorizationResponsePayload } = options;
+  if ("state" in authorizationRequestPayload && authorizationRequestPayload.state !== authorizationResponsePayload.state) {
     throw new Oauth2Error10("OpenId4Vp Authorization Response state mismatch.");
   }
-  if (responsePayload.id_token) {
+  if (authorizationResponsePayload.id_token) {
     throw new Oauth2Error10("OpenId4Vp Authorization Response id_token is not supported.");
   }
-  if (responsePayload.presentation_submission) {
-    if (!requestPayload.presentation_definition) {
+  if (authorizationResponsePayload.presentation_submission) {
+    if (!authorizationRequestPayload.presentation_definition) {
       throw new Oauth2Error10("OpenId4Vp Authorization Request is missing the required presentation_definition.");
     }
     return {
       type: "pex",
-      pex: "scope" in requestPayload && requestPayload.scope ? {
-        scope: requestPayload.scope,
-        presentationSubmission: responsePayload.presentation_submission,
-        presentations: parsePexVpToken(responsePayload.vp_token)
+      pex: "scope" in authorizationRequestPayload && authorizationRequestPayload.scope ? {
+        scope: authorizationRequestPayload.scope,
+        presentationSubmission: authorizationResponsePayload.presentation_submission,
+        presentations: parsePexVpToken(authorizationResponsePayload.vp_token)
       } : {
-        presentationDefinition: requestPayload.presentation_definition,
-        presentationSubmission: responsePayload.presentation_submission,
-        presentations: parsePexVpToken(responsePayload.vp_token)
+        presentationDefinition: authorizationRequestPayload.presentation_definition,
+        presentationSubmission: authorizationResponsePayload.presentation_submission,
+        presentations: parsePexVpToken(authorizationResponsePayload.vp_token)
       }
     };
   }
-  if (requestPayload.dcql_query) {
-    const presentations = parseDcqlVpToken(responsePayload.vp_token);
+  if (authorizationRequestPayload.dcql_query) {
+    const presentations = parseDcqlVpToken(authorizationResponsePayload.vp_token);
     return {
       type: "dcql",
-      dcql: "scope" in requestPayload && requestPayload.scope ? {
-        scope: requestPayload.scope,
+      dcql: "scope" in authorizationRequestPayload && authorizationRequestPayload.scope ? {
+        scope: authorizationRequestPayload.scope,
         presentations
       } : {
-        query: requestPayload.dcql_query,
+        query: authorizationRequestPayload.dcql_query,
         presentations
       }
     };
@@ -1502,29 +1469,29 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
 }
 
 // src/authorization-response/parse-authorization-response.ts
-import { Oauth2Error as Oauth2Error12, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError12 } from "@openid4vc/oauth2";
+import { Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError12 } from "@openid4vc/oauth2";
 
 // src/authorization-response/parse-authorization-response-payload.ts
 import { parseWithErrorHandling as parseWithErrorHandling6 } from "@openid4vc/utils";
 
 // src/authorization-response/z-authorization-response.ts
-import { z as z19 } from "zod";
+import { z as z18 } from "zod";
 
 // src/models/z-pex.ts
-import { z as z18 } from "zod";
-var zPexPresentationDefinition = z18.record(z18.any());
-var zPexPresentationSubmission = z18.record(z18.any());
+import { z as z17 } from "zod";
+var zPexPresentationDefinition = z17.record(z17.any());
+var zPexPresentationSubmission = z17.record(z17.any());
 
 // src/authorization-response/z-authorization-response.ts
-var zOpenid4vpAuthorizationResponse = z19.object({
-  state: z19.string().optional(),
-  id_token: z19.string().optional(),
+var zOpenid4vpAuthorizationResponse = z18.object({
+  state: z18.string().optional(),
+  id_token: z18.string().optional(),
   vp_token: zVpToken,
   presentation_submission: zPexPresentationSubmission.optional(),
-  refresh_token: z19.string().optional(),
-  token_type: z19.string().optional(),
-  access_token: z19.string().optional(),
-  expires_in: z19.number().optional()
+  refresh_token: z18.string().optional(),
+  token_type: z18.string().optional(),
+  access_token: z18.string().optional(),
+  expires_in: z18.number().optional()
 }).passthrough();
 
 // src/authorization-response/parse-authorization-response-payload.ts
@@ -1537,73 +1504,62 @@ function parseOpenid4VpAuthorizationResponsePayload(payload) {
 }
 
 // src/authorization-response/parse-jarm-authorization-response.ts
-import { Oauth2Error as Oauth2Error11, decodeJwtHeader as decodeJwtHeader2, zCompactJwe as zCompactJwe3, zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
-import { decodeBase64 as decodeBase642, encodeToUtf8String as encodeToUtf8String2, parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
-import z20 from "zod";
+import { Oauth2Error as Oauth2Error11, decodeJwtHeader, zCompactJwe as zCompactJwe3, zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
+import { parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
+import z19 from "zod";
 async function parseJarmAuthorizationResponse(options) {
-  const { jarmResponseJwt, callbacks } = options;
+  const { jarmResponseJwt, callbacks, authorizationRequestPayload, expectedClientId } = options;
   const jarmAuthorizationResponseJwt = parseWithErrorHandling7(
-    z20.union([zCompactJwt3, zCompactJwe3]),
+    z19.union([zCompactJwt3, zCompactJwe3]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
   );
-  const verifiedJarmResponse = await verifyJarmAuthorizationResponse({ jarmAuthorizationResponseJwt, callbacks });
-  const { header: jarmHeader } = decodeJwtHeader2({
+  const verifiedJarmResponse = await verifyJarmAuthorizationResponse({
+    jarmAuthorizationResponseJwt,
+    callbacks,
+    expectedClientId,
+    authorizationRequestPayload
+  });
+  const { header: jarmHeader } = decodeJwtHeader({
     jwt: jarmAuthorizationResponseJwt,
     headerSchema: zJarmHeader
   });
-  const parsedAuthorizationRequest = parseOpenid4vpAuthorizationRequestPayload({
-    authorizationRequest: verifiedJarmResponse.authorizationRequest
-  });
-  if (parsedAuthorizationRequest.type !== "openid4vp" && parsedAuthorizationRequest.type !== "openid4vp_dc_api") {
-    throw new Oauth2Error11("Invalid authorization request. Could not parse openid4vp authorization request.");
-  }
-  const authorizationResponsePayload = parseOpenid4VpAuthorizationResponsePayload(verifiedJarmResponse.jarmAuthResponse);
+  const authorizationResponsePayload = parseOpenid4VpAuthorizationResponsePayload(
+    verifiedJarmResponse.jarmAuthorizationResponse
+  );
   const validateOpenId4vpResponse = validateOpenid4vpAuthorizationResponsePayload({
-    requestPayload: parsedAuthorizationRequest.params,
-    responsePayload: authorizationResponsePayload
+    authorizationRequestPayload,
+    authorizationResponsePayload
   });
-  const authorizationRequestPayload = parsedAuthorizationRequest.params;
   if (!authorizationRequestPayload.response_mode || !isJarmResponseMode(authorizationRequestPayload.response_mode)) {
     throw new Oauth2Error11(
       `Invalid response mode for jarm response. Response mode: '${authorizationRequestPayload.response_mode ?? "fragment"}'`
     );
   }
-  let mdocGeneratedNonce = void 0;
-  if (jarmHeader?.apu) {
-    mdocGeneratedNonce = encodeToUtf8String2(decodeBase642(jarmHeader.apu));
-  }
-  if (jarmHeader?.apv) {
-    const jarmRequestNonce = encodeToUtf8String2(decodeBase642(jarmHeader.apv));
-    if (jarmRequestNonce !== authorizationRequestPayload.nonce) {
-      throw new Oauth2Error11("The nonce in the jarm header does not match the nonce in the request.");
-    }
-  }
   return {
     ...validateOpenId4vpResponse,
-    jarm: { ...verifiedJarmResponse, jarmHeader, mdocGeneratedNonce },
+    jarm: { ...verifiedJarmResponse, jarmHeader },
     expectedNonce: authorizationRequestPayload.nonce,
-    authorizationResponsePayload,
-    authorizationRequestPayload
+    authorizationResponsePayload
   };
 }
 
 // src/authorization-response/parse-authorization-response.ts
 async function parseOpenid4vpAuthorizationResponse(options) {
-  const { responsePayload, callbacks } = options;
-  if (responsePayload.response) {
-    return parseJarmAuthorizationResponse({ jarmResponseJwt: responsePayload.response, callbacks });
-  }
-  const authorizationResponsePayload = parseOpenid4VpAuthorizationResponsePayload(responsePayload);
-  const { authorizationRequest } = await callbacks.getOpenid4vpAuthorizationRequest(authorizationResponsePayload);
-  const parsedAuthRequest = parseOpenid4vpAuthorizationRequestPayload({ authorizationRequest });
-  if (parsedAuthRequest.type !== "openid4vp" && parsedAuthRequest.type !== "openid4vp_dc_api") {
-    throw new Oauth2Error12("Invalid authorization request. Could not parse openid4vp authorization request.");
+  const { authorizationResponse, callbacks, authorizationRequestPayload, origin } = options;
+  const expectedClientId = getClientId({ authorizationRequestPayload, origin });
+  if (authorizationResponse.response) {
+    return parseJarmAuthorizationResponse({
+      jarmResponseJwt: authorizationResponse.response,
+      callbacks,
+      authorizationRequestPayload,
+      expectedClientId
+    });
   }
-  const authorizationRequestPayload = parsedAuthRequest.params;
-  const validateOpenId4vpResponse = validateOpenid4vpAuthorizationResponsePayload({
-    requestPayload: authorizationRequestPayload,
-    responsePayload: authorizationResponsePayload
+  const authorizationResponsePayload = parseOpenid4VpAuthorizationResponsePayload(authorizationResponse);
+  const validatedOpenId4vpResponse = validateOpenid4vpAuthorizationResponsePayload({
+    authorizationRequestPayload,
+    authorizationResponsePayload
   });
   if (authorizationRequestPayload.response_mode && isJarmResponseMode(authorizationRequestPayload.response_mode)) {
     throw new Oauth2ServerErrorResponseError12(
@@ -1617,10 +1573,9 @@ async function parseOpenid4vpAuthorizationResponse(options) {
     );
   }
   return {
-    ...validateOpenId4vpResponse,
+    ...validatedOpenId4vpResponse,
     expectedNonce: authorizationRequestPayload.nonce,
     authorizationResponsePayload,
-    authorizationRequestPayload,
     jarm: void 0
   };
 }
@@ -1745,12 +1700,23 @@ var Openid4vpVerifier = class {
 };
 
 // src/models/z-credential-formats.ts
-import { z as z21 } from "zod";
-var zCredentialFormat = z21.enum(["jwt_vc_json", "ldp_vc", "ac_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
+import { z as z20 } from "zod";
+var zCredentialFormat = z20.enum(["jwt_vc_json", "ldp_vc", "ac_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
 
 // src/models/z-proof-formats.ts
+import { z as z21 } from "zod";
+var zProofFormat = z21.enum(["jwt_vp_json", "ldc_vp", "ac_vp", "dc+sd-jwt", "vc+sd-jwt", "mso_mdoc"]);
+
+// src/models/z-wallet-metadata.ts
 import { z as z22 } from "zod";
-var zProofFormat = z22.enum(["jwt_vp_json", "ldc_vp", "ac_vp", "dc+sd-jwt", "vc+sd-jwt", "mso_mdoc"]);
+var zWalletMetadata = z22.object({
+  presentation_definition_uri_supported: z22.optional(z22.boolean()),
+  vp_formats_supported: zVpFormatsSupported,
+  client_id_schemes_supported: z22.optional(z22.array(zClientIdScheme)),
+  request_object_signing_alg_values_supported: z22.optional(z22.array(z22.string())),
+  authorization_encryption_alg_values_supported: z22.optional(z22.array(z22.string())),
+  authorization_encryption_enc_values_supported: z22.optional(z22.array(z22.string()))
+});
 export {
   Openid4vpClient,
   Openid4vpVerifier,