@openid4vc/openid4vp 0.3.0-alpha-20250320222745 → 0.3.0-alpha-20250321120839

package/dist/index.js

@@ -60,7 +60,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/client-identifier-scheme/parse-client-identifier-scheme.ts
-var import_oauth24 = require("@openid4vc/oauth2");
+var import_oauth23 = require("@openid4vc/oauth2");
 var import_utils4 = require("@openid4vc/utils");
 
 // src/authorization-request/z-authorization-request-dc-api.ts
@@ -200,37 +200,31 @@ var zOpenid4vpAuthorizationRequestFromUriParams = import_zod4.z.string().url().t
 );
 
 // src/authorization-request/z-authorization-request-dc-api.ts
+var zOpenid4vpResponseModeDcApi = import_zod5.z.enum(["dc_api", "dc_api.jwt", "w3c_dc_api.jwt", "w3c_dc_api"]);
 var zOpenid4vpAuthorizationRequestDcApi = zOpenid4vpAuthorizationRequest.pick({
-  client_id: true,
   response_type: true,
-  response_mode: true,
   nonce: true,
   presentation_definition: true,
   client_metadata: true,
   transaction_data: true,
   dcql_query: true,
-  trust_chain: true
+  trust_chain: true,
+  state: true
 }).extend({
   client_id: import_zod5.z.optional(import_zod5.z.string()),
   expected_origins: import_zod5.z.array(import_zod5.z.string()).optional(),
-  response_mode: import_zod5.z.enum(["dc_api", "dc_api.jwt", "w3c_dc_api.jwt", "w3c_dc_api"]),
-  client_id_scheme: import_zod5.z.enum([
-    "pre-registered",
-    "redirect_uri",
-    "entity_id",
-    "did",
-    "verifier_attestation",
-    "x509_san_dns",
-    "x509_san_uri"
-  ]).optional()
-}).strip();
+  response_mode: zOpenid4vpResponseModeDcApi,
+  // Not allowed with dc_api, but added to make working with interfaces easier
+  client_id_scheme: import_zod5.z.never().optional(),
+  scope: import_zod5.z.never().optional()
+  // TODO: should we disallow any properties specifically, such as redirect_uri and response_uri?
+});
 function isOpenid4vpAuthorizationRequestDcApi(request) {
-  return request.response_mode === "dc_api" || request.response_mode === "dc_api.jwt" || request.response_mode === "w3c_dc_api.jwt" || request.response_mode === "w3c_dc_api";
+  return request.response_mode !== void 0 && zOpenid4vpResponseModeDcApi.options.includes(
+    request.response_mode
+  );
 }
 
-// src/version.ts
-var import_oauth23 = require("@openid4vc/oauth2");
-
 // src/client-identifier-scheme/z-client-id-scheme.ts
 var import_zod6 = require("zod");
 var zClientIdScheme = import_zod6.z.enum([
@@ -243,155 +237,114 @@ var zClientIdScheme = import_zod6.z.enum([
   "x509_san_uri",
   "web-origin"
 ]);
-
-// src/version.ts
-function parseAuthorizationRequestVersion(request) {
-  const requirements = [];
-  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "w3c_dc_api" || request.response_mode === "w3c_dc_api.jwt")) {
-    requirements.push(["<", 23]);
-    requirements.push([">=", 21]);
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(request) && request.response_mode === "dc_api" || request.response_mode === "dc_api.jwt") {
-    requirements.push([">=", 23]);
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.transaction_data || request.dcql_query)) {
-    requirements.push([">=", 23]);
-  }
-  if (request.dcql_query) {
-    requirements.push([">=", 22]);
-  }
-  if (request.transaction_data) {
-    requirements.push([">=", 22]);
-  }
-  if (request.client_id_scheme) {
-    requirements.push(["<", 22]);
-  }
-  if (request.client_id) {
-    const colonIndex = request.client_id.indexOf(":");
-    const schemePart = request.client_id.substring(0, colonIndex);
-    const parsedScheme = zClientIdScheme.safeParse(schemePart);
-    if (parsedScheme.success && parsedScheme.data !== "did" && parsedScheme.data !== "https") {
-      requirements.push([">=", 22]);
-    }
-  }
-  if (!request.client_id) {
-    requirements.push([">=", 21]);
-  }
-  if ("client_metadata_uri" in request) {
-    requirements.push(["<", 21]);
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(request)) {
-    requirements.push([">=", 21]);
-  }
-  if ("request_uri_method" in request || "wallet_nonce" in request) {
-    requirements.push([">=", 21]);
-  }
-  if (request.client_id_scheme === "verifier_attestation") {
-    requirements.push([">=", 20]);
-  }
-  if (request.client_id_scheme === "x509_san_dns" || request.client_id_scheme === "x509_san_uri") {
-    requirements.push([">=", 19]);
-  }
-  const lessThanVersions = requirements.filter(([operator]) => operator === "<").map(([_, version]) => version);
-  const greaterThanVersions = requirements.filter(([operator]) => operator === ">=").map(([_, version]) => version);
-  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 24;
-  const lowestRequiredVersion = greaterThanVersions.length > 0 ? Math.max(...greaterThanVersions) : 18;
-  if (lowestRequiredVersion > highestPossibleVersion) {
-    throw new import_oauth23.Oauth2ServerErrorResponseError({
-      error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-      error_description: "Could not infer openid4vp version from the openid4vp request payload."
-    });
-  }
-  return highestPossibleVersion;
-}
+var zLegacyClientIdScheme = import_zod6.z.enum([
+  "pre-registered",
+  "redirect_uri",
+  "entity_id",
+  "did",
+  "verifier_attestation",
+  "x509_san_dns",
+  "x509_san_uri"
+]);
 
 // src/client-identifier-scheme/parse-client-identifier-scheme.ts
 function getOpenid4vpClientId(options) {
-  const version = parseAuthorizationRequestVersion(options.authorizationRequestPayload);
-  if (version < 22) {
-    return getLegacyClientId(options);
-  }
   if (isOpenid4vpAuthorizationRequestDcApi(options.authorizationRequestPayload)) {
     if (!options.origin) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: "Failed to parse client identifier. 'origin' is required for requests with response_mode 'dc_api' and 'dc_api.jwt'"
       });
     }
-    if (!options.jar || !options.authorizationRequestPayload.client_id) return `web-origin:${options.origin}`;
-    return options.authorizationRequestPayload.client_id;
+    return {
+      clientId: options.authorizationRequestPayload.client_id ?? `web-origin:${options.origin}`
+    };
   }
-  return options.authorizationRequestPayload.client_id;
-}
-function getLegacyClientId(options) {
-  const legacyClientIdScheme = options.authorizationRequestPayload.client_id_scheme ?? "pre-registered";
-  const clientIdScheme = legacyClientIdScheme === "entity_id" ? "https" : legacyClientIdScheme;
-  if (isOpenid4vpAuthorizationRequestDcApi(options.authorizationRequestPayload)) {
-    if (!options.origin) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
-        error_description: "Failed to parse client identifier. 'origin' is required for requests with response_mode 'dc_api' and 'dc_api.jwt'"
+  if (!options.authorizationRequestPayload.client_id) {
+    throw new import_oauth23.Oauth2ServerErrorResponseError({
+      error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
+      error_description: `Failed to parse client identifier. Missing required client_id parameter for response_mode '${options.authorizationRequestPayload.response_mode}'.`
+    });
+  }
+  if (options.authorizationRequestPayload.client_id_scheme) {
+    const parsedClientIdScheme = zLegacyClientIdScheme.safeParse(options.authorizationRequestPayload.client_id_scheme);
+    if (!parsedClientIdScheme.success) {
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
+        error_description: `Failed to parse client identifier. Unsupported client_id_scheme value '${options.authorizationRequestPayload.client_id_scheme}'.`
       });
     }
-    if (!options.jar || !options.authorizationRequestPayload.client_id) return `web-origin:${options.origin}`;
-    return `${clientIdScheme}:${options.authorizationRequestPayload.client_id}`;
-  }
-  if (clientIdScheme === "https" || clientIdScheme === "did") {
-    return options.authorizationRequestPayload.client_id;
-  }
-  if (clientIdScheme === "pre-registered") {
-    return options.authorizationRequestPayload.client_id;
+    const clientIdScheme = parsedClientIdScheme.data === "entity_id" ? "https" : parsedClientIdScheme.data;
+    if (clientIdScheme === "https" || clientIdScheme === "did" || clientIdScheme === "pre-registered") {
+      return { clientId: options.authorizationRequestPayload.client_id };
+    }
+    return {
+      clientId: `${clientIdScheme}:${options.authorizationRequestPayload.client_id}`,
+      legacyClientId: options.authorizationRequestPayload.client_id
+    };
   }
-  return `${clientIdScheme}:${options.authorizationRequestPayload.client_id}`;
+  return {
+    clientId: options.authorizationRequestPayload.client_id
+  };
 }
 function parseClientIdentifier(options, parserConfig) {
-  const { authorizationRequestPayload, jar } = options;
+  const { authorizationRequestPayload, jar, origin } = options;
   const parserConfigWithDefaults = {
     supportedSchemes: parserConfig?.supportedSchemes || Object.values(zClientIdScheme.options)
   };
-  const clientId = getOpenid4vpClientId(options);
+  const { clientId, legacyClientId } = getOpenid4vpClientId({
+    authorizationRequestPayload,
+    origin
+  });
   const colonIndex = clientId.indexOf(":");
   if (colonIndex === -1) {
     return {
       scheme: "pre-registered",
       identifier: clientId,
       originalValue: clientId,
+      legacyClientId,
       clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
   const schemePart = clientId.substring(0, colonIndex);
   const identifierPart = clientId.substring(colonIndex + 1);
   if (!parserConfigWithDefaults.supportedSchemes.includes(schemePart)) {
-    throw new import_oauth24.Oauth2ServerErrorResponseError({
-      error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth23.Oauth2ServerErrorResponseError({
+      error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
       error_description: `Unsupported client identifier scheme. ${schemePart} is not supported.`
     });
   }
   const scheme = schemePart;
   if (scheme === "https") {
-    if (!clientId.startsWith("https://") && !((0, import_oauth24.getGlobalConfig)().allowInsecureUrls && clientId.startsWith("http://"))) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
-        error_description: "Invalid client identifier. Client identifier must start with https:// or http:// if allowInsecureUrls is true."
-      });
+    if (!import_utils4.zHttpsUrl.safeParse(clientId).success) {
+      throw new import_oauth23.Oauth2ServerErrorResponseError(
+        {
+          error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
+          error_description: "Invalid client identifier. Client identifier must start with https://"
+        },
+        {
+          internalMessage: `Insecure http:// urls can be enabled by setting the 'allowInsecureUrls' option using setGlobalConfig`
+        }
+      );
     }
     return {
       scheme,
       identifier: clientId,
       originalValue: clientId,
+      legacyClientId,
       trustChain: authorizationRequestPayload.trust_chain
     };
   }
   if (scheme === "redirect_uri") {
     if (jar) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: 'Using client identifier scheme "redirect_uri" the request MUST NOT be signed.'
       });
     }
     if (isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: `The client identifier scheme 'redirect_uri' is not supported when using the dc_api response mode.`
       });
     }
@@ -399,31 +352,32 @@ function parseClientIdentifier(options, parserConfig) {
       scheme,
       identifier: identifierPart,
       originalValue: clientId,
+      legacyClientId,
       redirectUri: authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri
     };
   }
   if (scheme === "did") {
     if (!jar) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: 'Using client identifier scheme "did" requires a signed JAR request.'
       });
     }
     if (!clientId.startsWith("did:")) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: "Invalid client identifier. Client identifier must start with 'did:'"
       });
     }
     if (!jar.signer.publicJwk.kid) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: `Missing required 'kid' for client identifier scheme: did`
       });
     }
     if (!jar.signer.publicJwk.kid?.startsWith(clientId)) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: 'With client identifier scheme "did" the JAR request must be signed by the same DID as the client identifier.'
       });
     }
@@ -431,27 +385,28 @@ function parseClientIdentifier(options, parserConfig) {
       scheme,
       identifier: clientId,
       originalValue: clientId,
+      legacyClientId,
       didUrl: jar.signer.publicJwk.kid
     };
   }
   if (scheme === "x509_san_dns" || scheme === "x509_san_uri") {
     if (!jar) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: 'Using client identifier scheme "x509_san_dns" or "x509_san_uri" requires a signed JAR request.'
       });
     }
     if (jar.signer.method !== "x5c") {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: "Something went wrong. The JWT signer method is not x5c but the client identifier scheme is x509_san_dns."
       });
     }
     if (scheme === "x509_san_dns") {
       if (!options.callbacks.getX509CertificateMetadata) {
-        throw new import_oauth24.Oauth2ServerErrorResponseError(
+        throw new import_oauth23.Oauth2ServerErrorResponseError(
           {
-            error: import_oauth24.Oauth2ErrorCodes.ServerError
+            error: import_oauth23.Oauth2ErrorCodes.ServerError
           },
           {
             internalMessage: "Missing required 'getX509CertificateMetadata' callback for verification of 'x509_san_dns' client id scheme"
@@ -460,25 +415,25 @@ function parseClientIdentifier(options, parserConfig) {
       }
       const { sanDnsNames } = options.callbacks.getX509CertificateMetadata(jar.signer.x5c[0]);
       if (!sanDnsNames.includes(identifierPart)) {
-        throw new import_oauth24.Oauth2ServerErrorResponseError({
-          error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+        throw new import_oauth23.Oauth2ServerErrorResponseError({
+          error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
           error_description: `Invalid client identifier. One of the leaf certificates san dns names [${sanDnsNames.join(", ")}] must match the client identifier '${identifierPart}'. `
         });
       }
       if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
         const uri = authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri;
         if (!uri || new import_utils4.URL(uri).hostname !== identifierPart) {
-          throw new import_oauth24.Oauth2ServerErrorResponseError({
-            error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+          throw new import_oauth23.Oauth2ServerErrorResponseError({
+            error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
             error_description: "Invalid client identifier. The fully qualified domain name of the redirect_uri value MUST match the Client Identifier without the prefix x509_san_dns."
           });
         }
       }
     } else if (scheme === "x509_san_uri") {
       if (!options.callbacks.getX509CertificateMetadata) {
-        throw new import_oauth24.Oauth2ServerErrorResponseError(
+        throw new import_oauth23.Oauth2ServerErrorResponseError(
           {
-            error: import_oauth24.Oauth2ErrorCodes.ServerError
+            error: import_oauth23.Oauth2ErrorCodes.ServerError
           },
           {
             internalMessage: "Missing required 'getX509CertificateMetadata' callback for verification of 'x509_san_uri' client id scheme"
@@ -487,16 +442,16 @@ function parseClientIdentifier(options, parserConfig) {
       }
       const { sanUriNames } = options.callbacks.getX509CertificateMetadata(jar.signer.x5c[0]);
       if (!sanUriNames.includes(identifierPart)) {
-        throw new import_oauth24.Oauth2ServerErrorResponseError({
-          error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+        throw new import_oauth23.Oauth2ServerErrorResponseError({
+          error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
           error_description: `Invalid client identifier. One of the leaf certificates san uri names [${sanUriNames.join(", ")}] must match the client identifier '${identifierPart}'.`
         });
       }
       if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
         const uri = authorizationRequestPayload.redirect_uri || authorizationRequestPayload.response_uri;
         if (!uri || uri !== identifierPart) {
-          throw new import_oauth24.Oauth2ServerErrorResponseError({
-            error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+          throw new import_oauth23.Oauth2ServerErrorResponseError({
+            error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
             error_description: "The redirect_uri value MUST match the Client Identifier without the prefix x509_san_uri"
           });
         }
@@ -506,6 +461,7 @@ function parseClientIdentifier(options, parserConfig) {
       scheme,
       identifier: identifierPart,
       originalValue: clientId,
+      legacyClientId,
       x5c: jar.signer.x5c
     };
   }
@@ -514,13 +470,14 @@ function parseClientIdentifier(options, parserConfig) {
       scheme,
       identifier: identifierPart,
       originalValue: clientId,
+      legacyClientId,
       clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
   if (scheme === "verifier_attestation") {
     if (!jar) {
-      throw new import_oauth24.Oauth2ServerErrorResponseError({
-        error: import_oauth24.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: 'Using client identifier scheme "verifier_attestation" requires a signed JAR request.'
       });
     }
@@ -528,12 +485,13 @@ function parseClientIdentifier(options, parserConfig) {
   return {
     scheme,
     identifier: identifierPart,
+    legacyClientId,
     originalValue: clientId
   };
 }
 
 // src/jarm/jarm-authorization-response/verify-jarm-authorization-response.ts
-var import_oauth27 = require("@openid4vc/oauth2");
+var import_oauth26 = require("@openid4vc/oauth2");
 var import_zod8 = __toESM(require("zod"));
 
 // src/jarm/jarm-extract-jwks.ts
@@ -549,25 +507,25 @@ function extractJwksFromClientMetadata(clientMetadata) {
 }
 
 // src/jarm/jarm-authorization-response/jarm-validate-authorization-response.ts
-var import_oauth26 = require("@openid4vc/oauth2");
+var import_oauth25 = require("@openid4vc/oauth2");
 var import_utils5 = require("@openid4vc/utils");
 
 // src/jarm/jarm-authorization-response/z-jarm-authorization-response.ts
-var import_oauth25 = require("@openid4vc/oauth2");
+var import_oauth24 = require("@openid4vc/oauth2");
 var import_zod7 = require("zod");
-var zJarmHeader = import_zod7.z.object({ ...import_oauth25.zJwtHeader.shape, apu: import_zod7.z.string().optional(), apv: import_zod7.z.string().optional() });
+var zJarmHeader = import_zod7.z.object({ ...import_oauth24.zJwtHeader.shape, apu: import_zod7.z.string().optional(), apv: import_zod7.z.string().optional() });
 var zJarmAuthorizationResponse = import_zod7.z.object({
   /**
    * iss: The issuer URL of the authorization server that created the response
    * aud: The client_id of the client the response is intended for
    * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.
    */
-  ...import_oauth25.zJwtPayload.shape,
-  ...import_oauth25.zJwtPayload.pick({ iss: true, aud: true, exp: true }).required().shape,
+  ...import_oauth24.zJwtPayload.shape,
+  ...import_oauth24.zJwtPayload.pick({ iss: true, aud: true, exp: true }).required().shape,
   state: import_zod7.z.optional(import_zod7.z.string())
 }).passthrough();
 var zJarmAuthorizationResponseEncryptedOnly = import_zod7.z.object({
-  ...import_oauth25.zJwtPayload.shape,
+  ...import_oauth24.zJwtPayload.shape,
   state: import_zod7.z.optional(import_zod7.z.string())
 }).passthrough();
 
@@ -578,12 +536,12 @@ var jarmAuthorizationResponseValidate = (options) => {
     return;
   }
   if (expectedClientId !== authorizationResponse.aud) {
-    throw new import_oauth26.Oauth2Error(
+    throw new import_oauth25.Oauth2Error(
       `Invalid 'aud' claim in JARM authorization response. Expected '${expectedClientId}' received '${JSON.stringify(authorizationResponse.aud)}'.`
     );
   }
   if (authorizationResponse.exp !== void 0 && authorizationResponse.exp < (0, import_utils5.dateToSeconds)()) {
-    throw new import_oauth26.Oauth2Error("Jarm auth response is expired.");
+    throw new import_oauth25.Oauth2Error("Jarm auth response is expired.");
   }
 };
 
@@ -602,37 +560,37 @@ var decryptJarmAuthorizationResponseJwt = async (options) => {
   }).encJwk : void 0;
   const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, { jwk: encryptionJwk });
   if (!result.decrypted) {
-    throw new import_oauth27.Oauth2Error("Failed to decrypt jarm auth response.");
+    throw new import_oauth26.Oauth2Error("Failed to decrypt jarm auth response.");
   }
   return result.payload;
 };
 async function verifyJarmAuthorizationResponse(options) {
   const { jarmAuthorizationResponseJwt, callbacks, expectedClientId, authorizationRequestPayload } = options;
-  const requestDataIsEncrypted = import_oauth27.zCompactJwe.safeParse(jarmAuthorizationResponseJwt).success;
+  const requestDataIsEncrypted = import_oauth26.zCompactJwe.safeParse(jarmAuthorizationResponseJwt).success;
   const decryptedRequestData = requestDataIsEncrypted ? await decryptJarmAuthorizationResponseJwt({
     jarmAuthorizationResponseJwt,
     callbacks,
     authorizationRequestPayload
   }) : jarmAuthorizationResponseJwt;
-  const responseIsSigned = import_oauth27.zCompactJwt.safeParse(decryptedRequestData).success;
+  const responseIsSigned = import_oauth26.zCompactJwt.safeParse(decryptedRequestData).success;
   if (!requestDataIsEncrypted && !responseIsSigned) {
-    throw new import_oauth27.Oauth2Error("Jarm Auth Response must be either encrypted, signed, or signed and encrypted.");
+    throw new import_oauth26.Oauth2Error("Jarm Auth Response must be either encrypted, signed, or signed and encrypted.");
   }
   let jarmAuthorizationResponse;
   if (responseIsSigned) {
-    const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_oauth27.decodeJwt)({
+    const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_oauth26.decodeJwt)({
       jwt: decryptedRequestData,
-      headerSchema: import_zod8.default.object({ ...import_oauth27.zJwtHeader.shape, kid: import_zod8.default.string() })
+      headerSchema: import_zod8.default.object({ ...import_oauth26.zJwtHeader.shape, kid: import_zod8.default.string() })
     });
     const response = zJarmAuthorizationResponse.parse(jwsPayload);
-    const jwtSigner = (0, import_oauth27.jwtSignerFromJwt)({ header: jwsProtectedHeader, payload: jwsPayload });
+    const jwtSigner = (0, import_oauth26.jwtSignerFromJwt)({ header: jwsProtectedHeader, payload: jwsPayload });
     const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {
       compact: decryptedRequestData,
       header: jwsProtectedHeader,
       payload: jwsPayload
     });
     if (!verificationResult.verified) {
-      throw new import_oauth27.Oauth2Error("Jarm Auth Response is not valid.");
+      throw new import_oauth26.Oauth2Error("Jarm Auth Response is not valid.");
     }
     jarmAuthorizationResponse = response;
   } else {
@@ -649,17 +607,17 @@ async function verifyJarmAuthorizationResponse(options) {
 }
 
 // src/authorization-request/create-authorization-request.ts
-var import_oauth211 = require("@openid4vc/oauth2");
+var import_oauth210 = require("@openid4vc/oauth2");
 var import_utils7 = require("@openid4vc/utils");
 
 // src/jar/create-jar-authorization-request.ts
-var import_oauth28 = require("@openid4vc/oauth2");
+var import_oauth27 = require("@openid4vc/oauth2");
 async function createJarAuthorizationRequest(options) {
   const { jwtSigner, jweEncryptor, authorizationRequestPayload, requestUri, callbacks } = options;
   let authorizationRequestJwt;
   let encryptionJwk;
   const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
-    header: { ...(0, import_oauth28.jwtHeaderFromJwtSigner)(jwtSigner), typ: "oauth-authz-req+jwt" },
+    header: { ...(0, import_oauth27.jwtHeaderFromJwtSigner)(jwtSigner), typ: "oauth-authz-req+jwt" },
     payload: { ...options.additionalJwtPayload, ...authorizationRequestPayload }
   });
   authorizationRequestJwt = jwt;
@@ -674,94 +632,94 @@ async function createJarAuthorizationRequest(options) {
 }
 
 // src/authorization-request/validate-authorization-request.ts
-var import_oauth29 = require("@openid4vc/oauth2");
+var import_oauth28 = require("@openid4vc/oauth2");
 var import_utils6 = require("@openid4vc/utils");
 var validateOpenid4vpAuthorizationRequestPayload = (options) => {
   const { params, walletVerificationOptions } = options;
   if (!params.redirect_uri && !params.response_uri) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: `Missing required 'redirect_uri' or 'response_uri' in openid4vp authorization request.`
     });
   }
   if (params.response_uri && !["direct_post", "direct_post.jwt"].find((mode) => mode === params.response_mode)) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'response_mode' parameter MUST be 'direct_post' or 'direct_post.jwt' when 'response_uri' is provided. Current: ${params.response_mode}`
     });
   }
   if ([params.presentation_definition_uri, params.presentation_definition, params.dcql_query, params.scope].filter(
     Boolean
   ).length > 1) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Exactly one of the following parameters MUST be present in the authorization request: dcql_query, presentation_definition, presentation_definition_uri, or a scope value representing a Presentation Definition."
     });
   }
   if (params.request_uri_method && !params.request_uri) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "request_uri_method" parameter MUST NOT be present in the authorization request if the "request_uri" parameter is not present.'
     });
   }
   if (params.request_uri_method && !["GET", "POST"].includes(params.request_uri_method)) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequestUriMethod,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequestUriMethod,
       error_description: `The 'request_uri_method' parameter MUST be 'GET' or 'POST'. Current: ${params.request_uri_method}`
     });
   }
   if (params.trust_chain && !import_utils6.zHttpsUrl.safeParse(params.client_id).success) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "trust_chain" parameter MUST NOT be present in the authorization request if the "client_id" is not an OpenId Federation Entity Identifier starting with http:// or https://.'
     });
   }
   if (walletVerificationOptions?.expectedNonce && !params.wallet_nonce) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "wallet_nonce" parameter MUST be present in the authorization request when the "expectedNonce" parameter is provided.'
     });
   }
   if (walletVerificationOptions?.expectedNonce !== params.wallet_nonce) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "wallet_nonce" parameter MUST match the "expectedNonce" parameter when the "expectedNonce" parameter is provided.'
     });
   }
   if (params.client_id.startsWith("web-origin:")) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'client_id' parameter MUST NOT use client identifier scheme 'web-origin' when not using the dc_api response mode. Current: ${params.client_id}`
     });
   }
 };
 
 // src/authorization-request/validate-authorization-request-dc-api.ts
-var import_oauth210 = require("@openid4vc/oauth2");
+var import_oauth29 = require("@openid4vc/oauth2");
 var validateOpenid4vpAuthorizationRequestDcApiPayload = (options) => {
   const { params, isJarRequest, disableOriginValidation, origin } = options;
   if (isJarRequest && !params.expected_origins) {
-    throw new import_oauth210.Oauth2ServerErrorResponseError({
-      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combinaction with jar.`
     });
   }
   if ([params.presentation_definition, params.dcql_query].filter(Boolean).length !== 1) {
-    throw new import_oauth210.Oauth2ServerErrorResponseError({
-      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Exactly one of the following parameters MUST be present in the Authorization Request: dcql_query or presentation_definition"
     });
   }
   if (params.expected_origins && !disableOriginValidation) {
     if (!origin) {
-      throw new import_oauth210.Oauth2ServerErrorResponseError({
-        error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth29.Oauth2ServerErrorResponseError({
+        error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
         error_description: `Failed to validate the 'origin' of the authorization request. The 'origin' was not provided.`
       });
     }
     if (params.expected_origins && !params.expected_origins.includes(origin)) {
-      throw new import_oauth210.Oauth2ServerErrorResponseError({
-        error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth29.Oauth2ServerErrorResponseError({
+        error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
         error_description: `The 'expected_origins' parameter MUST include the origin of the authorization request. Current: ${params.expected_origins.join(", ")}`
       });
     }
@@ -780,7 +738,7 @@ async function createOpenid4vpAuthorizationRequest(options) {
       "Invalid authorization request. Could not parse openid4vp dc_api authorization request."
     );
     if (jar && !authorizationRequestPayload.expected_origins) {
-      throw new import_oauth211.Oauth2Error(
+      throw new import_oauth210.Oauth2Error(
         `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combination with jar.`
       );
     }
@@ -836,12 +794,12 @@ async function createOpenid4vpAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-authorization-request-params.ts
-var import_oauth213 = require("@openid4vc/oauth2");
+var import_oauth212 = require("@openid4vc/oauth2");
 var import_utils9 = require("@openid4vc/utils");
 var import_zod10 = __toESM(require("zod"));
 
 // src/jar/z-jar-authorization-request.ts
-var import_oauth212 = require("@openid4vc/oauth2");
+var import_oauth211 = require("@openid4vc/oauth2");
 var import_utils8 = require("@openid4vc/utils");
 var import_zod9 = require("zod");
 var zJarAuthorizationRequest = import_zod9.z.object({
@@ -853,13 +811,13 @@ var zJarAuthorizationRequest = import_zod9.z.object({
 function validateJarRequestParams(options) {
   const { jarRequestParams } = options;
   if (jarRequestParams.request && jarRequestParams.request_uri) {
-    throw new import_oauth212.Oauth2ServerErrorResponseError({
+    throw new import_oauth211.Oauth2ServerErrorResponseError({
       error: "invalid_request_object",
       error_description: "request and request_uri cannot both be present in a JAR request"
     });
   }
   if (!jarRequestParams.request && !jarRequestParams.request_uri) {
-    throw new import_oauth212.Oauth2ServerErrorResponseError({
+    throw new import_oauth211.Oauth2ServerErrorResponseError({
       error: "invalid_request_object",
       error_description: "request or request_uri must be present"
     });
@@ -884,7 +842,7 @@ function parseOpenid4vpAuthorizationRequest(options) {
       );
       provided = "uri";
     } else {
-      const decoded = (0, import_oauth213.decodeJwt)({ jwt: authorizationRequest });
+      const decoded = (0, import_oauth212.decodeJwt)({ jwt: authorizationRequest });
       params = decoded.payload;
       provided = "jwt";
     }
@@ -922,7 +880,7 @@ var import_utils13 = require("@openid4vc/utils");
 var import_zod14 = __toESM(require("zod"));
 
 // src/fetch-client-metadata.ts
-var import_oauth214 = require("@openid4vc/oauth2");
+var import_oauth213 = require("@openid4vc/oauth2");
 var import_utils10 = require("@openid4vc/utils");
 async function fetchClientMetadata(options) {
   const { fetch, clientMetadataUri } = options;
@@ -934,15 +892,15 @@ async function fetchClientMetadata(options) {
     }
   });
   if (!response.ok) {
-    throw new import_oauth214.Oauth2ServerErrorResponseError({
+    throw new import_oauth213.Oauth2ServerErrorResponseError({
       error_description: `Fetching client metadata from '${clientMetadataUri}' failed with status code '${response.status}'.`,
-      error: import_oauth214.Oauth2ErrorCodes.InvalidRequestUri
+      error: import_oauth213.Oauth2ErrorCodes.InvalidRequestUri
     });
   }
   if (!result || !result.success) {
-    throw new import_oauth214.Oauth2ServerErrorResponseError({
+    throw new import_oauth213.Oauth2ServerErrorResponseError({
       error_description: `Parsing client metadata from '${clientMetadataUri}' failed.`,
-      error: import_oauth214.Oauth2ErrorCodes.InvalidRequestObject
+      error: import_oauth213.Oauth2ErrorCodes.InvalidRequestObject
     });
   }
   return result.data;
@@ -951,6 +909,68 @@ async function fetchClientMetadata(options) {
 // src/jar/handle-jar-request/verify-jar-request.ts
 var import_oauth217 = require("@openid4vc/oauth2");
 
+// src/version.ts
+var import_oauth214 = require("@openid4vc/oauth2");
+function parseAuthorizationRequestVersion(request) {
+  const requirements = [];
+  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "w3c_dc_api" || request.response_mode === "w3c_dc_api.jwt")) {
+    requirements.push(["<", 23]);
+    requirements.push([">=", 21]);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(request) && request.response_mode === "dc_api" || request.response_mode === "dc_api.jwt") {
+    requirements.push([">=", 23]);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.transaction_data || request.dcql_query)) {
+    requirements.push([">=", 23]);
+  }
+  if (request.dcql_query) {
+    requirements.push([">=", 22]);
+  }
+  if (request.transaction_data) {
+    requirements.push([">=", 22]);
+  }
+  if (request.client_id_scheme) {
+    requirements.push(["<", 22]);
+  }
+  if (request.client_id) {
+    const colonIndex = request.client_id.indexOf(":");
+    const schemePart = request.client_id.substring(0, colonIndex);
+    const parsedScheme = zClientIdScheme.safeParse(schemePart);
+    if (parsedScheme.success && parsedScheme.data !== "did" && parsedScheme.data !== "https") {
+      requirements.push([">=", 22]);
+    }
+  }
+  if (!request.client_id) {
+    requirements.push([">=", 21]);
+  }
+  if (request.client_metadata_uri) {
+    requirements.push(["<", 21]);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(request)) {
+    requirements.push([">=", 21]);
+  }
+  if (request.request_uri_method || request.wallet_nonce) {
+    requirements.push([">=", 21]);
+  }
+  if (request.client_id_scheme === "verifier_attestation") {
+    requirements.push([">=", 20]);
+  }
+  if (request.client_id_scheme === "x509_san_dns" || request.client_id_scheme === "x509_san_uri") {
+    requirements.push([">=", 19]);
+  }
+  const lessThanVersions = requirements.filter(([operator]) => operator === "<").map(([_, version]) => version);
+  const greaterThanVersions = requirements.filter(([operator]) => operator === ">=").map(([_, version]) => version);
+  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 24;
+  const lowestRequiredVersion = greaterThanVersions.length > 0 ? Math.max(...greaterThanVersions) : 18;
+  if (lowestRequiredVersion > highestPossibleVersion) {
+    throw new import_oauth214.Oauth2ServerErrorResponseError({
+      error: import_oauth214.Oauth2ErrorCodes.InvalidRequest,
+      error_description: "Could not infer openid4vp version from the openid4vp request payload."
+    });
+  }
+  return highestPossibleVersion;
+}
+
 // src/jar/jar-request-object/fetch-jar-request-object.ts
 var import_oauth215 = require("@openid4vc/oauth2");
 var import_utils11 = require("@openid4vc/utils");
@@ -999,7 +1019,7 @@ async function verifyJarRequest(options) {
   const { callbacks, wallet = {} } = options;
   const jarRequestParams = validateJarRequestParams(options);
   const sendBy = jarRequestParams.request ? "value" : "reference";
-  const clientIdentifierScheme = jarRequestParams.client_id ? zClientIdScheme.parse(jarRequestParams.client_id.split(":")[0]) : "web-origin";
+  const clientIdentifierScheme = jarRequestParams.client_id ? zClientIdScheme.safeParse(jarRequestParams.client_id.split(":")[0]).data : "web-origin";
   const method = jarRequestParams.request_uri_method ?? "GET";
   if (method !== "GET" && method !== "POST") {
     throw new import_oauth217.Oauth2ServerErrorResponseError({
@@ -1300,7 +1320,7 @@ async function createOpenid4vpAuthorizationResponse(options) {
   const { authorizationRequestPayload, jarm, callbacks } = options;
   const authorizationResponsePayload = {
     ...options.authorizationResponsePayload,
-    ..."state" in authorizationRequestPayload && { state: authorizationRequestPayload.state }
+    state: authorizationRequestPayload.state
   };
   if (authorizationRequestPayload.response_mode && isJarmResponseMode(authorizationRequestPayload.response_mode) && !jarm) {
     throw new import_oauth222.Oauth2Error(
@@ -1484,7 +1504,7 @@ function parseDcqlVpToken(vpToken) {
 // src/authorization-response/validate-authorization-response.ts
 function validateOpenid4vpAuthorizationResponsePayload(options) {
   const { authorizationRequestPayload, authorizationResponsePayload } = options;
-  if ("state" in authorizationRequestPayload && authorizationRequestPayload.state !== authorizationResponsePayload.state) {
+  if (authorizationRequestPayload.state && authorizationRequestPayload.state !== authorizationResponsePayload.state) {
     throw new import_oauth225.Oauth2Error("OpenId4Vp Authorization Response state mismatch.");
   }
   if (authorizationResponsePayload.id_token) {
@@ -1496,7 +1516,7 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
     }
     return {
       type: "pex",
-      pex: "scope" in authorizationRequestPayload && authorizationRequestPayload.scope ? {
+      pex: authorizationRequestPayload.scope ? {
         scope: authorizationRequestPayload.scope,
         presentationSubmission: authorizationResponsePayload.presentation_submission,
         presentations: parsePexVpToken(authorizationResponsePayload.vp_token)
@@ -1511,7 +1531,7 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
     const presentations = parseDcqlVpToken(authorizationResponsePayload.vp_token);
     return {
       type: "dcql",
-      dcql: "scope" in authorizationRequestPayload && authorizationRequestPayload.scope ? {
+      dcql: authorizationRequestPayload.scope ? {
         scope: authorizationRequestPayload.scope,
         presentations
       } : {
@@ -1605,13 +1625,18 @@ async function parseJarmAuthorizationResponse(options) {
 // src/authorization-response/parse-authorization-response.ts
 async function parseOpenid4vpAuthorizationResponse(options) {
   const { authorizationResponse, callbacks, authorizationRequestPayload, origin } = options;
-  const expectedClientId = getOpenid4vpClientId({ authorizationRequestPayload, origin });
+  const expectedClientId = getOpenid4vpClientId({
+    origin,
+    authorizationRequestPayload
+  });
   if (authorizationResponse.response) {
     return parseJarmAuthorizationResponse({
       jarmResponseJwt: authorizationResponse.response,
       callbacks,
       authorizationRequestPayload,
-      expectedClientId
+      // If client_id_scheme was provided we should use the legacy (unprefixed) client id scheme
+      // TODO: allow both versions, in case of e.g. did:
+      expectedClientId: expectedClientId.legacyClientId ?? expectedClientId.clientId
     });
   }
   const authorizationResponsePayload = parseOpenid4VpAuthorizationResponsePayload(authorizationResponse);