@openid4vc/openid4vp 0.3.0-alpha-20250322171044 → 0.3.0-alpha-20250324183425

package/dist/index.mjs

@@ -120,7 +120,7 @@ var zOpenid4vpAuthorizationRequest = z4.object({
   client_metadata_uri: zHttpsUrl2.optional(),
   state: z4.string().optional(),
   transaction_data: z4.array(z4.string().base64url()).optional(),
-  trust_chain: z4.unknown().optional(),
+  trust_chain: z4.array(z4.string()).nonempty().optional(),
   client_id_scheme: z4.enum([
     "pre-registered",
     "redirect_uri",
@@ -160,13 +160,15 @@ var zOpenid4vpAuthorizationRequestDcApi = zOpenid4vpAuthorizationRequest.pick({
   scope: z5.never().optional()
   // TODO: should we disallow any properties specifically, such as redirect_uri and response_uri?
 });
+function isOpenid4vpResponseModeDcApi(responseMode) {
+  return responseMode !== void 0 && zOpenid4vpResponseModeDcApi.options.includes(responseMode);
+}
 function isOpenid4vpAuthorizationRequestDcApi(request) {
-  return request.response_mode !== void 0 && zOpenid4vpResponseModeDcApi.options.includes(
-    request.response_mode
-  );
+  return isOpenid4vpResponseModeDcApi(request.response_mode);
 }
 
 // src/client-identifier-scheme/z-client-id-scheme.ts
+import { getGlobalConfig } from "@openid4vc/utils";
 import { z as z6 } from "zod";
 var zClientIdScheme = z6.enum([
   "pre-registered",
@@ -178,6 +180,18 @@ var zClientIdScheme = z6.enum([
   "x509_san_uri",
   "web-origin"
 ]);
+var zClientIdToClientIdScheme = z6.union(
+  [
+    z6.string({ message: "client_id MUST be a string" }).includes(":").transform((clientId) => {
+      const clientIdScheme = clientId.split(":")[0];
+      return clientIdScheme === "http" && getGlobalConfig().allowInsecureUrls ? "https" : clientIdScheme;
+    }).pipe(zClientIdScheme.exclude(["pre-registered"])),
+    z6.string().refine((clientId) => clientId.includes(":") === false).transform(() => "pre-registered")
+  ],
+  {
+    message: `client_id must either start with a known prefix followed by ':' or contain no ':'. Known prefixes are ${zClientIdScheme.exclude(["pre-registered"]).options.join(", ")}`
+  }
+);
 var zLegacyClientIdScheme = z6.enum([
   "pre-registered",
   "redirect_uri",
@@ -187,58 +201,80 @@ var zLegacyClientIdScheme = z6.enum([
   "x509_san_dns",
   "x509_san_uri"
 ]);
+var zLegacyClientIdSchemeToClientIdScheme = zLegacyClientIdScheme.optional().default("pre-registered").transform((clientIdScheme) => clientIdScheme === "entity_id" ? "https" : clientIdScheme);
 
 // src/client-identifier-scheme/parse-client-identifier-scheme.ts
 function getOpenid4vpClientId(options) {
-  if (isOpenid4vpAuthorizationRequestDcApi(options.authorizationRequestPayload)) {
-    if (!options.origin) {
+  if (isOpenid4vpResponseModeDcApi(options.responseMode)) {
+    if (!options.clientId) {
+      if (!options.origin) {
+        throw new Oauth2ServerErrorResponseError({
+          error: Oauth2ErrorCodes.InvalidRequest,
+          error_description: "Failed to parse client identifier. 'origin' is required for requests without a client_id and response_mode 'dc_api' and 'dc_api.jwt'"
+        });
+      }
+      return {
+        clientIdScheme: "web-origin",
+        clientId: `web-origin:${options.origin}`
+      };
+    }
+    const parsedClientIdScheme2 = zClientIdToClientIdScheme.safeParse(options.clientId);
+    if (!parsedClientIdScheme2.success) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
-        error_description: "Failed to parse client identifier. 'origin' is required for requests with response_mode 'dc_api' and 'dc_api.jwt'"
+        error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
       });
     }
     return {
-      clientId: options.authorizationRequestPayload.client_id ?? `web-origin:${options.origin}`
+      clientId: options.clientId,
+      clientIdScheme: parsedClientIdScheme2.data
     };
   }
-  if (!options.authorizationRequestPayload.client_id) {
+  if (!options.clientId) {
     throw new Oauth2ServerErrorResponseError({
       error: Oauth2ErrorCodes.InvalidRequest,
-      error_description: `Failed to parse client identifier. Missing required client_id parameter for response_mode '${options.authorizationRequestPayload.response_mode}'.`
+      error_description: `Failed to parse client identifier. Missing required client_id parameter for response_mode '${options.responseMode}'.`
     });
   }
-  if (options.authorizationRequestPayload.client_id_scheme) {
-    const parsedClientIdScheme = zLegacyClientIdScheme.safeParse(options.authorizationRequestPayload.client_id_scheme);
-    if (!parsedClientIdScheme.success) {
+  if (options.legacyClientIdScheme) {
+    const parsedClientIdScheme2 = zLegacyClientIdSchemeToClientIdScheme.safeParse(options.legacyClientIdScheme);
+    if (!parsedClientIdScheme2.success) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
-        error_description: `Failed to parse client identifier. Unsupported client_id_scheme value '${options.authorizationRequestPayload.client_id_scheme}'.`
+        error_description: `Failed to parse client identifier. Unsupported client_id_scheme value '${options.legacyClientIdScheme}'.`
       });
     }
-    const clientIdScheme = parsedClientIdScheme.data === "entity_id" ? "https" : parsedClientIdScheme.data;
-    if (clientIdScheme === "https" || clientIdScheme === "did" || clientIdScheme === "pre-registered") {
-      return { clientId: options.authorizationRequestPayload.client_id };
-    }
+    const clientIdScheme = parsedClientIdScheme2.data;
     return {
-      clientId: `${clientIdScheme}:${options.authorizationRequestPayload.client_id}`,
-      legacyClientId: options.authorizationRequestPayload.client_id
+      clientId: clientIdScheme === "https" || clientIdScheme === "did" || clientIdScheme === "pre-registered" ? options.clientId : `${parsedClientIdScheme2.data}:${options.clientId}`,
+      clientIdScheme: parsedClientIdScheme2.data,
+      legacyClientId: options.clientId
     };
   }
+  const parsedClientIdScheme = zClientIdToClientIdScheme.safeParse(options.clientId);
+  if (!parsedClientIdScheme.success) {
+    throw new Oauth2ServerErrorResponseError({
+      error: Oauth2ErrorCodes.InvalidRequest,
+      error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
+    });
+  }
   return {
-    clientId: options.authorizationRequestPayload.client_id
+    clientId: options.clientId,
+    clientIdScheme: parsedClientIdScheme.data
   };
 }
-function parseClientIdentifier(options, parserConfig) {
+function validateOpenid4vpClientId(options, parserConfig) {
   const { authorizationRequestPayload, jar, origin } = options;
   const parserConfigWithDefaults = {
     supportedSchemes: parserConfig?.supportedSchemes || Object.values(zClientIdScheme.options)
   };
-  const { clientId, legacyClientId } = getOpenid4vpClientId({
-    authorizationRequestPayload,
+  const { clientId, legacyClientId, clientIdScheme } = getOpenid4vpClientId({
+    clientId: authorizationRequestPayload.client_id,
+    legacyClientIdScheme: authorizationRequestPayload.client_id_scheme,
+    responseMode: authorizationRequestPayload.response_mode,
     origin
   });
-  const colonIndex = clientId.indexOf(":");
-  if (colonIndex === -1) {
+  if (clientIdScheme === "pre-registered") {
     return {
       scheme: "pre-registered",
       identifier: clientId,
@@ -247,16 +283,15 @@ function parseClientIdentifier(options, parserConfig) {
       clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
-  const schemePart = clientId.substring(0, colonIndex);
+  const colonIndex = clientId.indexOf(":");
   const identifierPart = clientId.substring(colonIndex + 1);
-  if (!parserConfigWithDefaults.supportedSchemes.includes(schemePart)) {
+  if (!parserConfigWithDefaults.supportedSchemes.includes(clientIdScheme)) {
     throw new Oauth2ServerErrorResponseError({
       error: Oauth2ErrorCodes.InvalidRequest,
-      error_description: `Unsupported client identifier scheme. ${schemePart} is not supported.`
+      error_description: `Unsupported client identifier scheme. ${clientIdScheme} is not supported.`
     });
   }
-  const scheme = schemePart;
-  if (scheme === "https") {
+  if (clientIdScheme === "https") {
     if (!zHttpsUrl3.safeParse(clientId).success) {
       throw new Oauth2ServerErrorResponseError(
         {
@@ -268,15 +303,27 @@ function parseClientIdentifier(options, parserConfig) {
         }
       );
     }
+    if (!jar) {
+      throw new Oauth2ServerErrorResponseError({
+        error: Oauth2ErrorCodes.InvalidRequest,
+        error_description: 'Using client identifier scheme "https" requires a signed JAR request.'
+      });
+    }
+    if (jar.signer.method !== "federation") {
+      throw new Oauth2ServerErrorResponseError({
+        error: Oauth2ErrorCodes.InvalidRequest,
+        error_description: "Something went wrong. The JWT signer method is not federation but the client identifier scheme is https."
+      });
+    }
     return {
-      scheme,
+      scheme: clientIdScheme,
       identifier: clientId,
       originalValue: clientId,
       legacyClientId,
       trustChain: authorizationRequestPayload.trust_chain
     };
   }
-  if (scheme === "redirect_uri") {
+  if (clientIdScheme === "redirect_uri") {
     if (jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
@@ -290,20 +337,26 @@ function parseClientIdentifier(options, parserConfig) {
       });
     }
     return {
-      scheme,
+      scheme: clientIdScheme,
       identifier: identifierPart,
       originalValue: clientId,
       legacyClientId,
       redirectUri: authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri
     };
   }
-  if (scheme === "did") {
+  if (clientIdScheme === "did") {
     if (!jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
         error_description: 'Using client identifier scheme "did" requires a signed JAR request.'
       });
     }
+    if (jar.signer.method !== "did") {
+      throw new Oauth2ServerErrorResponseError({
+        error: Oauth2ErrorCodes.InvalidRequest,
+        error_description: "Something went wrong. The JWT signer method is not did but the client identifier scheme is did."
+      });
+    }
     if (!clientId.startsWith("did:")) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
@@ -323,14 +376,14 @@ function parseClientIdentifier(options, parserConfig) {
       });
     }
     return {
-      scheme,
+      scheme: clientIdScheme,
       identifier: clientId,
       originalValue: clientId,
       legacyClientId,
       didUrl: jar.signer.publicJwk.kid
     };
   }
-  if (scheme === "x509_san_dns" || scheme === "x509_san_uri") {
+  if (clientIdScheme === "x509_san_dns" || clientIdScheme === "x509_san_uri") {
     if (!jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
@@ -343,7 +396,7 @@ function parseClientIdentifier(options, parserConfig) {
         error_description: "Something went wrong. The JWT signer method is not x5c but the client identifier scheme is x509_san_dns."
       });
     }
-    if (scheme === "x509_san_dns") {
+    if (clientIdScheme === "x509_san_dns") {
       if (!options.callbacks.getX509CertificateMetadata) {
         throw new Oauth2ServerErrorResponseError(
           {
@@ -370,7 +423,7 @@ function parseClientIdentifier(options, parserConfig) {
           });
         }
       }
-    } else if (scheme === "x509_san_uri") {
+    } else if (clientIdScheme === "x509_san_uri") {
       if (!options.callbacks.getX509CertificateMetadata) {
         throw new Oauth2ServerErrorResponseError(
           {
@@ -399,23 +452,23 @@ function parseClientIdentifier(options, parserConfig) {
       }
     }
     return {
-      scheme,
+      scheme: clientIdScheme,
       identifier: identifierPart,
       originalValue: clientId,
       legacyClientId,
       x5c: jar.signer.x5c
     };
   }
-  if (scheme === "web-origin") {
+  if (clientIdScheme === "web-origin") {
     return {
-      scheme,
+      scheme: clientIdScheme,
       identifier: identifierPart,
       originalValue: clientId,
       legacyClientId,
       clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
-  if (scheme === "verifier_attestation") {
+  if (clientIdScheme === "verifier_attestation") {
     if (!jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
@@ -424,7 +477,7 @@ function parseClientIdentifier(options, parserConfig) {
     }
   }
   return {
-    scheme,
+    scheme: clientIdScheme,
     identifier: identifierPart,
     legacyClientId,
     originalValue: clientId
@@ -836,7 +889,7 @@ function parseOpenid4vpAuthorizationRequest(options) {
 // src/authorization-request/resolve-authorization-request.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes9, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError10 } from "@openid4vc/oauth2";
 import { parseWithErrorHandling as parseWithErrorHandling4 } from "@openid4vc/utils";
-import z13 from "zod";
+import z14 from "zod";
 
 // src/fetch-client-metadata.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes4, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError5 } from "@openid4vc/oauth2";
@@ -867,6 +920,7 @@ async function fetchClientMetadata(options) {
 
 // src/jar/handle-jar-request/verify-jar-request.ts
 import {
+  Oauth2Error as Oauth2Error5,
   Oauth2ErrorCodes as Oauth2ErrorCodes7,
   Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError8,
   decodeJwt as decodeJwt3,
@@ -875,6 +929,7 @@ import {
   zCompactJwe as zCompactJwe2,
   zCompactJwt as zCompactJwt2
 } from "@openid4vc/oauth2";
+import z12 from "zod";
 
 // src/version.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes5, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError6 } from "@openid4vc/oauth2";
@@ -979,6 +1034,8 @@ var zJarRequestObjectPayload = z11.object({
 }).passthrough();
 
 // src/jar/handle-jar-request/verify-jar-request.ts
+var zSignedAuthorizationRequestJwtHeaderTyp = z12.literal("oauth-authz-req+jwt");
+var signedAuthorizationRequestJwtHeaderTyp = zSignedAuthorizationRequestJwtHeaderTyp.value;
 async function verifyJarRequest(options) {
   const { callbacks, wallet = {} } = options;
   const jarRequestParams = validateJarRequestParams(options);
@@ -1058,7 +1115,41 @@ async function decryptJarRequest(options) {
 async function verifyJarRequestObject(options) {
   const { decryptedRequestObject, callbacks } = options;
   const jwt = decodeJwt3({ jwt: decryptedRequestObject, payloadSchema: zJarRequestObjectPayload });
-  const jwtSigner = jwtSignerFromJwt2(jwt);
+  let jwtSigner;
+  const { clientIdScheme } = getOpenid4vpClientId({
+    responseMode: jwt.payload.response_mode,
+    clientId: jwt.payload.client_id,
+    legacyClientIdScheme: jwt.payload.client_id_scheme
+  });
+  const clientIdToSignerMethod = {
+    did: ["did"],
+    "pre-registered": ["custom", "did", "jwk"],
+    "web-origin": [],
+    // no signing allowed
+    redirect_uri: [],
+    // no signing allowed
+    // Not 100% sure which one are allowed?
+    verifier_attestation: ["did", "federation", "jwk", "x5c", "custom"],
+    x509_san_dns: ["x5c"],
+    x509_san_uri: ["x5c"],
+    // Handled separately
+    https: []
+  };
+  if (clientIdScheme === "https") {
+    if (!jwt.header.kid) {
+      throw new Oauth2Error5(
+        `When OpenID Federation is used for signed authorization request, the 'kid' parameter is required.`
+      );
+    }
+    jwtSigner = {
+      method: "federation",
+      alg: jwt.header.alg,
+      trustChain: jwt.payload.trust_chain,
+      kid: jwt.header.kid
+    };
+  } else {
+    jwtSigner = jwtSignerFromJwt2({ ...jwt, allowedSignerMethods: clientIdToSignerMethod[clientIdScheme] });
+  }
   const { signer } = await verifyJwt({
     verifyJwtCallback: callbacks.verifyJwt,
     compact: decryptedRequestObject,
@@ -1085,13 +1176,13 @@ import { Oauth2ErrorCodes as Oauth2ErrorCodes8, Oauth2ServerErrorResponseError a
 import { decodeBase64, encodeToUtf8String, parseIfJson } from "@openid4vc/utils";
 
 // src/transaction-data/z-transaction-data.ts
-import { z as z12 } from "zod";
-var zTransactionEntry = z12.object({
-  type: z12.string(),
-  credential_ids: z12.array(z12.string()).nonempty(),
-  transaction_data_hashes_alg: z12.array(z12.string()).optional()
+import { z as z13 } from "zod";
+var zTransactionEntry = z13.object({
+  type: z13.string(),
+  credential_ids: z13.array(z13.string()).nonempty(),
+  transaction_data_hashes_alg: z13.array(z13.string()).optional()
 }).passthrough();
-var zTransactionData = z12.array(zTransactionEntry);
+var zTransactionData = z13.array(zTransactionEntry);
 
 // src/transaction-data/parse-transaction-data.ts
 function parseTransactionData(options) {
@@ -1116,7 +1207,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
   const { wallet, callbacks, origin, disableOriginValidation } = options;
   let authorizationRequestPayload;
   const parsed = parseWithErrorHandling4(
-    z13.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest, zJarAuthorizationRequest]),
+    z14.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest, zJarAuthorizationRequest]),
     options.authorizationRequestPayload,
     "Invalid authorization request. Could not parse openid4vp authorization request as openid4vp or jar auth request."
   );
@@ -1124,7 +1215,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
   if (isJarAuthorizationRequest(parsed)) {
     jar = await verifyJarRequest({ jarRequestParams: parsed, callbacks, wallet });
     const parsedJarAuthorizationRequestPayload = parseWithErrorHandling4(
-      z13.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest]),
+      z14.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest]),
       jar.authorizationRequestPayload,
       "Invalid authorization request. Could not parse jar request payload as openid4vp auth request."
     );
@@ -1148,7 +1239,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
   if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload) && !clientMetadata && authorizationRequestPayload.client_metadata_uri) {
     clientMetadata = await fetchClientMetadata({ clientMetadataUri: authorizationRequestPayload.client_metadata_uri });
   }
-  const clientMeta = parseClientIdentifier({
+  const clientMeta = validateOpenid4vpClientId({
     authorizationRequestPayload: {
       ...authorizationRequestPayload,
       client_metadata: clientMetadata
@@ -1204,7 +1295,7 @@ function validateOpenId4vpAuthorizationRequestPayload(options) {
 
 // src/authorization-response/create-authorization-response.ts
 import {
-  Oauth2Error as Oauth2Error7,
+  Oauth2Error as Oauth2Error8,
   Oauth2ErrorCodes as Oauth2ErrorCodes10,
   Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError11,
   fetchJwks
@@ -1218,7 +1309,7 @@ function addSecondsToDate2(date, seconds) {
 
 // src/jarm/jarm-authorization-response-create.ts
 import {
-  Oauth2Error as Oauth2Error5,
+  Oauth2Error as Oauth2Error6,
   jwtHeaderFromJwtSigner as jwtHeaderFromJwtSigner2
 } from "@openid4vc/oauth2";
 async function createJarmAuthorizationResponse(options) {
@@ -1235,7 +1326,7 @@ async function createJarmAuthorizationResponse(options) {
     return { jarmAuthorizationResponseJwt: signed2.jwt };
   }
   if (!jwtSigner || !jweEncryptor) {
-    throw new Oauth2Error5("JWT signer and/or encryptor are required to create a JARM auth response.");
+    throw new Oauth2Error6("JWT signer and/or encryptor are required to create a JARM auth response.");
   }
   const signed = await callbacks.signJwt(jwtSigner, {
     header: jwtHeaderFromJwtSigner2(jwtSigner),
@@ -1246,7 +1337,7 @@ async function createJarmAuthorizationResponse(options) {
 }
 
 // src/jarm/jarm-response-mode.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var jarmResponseMode = [
   "jwt",
   "query.jwt",
@@ -1255,18 +1346,18 @@ var jarmResponseMode = [
   "direct_post.jwt",
   "dc_api.jwt"
 ];
-var zJarmResponseMode = z14.enum(jarmResponseMode);
+var zJarmResponseMode = z15.enum(jarmResponseMode);
 var isJarmResponseMode = (responseMode) => {
   return jarmResponseMode.includes(responseMode);
 };
 
 // src/jarm/metadata/jarm-assert-metadata-supported.ts
-import { Oauth2Error as Oauth2Error6 } from "@openid4vc/oauth2";
+import { Oauth2Error as Oauth2Error7 } from "@openid4vc/oauth2";
 function assertValueSupported(options) {
   const { errorMessage, supported, actual } = options;
   const intersection = supported.find((value) => value === actual);
   if (!intersection) {
-    throw new Oauth2Error6(errorMessage);
+    throw new Oauth2Error7(errorMessage);
   }
   return intersection;
 }
@@ -1307,7 +1398,7 @@ async function createOpenid4vpAuthorizationResponse(options) {
     state: authorizationRequestPayload.state
   };
   if (authorizationRequestPayload.response_mode && isJarmResponseMode(authorizationRequestPayload.response_mode) && !jarm) {
-    throw new Oauth2Error7(
+    throw new Oauth2Error8(
       `Missing jarm options for creating Jarm response with response mode '${authorizationRequestPayload.response_mode}'`
     );
   }
@@ -1317,7 +1408,7 @@ async function createOpenid4vpAuthorizationResponse(options) {
     };
   }
   if (!authorizationRequestPayload.client_metadata) {
-    throw new Oauth2Error7("Missing client metadata in the request params to assert Jarm metadata support.");
+    throw new Oauth2Error8("Missing client metadata in the request params to assert Jarm metadata support.");
   }
   let jwks;
   if (authorizationRequestPayload.client_metadata.jwks) {
@@ -1392,18 +1483,18 @@ async function createOpenid4vpAuthorizationResponse(options) {
 }
 
 // src/authorization-response/submit-authorization-response.ts
-import { Oauth2Error as Oauth2Error9 } from "@openid4vc/oauth2";
+import { Oauth2Error as Oauth2Error10 } from "@openid4vc/oauth2";
 import { ContentType as ContentType4, createFetcher as createFetcher3 } from "@openid4vc/utils";
 import { objectToQueryParams as objectToQueryParams3 } from "@openid4vc/utils";
 
 // src/jarm/jarm-authorizatino-response-send.ts
-import { Oauth2Error as Oauth2Error8 } from "@openid4vc/oauth2";
+import { Oauth2Error as Oauth2Error9 } from "@openid4vc/oauth2";
 import { ContentType as ContentType3, URL as URL4, createFetcher as createFetcher2 } from "@openid4vc/utils";
 var jarmAuthorizationResponseSend = (options) => {
   const { authorizationRequestPayload, jarmAuthorizationResponseJwt, callbacks } = options;
   const responseEndpoint = authorizationRequestPayload.response_uri ?? authorizationRequestPayload.redirect_uri;
   if (!responseEndpoint) {
-    throw new Oauth2Error8(`Either 'response_uri' or 'redirect_uri' MUST  be present in the authorization request`);
+    throw new Oauth2Error9(`Either 'response_uri' or 'redirect_uri' MUST  be present in the authorization request`);
   }
   const responseEndpointUrl = new URL4(responseEndpoint);
   return handleDirectPostJwt(responseEndpointUrl, jarmAuthorizationResponseJwt, callbacks);
@@ -1432,7 +1523,7 @@ async function submitOpenid4vpAuthorizationResponse(options) {
     });
   }
   if (!url) {
-    throw new Oauth2Error9(
+    throw new Oauth2Error10(
       "Failed to submit OpenId4Vp Authorization Response. No redirect_uri or response_uri provided."
     );
   }
@@ -1452,23 +1543,23 @@ async function submitOpenid4vpAuthorizationResponse(options) {
 }
 
 // src/authorization-response/validate-authorization-response.ts
-import { Oauth2Error as Oauth2Error10 } from "@openid4vc/oauth2";
+import { Oauth2Error as Oauth2Error11 } from "@openid4vc/oauth2";
 
 // src/vp-token/parse-vp-token.ts
 import { parseIfJson as parseIfJson2, parseWithErrorHandling as parseWithErrorHandling5 } from "@openid4vc/utils";
 
 // src/vp-token/z-vp-token.ts
-import { z as z15 } from "zod";
-var zVpTokenPexEntry = z15.union([z15.string(), z15.record(z15.any())], {
+import { z as z16 } from "zod";
+var zVpTokenPexEntry = z16.union([z16.string(), z16.record(z16.any())], {
   message: "pex vp_token entry must be a string or object"
 });
-var zVpTokenPex = z15.union(
-  [zVpTokenPexEntry, z15.array(zVpTokenPexEntry).nonempty("Must have at least entry in vp_token array")],
+var zVpTokenPex = z16.union(
+  [zVpTokenPexEntry, z16.array(zVpTokenPexEntry).nonempty("Must have at least entry in vp_token array")],
   {
     message: "pex vp_token must be a string, object or array of strings and objects"
   }
 );
-var zVpTokenDcql = z15.record(z15.union([z15.string(), z15.record(z15.any())]), {
+var zVpTokenDcql = z16.record(z16.union([z16.string(), z16.record(z16.any())]), {
   message: "dcql vp_token must be an object with keys referencing the dcql credential query id, and values the encoded (string or object) presentation"
 });
 var zVpToken = zVpTokenDcql.or(zVpTokenPex);
@@ -1494,14 +1585,14 @@ function parseDcqlVpToken(vpToken) {
 function validateOpenid4vpAuthorizationResponsePayload(options) {
   const { authorizationRequestPayload, authorizationResponsePayload } = options;
   if (authorizationRequestPayload.state && authorizationRequestPayload.state !== authorizationResponsePayload.state) {
-    throw new Oauth2Error10("OpenId4Vp Authorization Response state mismatch.");
+    throw new Oauth2Error11("OpenId4Vp Authorization Response state mismatch.");
   }
   if (authorizationResponsePayload.id_token) {
-    throw new Oauth2Error10("OpenId4Vp Authorization Response id_token is not supported.");
+    throw new Oauth2Error11("OpenId4Vp Authorization Response id_token is not supported.");
   }
   if (authorizationResponsePayload.presentation_submission) {
     if (!authorizationRequestPayload.presentation_definition) {
-      throw new Oauth2Error10("OpenId4Vp Authorization Request is missing the required presentation_definition.");
+      throw new Oauth2Error11("OpenId4Vp Authorization Request is missing the required presentation_definition.");
     }
     return {
       type: "pex",
@@ -1529,7 +1620,7 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
       }
     };
   }
-  throw new Oauth2Error10(
+  throw new Oauth2Error11(
     "Invalid OpenId4Vp Authorization Response. Response neither contains a presentation_submission nor request contains a dcql_query."
   );
 }
@@ -1542,23 +1633,23 @@ import { parseWithErrorHandling as parseWithErrorHandling6 } from "@openid4vc/ut
 
 // src/authorization-response/z-authorization-response.ts
 import { zStringToJson as zStringToJson2 } from "@openid4vc/utils";
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 
 // src/models/z-pex.ts
-import { z as z16 } from "zod";
-var zPexPresentationDefinition = z16.record(z16.any());
-var zPexPresentationSubmission = z16.record(z16.any());
+import { z as z17 } from "zod";
+var zPexPresentationDefinition = z17.record(z17.any());
+var zPexPresentationSubmission = z17.record(z17.any());
 
 // src/authorization-response/z-authorization-response.ts
-var zOpenid4vpAuthorizationResponse = z17.object({
-  state: z17.string().optional(),
-  id_token: z17.string().optional(),
+var zOpenid4vpAuthorizationResponse = z18.object({
+  state: z18.string().optional(),
+  id_token: z18.string().optional(),
   vp_token: zVpToken,
   presentation_submission: zPexPresentationSubmission.or(zStringToJson2).optional(),
-  refresh_token: z17.string().optional(),
-  token_type: z17.string().optional(),
-  access_token: z17.string().optional(),
-  expires_in: z17.number().optional()
+  refresh_token: z18.string().optional(),
+  token_type: z18.string().optional(),
+  access_token: z18.string().optional(),
+  expires_in: z18.number().optional()
 }).passthrough();
 
 // src/authorization-response/parse-authorization-response-payload.ts
@@ -1571,13 +1662,13 @@ function parseOpenid4VpAuthorizationResponsePayload(payload) {
 }
 
 // src/authorization-response/parse-jarm-authorization-response.ts
-import { Oauth2Error as Oauth2Error11, decodeJwtHeader, zCompactJwe as zCompactJwe3, zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
+import { Oauth2Error as Oauth2Error12, decodeJwtHeader, zCompactJwe as zCompactJwe3, zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
 import { parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
-import z18 from "zod";
+import z19 from "zod";
 async function parseJarmAuthorizationResponse(options) {
   const { jarmResponseJwt, callbacks, authorizationRequestPayload, expectedClientId } = options;
   const jarmAuthorizationResponseJwt = parseWithErrorHandling7(
-    z18.union([zCompactJwt3, zCompactJwe3]),
+    z19.union([zCompactJwt3, zCompactJwe3]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
   );
@@ -1599,7 +1690,7 @@ async function parseJarmAuthorizationResponse(options) {
     authorizationResponsePayload
   });
   if (!authorizationRequestPayload.response_mode || !isJarmResponseMode(authorizationRequestPayload.response_mode)) {
-    throw new Oauth2Error11(
+    throw new Oauth2Error12(
       `Invalid response mode for jarm response. Response mode: '${authorizationRequestPayload.response_mode ?? "fragment"}'`
     );
   }
@@ -1616,7 +1707,9 @@ async function parseOpenid4vpAuthorizationResponse(options) {
   const { authorizationResponse, callbacks, authorizationRequestPayload, origin } = options;
   const expectedClientId = getOpenid4vpClientId({
     origin,
-    authorizationRequestPayload
+    responseMode: authorizationRequestPayload.response_mode,
+    clientId: authorizationRequestPayload.client_id,
+    legacyClientIdScheme: authorizationRequestPayload.client_id_scheme
   });
   if (authorizationResponse.response) {
     return parseJarmAuthorizationResponse({
@@ -1775,22 +1868,22 @@ var Openid4vpVerifier = class {
 };
 
 // src/models/z-credential-formats.ts
-import { z as z19 } from "zod";
-var zCredentialFormat = z19.enum(["jwt_vc_json", "ldp_vc", "ac_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
+import { z as z20 } from "zod";
+var zCredentialFormat = z20.enum(["jwt_vc_json", "ldp_vc", "ac_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
 
 // src/models/z-proof-formats.ts
-import { z as z20 } from "zod";
-var zProofFormat = z20.enum(["jwt_vp_json", "ldc_vp", "ac_vp", "dc+sd-jwt", "vc+sd-jwt", "mso_mdoc"]);
+import { z as z21 } from "zod";
+var zProofFormat = z21.enum(["jwt_vp_json", "ldc_vp", "ac_vp", "dc+sd-jwt", "vc+sd-jwt", "mso_mdoc"]);
 
 // src/models/z-wallet-metadata.ts
-import { z as z21 } from "zod";
-var zWalletMetadata = z21.object({
-  presentation_definition_uri_supported: z21.optional(z21.boolean()),
+import { z as z22 } from "zod";
+var zWalletMetadata = z22.object({
+  presentation_definition_uri_supported: z22.optional(z22.boolean()),
   vp_formats_supported: zVpFormatsSupported,
-  client_id_schemes_supported: z21.optional(z21.array(zClientIdScheme)),
-  request_object_signing_alg_values_supported: z21.optional(z21.array(z21.string())),
-  authorization_encryption_alg_values_supported: z21.optional(z21.array(z21.string())),
-  authorization_encryption_enc_values_supported: z21.optional(z21.array(z21.string()))
+  client_id_schemes_supported: z22.optional(z22.array(zClientIdScheme)),
+  request_object_signing_alg_values_supported: z22.optional(z22.array(z22.string())),
+  authorization_encryption_alg_values_supported: z22.optional(z22.array(z22.string())),
+  authorization_encryption_enc_values_supported: z22.optional(z22.array(z22.string()))
 });
 export {
   JarmMode,