@openid4vc/openid4vp 0.3.0-alpha-20250707100752 → 0.3.0-alpha-20250707121837

package/dist/index.js

@@ -50,7 +50,7 @@ __export(index_exports, {
   validateOpenid4vpAuthorizationRequestPayload: () => validateOpenid4vpAuthorizationRequestPayload,
   validateOpenid4vpAuthorizationResponsePayload: () => validateOpenid4vpAuthorizationResponsePayload,
   verifyJarmAuthorizationResponse: () => verifyJarmAuthorizationResponse,
-  zClientIdScheme: () => zClientIdScheme,
+  zClientIdPrefix: () => zClientIdPrefix,
   zClientMetadata: () => zClientMetadata,
   zCredentialFormat: () => zCredentialFormat,
   zJarmClientMetadata: () => zJarmClientMetadata,
@@ -61,8 +61,9 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/client-identifier-scheme/parse-client-identifier-scheme.ts
+// src/client-identifier-prefix/parse-client-identifier-prefix.ts
 var import_oauth23 = require("@openid4vc/oauth2");
+var import_oauth24 = require("@openid4vc/oauth2");
 var import_utils5 = require("@openid4vc/utils");
 
 // src/authorization-request/z-authorization-request-dc-api.ts
@@ -117,7 +118,7 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
       type: "sign_encrypt",
       client_metadata: {
         ...SignEncrypt.data,
-        authorization_encrypted_response_enc: client_metadata.authorization_encrypted_response_enc ?? "A128CBC-HS256"
+        authorization_encrypted_response_enc: client_metadata.authorization_encrypted_response_enc
       }
     };
   }
@@ -127,7 +128,7 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
       type: "encrypt",
       client_metadata: {
         ...encryptOnly.data,
-        authorization_encrypted_response_enc: parsedClientMeta.authorization_encrypted_response_enc ?? "A128CBC-HS256"
+        authorization_encrypted_response_enc: parsedClientMeta.authorization_encrypted_response_enc
       }
     };
   }
@@ -137,7 +138,7 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
       type: "sign",
       client_metadata: {
         ...signOnly.data,
-        authorization_signed_response_alg: parsedClientMeta.authorization_signed_response_alg ?? "RS256"
+        authorization_signed_response_alg: parsedClientMeta.authorization_signed_response_alg
       }
     };
   }
@@ -146,7 +147,36 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
 
 // src/models/z-vp-formats-supported.ts
 var import_zod2 = require("zod");
-var zVpFormatsSupported = import_zod2.z.record(
+var zVpFormatsSupported = import_zod2.z.object({
+  "dc+sd-jwt": import_zod2.z.optional(
+    import_zod2.z.object({
+      "sd-jwt_alg_values": import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string()).nonempty()),
+      "kb-jwt_alg_values": import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string()).nonempty())
+    }).passthrough()
+  ),
+  jwt_vc_json: import_zod2.z.optional(
+    import_zod2.z.object({
+      alg_values: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string()).nonempty())
+    }).passthrough()
+  ),
+  ldp_vc: import_zod2.z.optional(
+    import_zod2.z.object({
+      proof_type_values: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string()).nonempty()),
+      cryptosuite_values: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string()).nonempty())
+    }).passthrough()
+  ),
+  mso_mdoc: import_zod2.z.optional(
+    import_zod2.z.object({
+      // Draft 27
+      issuer_signed_alg_values: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.number()).nonempty()),
+      device_signed_alg_values: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.number()).nonempty()),
+      // Draft 28+
+      issuerauth_alg_values: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.number()).nonempty()),
+      deviceauth_alg_values: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.number()).nonempty())
+    }).passthrough()
+  )
+}).passthrough().catchall(import_zod2.z.object({}).passthrough());
+var zLegacyVpFormats = import_zod2.z.record(
   import_zod2.z.string(),
   import_zod2.z.object({
     alg_values_supported: import_zod2.z.optional(import_zod2.z.array(import_zod2.z.string()))
@@ -158,7 +188,12 @@ var zClientMetadata = import_zod3.z.object({
   // Up until draft 22
   jwks_uri: import_zod3.z.string().url().optional(),
   jwks: import_zod3.z.optional(import_oauth22.zJwkSet),
-  vp_formats: import_zod3.z.optional(zVpFormatsSupported),
+  // Up until draft 26
+  vp_formats: import_zod3.z.optional(zLegacyVpFormats),
+  // From draft 27
+  vp_formats_supported: import_zod3.z.optional(zVpFormatsSupported),
+  // From draft 28
+  encrypted_response_enc_values_supported: import_zod3.z.optional(import_zod3.z.array(import_zod3.z.string())),
   ...zJarmClientMetadata.shape,
   logo_uri: import_utils2.zHttpsUrl.optional(),
   client_name: import_zod3.z.string().optional()
@@ -200,9 +235,11 @@ var zOpenid4vpAuthorizationRequest = import_zod5.z.object({
     "did",
     "verifier_attestation",
     "x509_san_dns",
-    "x509_san_uri"
+    "x509_san_uri",
+    "x509_hash"
   ]).optional(),
-  verifier_attestations: zVerifierAttestations.optional()
+  verifier_attestations: zVerifierAttestations.optional(),
+  verifier_info: zVerifierAttestations.optional()
 }).passthrough();
 var zOpenid4vpAuthorizationRequestFromUriParams = import_zod5.z.string().url().transform((url) => Object.fromEntries(new import_utils3.URL(url).searchParams)).pipe(
   import_zod5.z.object({
@@ -210,7 +247,8 @@ var zOpenid4vpAuthorizationRequestFromUriParams = import_zod5.z.string().url().t
     client_metadata: import_utils3.zStringToJson.optional(),
     dcql_query: import_utils3.zStringToJson.optional(),
     transaction_data: import_utils3.zStringToJson.optional(),
-    verifier_attestations: import_utils3.zStringToJson.optional()
+    verifier_attestations: import_utils3.zStringToJson.optional(),
+    verifier_info: import_utils3.zStringToJson.optional()
   }).passthrough()
 );
 
@@ -225,7 +263,8 @@ var zOpenid4vpAuthorizationRequestDcApi = zOpenid4vpAuthorizationRequest.pick({
   dcql_query: true,
   trust_chain: true,
   state: true,
-  verifier_attestations: true
+  verifier_attestations: true,
+  verifier_info: true
 }).extend({
   client_id: import_zod6.z.optional(import_zod6.z.string()),
   expected_origins: import_zod6.z.array(import_zod6.z.string()).optional(),
@@ -242,31 +281,55 @@ function isOpenid4vpAuthorizationRequestDcApi(request) {
   return isOpenid4vpResponseModeDcApi(request.response_mode);
 }
 
-// src/client-identifier-scheme/z-client-id-scheme.ts
+// src/client-identifier-prefix/z-client-id-prefix.ts
 var import_utils4 = require("@openid4vc/utils");
 var import_zod7 = require("zod");
-var zClientIdScheme = import_zod7.z.enum([
+var zClientIdPrefix = import_zod7.z.enum([
   "pre-registered",
   "redirect_uri",
-  "https",
   "verifier_attestation",
+  "https",
+  // pre draft 26
+  "openid_federation",
+  // from draft 26
   "did",
-  "x509_san_dns",
+  // pre draft 26
+  "decentralized_identifier",
+  // from draft 26
   "x509_san_uri",
+  // pre-draft 25
+  "x509_hash",
+  // from draft 25
+  "x509_san_dns",
+  "origin",
+  // from draft 25
   "web-origin"
+  // pre-draft 25
 ]);
-var zClientIdToClientIdScheme = import_zod7.z.union(
+var zUniformClientIdPrefix = zClientIdPrefix.exclude(["did", "https", "web-origin"]);
+var zClientIdToClientIdPrefixAndIdentifier = import_zod7.z.union(
   [
     import_zod7.z.string({ message: "client_id MUST be a string" }).includes(":").transform((clientId) => {
-      const clientIdScheme = clientId.split(":")[0];
-      return clientIdScheme === "http" && (0, import_utils4.getGlobalConfig)().allowInsecureUrls ? "https" : clientIdScheme;
-    }).pipe(zClientIdScheme.exclude(["pre-registered"])),
-    import_zod7.z.string().refine((clientId) => clientId.includes(":") === false).transform(() => "pre-registered")
+      const colonIndex = clientId.indexOf(":");
+      const clientIdPrefix = clientId.slice(0, colonIndex);
+      const clientIdIdentifier = clientId.slice(colonIndex + 1);
+      if (clientIdPrefix === "http" && (0, import_utils4.getGlobalConfig)().allowInsecureUrls) {
+        return ["https", clientId];
+      }
+      if (clientIdPrefix === "did" || clientIdPrefix === "http" || clientIdPrefix === "https") {
+        return [clientIdPrefix, clientId];
+      }
+      return [clientIdPrefix, clientIdIdentifier];
+    }).pipe(import_zod7.z.tuple([zClientIdPrefix.exclude(["pre-registered"]), import_zod7.z.string()])),
+    import_zod7.z.string().refine((clientId) => clientId.includes(":") === false).transform((clientId) => ["pre-registered", clientId])
   ],
   {
-    message: `client_id must either start with a known prefix followed by ':' or contain no ':'. Known prefixes are ${zClientIdScheme.exclude(["pre-registered"]).options.join(", ")}`
+    message: `client_id must either start with a known prefix followed by ':' or contain no ':'. Known prefixes are ${zClientIdPrefix.exclude(["pre-registered"]).options.join(", ")}`
   }
 );
+var zClientIdPrefixToUniform = zClientIdPrefix.transform(
+  (prefix) => prefix === "did" ? "decentralized_identifier" : prefix === "https" ? "openid_federation" : prefix === "web-origin" ? "origin" : prefix
+);
 var zLegacyClientIdScheme = import_zod7.z.enum([
   "pre-registered",
   "redirect_uri",
@@ -276,10 +339,15 @@ var zLegacyClientIdScheme = import_zod7.z.enum([
   "x509_san_dns",
   "x509_san_uri"
 ]);
-var zLegacyClientIdSchemeToClientIdScheme = zLegacyClientIdScheme.optional().default("pre-registered").transform((clientIdScheme) => clientIdScheme === "entity_id" ? "https" : clientIdScheme);
+var zLegacyClientIdSchemeToClientIdPrefix = zLegacyClientIdScheme.optional().default("pre-registered").transform(
+  (clientIdScheme) => clientIdScheme === "entity_id" ? "openid_federation" : clientIdScheme === "did" ? "decentralized_identifier" : clientIdScheme
+);
 
-// src/client-identifier-scheme/parse-client-identifier-scheme.ts
+// src/client-identifier-prefix/parse-client-identifier-prefix.ts
 function getOpenid4vpClientId(options) {
+  const original = {
+    clientId: options.clientId
+  };
   if (isOpenid4vpResponseModeDcApi(options.responseMode)) {
     if (!options.clientId) {
       if (!options.origin) {
@@ -289,20 +357,37 @@ function getOpenid4vpClientId(options) {
         });
       }
       return {
-        clientIdScheme: "web-origin",
-        clientId: `web-origin:${options.origin}`
+        clientIdPrefix: "origin",
+        effectiveClientIdPrefix: "origin",
+        clientIdIdentifier: options.origin,
+        // FIXME: draft 24 uses web-origin, draft 25+ uses origin
+        // But it's not really possible to know which one to use as the
+        // 'effective' client id. Defaulting to origin: since that's newer
+        effectiveClientId: `origin:${options.origin}`,
+        original
       };
     }
-    const parsedClientIdScheme2 = zClientIdToClientIdScheme.safeParse(options.clientId);
-    if (!parsedClientIdScheme2.success) {
+    const parsedClientIdPrefixAndIdentifier2 = zClientIdToClientIdPrefixAndIdentifier.safeParse(options.clientId);
+    if (!parsedClientIdPrefixAndIdentifier2.success) {
+      throw new import_oauth23.Oauth2ServerErrorResponseError({
+        error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
+        error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
+      });
+    }
+    const [clientIdScheme2, clientIdIdentifier2] = parsedClientIdPrefixAndIdentifier2.data;
+    const uniformClientIdScheme2 = zClientIdPrefixToUniform.safeParse(clientIdScheme2);
+    if (!uniformClientIdScheme2.success) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
       });
     }
     return {
-      clientId: options.clientId,
-      clientIdScheme: parsedClientIdScheme2.data
+      effectiveClientId: options.clientId,
+      effectiveClientIdPrefix: clientIdScheme2,
+      original,
+      clientIdPrefix: uniformClientIdScheme2.data,
+      clientIdIdentifier: clientIdIdentifier2
     };
   }
   if (!options.clientId) {
@@ -312,62 +397,75 @@ function getOpenid4vpClientId(options) {
     });
   }
   if (options.legacyClientIdScheme) {
-    const parsedClientIdScheme2 = zLegacyClientIdSchemeToClientIdScheme.safeParse(options.legacyClientIdScheme);
-    if (!parsedClientIdScheme2.success) {
+    const parsedClientIdPrefix = zLegacyClientIdSchemeToClientIdPrefix.safeParse(options.legacyClientIdScheme);
+    if (!parsedClientIdPrefix.success) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
         error_description: `Failed to parse client identifier. Unsupported client_id_scheme value '${options.legacyClientIdScheme}'.`
       });
     }
-    const clientIdScheme = parsedClientIdScheme2.data;
+    const clientIdPrefix = parsedClientIdPrefix.data;
     return {
-      clientId: clientIdScheme === "https" || clientIdScheme === "did" || clientIdScheme === "pre-registered" ? options.clientId : `${parsedClientIdScheme2.data}:${options.clientId}`,
-      clientIdScheme: parsedClientIdScheme2.data,
-      legacyClientId: options.clientId
+      effectiveClientId: options.clientId,
+      clientIdIdentifier: options.clientId,
+      clientIdPrefix,
+      effectiveClientIdPrefix: options.legacyClientIdScheme ?? "pre-registered",
+      original: {
+        ...original,
+        clientIdScheme: options.legacyClientIdScheme
+      }
     };
   }
-  const parsedClientIdScheme = zClientIdToClientIdScheme.safeParse(options.clientId);
-  if (!parsedClientIdScheme.success) {
+  const parsedClientIdPrefixAndIdentifier = zClientIdToClientIdPrefixAndIdentifier.safeParse(options.clientId);
+  if (!parsedClientIdPrefixAndIdentifier.success) {
+    throw new import_oauth23.Oauth2ServerErrorResponseError({
+      error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
+      error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
+    });
+  }
+  const [clientIdScheme, clientIdIdentifier] = parsedClientIdPrefixAndIdentifier.data;
+  const uniformClientIdScheme = zClientIdPrefixToUniform.safeParse(clientIdScheme);
+  if (!uniformClientIdScheme.success) {
     throw new import_oauth23.Oauth2ServerErrorResponseError({
       error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
       error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
     });
   }
   return {
-    clientId: options.clientId,
-    clientIdScheme: parsedClientIdScheme.data
+    effectiveClientId: options.clientId,
+    clientIdPrefix: uniformClientIdScheme.data,
+    effectiveClientIdPrefix: clientIdScheme,
+    clientIdIdentifier,
+    original
   };
 }
-function validateOpenid4vpClientId(options, parserConfig) {
+async function validateOpenid4vpClientId(options, parserConfig) {
   const { authorizationRequestPayload, jar, origin } = options;
   const parserConfigWithDefaults = {
-    supportedSchemes: parserConfig?.supportedSchemes || Object.values(zClientIdScheme.options)
+    supportedSchemes: parserConfig?.supportedSchemes || Object.values(zClientIdPrefix.options)
   };
-  const { clientId, legacyClientId, clientIdScheme } = getOpenid4vpClientId({
+  const { clientIdIdentifier, clientIdPrefix, effectiveClientId, original } = getOpenid4vpClientId({
     clientId: authorizationRequestPayload.client_id,
     legacyClientIdScheme: authorizationRequestPayload.client_id_scheme,
     responseMode: authorizationRequestPayload.response_mode,
     origin
   });
-  if (clientIdScheme === "pre-registered") {
+  if (clientIdPrefix === "pre-registered") {
     return {
-      scheme: "pre-registered",
-      identifier: clientId,
-      originalValue: clientId,
-      legacyClientId,
-      clientMetadata: authorizationRequestPayload.client_metadata
+      prefix: "pre-registered",
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original
     };
   }
-  const colonIndex = clientId.indexOf(":");
-  const identifierPart = clientId.substring(colonIndex + 1);
-  if (!parserConfigWithDefaults.supportedSchemes.includes(clientIdScheme)) {
+  if (!parserConfigWithDefaults.supportedSchemes.includes(clientIdPrefix)) {
     throw new import_oauth23.Oauth2ServerErrorResponseError({
       error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-      error_description: `Unsupported client identifier scheme. ${clientIdScheme} is not supported.`
+      error_description: `Unsupported client identifier scheme. ${clientIdPrefix} is not supported.`
     });
   }
-  if (clientIdScheme === "https") {
-    if (!import_utils5.zHttpsUrl.safeParse(clientId).success) {
+  if (clientIdPrefix === "openid_federation") {
+    if (!import_utils5.zHttpsUrl.safeParse(clientIdIdentifier).success) {
       throw new import_oauth23.Oauth2ServerErrorResponseError(
         {
           error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
@@ -391,14 +489,14 @@ function validateOpenid4vpClientId(options, parserConfig) {
       });
     }
     return {
-      scheme: clientIdScheme,
-      identifier: clientId,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: "openid_federation",
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
       trustChain: authorizationRequestPayload.trust_chain
     };
   }
-  if (clientIdScheme === "redirect_uri") {
+  if (clientIdPrefix === "redirect_uri") {
     if (jar) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
@@ -412,14 +510,15 @@ function validateOpenid4vpClientId(options, parserConfig) {
       });
     }
     return {
-      scheme: clientIdScheme,
-      identifier: identifierPart,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: clientIdPrefix,
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
+      clientMetadata: authorizationRequestPayload.client_metadata,
       redirectUri: authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri
     };
   }
-  if (clientIdScheme === "did") {
+  if (clientIdPrefix === "decentralized_identifier") {
     if (!jar) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
@@ -432,113 +531,115 @@ function validateOpenid4vpClientId(options, parserConfig) {
         error_description: "Something went wrong. The JWT signer method is not did but the client identifier scheme is did."
       });
     }
-    if (!clientId.startsWith("did:")) {
+    if (!clientIdIdentifier.startsWith("did:")) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-        error_description: "Invalid client identifier. Client identifier must start with 'did:'"
+        error_description: "Invalid client identifier. Client id identifier must start with 'did:'"
       });
     }
     const [did] = jar.signer.didUrl.split("#");
-    if (clientId !== did) {
+    if (clientIdIdentifier !== did) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-        error_description: 'With client identifier scheme "did" the JAR request must be signed by the same DID as the client identifier.'
+        error_description: `With client identifier scheme '${clientIdPrefix}' the JAR request must be signed by the same DID as the client identifier.`
       });
     }
     return {
-      scheme: clientIdScheme,
-      identifier: clientId,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: "decentralized_identifier",
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
+      clientMetadata: authorizationRequestPayload.client_metadata,
       didUrl: jar.signer.didUrl
     };
   }
-  if (clientIdScheme === "x509_san_dns" || clientIdScheme === "x509_san_uri") {
+  if (clientIdPrefix === "x509_san_dns" || clientIdPrefix === "x509_san_uri" || clientIdPrefix === "x509_hash") {
     if (!jar) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-        error_description: 'Using client identifier scheme "x509_san_dns" or "x509_san_uri" requires a signed JAR request.'
+        error_description: `Using client identifier scheme '${clientIdPrefix}' requires a signed JAR request.`
       });
     }
     if (jar.signer.method !== "x5c") {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-        error_description: "Something went wrong. The JWT signer method is not x5c but the client identifier scheme is x509_san_dns."
+        error_description: `Something went wrong. The JWT signer method is not x5c but the client identifier scheme is '${clientIdPrefix}'`
       });
     }
-    if (clientIdScheme === "x509_san_dns") {
-      if (!options.callbacks.getX509CertificateMetadata) {
-        throw new import_oauth23.Oauth2ServerErrorResponseError(
-          {
-            error: import_oauth23.Oauth2ErrorCodes.ServerError
-          },
-          {
-            internalMessage: "Missing required 'getX509CertificateMetadata' callback for verification of 'x509_san_dns' client id scheme"
-          }
-        );
-      }
+    if (!options.callbacks.getX509CertificateMetadata) {
+      throw new import_oauth23.Oauth2ServerErrorResponseError(
+        {
+          error: import_oauth23.Oauth2ErrorCodes.ServerError
+        },
+        {
+          internalMessage: `Missing required 'getX509CertificateMetadata' callback for verification of '${clientIdPrefix}' client id scheme`
+        }
+      );
+    }
+    if (clientIdPrefix === "x509_san_dns") {
       const { sanDnsNames } = options.callbacks.getX509CertificateMetadata(jar.signer.x5c[0]);
-      if (!sanDnsNames.includes(identifierPart)) {
+      if (!sanDnsNames.includes(clientIdIdentifier)) {
         throw new import_oauth23.Oauth2ServerErrorResponseError({
           error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-          error_description: `Invalid client identifier. One of the leaf certificates san dns names [${sanDnsNames.join(", ")}] must match the client identifier '${identifierPart}'. `
+          error_description: `Invalid client identifier. One of the leaf certificates san dns names [${sanDnsNames.join(", ")}] must match the client identifier '${clientIdIdentifier}'. `
         });
       }
       if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
         const uri = authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri;
-        if (!uri || new import_utils5.URL(uri).hostname !== identifierPart) {
+        if (!uri || new import_utils5.URL(uri).hostname !== clientIdIdentifier) {
           throw new import_oauth23.Oauth2ServerErrorResponseError({
             error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
             error_description: "Invalid client identifier. The fully qualified domain name of the redirect_uri value MUST match the Client Identifier without the prefix x509_san_dns."
           });
         }
       }
-    } else if (clientIdScheme === "x509_san_uri") {
-      if (!options.callbacks.getX509CertificateMetadata) {
-        throw new import_oauth23.Oauth2ServerErrorResponseError(
-          {
-            error: import_oauth23.Oauth2ErrorCodes.ServerError
-          },
-          {
-            internalMessage: "Missing required 'getX509CertificateMetadata' callback for verification of 'x509_san_uri' client id scheme"
-          }
-        );
-      }
+    } else if (clientIdPrefix === "x509_san_uri") {
       const { sanUriNames } = options.callbacks.getX509CertificateMetadata(jar.signer.x5c[0]);
-      if (!sanUriNames.includes(identifierPart)) {
+      if (!sanUriNames.includes(clientIdIdentifier)) {
         throw new import_oauth23.Oauth2ServerErrorResponseError({
           error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
-          error_description: `Invalid client identifier. One of the leaf certificates san uri names [${sanUriNames.join(", ")}] must match the client identifier '${identifierPart}'.`
+          error_description: `Invalid client identifier. One of the leaf certificates san uri names [${sanUriNames.join(", ")}] must match the client identifier '${clientIdIdentifier}'.`
         });
       }
       if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
         const uri = authorizationRequestPayload.redirect_uri || authorizationRequestPayload.response_uri;
-        if (!uri || uri !== identifierPart) {
+        if (!uri || uri !== clientIdIdentifier) {
           throw new import_oauth23.Oauth2ServerErrorResponseError({
             error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
             error_description: "The redirect_uri value MUST match the Client Identifier without the prefix x509_san_uri"
           });
         }
       }
+    } else if (clientIdPrefix === "x509_hash") {
+      const x509Hash = (0, import_utils5.encodeToBase64Url)(
+        await options.callbacks.hash((0, import_utils5.decodeBase64)(jar.signer.x5c[0]), import_oauth24.HashAlgorithm.Sha256)
+      );
+      if (x509Hash !== clientIdIdentifier) {
+        throw new import_oauth23.Oauth2ServerErrorResponseError({
+          error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
+          error_description: `Invalid client identifier. Expected the base64url encoded sha-256 hash of the leaf x5c certificate ('${x509Hash}') to match the client identifier '${clientIdIdentifier}'.`
+        });
+      }
     }
     return {
-      scheme: clientIdScheme,
-      identifier: identifierPart,
-      originalValue: clientId,
-      legacyClientId,
-      x5c: jar.signer.x5c
+      prefix: clientIdPrefix,
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
+      x5c: jar.signer.x5c,
+      clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
-  if (clientIdScheme === "web-origin") {
+  if (clientIdPrefix === "origin") {
     return {
-      scheme: clientIdScheme,
-      identifier: identifierPart,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: clientIdPrefix,
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
       clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
-  if (clientIdScheme === "verifier_attestation") {
+  if (clientIdPrefix === "verifier_attestation") {
     if (!jar) {
       throw new import_oauth23.Oauth2ServerErrorResponseError({
         error: import_oauth23.Oauth2ErrorCodes.InvalidRequest,
@@ -547,49 +648,53 @@ function validateOpenid4vpClientId(options, parserConfig) {
     }
   }
   return {
-    scheme: clientIdScheme,
-    identifier: identifierPart,
-    legacyClientId,
-    originalValue: clientId
+    prefix: clientIdPrefix,
+    clientMetadata: authorizationRequestPayload.client_metadata,
+    identifier: clientIdIdentifier,
+    effective: effectiveClientId,
+    original
   };
 }
 
 // src/jarm/jarm-authorization-response/verify-jarm-authorization-response.ts
-var import_oauth26 = require("@openid4vc/oauth2");
+var import_oauth27 = require("@openid4vc/oauth2");
 var import_zod9 = __toESM(require("zod"));
 
 // src/jarm/jarm-extract-jwks.ts
-function extractJwksFromClientMetadata(clientMetadata) {
-  const parsed = zJarmClientMetadataParsed.parse(clientMetadata);
-  const encryptionAlg = parsed.client_metadata.authorization_encrypted_response_enc;
-  const signingAlg = parsed.client_metadata.authorization_signed_response_alg;
-  const encJwk = clientMetadata.jwks.keys.find((key) => key.use === "enc" && key.alg === encryptionAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "enc") ?? // fallback, take first key. HAIP does not specify requirement on enc
-  clientMetadata.jwks.keys?.[0];
-  const sigJwk = clientMetadata.jwks.keys.find((key) => key.use === "sig" && key.alg === signingAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "sig") ?? // falback, take first key
-  clientMetadata.jwks.keys?.[0];
-  return { encJwk, sigJwk };
+function extractJwkFromJwks(jwks, {
+  kid,
+  supportedAlgValues
+}) {
+  if (kid) {
+    return jwks.keys.find((jwk) => jwk.kid === kid);
+  }
+  let algFiltered = jwks.keys.filter((key) => key.alg && supportedAlgValues?.includes(key.alg));
+  if (algFiltered.length === 0) algFiltered = jwks.keys;
+  let encFiltered = algFiltered.filter((key) => key.use === "enc");
+  if (!encFiltered) encFiltered = algFiltered.filter((key) => key.use !== "sig");
+  return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];
 }
 
 // src/jarm/jarm-authorization-response/jarm-validate-authorization-response.ts
-var import_oauth25 = require("@openid4vc/oauth2");
+var import_oauth26 = require("@openid4vc/oauth2");
 var import_utils6 = require("@openid4vc/utils");
 
 // src/jarm/jarm-authorization-response/z-jarm-authorization-response.ts
-var import_oauth24 = require("@openid4vc/oauth2");
+var import_oauth25 = require("@openid4vc/oauth2");
 var import_zod8 = require("zod");
-var zJarmHeader = import_zod8.z.object({ ...import_oauth24.zJwtHeader.shape, apu: import_zod8.z.string().optional(), apv: import_zod8.z.string().optional() });
+var zJarmHeader = import_zod8.z.object({ ...import_oauth25.zJwtHeader.shape, apu: import_zod8.z.string().optional(), apv: import_zod8.z.string().optional() });
 var zJarmAuthorizationResponse = import_zod8.z.object({
   /**
    * iss: The issuer URL of the authorization server that created the response
    * aud: The client_id of the client the response is intended for
    * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.
    */
-  ...import_oauth24.zJwtPayload.shape,
-  ...import_oauth24.zJwtPayload.pick({ iss: true, aud: true, exp: true }).required().shape,
+  ...import_oauth25.zJwtPayload.shape,
+  ...import_oauth25.zJwtPayload.pick({ iss: true, aud: true, exp: true }).required().shape,
   state: import_zod8.z.optional(import_zod8.z.string())
 }).passthrough();
 var zJarmAuthorizationResponseEncryptedOnly = import_zod8.z.object({
-  ...import_oauth24.zJwtPayload.shape,
+  ...import_oauth25.zJwtPayload.shape,
   state: import_zod8.z.optional(import_zod8.z.string())
 }).passthrough();
 
@@ -600,12 +705,12 @@ var jarmAuthorizationResponseValidate = (options) => {
     return;
   }
   if (expectedClientId !== authorizationResponse.aud) {
-    throw new import_oauth25.Oauth2Error(
+    throw new import_oauth26.Oauth2Error(
       `Invalid 'aud' claim in JARM authorization response. Expected '${expectedClientId}' received '${JSON.stringify(authorizationResponse.aud)}'.`
     );
   }
   if (authorizationResponse.exp !== void 0 && authorizationResponse.exp < (0, import_utils6.dateToSeconds)()) {
-    throw new import_oauth25.Oauth2Error("Jarm auth response is expired.");
+    throw new import_oauth26.Oauth2Error("Jarm auth response is expired.");
   }
 };
 
@@ -618,43 +723,51 @@ var JarmMode = /* @__PURE__ */ ((JarmMode2) => {
 })(JarmMode || {});
 var decryptJarmAuthorizationResponseJwt = async (options) => {
   const { jarmAuthorizationResponseJwt, callbacks, authorizationRequestPayload } = options;
-  const encryptionJwk = authorizationRequestPayload.client_metadata?.jwks ? extractJwksFromClientMetadata({
-    ...authorizationRequestPayload.client_metadata,
-    jwks: authorizationRequestPayload.client_metadata.jwks
-  }).encJwk : void 0;
+  let encryptionJwk = void 0;
+  const { header } = (0, import_oauth27.decodeJwtHeader)({
+    jwt: jarmAuthorizationResponseJwt
+  });
+  if (authorizationRequestPayload.client_metadata?.jwks) {
+    encryptionJwk = extractJwkFromJwks(authorizationRequestPayload.client_metadata.jwks, {
+      // Kid always take precedence
+      kid: header.kid,
+      // This value was removed in draft 26, but if it's still provided, we can use it to determine the key to use
+      supportedAlgValues: authorizationRequestPayload.client_metadata.authorization_encrypted_response_alg ? [authorizationRequestPayload.client_metadata.authorization_encrypted_response_alg] : void 0
+    });
+  }
   const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, { jwk: encryptionJwk });
   if (!result.decrypted) {
-    throw new import_oauth26.Oauth2Error("Failed to decrypt jarm auth response.");
+    throw new import_oauth27.Oauth2Error("Failed to decrypt jarm auth response.");
   }
   return result.payload;
 };
 async function verifyJarmAuthorizationResponse(options) {
   const { jarmAuthorizationResponseJwt, callbacks, expectedClientId, authorizationRequestPayload } = options;
-  const requestDataIsEncrypted = import_oauth26.zCompactJwe.safeParse(jarmAuthorizationResponseJwt).success;
+  const requestDataIsEncrypted = import_oauth27.zCompactJwe.safeParse(jarmAuthorizationResponseJwt).success;
   const decryptedRequestData = requestDataIsEncrypted ? await decryptJarmAuthorizationResponseJwt({
     jarmAuthorizationResponseJwt,
     callbacks,
     authorizationRequestPayload
   }) : jarmAuthorizationResponseJwt;
-  const responseIsSigned = import_oauth26.zCompactJwt.safeParse(decryptedRequestData).success;
+  const responseIsSigned = import_oauth27.zCompactJwt.safeParse(decryptedRequestData).success;
   if (!requestDataIsEncrypted && !responseIsSigned) {
-    throw new import_oauth26.Oauth2Error("Jarm Auth Response must be either encrypted, signed, or signed and encrypted.");
+    throw new import_oauth27.Oauth2Error("Jarm Auth Response must be either encrypted, signed, or signed and encrypted.");
   }
   let jarmAuthorizationResponse;
   if (responseIsSigned) {
-    const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_oauth26.decodeJwt)({
+    const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_oauth27.decodeJwt)({
       jwt: decryptedRequestData,
-      headerSchema: import_zod9.default.object({ ...import_oauth26.zJwtHeader.shape, kid: import_zod9.default.string() })
+      headerSchema: import_zod9.default.object({ ...import_oauth27.zJwtHeader.shape, kid: import_zod9.default.string() })
     });
     const response = zJarmAuthorizationResponse.parse(jwsPayload);
-    const jwtSigner = (0, import_oauth26.jwtSignerFromJwt)({ header: jwsProtectedHeader, payload: jwsPayload });
+    const jwtSigner = (0, import_oauth27.jwtSignerFromJwt)({ header: jwsProtectedHeader, payload: jwsPayload });
     const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {
       compact: decryptedRequestData,
       header: jwsProtectedHeader,
       payload: jwsPayload
     });
     if (!verificationResult.verified) {
-      throw new import_oauth26.Oauth2Error("Jarm Auth Response is not valid.");
+      throw new import_oauth27.Oauth2Error("Jarm Auth Response is not valid.");
     }
     jarmAuthorizationResponse = response;
   } else {
@@ -671,11 +784,11 @@ async function verifyJarmAuthorizationResponse(options) {
 }
 
 // src/authorization-request/create-authorization-request.ts
-var import_oauth210 = require("@openid4vc/oauth2");
+var import_oauth211 = require("@openid4vc/oauth2");
 var import_utils9 = require("@openid4vc/utils");
 
 // src/jar/create-jar-authorization-request.ts
-var import_oauth27 = require("@openid4vc/oauth2");
+var import_oauth28 = require("@openid4vc/oauth2");
 var import_utils7 = require("@openid4vc/utils");
 async function createJarAuthorizationRequest(options) {
   const { jwtSigner, jweEncryptor, authorizationRequestPayload, requestUri, callbacks } = options;
@@ -683,7 +796,7 @@ async function createJarAuthorizationRequest(options) {
   let encryptionJwk;
   const now = options.now ?? /* @__PURE__ */ new Date();
   const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
-    header: { ...(0, import_oauth27.jwtHeaderFromJwtSigner)(jwtSigner), typ: "oauth-authz-req+jwt" },
+    header: { ...(0, import_oauth28.jwtHeaderFromJwtSigner)(jwtSigner), typ: "oauth-authz-req+jwt" },
     payload: {
       iat: (0, import_utils7.dateToSeconds)(now),
       exp: (0, import_utils7.dateToSeconds)((0, import_utils7.addSecondsToDate)(now, options.expiresInSeconds)),
@@ -703,94 +816,94 @@ async function createJarAuthorizationRequest(options) {
 }
 
 // src/authorization-request/validate-authorization-request.ts
-var import_oauth28 = require("@openid4vc/oauth2");
+var import_oauth29 = require("@openid4vc/oauth2");
 var import_utils8 = require("@openid4vc/utils");
 var validateOpenid4vpAuthorizationRequestPayload = (options) => {
   const { params, walletVerificationOptions } = options;
   if (!params.redirect_uri && !params.response_uri) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: `Missing required 'redirect_uri' or 'response_uri' in openid4vp authorization request.`
     });
   }
   if (params.response_uri && !["direct_post", "direct_post.jwt"].find((mode) => mode === params.response_mode)) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'response_mode' parameter MUST be 'direct_post' or 'direct_post.jwt' when 'response_uri' is provided. Current: ${params.response_mode}`
     });
   }
   if ([params.presentation_definition_uri, params.presentation_definition, params.dcql_query, params.scope].filter(
     Boolean
   ).length > 1) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Exactly one of the following parameters MUST be present in the authorization request: dcql_query, presentation_definition, presentation_definition_uri, or a scope value representing a Presentation Definition."
     });
   }
   if (params.request_uri_method && !params.request_uri) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "request_uri_method" parameter MUST NOT be present in the authorization request if the "request_uri" parameter is not present.'
     });
   }
   if (params.request_uri_method && !["GET", "POST"].includes(params.request_uri_method)) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequestUriMethod,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequestUriMethod,
       error_description: `The 'request_uri_method' parameter MUST be 'GET' or 'POST'. Current: ${params.request_uri_method}`
     });
   }
   if (params.trust_chain && !import_utils8.zHttpsUrl.safeParse(params.client_id).success) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "trust_chain" parameter MUST NOT be present in the authorization request if the "client_id" is not an OpenId Federation Entity Identifier starting with http:// or https://.'
     });
   }
   if (walletVerificationOptions?.expectedNonce && !params.wallet_nonce) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "wallet_nonce" parameter MUST be present in the authorization request when the "expectedNonce" parameter is provided.'
     });
   }
   if (walletVerificationOptions?.expectedNonce !== params.wallet_nonce) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "wallet_nonce" parameter MUST match the "expectedNonce" parameter when the "expectedNonce" parameter is provided.'
     });
   }
-  if (params.client_id.startsWith("web-origin:")) {
-    throw new import_oauth28.Oauth2ServerErrorResponseError({
-      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
-      error_description: `The 'client_id' parameter MUST NOT use client identifier scheme 'web-origin' when not using the dc_api response mode. Current: ${params.client_id}`
+  if (params.client_id.startsWith("web-origin:") || params.client_id.startsWith("origin:")) {
+    throw new import_oauth29.Oauth2ServerErrorResponseError({
+      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+      error_description: `The 'client_id' parameter MUST NOT use client identifier scheme '${params.client_id.split(":")[0]}' when not using the dc_api response mode. Current: ${params.client_id}`
     });
   }
 };
 
 // src/authorization-request/validate-authorization-request-dc-api.ts
-var import_oauth29 = require("@openid4vc/oauth2");
+var import_oauth210 = require("@openid4vc/oauth2");
 var validateOpenid4vpAuthorizationRequestDcApiPayload = (options) => {
   const { params, isJarRequest, disableOriginValidation, origin } = options;
   if (isJarRequest && !params.expected_origins) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combinaction with jar.`
     });
   }
   if ([params.presentation_definition, params.dcql_query].filter(Boolean).length !== 1) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Exactly one of the following parameters MUST be present in the Authorization Request: dcql_query or presentation_definition"
     });
   }
   if (params.expected_origins && !disableOriginValidation) {
     if (!origin) {
-      throw new import_oauth29.Oauth2ServerErrorResponseError({
-        error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth210.Oauth2ServerErrorResponseError({
+        error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
         error_description: `Failed to validate the 'origin' of the authorization request. The 'origin' was not provided.`
       });
     }
     if (params.expected_origins && !params.expected_origins.includes(origin)) {
-      throw new import_oauth29.Oauth2ServerErrorResponseError({
-        error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth210.Oauth2ServerErrorResponseError({
+        error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
         error_description: `The 'expected_origins' parameter MUST include the origin of the authorization request. Current: ${params.expected_origins.join(", ")}`
       });
     }
@@ -809,7 +922,7 @@ async function createOpenid4vpAuthorizationRequest(options) {
       "Invalid authorization request. Could not parse openid4vp dc_api authorization request."
     );
     if (jar && !authorizationRequestPayload.expected_origins) {
-      throw new import_oauth210.Oauth2Error(
+      throw new import_oauth211.Oauth2Error(
         `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combination with jar.`
       );
     }
@@ -867,12 +980,12 @@ async function createOpenid4vpAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-authorization-request-params.ts
-var import_oauth212 = require("@openid4vc/oauth2");
+var import_oauth213 = require("@openid4vc/oauth2");
 var import_utils11 = require("@openid4vc/utils");
 var import_zod11 = __toESM(require("zod"));
 
 // src/jar/z-jar-authorization-request.ts
-var import_oauth211 = require("@openid4vc/oauth2");
+var import_oauth212 = require("@openid4vc/oauth2");
 var import_utils10 = require("@openid4vc/utils");
 var import_zod10 = require("zod");
 var zJarAuthorizationRequest = import_zod10.z.object({
@@ -884,13 +997,13 @@ var zJarAuthorizationRequest = import_zod10.z.object({
 function validateJarRequestParams(options) {
   const { jarRequestParams } = options;
   if (jarRequestParams.request && jarRequestParams.request_uri) {
-    throw new import_oauth211.Oauth2ServerErrorResponseError({
+    throw new import_oauth212.Oauth2ServerErrorResponseError({
       error: "invalid_request_object",
       error_description: "request and request_uri cannot both be present in a JAR request"
     });
   }
   if (!jarRequestParams.request && !jarRequestParams.request_uri) {
-    throw new import_oauth211.Oauth2ServerErrorResponseError({
+    throw new import_oauth212.Oauth2ServerErrorResponseError({
       error: "invalid_request_object",
       error_description: "request or request_uri must be present"
     });
@@ -915,7 +1028,7 @@ function parseOpenid4vpAuthorizationRequest(options) {
       );
       provided = "uri";
     } else {
-      const decoded = (0, import_oauth212.decodeJwt)({ jwt: authorizationRequest });
+      const decoded = (0, import_oauth213.decodeJwt)({ jwt: authorizationRequest });
       params = decoded.payload;
       provided = "jwt";
     }
@@ -948,12 +1061,12 @@ function parseOpenid4vpAuthorizationRequest(options) {
 }
 
 // src/authorization-request/resolve-authorization-request.ts
-var import_oauth219 = require("@openid4vc/oauth2");
+var import_oauth220 = require("@openid4vc/oauth2");
 var import_utils15 = require("@openid4vc/utils");
 var import_zod15 = __toESM(require("zod"));
 
 // src/fetch-client-metadata.ts
-var import_oauth213 = require("@openid4vc/oauth2");
+var import_oauth214 = require("@openid4vc/oauth2");
 var import_utils12 = require("@openid4vc/utils");
 async function fetchClientMetadata(options) {
   const { fetch, clientMetadataUri } = options;
@@ -965,28 +1078,70 @@ async function fetchClientMetadata(options) {
     }
   });
   if (!response.ok) {
-    throw new import_oauth213.Oauth2ServerErrorResponseError({
+    throw new import_oauth214.Oauth2ServerErrorResponseError({
       error_description: `Fetching client metadata from '${clientMetadataUri}' failed with status code '${response.status}'.`,
-      error: import_oauth213.Oauth2ErrorCodes.InvalidRequestUri
+      error: import_oauth214.Oauth2ErrorCodes.InvalidRequestUri
     });
   }
   if (!result || !result.success) {
-    throw new import_oauth213.Oauth2ServerErrorResponseError({
+    throw new import_oauth214.Oauth2ServerErrorResponseError({
       error_description: `Parsing client metadata from '${clientMetadataUri}' failed.`,
-      error: import_oauth213.Oauth2ErrorCodes.InvalidRequestObject
+      error: import_oauth214.Oauth2ErrorCodes.InvalidRequestObject
     });
   }
   return result.data;
 }
 
 // src/jar/handle-jar-request/verify-jar-request.ts
-var import_oauth217 = require("@openid4vc/oauth2");
+var import_oauth218 = require("@openid4vc/oauth2");
 var import_zod13 = __toESM(require("zod"));
 
 // src/version.ts
-var import_oauth214 = require("@openid4vc/oauth2");
+var import_oauth215 = require("@openid4vc/oauth2");
 function parseAuthorizationRequestVersion(request) {
   const requirements = [];
+  if (request.verifier_info) {
+    requirements.push([">=", 29]);
+  }
+  if (request.verifier_attestations) {
+    requirements.push(["<", 29]);
+  }
+  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values) {
+    requirements.push([">=", 28]);
+  }
+  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.issuer_signed_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.device_signed_alg_values) {
+    requirements.push(["<", 28]);
+  }
+  if (request.client_metadata?.vp_formats) {
+    requirements.push([">=", 27]);
+  }
+  if (request.client_metadata?.vp_formats_supported) {
+    requirements.push(["<", 27]);
+  }
+  if (request.client_id?.startsWith("openid_federation:") || request.client_id?.startsWith("decentralized_identifier:")) {
+    requirements.push([">=", 26]);
+  }
+  if (request.client_id?.startsWith("did:")) {
+    requirements.push(["<", 26]);
+  }
+  if (request.presentation_definition || request.presentation_definition_uri) {
+    requirements.push([">=", 26]);
+  }
+  if (request.verifier_attestations) {
+    requirements.push([">=", 26]);
+  }
+  if (request.client_id?.startsWith("x509_san_uri:")) {
+    requirements.push(["<", 25]);
+  }
+  if (request.client_id?.startsWith("x509_hash:")) {
+    requirements.push([">=", 25]);
+  }
+  if (request.client_id?.startsWith("web-origin:")) {
+    requirements.push(["<", 25]);
+  }
+  if (request.client_id?.startsWith("origin:")) {
+    requirements.push([">=", 25]);
+  }
   if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "w3c_dc_api" || request.response_mode === "w3c_dc_api.jwt")) {
     requirements.push(["<", 23]);
     requirements.push([">=", 21]);
@@ -1006,7 +1161,7 @@ function parseAuthorizationRequestVersion(request) {
   if (request.client_id) {
     const colonIndex = request.client_id.indexOf(":");
     const schemePart = request.client_id.substring(0, colonIndex);
-    const parsedScheme = zClientIdScheme.safeParse(schemePart);
+    const parsedScheme = zClientIdPrefix.safeParse(schemePart);
     if (parsedScheme.success && parsedScheme.data !== "did" && parsedScheme.data !== "https") {
       requirements.push([">=", 22]);
     }
@@ -1014,6 +1169,9 @@ function parseAuthorizationRequestVersion(request) {
   if (!request.client_id) {
     requirements.push([">=", 21]);
   }
+  if (request.dcql_query) {
+    requirements.push([">=", 21]);
+  }
   if (request.client_metadata_uri) {
     requirements.push(["<", 21]);
   }
@@ -1031,11 +1189,11 @@ function parseAuthorizationRequestVersion(request) {
   }
   const lessThanVersions = requirements.filter(([operator]) => operator === "<").map(([_, version]) => version);
   const greaterThanVersions = requirements.filter(([operator]) => operator === ">=").map(([_, version]) => version);
-  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 24;
+  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 29;
   const lowestRequiredVersion = greaterThanVersions.length > 0 ? Math.max(...greaterThanVersions) : 18;
   if (lowestRequiredVersion > highestPossibleVersion) {
-    throw new import_oauth214.Oauth2ServerErrorResponseError({
-      error: import_oauth214.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth215.Oauth2ServerErrorResponseError({
+      error: import_oauth215.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Could not infer openid4vp version from the openid4vp request payload."
     });
   }
@@ -1043,7 +1201,7 @@ function parseAuthorizationRequestVersion(request) {
 }
 
 // src/jar/jar-request-object/fetch-jar-request-object.ts
-var import_oauth215 = require("@openid4vc/oauth2");
+var import_oauth216 = require("@openid4vc/oauth2");
 var import_utils13 = require("@openid4vc/utils");
 async function fetchJarRequestObject(options) {
   const { requestUri, clientIdentifierScheme, method, wallet, fetch } = options;
@@ -1060,25 +1218,25 @@ async function fetchJarRequestObject(options) {
       "Content-Type": import_utils13.ContentType.XWwwFormUrlencoded
     }
   }).catch(() => {
-    throw new import_oauth215.Oauth2ServerErrorResponseError({
+    throw new import_oauth216.Oauth2ServerErrorResponseError({
       error_description: `Fetching request_object from request_uri '${requestUri}' failed`,
-      error: import_oauth215.Oauth2ErrorCodes.InvalidRequestUri
+      error: import_oauth216.Oauth2ErrorCodes.InvalidRequestUri
     });
   });
   if (!response.ok) {
-    throw new import_oauth215.Oauth2ServerErrorResponseError({
+    throw new import_oauth216.Oauth2ServerErrorResponseError({
       error_description: `Fetching request_object from request_uri '${requestUri}' failed with status code '${response.status}'.`,
-      error: import_oauth215.Oauth2ErrorCodes.InvalidRequestUri
+      error: import_oauth216.Oauth2ErrorCodes.InvalidRequestUri
     });
   }
   return await response.text();
 }
 
 // src/jar/jar-request-object/z-jar-request-object.ts
-var import_oauth216 = require("@openid4vc/oauth2");
+var import_oauth217 = require("@openid4vc/oauth2");
 var import_zod12 = require("zod");
 var zJarRequestObjectPayload = import_zod12.z.object({
-  ...import_oauth216.zJwtPayload.shape,
+  ...import_oauth217.zJwtPayload.shape,
   client_id: import_zod12.z.string()
 }).passthrough();
 
@@ -1089,11 +1247,11 @@ async function verifyJarRequest(options) {
   const { callbacks, wallet = {} } = options;
   const jarRequestParams = validateJarRequestParams(options);
   const sendBy = jarRequestParams.request ? "value" : "reference";
-  const clientIdentifierScheme = jarRequestParams.client_id ? zClientIdScheme.safeParse(jarRequestParams.client_id.split(":")[0]).data : "web-origin";
+  const clientIdentifierScheme = jarRequestParams.client_id ? zClientIdPrefix.safeParse(jarRequestParams.client_id.split(":")[0]).data : "origin";
   const method = jarRequestParams.request_uri_method ?? "get";
   if (method !== "get" && method !== "post") {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
-      error: import_oauth217.Oauth2ErrorCodes.InvalidRequestUriMethod,
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
+      error: import_oauth218.Oauth2ErrorCodes.InvalidRequestUriMethod,
       error_description: `Invalid request_uri_method. Must be 'get' or 'post'.`
     });
   }
@@ -1104,12 +1262,12 @@ async function verifyJarRequest(options) {
     wallet,
     fetch: callbacks.fetch
   });
-  const requestObjectIsEncrypted = import_oauth217.zCompactJwe.safeParse(requestObject).success;
+  const requestObjectIsEncrypted = import_oauth218.zCompactJwe.safeParse(requestObject).success;
   const { decryptionJwk, payload: decryptedRequestObject } = requestObjectIsEncrypted ? await decryptJarRequest({ jwe: requestObject, callbacks }) : { payload: requestObject, decryptionJwk: void 0 };
-  const requestIsSigned = import_oauth217.zCompactJwt.safeParse(decryptedRequestObject).success;
+  const requestIsSigned = import_oauth218.zCompactJwt.safeParse(decryptedRequestObject).success;
   if (!requestIsSigned) {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
-      error: import_oauth217.Oauth2ErrorCodes.InvalidRequestObject,
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
+      error: import_oauth218.Oauth2ErrorCodes.InvalidRequestObject,
       error_description: "JAR request object is not a valid JWT."
     });
   }
@@ -1118,20 +1276,20 @@ async function verifyJarRequest(options) {
     callbacks
   });
   if (!authorizationRequestPayload.client_id) {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
-      error: import_oauth217.Oauth2ErrorCodes.InvalidRequestObject,
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
+      error: import_oauth218.Oauth2ErrorCodes.InvalidRequestObject,
       error_description: 'Jar Request Object is missing the required "client_id" field.'
     });
   }
   if (!isOpenid4vpResponseModeDcApi(authorizationRequestPayload.response_mode) && jarRequestParams.client_id !== authorizationRequestPayload.client_id) {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
-      error: import_oauth217.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
+      error: import_oauth218.Oauth2ErrorCodes.InvalidRequest,
       error_description: "client_id does not match the request object client_id."
     });
   }
   if (jarRequestParams.client_id_scheme && jarRequestParams.client_id_scheme !== authorizationRequestPayload.client_id_scheme) {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
-      error: import_oauth217.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
+      error: import_oauth218.Oauth2ErrorCodes.InvalidRequest,
       error_description: "client_id_scheme does not match the request object client_id_scheme."
     });
   }
@@ -1145,16 +1303,16 @@ async function verifyJarRequest(options) {
 }
 async function decryptJarRequest(options) {
   const { jwe, callbacks } = options;
-  const { header } = (0, import_oauth217.decodeJwt)({ jwt: jwe });
+  const { header } = (0, import_oauth218.decodeJwt)({ jwt: jwe });
   if (!header.kid) {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
-      error: import_oauth217.Oauth2ErrorCodes.InvalidRequestObject,
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
+      error: import_oauth218.Oauth2ErrorCodes.InvalidRequestObject,
       error_description: 'Jar JWE is missing the protected header field "kid".'
     });
   }
   const decryptionResult = await callbacks.decryptJwe(jwe);
   if (!decryptionResult.decrypted) {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
       error: "invalid_request_object",
       error_description: "Failed to decrypt jar request object."
     });
@@ -1163,17 +1321,17 @@ async function decryptJarRequest(options) {
 }
 async function verifyJarRequestObject(options) {
   const { decryptedRequestObject, callbacks } = options;
-  const jwt = (0, import_oauth217.decodeJwt)({ jwt: decryptedRequestObject, payloadSchema: zJarRequestObjectPayload });
+  const jwt = (0, import_oauth218.decodeJwt)({ jwt: decryptedRequestObject, payloadSchema: zJarRequestObjectPayload });
   let jwtSigner;
-  const { clientIdScheme } = getOpenid4vpClientId({
+  const { clientIdPrefix } = getOpenid4vpClientId({
     responseMode: jwt.payload.response_mode,
     clientId: jwt.payload.client_id,
     legacyClientIdScheme: jwt.payload.client_id_scheme
   });
   const clientIdToSignerMethod = {
-    did: ["did"],
+    decentralized_identifier: ["did"],
     "pre-registered": ["custom", "did", "jwk"],
-    "web-origin": [],
+    origin: [],
     // no signing allowed
     redirect_uri: [],
     // no signing allowed
@@ -1181,12 +1339,13 @@ async function verifyJarRequestObject(options) {
     verifier_attestation: ["did", "federation", "jwk", "x5c", "custom"],
     x509_san_dns: ["x5c"],
     x509_san_uri: ["x5c"],
+    x509_hash: ["x5c"],
     // Handled separately
-    https: []
+    openid_federation: []
   };
-  if (clientIdScheme === "https") {
+  if (clientIdPrefix === "openid_federation") {
     if (!jwt.header.kid) {
-      throw new import_oauth217.Oauth2Error(
+      throw new import_oauth218.Oauth2Error(
         `When OpenID Federation is used for signed authorization request, the 'kid' parameter is required.`
       );
     }
@@ -1197,9 +1356,9 @@ async function verifyJarRequestObject(options) {
       kid: jwt.header.kid
     };
   } else {
-    jwtSigner = (0, import_oauth217.jwtSignerFromJwt)({ ...jwt, allowedSignerMethods: clientIdToSignerMethod[clientIdScheme] });
+    jwtSigner = (0, import_oauth218.jwtSignerFromJwt)({ ...jwt, allowedSignerMethods: clientIdToSignerMethod[clientIdPrefix] });
   }
-  const { signer } = await (0, import_oauth217.verifyJwt)({
+  const { signer } = await (0, import_oauth218.verifyJwt)({
     verifyJwtCallback: callbacks.verifyJwt,
     compact: decryptedRequestObject,
     header: jwt.header,
@@ -1208,8 +1367,8 @@ async function verifyJarRequestObject(options) {
   });
   const version = parseAuthorizationRequestVersion(jwt.payload);
   if (jwt.header.typ !== "oauth-authz-req+jwt" && version >= 24) {
-    throw new import_oauth217.Oauth2ServerErrorResponseError({
-      error: import_oauth217.Oauth2ErrorCodes.InvalidRequestObject,
+    throw new import_oauth218.Oauth2ServerErrorResponseError({
+      error: import_oauth218.Oauth2ErrorCodes.InvalidRequestObject,
       error_description: `Invalid Jar Request Object typ header. Expected "oauth-authz-req+jwt", received "${jwt.header.typ}".`
     });
   }
@@ -1221,7 +1380,7 @@ async function verifyJarRequestObject(options) {
 }
 
 // src/transaction-data/parse-transaction-data.ts
-var import_oauth218 = require("@openid4vc/oauth2");
+var import_oauth219 = require("@openid4vc/oauth2");
 var import_utils14 = require("@openid4vc/utils");
 
 // src/transaction-data/z-transaction-data.ts
@@ -1239,8 +1398,8 @@ function parseTransactionData(options) {
   const decoded = transactionData.map((tdEntry) => (0, import_utils14.parseIfJson)((0, import_utils14.encodeToUtf8String)((0, import_utils14.decodeBase64)(tdEntry))));
   const parsedResult = zTransactionData.safeParse(decoded);
   if (!parsedResult.success) {
-    throw new import_oauth218.Oauth2ServerErrorResponseError({
-      error: import_oauth218.Oauth2ErrorCodes.InvalidTransactionData,
+    throw new import_oauth219.Oauth2ServerErrorResponseError({
+      error: import_oauth219.Oauth2ErrorCodes.InvalidTransactionData,
       error_description: "Failed to parse transaction data."
     });
   }
@@ -1288,7 +1447,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
   if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload) && !clientMetadata && authorizationRequestPayload.client_metadata_uri) {
     clientMetadata = await fetchClientMetadata({ clientMetadataUri: authorizationRequestPayload.client_metadata_uri });
   }
-  const clientMeta = validateOpenid4vpClientId({
+  const clientMeta = await validateOpenid4vpClientId({
     authorizationRequestPayload: {
       ...authorizationRequestPayload,
       client_metadata: clientMetadata
@@ -1301,8 +1460,8 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
   let dcql;
   if (authorizationRequestPayload.presentation_definition || authorizationRequestPayload.presentation_definition_uri) {
     if (authorizationRequestPayload.presentation_definition_uri) {
-      throw new import_oauth219.Oauth2ServerErrorResponseError({
-        error: import_oauth219.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth220.Oauth2ServerErrorResponseError({
+        error: import_oauth220.Oauth2ErrorCodes.InvalidRequest,
         error_description: "Cannot fetch presentation definition from URI. Not supported."
       });
     }
@@ -1321,7 +1480,8 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
     jar,
     client: clientMeta,
     pex,
-    dcql
+    dcql,
+    version: parseAuthorizationRequestVersion(authorizationRequestPayload)
   };
 }
 function validateOpenId4vpAuthorizationRequestPayload(options) {
@@ -1343,7 +1503,7 @@ function validateOpenId4vpAuthorizationRequestPayload(options) {
 }
 
 // src/authorization-response/create-authorization-response.ts
-var import_oauth222 = require("@openid4vc/oauth2");
+var import_oauth223 = require("@openid4vc/oauth2");
 var import_utils16 = require("@openid4vc/utils");
 
 // ../utils/src/date.ts
@@ -1352,7 +1512,7 @@ function addSecondsToDate2(date, seconds) {
 }
 
 // src/jarm/jarm-authorization-response-create.ts
-var import_oauth220 = require("@openid4vc/oauth2");
+var import_oauth221 = require("@openid4vc/oauth2");
 async function createJarmAuthorizationResponse(options) {
   const { jarmAuthorizationResponse, jweEncryptor, jwtSigner, callbacks } = options;
   if (!jwtSigner && jweEncryptor) {
@@ -1361,16 +1521,16 @@ async function createJarmAuthorizationResponse(options) {
   }
   if (jwtSigner && !jweEncryptor) {
     const signed2 = await callbacks.signJwt(jwtSigner, {
-      header: (0, import_oauth220.jwtHeaderFromJwtSigner)(jwtSigner),
+      header: (0, import_oauth221.jwtHeaderFromJwtSigner)(jwtSigner),
       payload: jarmAuthorizationResponse
     });
     return { jarmAuthorizationResponseJwt: signed2.jwt };
   }
   if (!jwtSigner || !jweEncryptor) {
-    throw new import_oauth220.Oauth2Error("JWT signer and/or encryptor are required to create a JARM auth response.");
+    throw new import_oauth221.Oauth2Error("JWT signer and/or encryptor are required to create a JARM auth response.");
   }
   const signed = await callbacks.signJwt(jwtSigner, {
-    header: (0, import_oauth220.jwtHeaderFromJwtSigner)(jwtSigner),
+    header: (0, import_oauth221.jwtHeaderFromJwtSigner)(jwtSigner),
     payload: jarmAuthorizationResponse
   });
   const encrypted = await callbacks.encryptJwe(jweEncryptor, signed.jwt);
@@ -1393,12 +1553,12 @@ var isJarmResponseMode = (responseMode) => {
 };
 
 // src/jarm/metadata/jarm-assert-metadata-supported.ts
-var import_oauth221 = require("@openid4vc/oauth2");
+var import_oauth222 = require("@openid4vc/oauth2");
 function assertValueSupported(options) {
   const { errorMessage, supported, actual } = options;
   const intersection = supported.find((value) => value === actual);
   if (!intersection) {
-    throw new import_oauth221.Oauth2Error(errorMessage);
+    throw new import_oauth222.Oauth2Error(errorMessage);
   }
   return intersection;
 }
@@ -1438,14 +1598,14 @@ async function createOpenid4vpAuthorizationResponse(options) {
     ...options.authorizationResponsePayload,
     state: authorizationRequestPayload.state
   };
-  const { clientIdScheme } = getOpenid4vpClientId({
+  const { clientIdPrefix } = getOpenid4vpClientId({
     responseMode: authorizationRequestPayload.response_mode,
     clientId: authorizationRequestPayload.client_id,
     legacyClientIdScheme: authorizationRequestPayload.client_id_scheme,
     origin
   });
   if (authorizationRequestPayload.response_mode && isJarmResponseMode(authorizationRequestPayload.response_mode) && !jarm) {
-    throw new import_oauth222.Oauth2Error(
+    throw new import_oauth223.Oauth2Error(
       `Missing jarm options for creating Jarm response with response mode '${authorizationRequestPayload.response_mode}'`
     );
   }
@@ -1454,51 +1614,71 @@ async function createOpenid4vpAuthorizationResponse(options) {
       authorizationResponsePayload
     };
   }
-  if (clientIdScheme === "https" && !options.clientMetadata) {
-    throw new import_oauth222.Oauth2Error(
-      "When OpenID Federation is used as the client id scheme (https), passing externally fetched and verified 'clientMetadata' to the 'createOpenid4vpAuthorizationResponse' is required."
+  if (clientIdPrefix === "openid_federation" && !options.clientMetadata) {
+    throw new import_oauth223.Oauth2Error(
+      "When OpenID Federation is used as the client id scheme (https/openid_federation), passing externally fetched and verified 'clientMetadata' to the 'createOpenid4vpAuthorizationResponse' is required."
     );
   }
   const clientMetadata = options.clientMetadata ?? authorizationRequestPayload.client_metadata;
   if (!clientMetadata) {
-    throw new import_oauth222.Oauth2Error("Missing client metadata in the request params to assert Jarm metadata support.");
+    throw new import_oauth223.Oauth2Error("Missing client metadata in the request params to assert Jarm metadata support.");
   }
   let jwks;
   if (clientMetadata.jwks) {
     jwks = clientMetadata.jwks;
   } else if (clientMetadata.jwks_uri) {
-    jwks = await (0, import_oauth222.fetchJwks)(clientMetadata.jwks_uri, options.callbacks.fetch);
+    jwks = await (0, import_oauth223.fetchJwks)(clientMetadata.jwks_uri, options.callbacks.fetch);
   } else {
-    throw new import_oauth222.Oauth2ServerErrorResponseError({
-      error: import_oauth222.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth223.Oauth2ServerErrorResponseError({
+      error: import_oauth223.Oauth2ErrorCodes.InvalidRequest,
       error_description: `Missing 'jwks' or 'jwks_uri' in client metadata. Cannot extract encryption JWK.`
     });
   }
-  const supportedJarmMetadata = jarmAssertMetadataSupported({
-    clientMetadata,
-    serverMetadata: jarm.serverMetadata
-  });
-  const clientMetaJwks = extractJwksFromClientMetadata({
-    ...clientMetadata,
-    jwks
+  if (clientMetadata.authorization_encrypted_response_alg || clientMetadata.authorization_encrypted_response_env || clientMetadata.authorization_signed_response_alg) {
+    jarmAssertMetadataSupported({
+      clientMetadata,
+      serverMetadata: jarm.serverMetadata
+    });
+  }
+  const encJwk = extractJwkFromJwks(jwks, {
+    supportedAlgValues: jarm.serverMetadata.authorization_encryption_alg_values_supported ?? (clientMetadata.authorization_encrypted_response_alg ? [clientMetadata.authorization_encrypted_response_alg] : void 0)
   });
-  if (!clientMetaJwks?.encJwk) {
-    throw new import_oauth222.Oauth2ServerErrorResponseError({
-      error: import_oauth222.Oauth2ErrorCodes.InvalidRequest,
+  if (!encJwk) {
+    throw new import_oauth223.Oauth2ServerErrorResponseError({
+      error: import_oauth223.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Could not extract encryption JWK from client metadata. Failed to create JARM response."
     });
   }
+  let enc;
+  if (clientMetadata.encrypted_response_enc_values_supported) {
+    enc = jarm.serverMetadata.authorization_encryption_enc_values_supported.find(
+      (enc2) => clientMetadata.encrypted_response_enc_values_supported?.includes(enc2)
+    ) ?? clientMetadata.encrypted_response_enc_values_supported[0];
+  } else {
+    enc = clientMetadata.authorization_encrypted_response_enc ?? "A128GCM";
+  }
+  assertValueSupported({
+    actual: enc,
+    supported: jarm.serverMetadata.authorization_encryption_enc_values_supported,
+    errorMessage: `Invalid 'enc' value ${enc}. Supported values are ${jarm.serverMetadata.authorization_encryption_enc_values_supported.join(", ")}`
+  });
+  const alg = encJwk.alg ?? clientMetadata.authorization_encrypted_response_alg ?? "ECDH-ES";
+  assertValueSupported({
+    actual: alg,
+    supported: jarm.serverMetadata.authorization_encryption_alg_values_supported,
+    errorMessage: `Invalid 'alg' value ${alg}. Supported values are ${jarm.serverMetadata.authorization_encryption_alg_values_supported.join(", ")}`
+  });
   let additionalJwtPayload;
   if (jarm?.jwtSigner) {
     if (!jarm.authorizationServer) {
-      throw new import_oauth222.Oauth2ServerErrorResponseError({
-        error: import_oauth222.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth223.Oauth2ServerErrorResponseError({
+        error: import_oauth223.Oauth2ErrorCodes.InvalidRequest,
         error_description: "Missing required iss in JARM configuration for creating OpenID4VP authorization response."
       });
     }
     if (!jarm.audience) {
-      throw new import_oauth222.Oauth2ServerErrorResponseError({
-        error: import_oauth222.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth223.Oauth2ServerErrorResponseError({
+        error: import_oauth223.Oauth2ErrorCodes.InvalidRequest,
         error_description: "Missing required aud in JARM configuration for creating OpenID4VP authorization response."
       });
     }
@@ -1516,13 +1696,13 @@ async function createOpenid4vpAuthorizationResponse(options) {
   const result = await createJarmAuthorizationResponse({
     jarmAuthorizationResponse: jarmResponsePayload,
     jwtSigner: jarm?.jwtSigner,
-    jweEncryptor: jarm?.encryption && (supportedJarmMetadata.type === "encrypt" || supportedJarmMetadata.type === "sign_encrypt") ? {
+    jweEncryptor: jarm?.encryption ? {
       method: "jwk",
-      publicJwk: clientMetaJwks.encJwk,
+      publicJwk: encJwk,
       apu: jarm.encryption.nonce ? (0, import_utils16.encodeToBase64Url)(jarm.encryption.nonce) : void 0,
       apv: (0, import_utils16.encodeToBase64Url)(authorizationRequestPayload.nonce),
-      alg: supportedJarmMetadata.client_metadata.authorization_encrypted_response_alg,
-      enc: supportedJarmMetadata.client_metadata.authorization_encrypted_response_enc
+      alg,
+      enc
     } : void 0,
     callbacks: {
       signJwt: callbacks.signJwt,
@@ -1536,18 +1716,18 @@ async function createOpenid4vpAuthorizationResponse(options) {
 }
 
 // src/authorization-response/submit-authorization-response.ts
-var import_oauth224 = require("@openid4vc/oauth2");
+var import_oauth225 = require("@openid4vc/oauth2");
 var import_utils18 = require("@openid4vc/utils");
 var import_utils19 = require("@openid4vc/utils");
 
 // src/jarm/jarm-authorizatino-response-send.ts
-var import_oauth223 = require("@openid4vc/oauth2");
+var import_oauth224 = require("@openid4vc/oauth2");
 var import_utils17 = require("@openid4vc/utils");
 var jarmAuthorizationResponseSend = (options) => {
   const { authorizationRequestPayload, jarmAuthorizationResponseJwt, callbacks } = options;
   const responseEndpoint = authorizationRequestPayload.response_uri ?? authorizationRequestPayload.redirect_uri;
   if (!responseEndpoint) {
-    throw new import_oauth223.Oauth2Error(`Either 'response_uri' or 'redirect_uri' MUST  be present in the authorization request`);
+    throw new import_oauth224.Oauth2Error(`Either 'response_uri' or 'redirect_uri' MUST  be present in the authorization request`);
   }
   const responseEndpointUrl = new import_utils17.URL(responseEndpoint);
   return handleDirectPostJwt(responseEndpointUrl, jarmAuthorizationResponseJwt, callbacks);
@@ -1576,7 +1756,7 @@ async function submitOpenid4vpAuthorizationResponse(options) {
     });
   }
   if (!url) {
-    throw new import_oauth224.Oauth2Error(
+    throw new import_oauth225.Oauth2Error(
       "Failed to submit OpenId4Vp Authorization Response. No redirect_uri or response_uri provided."
     );
   }
@@ -1596,7 +1776,7 @@ async function submitOpenid4vpAuthorizationResponse(options) {
 }
 
 // src/authorization-response/validate-authorization-response.ts
-var import_oauth225 = require("@openid4vc/oauth2");
+var import_oauth226 = require("@openid4vc/oauth2");
 
 // src/vp-token/parse-vp-token.ts
 var import_utils20 = require("@openid4vc/utils");
@@ -1638,14 +1818,14 @@ function parseDcqlVpToken(vpToken) {
 function validateOpenid4vpAuthorizationResponsePayload(options) {
   const { authorizationRequestPayload, authorizationResponsePayload } = options;
   if (authorizationRequestPayload.state && authorizationRequestPayload.state !== authorizationResponsePayload.state) {
-    throw new import_oauth225.Oauth2Error("OpenId4Vp Authorization Response state mismatch.");
+    throw new import_oauth226.Oauth2Error("OpenId4Vp Authorization Response state mismatch.");
   }
   if (authorizationResponsePayload.id_token) {
-    throw new import_oauth225.Oauth2Error("OpenId4Vp Authorization Response id_token is not supported.");
+    throw new import_oauth226.Oauth2Error("OpenId4Vp Authorization Response id_token is not supported.");
   }
   if (authorizationResponsePayload.presentation_submission) {
     if (!authorizationRequestPayload.presentation_definition) {
-      throw new import_oauth225.Oauth2Error("OpenId4Vp Authorization Request is missing the required presentation_definition.");
+      throw new import_oauth226.Oauth2Error("OpenId4Vp Authorization Request is missing the required presentation_definition.");
     }
     return {
       type: "pex",
@@ -1673,13 +1853,13 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
       }
     };
   }
-  throw new import_oauth225.Oauth2Error(
+  throw new import_oauth226.Oauth2Error(
     "Invalid OpenId4Vp Authorization Response. Response neither contains a presentation_submission nor request contains a dcql_query."
   );
 }
 
 // src/authorization-response/parse-authorization-response.ts
-var import_oauth227 = require("@openid4vc/oauth2");
+var import_oauth228 = require("@openid4vc/oauth2");
 
 // src/authorization-response/parse-authorization-response-payload.ts
 var import_utils22 = require("@openid4vc/utils");
@@ -1715,13 +1895,13 @@ function parseOpenid4VpAuthorizationResponsePayload(payload) {
 }
 
 // src/authorization-response/parse-jarm-authorization-response.ts
-var import_oauth226 = require("@openid4vc/oauth2");
+var import_oauth227 = require("@openid4vc/oauth2");
 var import_utils23 = require("@openid4vc/utils");
 var import_zod20 = __toESM(require("zod"));
 async function parseJarmAuthorizationResponse(options) {
   const { jarmResponseJwt, callbacks, authorizationRequestPayload, expectedClientId } = options;
   const jarmAuthorizationResponseJwt = (0, import_utils23.parseWithErrorHandling)(
-    import_zod20.default.union([import_oauth226.zCompactJwt, import_oauth226.zCompactJwe]),
+    import_zod20.default.union([import_oauth227.zCompactJwt, import_oauth227.zCompactJwe]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
   );
@@ -1731,7 +1911,7 @@ async function parseJarmAuthorizationResponse(options) {
     expectedClientId,
     authorizationRequestPayload
   });
-  const { header: jarmHeader } = (0, import_oauth226.decodeJwtHeader)({
+  const { header: jarmHeader } = (0, import_oauth227.decodeJwtHeader)({
     jwt: jarmAuthorizationResponseJwt,
     headerSchema: zJarmHeader
   });
@@ -1743,7 +1923,7 @@ async function parseJarmAuthorizationResponse(options) {
     authorizationResponsePayload
   });
   if (!authorizationRequestPayload.response_mode || !isJarmResponseMode(authorizationRequestPayload.response_mode)) {
-    throw new import_oauth226.Oauth2Error(
+    throw new import_oauth227.Oauth2Error(
       `Invalid response mode for jarm response. Response mode: '${authorizationRequestPayload.response_mode ?? "fragment"}'`
     );
   }
@@ -1769,9 +1949,7 @@ async function parseOpenid4vpAuthorizationResponse(options) {
       jarmResponseJwt: authorizationResponse.response,
       callbacks,
       authorizationRequestPayload,
-      // If client_id_scheme was provided we should use the legacy (unprefixed) client id scheme
-      // TODO: allow both versions, in case of e.g. did:
-      expectedClientId: expectedClientId.legacyClientId ?? expectedClientId.clientId
+      expectedClientId: expectedClientId.effectiveClientId
     });
   }
   const authorizationResponsePayload = parseOpenid4VpAuthorizationResponsePayload(authorizationResponse);
@@ -1780,7 +1958,7 @@ async function parseOpenid4vpAuthorizationResponse(options) {
     authorizationResponsePayload
   });
   if (authorizationRequestPayload.response_mode && isJarmResponseMode(authorizationRequestPayload.response_mode)) {
-    throw new import_oauth227.Oauth2ServerErrorResponseError(
+    throw new import_oauth228.Oauth2ServerErrorResponseError(
       {
         error: "invalid_request",
         error_description: "Invalid response mode for openid4vp response. Expected jarm response."
@@ -1818,7 +1996,7 @@ var Openid4vpClient = class {
 };
 
 // src/transaction-data/verify-transaction-data.ts
-var import_oauth228 = require("@openid4vc/oauth2");
+var import_oauth229 = require("@openid4vc/oauth2");
 var import_utils24 = require("@openid4vc/utils");
 async function verifyTransactionData(options) {
   const parsedTransactionData = parseTransactionData({
@@ -1842,7 +2020,7 @@ async function verifyTransactionDataEntry({
 }) {
   const allowedAlgs = entry.transactionData.transaction_data_hashes_alg ?? ["sha-256"];
   const supportedAlgs = allowedAlgs.filter(
-    (alg) => Object.values(import_oauth228.HashAlgorithm).includes(alg)
+    (alg) => Object.values(import_oauth229.HashAlgorithm).includes(alg)
   );
   const hashes = {};
   for (const alg of supportedAlgs) {
@@ -1854,15 +2032,15 @@ async function verifyTransactionDataEntry({
     const alg = transactionDataHashesCredential.transaction_data_hashes_alg ?? "sha-256";
     const hash = hashes[alg];
     if (!allowedAlgs.includes(alg)) {
-      throw new import_oauth228.Oauth2ServerErrorResponseError({
-        error: import_oauth228.Oauth2ErrorCodes.InvalidTransactionData,
+      throw new import_oauth229.Oauth2ServerErrorResponseError({
+        error: import_oauth229.Oauth2ErrorCodes.InvalidTransactionData,
         error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using alg '${alg}'. However transaction data only allows alg values ${allowedAlgs.join(", ")}.`
       });
     }
     if (!hash) {
-      throw new import_oauth228.Oauth2ServerErrorResponseError({
-        error: import_oauth228.Oauth2ErrorCodes.InvalidTransactionData,
-        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using unsupported alg '${alg}'. This library only supports verification of transaction data hashes using alg values ${Object.values(import_oauth228.HashAlgorithm).join(", ")}. Either verify the hashes outside of this library, or limit the allowed alg values to the ones supported by this library.`
+      throw new import_oauth229.Oauth2ServerErrorResponseError({
+        error: import_oauth229.Oauth2ErrorCodes.InvalidTransactionData,
+        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using unsupported alg '${alg}'. This library only supports verification of transaction data hashes using alg values ${Object.values(import_oauth229.HashAlgorithm).join(", ")}. Either verify the hashes outside of this library, or limit the allowed alg values to the ones supported by this library.`
       });
     }
     const credentialHashIndex = transactionDataHashesCredential.transaction_data_hashes.indexOf(hash);
@@ -1876,8 +2054,8 @@ async function verifyTransactionDataEntry({
       };
     }
   }
-  throw new import_oauth228.Oauth2ServerErrorResponseError({
-    error: import_oauth228.Oauth2ErrorCodes.InvalidTransactionData,
+  throw new import_oauth229.Oauth2ServerErrorResponseError({
+    error: import_oauth229.Oauth2ErrorCodes.InvalidTransactionData,
     error_description: `Transaction data entry with index ${entry.transactionDataIndex} does not have a matching hash in any of the submitted credentials`
   });
 }
@@ -1918,7 +2096,7 @@ var Openid4vpVerifier = class {
 
 // src/models/z-credential-formats.ts
 var import_zod21 = require("zod");
-var zCredentialFormat = import_zod21.z.enum(["jwt_vc_json", "ldp_vc", "ac_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
+var zCredentialFormat = import_zod21.z.enum(["jwt_vc_json", "ldp_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
 
 // src/models/z-proof-formats.ts
 var import_zod22 = require("zod");
@@ -1928,8 +2106,13 @@ var zProofFormat = import_zod22.z.enum(["jwt_vp_json", "ldc_vp", "ac_vp", "dc+sd
 var import_zod23 = require("zod");
 var zWalletMetadata = import_zod23.z.object({
   presentation_definition_uri_supported: import_zod23.z.optional(import_zod23.z.boolean()),
-  vp_formats_supported: zVpFormatsSupported,
-  client_id_schemes_supported: import_zod23.z.optional(import_zod23.z.array(zClientIdScheme)),
+  // Up until draft 26 the legacy format was used
+  vp_formats_supported: import_zod23.z.optional(zVpFormatsSupported.or(zLegacyVpFormats)),
+  client_id_schemes_supported: import_zod23.z.optional(
+    // client_id_schemes_supported was from before decentralized_identifier and openid_federation were defined
+    import_zod23.z.array(zClientIdPrefix.exclude(["decentralized_identifier", "openid_federation"]))
+  ),
+  client_id_prefixes_supported: import_zod23.z.optional(import_zod23.z.array(zUniformClientIdPrefix)),
   request_object_signing_alg_values_supported: import_zod23.z.optional(import_zod23.z.array(import_zod23.z.string())),
   authorization_encryption_alg_values_supported: import_zod23.z.optional(import_zod23.z.array(import_zod23.z.string())),
   authorization_encryption_enc_values_supported: import_zod23.z.optional(import_zod23.z.array(import_zod23.z.string()))
@@ -1956,7 +2139,7 @@ var zWalletMetadata = import_zod23.z.object({
   validateOpenid4vpAuthorizationRequestPayload,
   validateOpenid4vpAuthorizationResponsePayload,
   verifyJarmAuthorizationResponse,
-  zClientIdScheme,
+  zClientIdPrefix,
   zClientMetadata,
   zCredentialFormat,
   zJarmClientMetadata,