@openid4vc/openid4vp 0.3.0-alpha-20250707100752 → 0.3.0-alpha-20250707121837

package/dist/index.mjs

@@ -1,6 +1,7 @@
-// src/client-identifier-scheme/parse-client-identifier-scheme.ts
+// src/client-identifier-prefix/parse-client-identifier-prefix.ts
 import { Oauth2ErrorCodes, Oauth2ServerErrorResponseError } from "@openid4vc/oauth2";
-import { URL as URL2, zHttpsUrl as zHttpsUrl3 } from "@openid4vc/utils";
+import { HashAlgorithm } from "@openid4vc/oauth2";
+import { URL as URL2, decodeBase64, encodeToBase64Url, zHttpsUrl as zHttpsUrl3 } from "@openid4vc/utils";
 
 // src/authorization-request/z-authorization-request-dc-api.ts
 import { z as z6 } from "zod";
@@ -54,7 +55,7 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
       type: "sign_encrypt",
       client_metadata: {
         ...SignEncrypt.data,
-        authorization_encrypted_response_enc: client_metadata.authorization_encrypted_response_enc ?? "A128CBC-HS256"
+        authorization_encrypted_response_enc: client_metadata.authorization_encrypted_response_enc
       }
     };
   }
@@ -64,7 +65,7 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
       type: "encrypt",
       client_metadata: {
         ...encryptOnly.data,
-        authorization_encrypted_response_enc: parsedClientMeta.authorization_encrypted_response_enc ?? "A128CBC-HS256"
+        authorization_encrypted_response_enc: parsedClientMeta.authorization_encrypted_response_enc
       }
     };
   }
@@ -74,7 +75,7 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
       type: "sign",
       client_metadata: {
         ...signOnly.data,
-        authorization_signed_response_alg: parsedClientMeta.authorization_signed_response_alg ?? "RS256"
+        authorization_signed_response_alg: parsedClientMeta.authorization_signed_response_alg
       }
     };
   }
@@ -83,7 +84,36 @@ var zJarmClientMetadataParsed = zJarmClientMetadata.transform((client_metadata)
 
 // src/models/z-vp-formats-supported.ts
 import { z as z2 } from "zod";
-var zVpFormatsSupported = z2.record(
+var zVpFormatsSupported = z2.object({
+  "dc+sd-jwt": z2.optional(
+    z2.object({
+      "sd-jwt_alg_values": z2.optional(z2.array(z2.string()).nonempty()),
+      "kb-jwt_alg_values": z2.optional(z2.array(z2.string()).nonempty())
+    }).passthrough()
+  ),
+  jwt_vc_json: z2.optional(
+    z2.object({
+      alg_values: z2.optional(z2.array(z2.string()).nonempty())
+    }).passthrough()
+  ),
+  ldp_vc: z2.optional(
+    z2.object({
+      proof_type_values: z2.optional(z2.array(z2.string()).nonempty()),
+      cryptosuite_values: z2.optional(z2.array(z2.string()).nonempty())
+    }).passthrough()
+  ),
+  mso_mdoc: z2.optional(
+    z2.object({
+      // Draft 27
+      issuer_signed_alg_values: z2.optional(z2.array(z2.number()).nonempty()),
+      device_signed_alg_values: z2.optional(z2.array(z2.number()).nonempty()),
+      // Draft 28+
+      issuerauth_alg_values: z2.optional(z2.array(z2.number()).nonempty()),
+      deviceauth_alg_values: z2.optional(z2.array(z2.number()).nonempty())
+    }).passthrough()
+  )
+}).passthrough().catchall(z2.object({}).passthrough());
+var zLegacyVpFormats = z2.record(
   z2.string(),
   z2.object({
     alg_values_supported: z2.optional(z2.array(z2.string()))
@@ -95,7 +125,12 @@ var zClientMetadata = z3.object({
   // Up until draft 22
   jwks_uri: z3.string().url().optional(),
   jwks: z3.optional(zJwkSet),
-  vp_formats: z3.optional(zVpFormatsSupported),
+  // Up until draft 26
+  vp_formats: z3.optional(zLegacyVpFormats),
+  // From draft 27
+  vp_formats_supported: z3.optional(zVpFormatsSupported),
+  // From draft 28
+  encrypted_response_enc_values_supported: z3.optional(z3.array(z3.string())),
   ...zJarmClientMetadata.shape,
   logo_uri: zHttpsUrl.optional(),
   client_name: z3.string().optional()
@@ -137,9 +172,11 @@ var zOpenid4vpAuthorizationRequest = z5.object({
     "did",
     "verifier_attestation",
     "x509_san_dns",
-    "x509_san_uri"
+    "x509_san_uri",
+    "x509_hash"
   ]).optional(),
-  verifier_attestations: zVerifierAttestations.optional()
+  verifier_attestations: zVerifierAttestations.optional(),
+  verifier_info: zVerifierAttestations.optional()
 }).passthrough();
 var zOpenid4vpAuthorizationRequestFromUriParams = z5.string().url().transform((url) => Object.fromEntries(new URL(url).searchParams)).pipe(
   z5.object({
@@ -147,7 +184,8 @@ var zOpenid4vpAuthorizationRequestFromUriParams = z5.string().url().transform((u
     client_metadata: zStringToJson.optional(),
     dcql_query: zStringToJson.optional(),
     transaction_data: zStringToJson.optional(),
-    verifier_attestations: zStringToJson.optional()
+    verifier_attestations: zStringToJson.optional(),
+    verifier_info: zStringToJson.optional()
   }).passthrough()
 );
 
@@ -162,7 +200,8 @@ var zOpenid4vpAuthorizationRequestDcApi = zOpenid4vpAuthorizationRequest.pick({
   dcql_query: true,
   trust_chain: true,
   state: true,
-  verifier_attestations: true
+  verifier_attestations: true,
+  verifier_info: true
 }).extend({
   client_id: z6.optional(z6.string()),
   expected_origins: z6.array(z6.string()).optional(),
@@ -179,31 +218,55 @@ function isOpenid4vpAuthorizationRequestDcApi(request) {
   return isOpenid4vpResponseModeDcApi(request.response_mode);
 }
 
-// src/client-identifier-scheme/z-client-id-scheme.ts
+// src/client-identifier-prefix/z-client-id-prefix.ts
 import { getGlobalConfig } from "@openid4vc/utils";
 import { z as z7 } from "zod";
-var zClientIdScheme = z7.enum([
+var zClientIdPrefix = z7.enum([
   "pre-registered",
   "redirect_uri",
-  "https",
   "verifier_attestation",
+  "https",
+  // pre draft 26
+  "openid_federation",
+  // from draft 26
   "did",
-  "x509_san_dns",
+  // pre draft 26
+  "decentralized_identifier",
+  // from draft 26
   "x509_san_uri",
+  // pre-draft 25
+  "x509_hash",
+  // from draft 25
+  "x509_san_dns",
+  "origin",
+  // from draft 25
   "web-origin"
+  // pre-draft 25
 ]);
-var zClientIdToClientIdScheme = z7.union(
+var zUniformClientIdPrefix = zClientIdPrefix.exclude(["did", "https", "web-origin"]);
+var zClientIdToClientIdPrefixAndIdentifier = z7.union(
   [
     z7.string({ message: "client_id MUST be a string" }).includes(":").transform((clientId) => {
-      const clientIdScheme = clientId.split(":")[0];
-      return clientIdScheme === "http" && getGlobalConfig().allowInsecureUrls ? "https" : clientIdScheme;
-    }).pipe(zClientIdScheme.exclude(["pre-registered"])),
-    z7.string().refine((clientId) => clientId.includes(":") === false).transform(() => "pre-registered")
+      const colonIndex = clientId.indexOf(":");
+      const clientIdPrefix = clientId.slice(0, colonIndex);
+      const clientIdIdentifier = clientId.slice(colonIndex + 1);
+      if (clientIdPrefix === "http" && getGlobalConfig().allowInsecureUrls) {
+        return ["https", clientId];
+      }
+      if (clientIdPrefix === "did" || clientIdPrefix === "http" || clientIdPrefix === "https") {
+        return [clientIdPrefix, clientId];
+      }
+      return [clientIdPrefix, clientIdIdentifier];
+    }).pipe(z7.tuple([zClientIdPrefix.exclude(["pre-registered"]), z7.string()])),
+    z7.string().refine((clientId) => clientId.includes(":") === false).transform((clientId) => ["pre-registered", clientId])
   ],
   {
-    message: `client_id must either start with a known prefix followed by ':' or contain no ':'. Known prefixes are ${zClientIdScheme.exclude(["pre-registered"]).options.join(", ")}`
+    message: `client_id must either start with a known prefix followed by ':' or contain no ':'. Known prefixes are ${zClientIdPrefix.exclude(["pre-registered"]).options.join(", ")}`
   }
 );
+var zClientIdPrefixToUniform = zClientIdPrefix.transform(
+  (prefix) => prefix === "did" ? "decentralized_identifier" : prefix === "https" ? "openid_federation" : prefix === "web-origin" ? "origin" : prefix
+);
 var zLegacyClientIdScheme = z7.enum([
   "pre-registered",
   "redirect_uri",
@@ -213,10 +276,15 @@ var zLegacyClientIdScheme = z7.enum([
   "x509_san_dns",
   "x509_san_uri"
 ]);
-var zLegacyClientIdSchemeToClientIdScheme = zLegacyClientIdScheme.optional().default("pre-registered").transform((clientIdScheme) => clientIdScheme === "entity_id" ? "https" : clientIdScheme);
+var zLegacyClientIdSchemeToClientIdPrefix = zLegacyClientIdScheme.optional().default("pre-registered").transform(
+  (clientIdScheme) => clientIdScheme === "entity_id" ? "openid_federation" : clientIdScheme === "did" ? "decentralized_identifier" : clientIdScheme
+);
 
-// src/client-identifier-scheme/parse-client-identifier-scheme.ts
+// src/client-identifier-prefix/parse-client-identifier-prefix.ts
 function getOpenid4vpClientId(options) {
+  const original = {
+    clientId: options.clientId
+  };
   if (isOpenid4vpResponseModeDcApi(options.responseMode)) {
     if (!options.clientId) {
       if (!options.origin) {
@@ -226,20 +294,37 @@ function getOpenid4vpClientId(options) {
         });
       }
       return {
-        clientIdScheme: "web-origin",
-        clientId: `web-origin:${options.origin}`
+        clientIdPrefix: "origin",
+        effectiveClientIdPrefix: "origin",
+        clientIdIdentifier: options.origin,
+        // FIXME: draft 24 uses web-origin, draft 25+ uses origin
+        // But it's not really possible to know which one to use as the
+        // 'effective' client id. Defaulting to origin: since that's newer
+        effectiveClientId: `origin:${options.origin}`,
+        original
       };
     }
-    const parsedClientIdScheme2 = zClientIdToClientIdScheme.safeParse(options.clientId);
-    if (!parsedClientIdScheme2.success) {
+    const parsedClientIdPrefixAndIdentifier2 = zClientIdToClientIdPrefixAndIdentifier.safeParse(options.clientId);
+    if (!parsedClientIdPrefixAndIdentifier2.success) {
+      throw new Oauth2ServerErrorResponseError({
+        error: Oauth2ErrorCodes.InvalidRequest,
+        error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
+      });
+    }
+    const [clientIdScheme2, clientIdIdentifier2] = parsedClientIdPrefixAndIdentifier2.data;
+    const uniformClientIdScheme2 = zClientIdPrefixToUniform.safeParse(clientIdScheme2);
+    if (!uniformClientIdScheme2.success) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
         error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
       });
     }
     return {
-      clientId: options.clientId,
-      clientIdScheme: parsedClientIdScheme2.data
+      effectiveClientId: options.clientId,
+      effectiveClientIdPrefix: clientIdScheme2,
+      original,
+      clientIdPrefix: uniformClientIdScheme2.data,
+      clientIdIdentifier: clientIdIdentifier2
     };
   }
   if (!options.clientId) {
@@ -249,62 +334,75 @@ function getOpenid4vpClientId(options) {
     });
   }
   if (options.legacyClientIdScheme) {
-    const parsedClientIdScheme2 = zLegacyClientIdSchemeToClientIdScheme.safeParse(options.legacyClientIdScheme);
-    if (!parsedClientIdScheme2.success) {
+    const parsedClientIdPrefix = zLegacyClientIdSchemeToClientIdPrefix.safeParse(options.legacyClientIdScheme);
+    if (!parsedClientIdPrefix.success) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
         error_description: `Failed to parse client identifier. Unsupported client_id_scheme value '${options.legacyClientIdScheme}'.`
       });
     }
-    const clientIdScheme = parsedClientIdScheme2.data;
+    const clientIdPrefix = parsedClientIdPrefix.data;
     return {
-      clientId: clientIdScheme === "https" || clientIdScheme === "did" || clientIdScheme === "pre-registered" ? options.clientId : `${parsedClientIdScheme2.data}:${options.clientId}`,
-      clientIdScheme: parsedClientIdScheme2.data,
-      legacyClientId: options.clientId
+      effectiveClientId: options.clientId,
+      clientIdIdentifier: options.clientId,
+      clientIdPrefix,
+      effectiveClientIdPrefix: options.legacyClientIdScheme ?? "pre-registered",
+      original: {
+        ...original,
+        clientIdScheme: options.legacyClientIdScheme
+      }
     };
   }
-  const parsedClientIdScheme = zClientIdToClientIdScheme.safeParse(options.clientId);
-  if (!parsedClientIdScheme.success) {
+  const parsedClientIdPrefixAndIdentifier = zClientIdToClientIdPrefixAndIdentifier.safeParse(options.clientId);
+  if (!parsedClientIdPrefixAndIdentifier.success) {
+    throw new Oauth2ServerErrorResponseError({
+      error: Oauth2ErrorCodes.InvalidRequest,
+      error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
+    });
+  }
+  const [clientIdScheme, clientIdIdentifier] = parsedClientIdPrefixAndIdentifier.data;
+  const uniformClientIdScheme = zClientIdPrefixToUniform.safeParse(clientIdScheme);
+  if (!uniformClientIdScheme.success) {
     throw new Oauth2ServerErrorResponseError({
       error: Oauth2ErrorCodes.InvalidRequest,
       error_description: `Failed to parse client identifier. Unsupported client_id '${options.clientId}'.`
     });
   }
   return {
-    clientId: options.clientId,
-    clientIdScheme: parsedClientIdScheme.data
+    effectiveClientId: options.clientId,
+    clientIdPrefix: uniformClientIdScheme.data,
+    effectiveClientIdPrefix: clientIdScheme,
+    clientIdIdentifier,
+    original
   };
 }
-function validateOpenid4vpClientId(options, parserConfig) {
+async function validateOpenid4vpClientId(options, parserConfig) {
   const { authorizationRequestPayload, jar, origin } = options;
   const parserConfigWithDefaults = {
-    supportedSchemes: parserConfig?.supportedSchemes || Object.values(zClientIdScheme.options)
+    supportedSchemes: parserConfig?.supportedSchemes || Object.values(zClientIdPrefix.options)
   };
-  const { clientId, legacyClientId, clientIdScheme } = getOpenid4vpClientId({
+  const { clientIdIdentifier, clientIdPrefix, effectiveClientId, original } = getOpenid4vpClientId({
     clientId: authorizationRequestPayload.client_id,
     legacyClientIdScheme: authorizationRequestPayload.client_id_scheme,
     responseMode: authorizationRequestPayload.response_mode,
     origin
   });
-  if (clientIdScheme === "pre-registered") {
+  if (clientIdPrefix === "pre-registered") {
     return {
-      scheme: "pre-registered",
-      identifier: clientId,
-      originalValue: clientId,
-      legacyClientId,
-      clientMetadata: authorizationRequestPayload.client_metadata
+      prefix: "pre-registered",
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original
     };
   }
-  const colonIndex = clientId.indexOf(":");
-  const identifierPart = clientId.substring(colonIndex + 1);
-  if (!parserConfigWithDefaults.supportedSchemes.includes(clientIdScheme)) {
+  if (!parserConfigWithDefaults.supportedSchemes.includes(clientIdPrefix)) {
     throw new Oauth2ServerErrorResponseError({
       error: Oauth2ErrorCodes.InvalidRequest,
-      error_description: `Unsupported client identifier scheme. ${clientIdScheme} is not supported.`
+      error_description: `Unsupported client identifier scheme. ${clientIdPrefix} is not supported.`
     });
   }
-  if (clientIdScheme === "https") {
-    if (!zHttpsUrl3.safeParse(clientId).success) {
+  if (clientIdPrefix === "openid_federation") {
+    if (!zHttpsUrl3.safeParse(clientIdIdentifier).success) {
       throw new Oauth2ServerErrorResponseError(
         {
           error: Oauth2ErrorCodes.InvalidRequest,
@@ -328,14 +426,14 @@ function validateOpenid4vpClientId(options, parserConfig) {
       });
     }
     return {
-      scheme: clientIdScheme,
-      identifier: clientId,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: "openid_federation",
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
       trustChain: authorizationRequestPayload.trust_chain
     };
   }
-  if (clientIdScheme === "redirect_uri") {
+  if (clientIdPrefix === "redirect_uri") {
     if (jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
@@ -349,14 +447,15 @@ function validateOpenid4vpClientId(options, parserConfig) {
       });
     }
     return {
-      scheme: clientIdScheme,
-      identifier: identifierPart,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: clientIdPrefix,
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
+      clientMetadata: authorizationRequestPayload.client_metadata,
       redirectUri: authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri
     };
   }
-  if (clientIdScheme === "did") {
+  if (clientIdPrefix === "decentralized_identifier") {
     if (!jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
@@ -369,113 +468,115 @@ function validateOpenid4vpClientId(options, parserConfig) {
         error_description: "Something went wrong. The JWT signer method is not did but the client identifier scheme is did."
       });
     }
-    if (!clientId.startsWith("did:")) {
+    if (!clientIdIdentifier.startsWith("did:")) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
-        error_description: "Invalid client identifier. Client identifier must start with 'did:'"
+        error_description: "Invalid client identifier. Client id identifier must start with 'did:'"
       });
     }
     const [did] = jar.signer.didUrl.split("#");
-    if (clientId !== did) {
+    if (clientIdIdentifier !== did) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
-        error_description: 'With client identifier scheme "did" the JAR request must be signed by the same DID as the client identifier.'
+        error_description: `With client identifier scheme '${clientIdPrefix}' the JAR request must be signed by the same DID as the client identifier.`
       });
     }
     return {
-      scheme: clientIdScheme,
-      identifier: clientId,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: "decentralized_identifier",
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
+      clientMetadata: authorizationRequestPayload.client_metadata,
       didUrl: jar.signer.didUrl
     };
   }
-  if (clientIdScheme === "x509_san_dns" || clientIdScheme === "x509_san_uri") {
+  if (clientIdPrefix === "x509_san_dns" || clientIdPrefix === "x509_san_uri" || clientIdPrefix === "x509_hash") {
     if (!jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
-        error_description: 'Using client identifier scheme "x509_san_dns" or "x509_san_uri" requires a signed JAR request.'
+        error_description: `Using client identifier scheme '${clientIdPrefix}' requires a signed JAR request.`
       });
     }
     if (jar.signer.method !== "x5c") {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
-        error_description: "Something went wrong. The JWT signer method is not x5c but the client identifier scheme is x509_san_dns."
+        error_description: `Something went wrong. The JWT signer method is not x5c but the client identifier scheme is '${clientIdPrefix}'`
       });
     }
-    if (clientIdScheme === "x509_san_dns") {
-      if (!options.callbacks.getX509CertificateMetadata) {
-        throw new Oauth2ServerErrorResponseError(
-          {
-            error: Oauth2ErrorCodes.ServerError
-          },
-          {
-            internalMessage: "Missing required 'getX509CertificateMetadata' callback for verification of 'x509_san_dns' client id scheme"
-          }
-        );
-      }
+    if (!options.callbacks.getX509CertificateMetadata) {
+      throw new Oauth2ServerErrorResponseError(
+        {
+          error: Oauth2ErrorCodes.ServerError
+        },
+        {
+          internalMessage: `Missing required 'getX509CertificateMetadata' callback for verification of '${clientIdPrefix}' client id scheme`
+        }
+      );
+    }
+    if (clientIdPrefix === "x509_san_dns") {
       const { sanDnsNames } = options.callbacks.getX509CertificateMetadata(jar.signer.x5c[0]);
-      if (!sanDnsNames.includes(identifierPart)) {
+      if (!sanDnsNames.includes(clientIdIdentifier)) {
         throw new Oauth2ServerErrorResponseError({
           error: Oauth2ErrorCodes.InvalidRequest,
-          error_description: `Invalid client identifier. One of the leaf certificates san dns names [${sanDnsNames.join(", ")}] must match the client identifier '${identifierPart}'. `
+          error_description: `Invalid client identifier. One of the leaf certificates san dns names [${sanDnsNames.join(", ")}] must match the client identifier '${clientIdIdentifier}'. `
         });
       }
       if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
         const uri = authorizationRequestPayload.redirect_uri ?? authorizationRequestPayload.response_uri;
-        if (!uri || new URL2(uri).hostname !== identifierPart) {
+        if (!uri || new URL2(uri).hostname !== clientIdIdentifier) {
           throw new Oauth2ServerErrorResponseError({
             error: Oauth2ErrorCodes.InvalidRequest,
             error_description: "Invalid client identifier. The fully qualified domain name of the redirect_uri value MUST match the Client Identifier without the prefix x509_san_dns."
           });
         }
       }
-    } else if (clientIdScheme === "x509_san_uri") {
-      if (!options.callbacks.getX509CertificateMetadata) {
-        throw new Oauth2ServerErrorResponseError(
-          {
-            error: Oauth2ErrorCodes.ServerError
-          },
-          {
-            internalMessage: "Missing required 'getX509CertificateMetadata' callback for verification of 'x509_san_uri' client id scheme"
-          }
-        );
-      }
+    } else if (clientIdPrefix === "x509_san_uri") {
       const { sanUriNames } = options.callbacks.getX509CertificateMetadata(jar.signer.x5c[0]);
-      if (!sanUriNames.includes(identifierPart)) {
+      if (!sanUriNames.includes(clientIdIdentifier)) {
         throw new Oauth2ServerErrorResponseError({
           error: Oauth2ErrorCodes.InvalidRequest,
-          error_description: `Invalid client identifier. One of the leaf certificates san uri names [${sanUriNames.join(", ")}] must match the client identifier '${identifierPart}'.`
+          error_description: `Invalid client identifier. One of the leaf certificates san uri names [${sanUriNames.join(", ")}] must match the client identifier '${clientIdIdentifier}'.`
         });
       }
       if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload)) {
         const uri = authorizationRequestPayload.redirect_uri || authorizationRequestPayload.response_uri;
-        if (!uri || uri !== identifierPart) {
+        if (!uri || uri !== clientIdIdentifier) {
           throw new Oauth2ServerErrorResponseError({
             error: Oauth2ErrorCodes.InvalidRequest,
             error_description: "The redirect_uri value MUST match the Client Identifier without the prefix x509_san_uri"
           });
         }
       }
+    } else if (clientIdPrefix === "x509_hash") {
+      const x509Hash = encodeToBase64Url(
+        await options.callbacks.hash(decodeBase64(jar.signer.x5c[0]), HashAlgorithm.Sha256)
+      );
+      if (x509Hash !== clientIdIdentifier) {
+        throw new Oauth2ServerErrorResponseError({
+          error: Oauth2ErrorCodes.InvalidRequest,
+          error_description: `Invalid client identifier. Expected the base64url encoded sha-256 hash of the leaf x5c certificate ('${x509Hash}') to match the client identifier '${clientIdIdentifier}'.`
+        });
+      }
     }
     return {
-      scheme: clientIdScheme,
-      identifier: identifierPart,
-      originalValue: clientId,
-      legacyClientId,
-      x5c: jar.signer.x5c
+      prefix: clientIdPrefix,
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
+      x5c: jar.signer.x5c,
+      clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
-  if (clientIdScheme === "web-origin") {
+  if (clientIdPrefix === "origin") {
     return {
-      scheme: clientIdScheme,
-      identifier: identifierPart,
-      originalValue: clientId,
-      legacyClientId,
+      prefix: clientIdPrefix,
+      identifier: clientIdIdentifier,
+      effective: effectiveClientId,
+      original,
       clientMetadata: authorizationRequestPayload.client_metadata
     };
   }
-  if (clientIdScheme === "verifier_attestation") {
+  if (clientIdPrefix === "verifier_attestation") {
     if (!jar) {
       throw new Oauth2ServerErrorResponseError({
         error: Oauth2ErrorCodes.InvalidRequest,
@@ -484,10 +585,11 @@ function validateOpenid4vpClientId(options, parserConfig) {
     }
   }
   return {
-    scheme: clientIdScheme,
-    identifier: identifierPart,
-    legacyClientId,
-    originalValue: clientId
+    prefix: clientIdPrefix,
+    clientMetadata: authorizationRequestPayload.client_metadata,
+    identifier: clientIdIdentifier,
+    effective: effectiveClientId,
+    original
   };
 }
 
@@ -495,6 +597,7 @@ function validateOpenid4vpClientId(options, parserConfig) {
 import {
   Oauth2Error as Oauth2Error3,
   decodeJwt,
+  decodeJwtHeader,
   jwtSignerFromJwt,
   zCompactJwe,
   zCompactJwt,
@@ -503,15 +606,18 @@ import {
 import z9 from "zod";
 
 // src/jarm/jarm-extract-jwks.ts
-function extractJwksFromClientMetadata(clientMetadata) {
-  const parsed = zJarmClientMetadataParsed.parse(clientMetadata);
-  const encryptionAlg = parsed.client_metadata.authorization_encrypted_response_enc;
-  const signingAlg = parsed.client_metadata.authorization_signed_response_alg;
-  const encJwk = clientMetadata.jwks.keys.find((key) => key.use === "enc" && key.alg === encryptionAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "enc") ?? // fallback, take first key. HAIP does not specify requirement on enc
-  clientMetadata.jwks.keys?.[0];
-  const sigJwk = clientMetadata.jwks.keys.find((key) => key.use === "sig" && key.alg === signingAlg) ?? clientMetadata.jwks.keys.find((key) => key.use === "sig") ?? // falback, take first key
-  clientMetadata.jwks.keys?.[0];
-  return { encJwk, sigJwk };
+function extractJwkFromJwks(jwks, {
+  kid,
+  supportedAlgValues
+}) {
+  if (kid) {
+    return jwks.keys.find((jwk) => jwk.kid === kid);
+  }
+  let algFiltered = jwks.keys.filter((key) => key.alg && supportedAlgValues?.includes(key.alg));
+  if (algFiltered.length === 0) algFiltered = jwks.keys;
+  let encFiltered = algFiltered.filter((key) => key.use === "enc");
+  if (!encFiltered) encFiltered = algFiltered.filter((key) => key.use !== "sig");
+  return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];
 }
 
 // src/jarm/jarm-authorization-response/jarm-validate-authorization-response.ts
@@ -562,10 +668,18 @@ var JarmMode = /* @__PURE__ */ ((JarmMode2) => {
 })(JarmMode || {});
 var decryptJarmAuthorizationResponseJwt = async (options) => {
   const { jarmAuthorizationResponseJwt, callbacks, authorizationRequestPayload } = options;
-  const encryptionJwk = authorizationRequestPayload.client_metadata?.jwks ? extractJwksFromClientMetadata({
-    ...authorizationRequestPayload.client_metadata,
-    jwks: authorizationRequestPayload.client_metadata.jwks
-  }).encJwk : void 0;
+  let encryptionJwk = void 0;
+  const { header } = decodeJwtHeader({
+    jwt: jarmAuthorizationResponseJwt
+  });
+  if (authorizationRequestPayload.client_metadata?.jwks) {
+    encryptionJwk = extractJwkFromJwks(authorizationRequestPayload.client_metadata.jwks, {
+      // Kid always take precedence
+      kid: header.kid,
+      // This value was removed in draft 26, but if it's still provided, we can use it to determine the key to use
+      supportedAlgValues: authorizationRequestPayload.client_metadata.authorization_encrypted_response_alg ? [authorizationRequestPayload.client_metadata.authorization_encrypted_response_alg] : void 0
+    });
+  }
   const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, { jwk: encryptionJwk });
   if (!result.decrypted) {
     throw new Oauth2Error3("Failed to decrypt jarm auth response.");
@@ -703,10 +817,10 @@ var validateOpenid4vpAuthorizationRequestPayload = (options) => {
       error_description: 'The "wallet_nonce" parameter MUST match the "expectedNonce" parameter when the "expectedNonce" parameter is provided.'
     });
   }
-  if (params.client_id.startsWith("web-origin:")) {
+  if (params.client_id.startsWith("web-origin:") || params.client_id.startsWith("origin:")) {
     throw new Oauth2ServerErrorResponseError2({
       error: Oauth2ErrorCodes2.InvalidRequest,
-      error_description: `The 'client_id' parameter MUST NOT use client identifier scheme 'web-origin' when not using the dc_api response mode. Current: ${params.client_id}`
+      error_description: `The 'client_id' parameter MUST NOT use client identifier scheme '${params.client_id.split(":")[0]}' when not using the dc_api response mode. Current: ${params.client_id}`
     });
   }
 };
@@ -942,6 +1056,48 @@ import z13 from "zod";
 import { Oauth2ErrorCodes as Oauth2ErrorCodes5, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError6 } from "@openid4vc/oauth2";
 function parseAuthorizationRequestVersion(request) {
   const requirements = [];
+  if (request.verifier_info) {
+    requirements.push([">=", 29]);
+  }
+  if (request.verifier_attestations) {
+    requirements.push(["<", 29]);
+  }
+  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values) {
+    requirements.push([">=", 28]);
+  }
+  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.issuer_signed_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.device_signed_alg_values) {
+    requirements.push(["<", 28]);
+  }
+  if (request.client_metadata?.vp_formats) {
+    requirements.push([">=", 27]);
+  }
+  if (request.client_metadata?.vp_formats_supported) {
+    requirements.push(["<", 27]);
+  }
+  if (request.client_id?.startsWith("openid_federation:") || request.client_id?.startsWith("decentralized_identifier:")) {
+    requirements.push([">=", 26]);
+  }
+  if (request.client_id?.startsWith("did:")) {
+    requirements.push(["<", 26]);
+  }
+  if (request.presentation_definition || request.presentation_definition_uri) {
+    requirements.push([">=", 26]);
+  }
+  if (request.verifier_attestations) {
+    requirements.push([">=", 26]);
+  }
+  if (request.client_id?.startsWith("x509_san_uri:")) {
+    requirements.push(["<", 25]);
+  }
+  if (request.client_id?.startsWith("x509_hash:")) {
+    requirements.push([">=", 25]);
+  }
+  if (request.client_id?.startsWith("web-origin:")) {
+    requirements.push(["<", 25]);
+  }
+  if (request.client_id?.startsWith("origin:")) {
+    requirements.push([">=", 25]);
+  }
   if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "w3c_dc_api" || request.response_mode === "w3c_dc_api.jwt")) {
     requirements.push(["<", 23]);
     requirements.push([">=", 21]);
@@ -961,7 +1117,7 @@ function parseAuthorizationRequestVersion(request) {
   if (request.client_id) {
     const colonIndex = request.client_id.indexOf(":");
     const schemePart = request.client_id.substring(0, colonIndex);
-    const parsedScheme = zClientIdScheme.safeParse(schemePart);
+    const parsedScheme = zClientIdPrefix.safeParse(schemePart);
     if (parsedScheme.success && parsedScheme.data !== "did" && parsedScheme.data !== "https") {
       requirements.push([">=", 22]);
     }
@@ -969,6 +1125,9 @@ function parseAuthorizationRequestVersion(request) {
   if (!request.client_id) {
     requirements.push([">=", 21]);
   }
+  if (request.dcql_query) {
+    requirements.push([">=", 21]);
+  }
   if (request.client_metadata_uri) {
     requirements.push(["<", 21]);
   }
@@ -986,7 +1145,7 @@ function parseAuthorizationRequestVersion(request) {
   }
   const lessThanVersions = requirements.filter(([operator]) => operator === "<").map(([_, version]) => version);
   const greaterThanVersions = requirements.filter(([operator]) => operator === ">=").map(([_, version]) => version);
-  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 24;
+  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 29;
   const lowestRequiredVersion = greaterThanVersions.length > 0 ? Math.max(...greaterThanVersions) : 18;
   if (lowestRequiredVersion > highestPossibleVersion) {
     throw new Oauth2ServerErrorResponseError6({
@@ -1044,7 +1203,7 @@ async function verifyJarRequest(options) {
   const { callbacks, wallet = {} } = options;
   const jarRequestParams = validateJarRequestParams(options);
   const sendBy = jarRequestParams.request ? "value" : "reference";
-  const clientIdentifierScheme = jarRequestParams.client_id ? zClientIdScheme.safeParse(jarRequestParams.client_id.split(":")[0]).data : "web-origin";
+  const clientIdentifierScheme = jarRequestParams.client_id ? zClientIdPrefix.safeParse(jarRequestParams.client_id.split(":")[0]).data : "origin";
   const method = jarRequestParams.request_uri_method ?? "get";
   if (method !== "get" && method !== "post") {
     throw new Oauth2ServerErrorResponseError8({
@@ -1120,15 +1279,15 @@ async function verifyJarRequestObject(options) {
   const { decryptedRequestObject, callbacks } = options;
   const jwt = decodeJwt3({ jwt: decryptedRequestObject, payloadSchema: zJarRequestObjectPayload });
   let jwtSigner;
-  const { clientIdScheme } = getOpenid4vpClientId({
+  const { clientIdPrefix } = getOpenid4vpClientId({
     responseMode: jwt.payload.response_mode,
     clientId: jwt.payload.client_id,
     legacyClientIdScheme: jwt.payload.client_id_scheme
   });
   const clientIdToSignerMethod = {
-    did: ["did"],
+    decentralized_identifier: ["did"],
     "pre-registered": ["custom", "did", "jwk"],
-    "web-origin": [],
+    origin: [],
     // no signing allowed
     redirect_uri: [],
     // no signing allowed
@@ -1136,10 +1295,11 @@ async function verifyJarRequestObject(options) {
     verifier_attestation: ["did", "federation", "jwk", "x5c", "custom"],
     x509_san_dns: ["x5c"],
     x509_san_uri: ["x5c"],
+    x509_hash: ["x5c"],
     // Handled separately
-    https: []
+    openid_federation: []
   };
-  if (clientIdScheme === "https") {
+  if (clientIdPrefix === "openid_federation") {
     if (!jwt.header.kid) {
       throw new Oauth2Error5(
         `When OpenID Federation is used for signed authorization request, the 'kid' parameter is required.`
@@ -1152,7 +1312,7 @@ async function verifyJarRequestObject(options) {
       kid: jwt.header.kid
     };
   } else {
-    jwtSigner = jwtSignerFromJwt2({ ...jwt, allowedSignerMethods: clientIdToSignerMethod[clientIdScheme] });
+    jwtSigner = jwtSignerFromJwt2({ ...jwt, allowedSignerMethods: clientIdToSignerMethod[clientIdPrefix] });
   }
   const { signer } = await verifyJwt({
     verifyJwtCallback: callbacks.verifyJwt,
@@ -1177,7 +1337,7 @@ async function verifyJarRequestObject(options) {
 
 // src/transaction-data/parse-transaction-data.ts
 import { Oauth2ErrorCodes as Oauth2ErrorCodes8, Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError9 } from "@openid4vc/oauth2";
-import { decodeBase64, encodeToUtf8String, parseIfJson } from "@openid4vc/utils";
+import { decodeBase64 as decodeBase642, encodeToUtf8String, parseIfJson } from "@openid4vc/utils";
 
 // src/transaction-data/z-transaction-data.ts
 import { z as z14 } from "zod";
@@ -1191,7 +1351,7 @@ var zTransactionData = z14.array(zTransactionEntry);
 // src/transaction-data/parse-transaction-data.ts
 function parseTransactionData(options) {
   const { transactionData } = options;
-  const decoded = transactionData.map((tdEntry) => parseIfJson(encodeToUtf8String(decodeBase64(tdEntry))));
+  const decoded = transactionData.map((tdEntry) => parseIfJson(encodeToUtf8String(decodeBase642(tdEntry))));
   const parsedResult = zTransactionData.safeParse(decoded);
   if (!parsedResult.success) {
     throw new Oauth2ServerErrorResponseError9({
@@ -1243,7 +1403,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
   if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload) && !clientMetadata && authorizationRequestPayload.client_metadata_uri) {
     clientMetadata = await fetchClientMetadata({ clientMetadataUri: authorizationRequestPayload.client_metadata_uri });
   }
-  const clientMeta = validateOpenid4vpClientId({
+  const clientMeta = await validateOpenid4vpClientId({
     authorizationRequestPayload: {
       ...authorizationRequestPayload,
       client_metadata: clientMetadata
@@ -1276,7 +1436,8 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
     jar,
     client: clientMeta,
     pex,
-    dcql
+    dcql,
+    version: parseAuthorizationRequestVersion(authorizationRequestPayload)
   };
 }
 function validateOpenId4vpAuthorizationRequestPayload(options) {
@@ -1304,7 +1465,7 @@ import {
   Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError11,
   fetchJwks
 } from "@openid4vc/oauth2";
-import { dateToSeconds as dateToSeconds3, encodeToBase64Url } from "@openid4vc/utils";
+import { dateToSeconds as dateToSeconds3, encodeToBase64Url as encodeToBase64Url2 } from "@openid4vc/utils";
 
 // ../utils/src/date.ts
 function addSecondsToDate2(date, seconds) {
@@ -1401,7 +1562,7 @@ async function createOpenid4vpAuthorizationResponse(options) {
     ...options.authorizationResponsePayload,
     state: authorizationRequestPayload.state
   };
-  const { clientIdScheme } = getOpenid4vpClientId({
+  const { clientIdPrefix } = getOpenid4vpClientId({
     responseMode: authorizationRequestPayload.response_mode,
     clientId: authorizationRequestPayload.client_id,
     legacyClientIdScheme: authorizationRequestPayload.client_id_scheme,
@@ -1417,9 +1578,9 @@ async function createOpenid4vpAuthorizationResponse(options) {
       authorizationResponsePayload
     };
   }
-  if (clientIdScheme === "https" && !options.clientMetadata) {
+  if (clientIdPrefix === "openid_federation" && !options.clientMetadata) {
     throw new Oauth2Error8(
-      "When OpenID Federation is used as the client id scheme (https), passing externally fetched and verified 'clientMetadata' to the 'createOpenid4vpAuthorizationResponse' is required."
+      "When OpenID Federation is used as the client id scheme (https/openid_federation), passing externally fetched and verified 'clientMetadata' to the 'createOpenid4vpAuthorizationResponse' is required."
     );
   }
   const clientMetadata = options.clientMetadata ?? authorizationRequestPayload.client_metadata;
@@ -1437,20 +1598,40 @@ async function createOpenid4vpAuthorizationResponse(options) {
       error_description: `Missing 'jwks' or 'jwks_uri' in client metadata. Cannot extract encryption JWK.`
     });
   }
-  const supportedJarmMetadata = jarmAssertMetadataSupported({
-    clientMetadata,
-    serverMetadata: jarm.serverMetadata
-  });
-  const clientMetaJwks = extractJwksFromClientMetadata({
-    ...clientMetadata,
-    jwks
+  if (clientMetadata.authorization_encrypted_response_alg || clientMetadata.authorization_encrypted_response_env || clientMetadata.authorization_signed_response_alg) {
+    jarmAssertMetadataSupported({
+      clientMetadata,
+      serverMetadata: jarm.serverMetadata
+    });
+  }
+  const encJwk = extractJwkFromJwks(jwks, {
+    supportedAlgValues: jarm.serverMetadata.authorization_encryption_alg_values_supported ?? (clientMetadata.authorization_encrypted_response_alg ? [clientMetadata.authorization_encrypted_response_alg] : void 0)
   });
-  if (!clientMetaJwks?.encJwk) {
+  if (!encJwk) {
     throw new Oauth2ServerErrorResponseError11({
       error: Oauth2ErrorCodes10.InvalidRequest,
       error_description: "Could not extract encryption JWK from client metadata. Failed to create JARM response."
     });
   }
+  let enc;
+  if (clientMetadata.encrypted_response_enc_values_supported) {
+    enc = jarm.serverMetadata.authorization_encryption_enc_values_supported.find(
+      (enc2) => clientMetadata.encrypted_response_enc_values_supported?.includes(enc2)
+    ) ?? clientMetadata.encrypted_response_enc_values_supported[0];
+  } else {
+    enc = clientMetadata.authorization_encrypted_response_enc ?? "A128GCM";
+  }
+  assertValueSupported({
+    actual: enc,
+    supported: jarm.serverMetadata.authorization_encryption_enc_values_supported,
+    errorMessage: `Invalid 'enc' value ${enc}. Supported values are ${jarm.serverMetadata.authorization_encryption_enc_values_supported.join(", ")}`
+  });
+  const alg = encJwk.alg ?? clientMetadata.authorization_encrypted_response_alg ?? "ECDH-ES";
+  assertValueSupported({
+    actual: alg,
+    supported: jarm.serverMetadata.authorization_encryption_alg_values_supported,
+    errorMessage: `Invalid 'alg' value ${alg}. Supported values are ${jarm.serverMetadata.authorization_encryption_alg_values_supported.join(", ")}`
+  });
   let additionalJwtPayload;
   if (jarm?.jwtSigner) {
     if (!jarm.authorizationServer) {
@@ -1479,13 +1660,13 @@ async function createOpenid4vpAuthorizationResponse(options) {
   const result = await createJarmAuthorizationResponse({
     jarmAuthorizationResponse: jarmResponsePayload,
     jwtSigner: jarm?.jwtSigner,
-    jweEncryptor: jarm?.encryption && (supportedJarmMetadata.type === "encrypt" || supportedJarmMetadata.type === "sign_encrypt") ? {
+    jweEncryptor: jarm?.encryption ? {
       method: "jwk",
-      publicJwk: clientMetaJwks.encJwk,
-      apu: jarm.encryption.nonce ? encodeToBase64Url(jarm.encryption.nonce) : void 0,
-      apv: encodeToBase64Url(authorizationRequestPayload.nonce),
-      alg: supportedJarmMetadata.client_metadata.authorization_encrypted_response_alg,
-      enc: supportedJarmMetadata.client_metadata.authorization_encrypted_response_enc
+      publicJwk: encJwk,
+      apu: jarm.encryption.nonce ? encodeToBase64Url2(jarm.encryption.nonce) : void 0,
+      apv: encodeToBase64Url2(authorizationRequestPayload.nonce),
+      alg,
+      enc
     } : void 0,
     callbacks: {
       signJwt: callbacks.signJwt,
@@ -1678,7 +1859,7 @@ function parseOpenid4VpAuthorizationResponsePayload(payload) {
 }
 
 // src/authorization-response/parse-jarm-authorization-response.ts
-import { Oauth2Error as Oauth2Error12, decodeJwtHeader, zCompactJwe as zCompactJwe3, zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
+import { Oauth2Error as Oauth2Error12, decodeJwtHeader as decodeJwtHeader2, zCompactJwe as zCompactJwe3, zCompactJwt as zCompactJwt3 } from "@openid4vc/oauth2";
 import { parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
 import z20 from "zod";
 async function parseJarmAuthorizationResponse(options) {
@@ -1694,7 +1875,7 @@ async function parseJarmAuthorizationResponse(options) {
     expectedClientId,
     authorizationRequestPayload
   });
-  const { header: jarmHeader } = decodeJwtHeader({
+  const { header: jarmHeader } = decodeJwtHeader2({
     jwt: jarmAuthorizationResponseJwt,
     headerSchema: zJarmHeader
   });
@@ -1732,9 +1913,7 @@ async function parseOpenid4vpAuthorizationResponse(options) {
       jarmResponseJwt: authorizationResponse.response,
       callbacks,
       authorizationRequestPayload,
-      // If client_id_scheme was provided we should use the legacy (unprefixed) client id scheme
-      // TODO: allow both versions, in case of e.g. did:
-      expectedClientId: expectedClientId.legacyClientId ?? expectedClientId.clientId
+      expectedClientId: expectedClientId.effectiveClientId
     });
   }
   const authorizationResponsePayload = parseOpenid4VpAuthorizationResponsePayload(authorizationResponse);
@@ -1782,11 +1961,11 @@ var Openid4vpClient = class {
 
 // src/transaction-data/verify-transaction-data.ts
 import {
-  HashAlgorithm,
+  HashAlgorithm as HashAlgorithm2,
   Oauth2ErrorCodes as Oauth2ErrorCodes11,
   Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError13
 } from "@openid4vc/oauth2";
-import { decodeUtf8String, encodeToBase64Url as encodeToBase64Url2 } from "@openid4vc/utils";
+import { decodeUtf8String, encodeToBase64Url as encodeToBase64Url3 } from "@openid4vc/utils";
 async function verifyTransactionData(options) {
   const parsedTransactionData = parseTransactionData({
     transactionData: options.transactionData
@@ -1809,11 +1988,11 @@ async function verifyTransactionDataEntry({
 }) {
   const allowedAlgs = entry.transactionData.transaction_data_hashes_alg ?? ["sha-256"];
   const supportedAlgs = allowedAlgs.filter(
-    (alg) => Object.values(HashAlgorithm).includes(alg)
+    (alg) => Object.values(HashAlgorithm2).includes(alg)
   );
   const hashes = {};
   for (const alg of supportedAlgs) {
-    hashes[alg] = encodeToBase64Url2(await callbacks.hash(decodeUtf8String(entry.encoded), alg));
+    hashes[alg] = encodeToBase64Url3(await callbacks.hash(decodeUtf8String(entry.encoded), alg));
   }
   for (const credentialId of entry.transactionData.credential_ids) {
     const transactionDataHashesCredential = credentials[credentialId];
@@ -1829,7 +2008,7 @@ async function verifyTransactionDataEntry({
     if (!hash) {
       throw new Oauth2ServerErrorResponseError13({
         error: Oauth2ErrorCodes11.InvalidTransactionData,
-        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using unsupported alg '${alg}'. This library only supports verification of transaction data hashes using alg values ${Object.values(HashAlgorithm).join(", ")}. Either verify the hashes outside of this library, or limit the allowed alg values to the ones supported by this library.`
+        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using unsupported alg '${alg}'. This library only supports verification of transaction data hashes using alg values ${Object.values(HashAlgorithm2).join(", ")}. Either verify the hashes outside of this library, or limit the allowed alg values to the ones supported by this library.`
       });
     }
     const credentialHashIndex = transactionDataHashesCredential.transaction_data_hashes.indexOf(hash);
@@ -1885,7 +2064,7 @@ var Openid4vpVerifier = class {
 
 // src/models/z-credential-formats.ts
 import { z as z21 } from "zod";
-var zCredentialFormat = z21.enum(["jwt_vc_json", "ldp_vc", "ac_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
+var zCredentialFormat = z21.enum(["jwt_vc_json", "ldp_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]);
 
 // src/models/z-proof-formats.ts
 import { z as z22 } from "zod";
@@ -1895,8 +2074,13 @@ var zProofFormat = z22.enum(["jwt_vp_json", "ldc_vp", "ac_vp", "dc+sd-jwt", "vc+
 import { z as z23 } from "zod";
 var zWalletMetadata = z23.object({
   presentation_definition_uri_supported: z23.optional(z23.boolean()),
-  vp_formats_supported: zVpFormatsSupported,
-  client_id_schemes_supported: z23.optional(z23.array(zClientIdScheme)),
+  // Up until draft 26 the legacy format was used
+  vp_formats_supported: z23.optional(zVpFormatsSupported.or(zLegacyVpFormats)),
+  client_id_schemes_supported: z23.optional(
+    // client_id_schemes_supported was from before decentralized_identifier and openid_federation were defined
+    z23.array(zClientIdPrefix.exclude(["decentralized_identifier", "openid_federation"]))
+  ),
+  client_id_prefixes_supported: z23.optional(z23.array(zUniformClientIdPrefix)),
   request_object_signing_alg_values_supported: z23.optional(z23.array(z23.string())),
   authorization_encryption_alg_values_supported: z23.optional(z23.array(z23.string())),
   authorization_encryption_enc_values_supported: z23.optional(z23.array(z23.string()))
@@ -1922,7 +2106,7 @@ export {
   validateOpenid4vpAuthorizationRequestPayload,
   validateOpenid4vpAuthorizationResponsePayload,
   verifyJarmAuthorizationResponse,
-  zClientIdScheme,
+  zClientIdPrefix,
   zClientMetadata,
   zCredentialFormat,
   zJarmClientMetadata,