@openid4vc/openid4vp 0.3.0-alpha-20250711120307 → 0.3.0-alpha-20250713102850

package/dist/index.js

@@ -38,6 +38,7 @@ __export(index_exports, {
   getOpenid4vpClientId: () => getOpenid4vpClientId,
   isJarmResponseMode: () => isJarmResponseMode,
   isOpenid4vpAuthorizationRequestDcApi: () => isOpenid4vpAuthorizationRequestDcApi,
+  parseAuthorizationRequestVersion: () => parseAuthorizationRequestVersion,
   parseDcqlVpToken: () => parseDcqlVpToken,
   parseJarmAuthorizationResponse: () => parseJarmAuthorizationResponse,
   parseOpenid4VpAuthorizationResponsePayload: () => parseOpenid4VpAuthorizationResponsePayload,
@@ -658,6 +659,7 @@ async function validateOpenid4vpClientId(options, parserConfig) {
 
 // src/jarm/jarm-authorization-response/verify-jarm-authorization-response.ts
 var import_oauth27 = require("@openid4vc/oauth2");
+var import_utils7 = require("@openid4vc/utils");
 var import_zod9 = __toESM(require("zod"));
 
 // src/jarm/jarm-extract-jwks.ts
@@ -739,7 +741,10 @@ var decryptJarmAuthorizationResponseJwt = async (options) => {
   if (!result.decrypted) {
     throw new import_oauth27.Oauth2Error("Failed to decrypt jarm auth response.");
   }
-  return result.payload;
+  return {
+    decryptionJwk: result.decryptionJwk,
+    payload: result.payload
+  };
 };
 async function verifyJarmAuthorizationResponse(options) {
   const { jarmAuthorizationResponseJwt, callbacks, expectedClientId, authorizationRequestPayload } = options;
@@ -748,21 +753,21 @@ async function verifyJarmAuthorizationResponse(options) {
     jarmAuthorizationResponseJwt,
     callbacks,
     authorizationRequestPayload
-  }) : jarmAuthorizationResponseJwt;
-  const responseIsSigned = import_oauth27.zCompactJwt.safeParse(decryptedRequestData).success;
+  }) : { payload: jarmAuthorizationResponseJwt, decryptionJwk: void 0 };
+  const responseIsSigned = import_oauth27.zCompactJwt.safeParse(decryptedRequestData.payload).success;
   if (!requestDataIsEncrypted && !responseIsSigned) {
     throw new import_oauth27.Oauth2Error("Jarm Auth Response must be either encrypted, signed, or signed and encrypted.");
   }
   let jarmAuthorizationResponse;
   if (responseIsSigned) {
     const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_oauth27.decodeJwt)({
-      jwt: decryptedRequestData,
+      jwt: decryptedRequestData.payload,
       headerSchema: import_zod9.default.object({ ...import_oauth27.zJwtHeader.shape, kid: import_zod9.default.string() })
     });
     const response = zJarmAuthorizationResponse.parse(jwsPayload);
     const jwtSigner = (0, import_oauth27.jwtSignerFromJwt)({ header: jwsProtectedHeader, payload: jwsPayload });
     const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {
-      compact: decryptedRequestData,
+      compact: decryptedRequestData.payload,
       header: jwsProtectedHeader,
       payload: jwsPayload
     });
@@ -771,7 +776,10 @@ async function verifyJarmAuthorizationResponse(options) {
     }
     jarmAuthorizationResponse = response;
   } else {
-    const jsonRequestData = JSON.parse(decryptedRequestData);
+    const jsonRequestData = (0, import_utils7.stringToJsonWithErrorHandling)(
+      decryptedRequestData.payload,
+      "Unable to parse decrypted JARM JWE body to JSON"
+    );
     jarmAuthorizationResponse = zJarmAuthorizationResponseEncryptedOnly.parse(jsonRequestData);
   }
   jarmAuthorizationResponseValidate({
@@ -780,26 +788,135 @@ async function verifyJarmAuthorizationResponse(options) {
   });
   const type = requestDataIsEncrypted && responseIsSigned ? "SignedEncrypted" /* SignedEncrypted */ : requestDataIsEncrypted ? "Encrypted" /* Encrypted */ : "Signed" /* Signed */;
   const issuer = jarmAuthorizationResponse.iss;
-  return { jarmAuthorizationResponse, type, issuer };
+  return {
+    jarmAuthorizationResponse,
+    type,
+    issuer,
+    decryptionJwk: decryptedRequestData.decryptionJwk
+  };
+}
+
+// src/version.ts
+var import_oauth28 = require("@openid4vc/oauth2");
+function parseAuthorizationRequestVersion(request) {
+  const requirements = [];
+  if (request.verifier_info) {
+    requirements.push([">=", 100]);
+  }
+  if (request.verifier_attestations) {
+    requirements.push(["<", 100]);
+  }
+  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values) {
+    requirements.push([">=", 28]);
+  }
+  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.issuer_signed_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.device_signed_alg_values) {
+    requirements.push(["<", 28]);
+  }
+  if (request.client_metadata?.vp_formats) {
+    requirements.push([">=", 27]);
+  }
+  if (request.client_metadata?.vp_formats_supported) {
+    requirements.push(["<", 27]);
+  }
+  if (request.client_id?.startsWith("openid_federation:") || request.client_id?.startsWith("decentralized_identifier:")) {
+    requirements.push([">=", 26]);
+  }
+  if (request.client_id?.startsWith("did:")) {
+    requirements.push(["<", 26]);
+  }
+  if (request.presentation_definition || request.presentation_definition_uri) {
+    requirements.push([">=", 26]);
+  }
+  if (request.verifier_attestations) {
+    requirements.push([">=", 26]);
+  }
+  if (request.client_id?.startsWith("x509_san_uri:")) {
+    requirements.push(["<", 25]);
+  }
+  if (request.client_id?.startsWith("x509_hash:")) {
+    requirements.push([">=", 25]);
+  }
+  if (request.client_id?.startsWith("web-origin:")) {
+    requirements.push(["<", 25]);
+  }
+  if (request.client_id?.startsWith("origin:")) {
+    requirements.push([">=", 25]);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "w3c_dc_api" || request.response_mode === "w3c_dc_api.jwt")) {
+    requirements.push(["<", 23]);
+    requirements.push([">=", 21]);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "dc_api" || request.response_mode === "dc_api.jwt")) {
+    requirements.push([">=", 23]);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.transaction_data || request.dcql_query)) {
+    requirements.push([">=", 23]);
+  }
+  if (request.transaction_data) {
+    requirements.push([">=", 22]);
+  }
+  if (request.client_id_scheme) {
+    requirements.push(["<", 22]);
+  }
+  if (request.client_id) {
+    const colonIndex = request.client_id.indexOf(":");
+    const schemePart = request.client_id.substring(0, colonIndex);
+    const parsedScheme = zClientIdPrefix.safeParse(schemePart);
+    if (parsedScheme.success && parsedScheme.data !== "did" && parsedScheme.data !== "https") {
+      requirements.push([">=", 22]);
+    }
+  }
+  if (!request.client_id) {
+    requirements.push([">=", 21]);
+  }
+  if (request.dcql_query) {
+    requirements.push([">=", 21]);
+  }
+  if (request.client_metadata_uri) {
+    requirements.push(["<", 21]);
+  }
+  if (isOpenid4vpAuthorizationRequestDcApi(request)) {
+    requirements.push([">=", 21]);
+  }
+  if (request.request_uri_method || request.wallet_nonce) {
+    requirements.push([">=", 21]);
+  }
+  if (request.client_id_scheme === "verifier_attestation") {
+    requirements.push([">=", 20]);
+  }
+  if (request.client_id_scheme === "x509_san_dns" || request.client_id_scheme === "x509_san_uri") {
+    requirements.push([">=", 19]);
+  }
+  const lessThanVersions = requirements.filter(([operator]) => operator === "<").map(([_, version]) => version);
+  const greaterThanVersions = requirements.filter(([operator]) => operator === ">=").map(([_, version]) => version);
+  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 100;
+  const lowestRequiredVersion = greaterThanVersions.length > 0 ? Math.max(...greaterThanVersions) : 18;
+  if (lowestRequiredVersion > highestPossibleVersion) {
+    throw new import_oauth28.Oauth2ServerErrorResponseError({
+      error: import_oauth28.Oauth2ErrorCodes.InvalidRequest,
+      error_description: `Could not infer openid4vp version from the openid4vp request payload. Based on specification requirements, lowest required version is ${lowestRequiredVersion} and highest possible version is ${highestPossibleVersion}`
+    });
+  }
+  return highestPossibleVersion;
 }
 
 // src/authorization-request/create-authorization-request.ts
-var import_oauth211 = require("@openid4vc/oauth2");
-var import_utils9 = require("@openid4vc/utils");
+var import_oauth212 = require("@openid4vc/oauth2");
+var import_utils10 = require("@openid4vc/utils");
 
 // src/jar/create-jar-authorization-request.ts
-var import_oauth28 = require("@openid4vc/oauth2");
-var import_utils7 = require("@openid4vc/utils");
+var import_oauth29 = require("@openid4vc/oauth2");
+var import_utils8 = require("@openid4vc/utils");
 async function createJarAuthorizationRequest(options) {
   const { jwtSigner, jweEncryptor, authorizationRequestPayload, requestUri, callbacks } = options;
   let authorizationRequestJwt;
   let encryptionJwk;
   const now = options.now ?? /* @__PURE__ */ new Date();
   const { jwt, signerJwk } = await callbacks.signJwt(jwtSigner, {
-    header: { ...(0, import_oauth28.jwtHeaderFromJwtSigner)(jwtSigner), typ: "oauth-authz-req+jwt" },
+    header: { ...(0, import_oauth29.jwtHeaderFromJwtSigner)(jwtSigner), typ: "oauth-authz-req+jwt" },
     payload: {
-      iat: (0, import_utils7.dateToSeconds)(now),
-      exp: (0, import_utils7.dateToSeconds)((0, import_utils7.addSecondsToDate)(now, options.expiresInSeconds)),
+      iat: (0, import_utils8.dateToSeconds)(now),
+      exp: (0, import_utils8.dateToSeconds)((0, import_utils8.addSecondsToDate)(now, options.expiresInSeconds)),
       ...options.additionalJwtPayload,
       ...authorizationRequestPayload
     }
@@ -816,94 +933,94 @@ async function createJarAuthorizationRequest(options) {
 }
 
 // src/authorization-request/validate-authorization-request.ts
-var import_oauth29 = require("@openid4vc/oauth2");
-var import_utils8 = require("@openid4vc/utils");
+var import_oauth210 = require("@openid4vc/oauth2");
+var import_utils9 = require("@openid4vc/utils");
 var validateOpenid4vpAuthorizationRequestPayload = (options) => {
   const { params, walletVerificationOptions } = options;
   if (!params.redirect_uri && !params.response_uri) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: `Missing required 'redirect_uri' or 'response_uri' in openid4vp authorization request.`
     });
   }
   if (params.response_uri && !["direct_post", "direct_post.jwt"].find((mode) => mode === params.response_mode)) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'response_mode' parameter MUST be 'direct_post' or 'direct_post.jwt' when 'response_uri' is provided. Current: ${params.response_mode}`
     });
   }
   if ([params.presentation_definition_uri, params.presentation_definition, params.dcql_query, params.scope].filter(
     Boolean
   ).length > 1) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Exactly one of the following parameters MUST be present in the authorization request: dcql_query, presentation_definition, presentation_definition_uri, or a scope value representing a Presentation Definition."
     });
   }
   if (params.request_uri_method && !params.request_uri) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "request_uri_method" parameter MUST NOT be present in the authorization request if the "request_uri" parameter is not present.'
     });
   }
   if (params.request_uri_method && !["GET", "POST"].includes(params.request_uri_method)) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequestUriMethod,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequestUriMethod,
       error_description: `The 'request_uri_method' parameter MUST be 'GET' or 'POST'. Current: ${params.request_uri_method}`
     });
   }
-  if (params.trust_chain && !import_utils8.zHttpsUrl.safeParse(params.client_id).success) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+  if (params.trust_chain && !import_utils9.zHttpsUrl.safeParse(params.client_id).success) {
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "trust_chain" parameter MUST NOT be present in the authorization request if the "client_id" is not an OpenId Federation Entity Identifier starting with http:// or https://.'
     });
   }
   if (walletVerificationOptions?.expectedNonce && !params.wallet_nonce) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "wallet_nonce" parameter MUST be present in the authorization request when the "expectedNonce" parameter is provided.'
     });
   }
   if (walletVerificationOptions?.expectedNonce !== params.wallet_nonce) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: 'The "wallet_nonce" parameter MUST match the "expectedNonce" parameter when the "expectedNonce" parameter is provided.'
     });
   }
   if (params.client_id.startsWith("web-origin:") || params.client_id.startsWith("origin:")) {
-    throw new import_oauth29.Oauth2ServerErrorResponseError({
-      error: import_oauth29.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth210.Oauth2ServerErrorResponseError({
+      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'client_id' parameter MUST NOT use client identifier scheme '${params.client_id.split(":")[0]}' when not using the dc_api response mode. Current: ${params.client_id}`
     });
   }
 };
 
 // src/authorization-request/validate-authorization-request-dc-api.ts
-var import_oauth210 = require("@openid4vc/oauth2");
+var import_oauth211 = require("@openid4vc/oauth2");
 var validateOpenid4vpAuthorizationRequestDcApiPayload = (options) => {
   const { params, isJarRequest, disableOriginValidation, origin } = options;
   if (isJarRequest && !params.expected_origins) {
-    throw new import_oauth210.Oauth2ServerErrorResponseError({
-      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth211.Oauth2ServerErrorResponseError({
+      error: import_oauth211.Oauth2ErrorCodes.InvalidRequest,
       error_description: `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combinaction with jar.`
     });
   }
   if ([params.presentation_definition, params.dcql_query].filter(Boolean).length !== 1) {
-    throw new import_oauth210.Oauth2ServerErrorResponseError({
-      error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+    throw new import_oauth211.Oauth2ServerErrorResponseError({
+      error: import_oauth211.Oauth2ErrorCodes.InvalidRequest,
       error_description: "Exactly one of the following parameters MUST be present in the Authorization Request: dcql_query or presentation_definition"
     });
   }
   if (params.expected_origins && !disableOriginValidation) {
     if (!origin) {
-      throw new import_oauth210.Oauth2ServerErrorResponseError({
-        error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth211.Oauth2ServerErrorResponseError({
+        error: import_oauth211.Oauth2ErrorCodes.InvalidRequest,
         error_description: `Failed to validate the 'origin' of the authorization request. The 'origin' was not provided.`
       });
     }
     if (params.expected_origins && !params.expected_origins.includes(origin)) {
-      throw new import_oauth210.Oauth2ServerErrorResponseError({
-        error: import_oauth210.Oauth2ErrorCodes.InvalidRequest,
+      throw new import_oauth211.Oauth2ServerErrorResponseError({
+        error: import_oauth211.Oauth2ErrorCodes.InvalidRequest,
         error_description: `The 'expected_origins' parameter MUST include the origin of the authorization request. Current: ${params.expected_origins.join(", ")}`
       });
     }
@@ -916,13 +1033,13 @@ async function createOpenid4vpAuthorizationRequest(options) {
   let additionalJwtPayload;
   let authorizationRequestPayload;
   if (isOpenid4vpAuthorizationRequestDcApi(options.authorizationRequestPayload)) {
-    authorizationRequestPayload = (0, import_utils9.parseWithErrorHandling)(
+    authorizationRequestPayload = (0, import_utils10.parseWithErrorHandling)(
       zOpenid4vpAuthorizationRequestDcApi,
       options.authorizationRequestPayload,
       "Invalid authorization request. Could not parse openid4vp dc_api authorization request."
     );
     if (jar && !authorizationRequestPayload.expected_origins) {
-      throw new import_oauth211.Oauth2Error(
+      throw new import_oauth212.Oauth2Error(
         `The 'expected_origins' parameter MUST be present when using the dc_api response mode in combination with jar.`
       );
     }
@@ -932,7 +1049,7 @@ async function createOpenid4vpAuthorizationRequest(options) {
       disableOriginValidation: true
     });
   } else {
-    authorizationRequestPayload = (0, import_utils9.parseWithErrorHandling)(
+    authorizationRequestPayload = (0, import_utils10.parseWithErrorHandling)(
       zOpenid4vpAuthorizationRequest,
       options.authorizationRequestPayload,
       "Invalid authorization request. Could not parse openid4vp authorization request."
@@ -952,10 +1069,10 @@ async function createOpenid4vpAuthorizationRequest(options) {
       additionalJwtPayload,
       callbacks
     });
-    const url2 = new import_utils9.URL(scheme);
-    url2.search = `?${new import_utils9.URLSearchParams([
+    const url2 = new import_utils10.URL(scheme);
+    url2.search = `?${new import_utils10.URLSearchParams([
       ...url2.searchParams.entries(),
-      ...(0, import_utils9.objectToQueryParams)(jarResult.jarAuthorizationRequest).entries(),
+      ...(0, import_utils10.objectToQueryParams)(jarResult.jarAuthorizationRequest).entries(),
       // Add client_id_scheme if defined for backwards compat
       ...authorizationRequestPayload.client_id_scheme ? [["client_id_scheme", authorizationRequestPayload.client_id_scheme]] : []
     ]).toString()}`;
@@ -966,10 +1083,10 @@ async function createOpenid4vpAuthorizationRequest(options) {
       jar: { ...jar, ...jarResult }
     };
   }
-  const url = new import_utils9.URL(scheme);
-  url.search = `?${new import_utils9.URLSearchParams([
+  const url = new import_utils10.URL(scheme);
+  url.search = `?${new import_utils10.URLSearchParams([
     ...url.searchParams.entries(),
-    ...(0, import_utils9.objectToQueryParams)(authorizationRequestPayload).entries()
+    ...(0, import_utils10.objectToQueryParams)(authorizationRequestPayload).entries()
   ]).toString()}`;
   return {
     authorizationRequestPayload,
@@ -980,30 +1097,30 @@ async function createOpenid4vpAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-authorization-request-params.ts
-var import_oauth213 = require("@openid4vc/oauth2");
-var import_utils11 = require("@openid4vc/utils");
+var import_oauth214 = require("@openid4vc/oauth2");
+var import_utils12 = require("@openid4vc/utils");
 var import_zod11 = __toESM(require("zod"));
 
 // src/jar/z-jar-authorization-request.ts
-var import_oauth212 = require("@openid4vc/oauth2");
-var import_utils10 = require("@openid4vc/utils");
+var import_oauth213 = require("@openid4vc/oauth2");
+var import_utils11 = require("@openid4vc/utils");
 var import_zod10 = require("zod");
 var zJarAuthorizationRequest = import_zod10.z.object({
   request: import_zod10.z.optional(import_zod10.z.string()),
-  request_uri: import_zod10.z.optional(import_utils10.zHttpsUrl),
+  request_uri: import_zod10.z.optional(import_utils11.zHttpsUrl),
   request_uri_method: import_zod10.z.optional(import_zod10.z.string()),
   client_id: import_zod10.z.optional(import_zod10.z.string())
 }).passthrough();
 function validateJarRequestParams(options) {
   const { jarRequestParams } = options;
   if (jarRequestParams.request && jarRequestParams.request_uri) {
-    throw new import_oauth212.Oauth2ServerErrorResponseError({
+    throw new import_oauth213.Oauth2ServerErrorResponseError({
       error: "invalid_request_object",
       error_description: "request and request_uri cannot both be present in a JAR request"
     });
   }
   if (!jarRequestParams.request && !jarRequestParams.request_uri) {
-    throw new import_oauth212.Oauth2ServerErrorResponseError({
+    throw new import_oauth213.Oauth2ServerErrorResponseError({
       error: "invalid_request_object",
       error_description: "request or request_uri must be present"
     });
@@ -1021,21 +1138,21 @@ function parseOpenid4vpAuthorizationRequest(options) {
   let params;
   if (typeof authorizationRequest === "string") {
     if (authorizationRequest.includes(":")) {
-      params = (0, import_utils11.parseWithErrorHandling)(
+      params = (0, import_utils12.parseWithErrorHandling)(
         zOpenid4vpAuthorizationRequestFromUriParams,
         authorizationRequest,
         "Unable to parse openid4vp authorization request uri to a valid object"
       );
       provided = "uri";
     } else {
-      const decoded = (0, import_oauth213.decodeJwt)({ jwt: authorizationRequest });
+      const decoded = (0, import_oauth214.decodeJwt)({ jwt: authorizationRequest });
       params = decoded.payload;
       provided = "jwt";
     }
   } else {
     params = authorizationRequest;
   }
-  const parsedRequest = (0, import_utils11.parseWithErrorHandling)(
+  const parsedRequest = (0, import_utils12.parseWithErrorHandling)(
     import_zod11.default.union([zOpenid4vpAuthorizationRequest, zJarAuthorizationRequest, zOpenid4vpAuthorizationRequestDcApi]),
     params
   );
@@ -1062,31 +1179,31 @@ function parseOpenid4vpAuthorizationRequest(options) {
 
 // src/authorization-request/resolve-authorization-request.ts
 var import_oauth220 = require("@openid4vc/oauth2");
-var import_utils15 = require("@openid4vc/utils");
+var import_utils16 = require("@openid4vc/utils");
 var import_zod15 = __toESM(require("zod"));
 
 // src/fetch-client-metadata.ts
-var import_oauth214 = require("@openid4vc/oauth2");
-var import_utils12 = require("@openid4vc/utils");
+var import_oauth215 = require("@openid4vc/oauth2");
+var import_utils13 = require("@openid4vc/utils");
 async function fetchClientMetadata(options) {
   const { fetch, clientMetadataUri } = options;
-  const fetcher = (0, import_utils12.createZodFetcher)(fetch);
-  const { result, response } = await fetcher(zClientMetadata, import_utils12.ContentType.Json, clientMetadataUri, {
+  const fetcher = (0, import_utils13.createZodFetcher)(fetch);
+  const { result, response } = await fetcher(zClientMetadata, import_utils13.ContentType.Json, clientMetadataUri, {
     method: "GET",
     headers: {
-      Accept: import_utils12.ContentType.Json
+      Accept: import_utils13.ContentType.Json
     }
   });
   if (!response.ok) {
-    throw new import_oauth214.Oauth2ServerErrorResponseError({
+    throw new import_oauth215.Oauth2ServerErrorResponseError({
       error_description: `Fetching client metadata from '${clientMetadataUri}' failed with status code '${response.status}'.`,
-      error: import_oauth214.Oauth2ErrorCodes.InvalidRequestUri
+      error: import_oauth215.Oauth2ErrorCodes.InvalidRequestUri
     });
   }
   if (!result || !result.success) {
-    throw new import_oauth214.Oauth2ServerErrorResponseError({
+    throw new import_oauth215.Oauth2ServerErrorResponseError({
       error_description: `Parsing client metadata from '${clientMetadataUri}' failed.`,
-      error: import_oauth214.Oauth2ErrorCodes.InvalidRequestObject
+      error: import_oauth215.Oauth2ErrorCodes.InvalidRequestObject
     });
   }
   return result.data;
@@ -1096,113 +1213,9 @@ async function fetchClientMetadata(options) {
 var import_oauth218 = require("@openid4vc/oauth2");
 var import_zod13 = __toESM(require("zod"));
 
-// src/version.ts
-var import_oauth215 = require("@openid4vc/oauth2");
-function parseAuthorizationRequestVersion(request) {
-  const requirements = [];
-  if (request.verifier_info) {
-    requirements.push([">=", 100]);
-  }
-  if (request.verifier_attestations) {
-    requirements.push(["<", 100]);
-  }
-  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.deviceauth_alg_values) {
-    requirements.push([">=", 28]);
-  }
-  if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.issuer_signed_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.device_signed_alg_values) {
-    requirements.push(["<", 28]);
-  }
-  if (request.client_metadata?.vp_formats) {
-    requirements.push([">=", 27]);
-  }
-  if (request.client_metadata?.vp_formats_supported) {
-    requirements.push(["<", 27]);
-  }
-  if (request.client_id?.startsWith("openid_federation:") || request.client_id?.startsWith("decentralized_identifier:")) {
-    requirements.push([">=", 26]);
-  }
-  if (request.client_id?.startsWith("did:")) {
-    requirements.push(["<", 26]);
-  }
-  if (request.presentation_definition || request.presentation_definition_uri) {
-    requirements.push([">=", 26]);
-  }
-  if (request.verifier_attestations) {
-    requirements.push([">=", 26]);
-  }
-  if (request.client_id?.startsWith("x509_san_uri:")) {
-    requirements.push(["<", 25]);
-  }
-  if (request.client_id?.startsWith("x509_hash:")) {
-    requirements.push([">=", 25]);
-  }
-  if (request.client_id?.startsWith("web-origin:")) {
-    requirements.push(["<", 25]);
-  }
-  if (request.client_id?.startsWith("origin:")) {
-    requirements.push([">=", 25]);
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "w3c_dc_api" || request.response_mode === "w3c_dc_api.jwt")) {
-    requirements.push(["<", 23]);
-    requirements.push([">=", 21]);
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.response_mode === "dc_api" || request.response_mode === "dc_api.jwt")) {
-    requirements.push([">=", 23]);
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(request) && (request.transaction_data || request.dcql_query)) {
-    requirements.push([">=", 23]);
-  }
-  if (request.transaction_data) {
-    requirements.push([">=", 22]);
-  }
-  if (request.client_id_scheme) {
-    requirements.push(["<", 22]);
-  }
-  if (request.client_id) {
-    const colonIndex = request.client_id.indexOf(":");
-    const schemePart = request.client_id.substring(0, colonIndex);
-    const parsedScheme = zClientIdPrefix.safeParse(schemePart);
-    if (parsedScheme.success && parsedScheme.data !== "did" && parsedScheme.data !== "https") {
-      requirements.push([">=", 22]);
-    }
-  }
-  if (!request.client_id) {
-    requirements.push([">=", 21]);
-  }
-  if (request.dcql_query) {
-    requirements.push([">=", 21]);
-  }
-  if (request.client_metadata_uri) {
-    requirements.push(["<", 21]);
-  }
-  if (isOpenid4vpAuthorizationRequestDcApi(request)) {
-    requirements.push([">=", 21]);
-  }
-  if (request.request_uri_method || request.wallet_nonce) {
-    requirements.push([">=", 21]);
-  }
-  if (request.client_id_scheme === "verifier_attestation") {
-    requirements.push([">=", 20]);
-  }
-  if (request.client_id_scheme === "x509_san_dns" || request.client_id_scheme === "x509_san_uri") {
-    requirements.push([">=", 19]);
-  }
-  const lessThanVersions = requirements.filter(([operator]) => operator === "<").map(([_, version]) => version);
-  const greaterThanVersions = requirements.filter(([operator]) => operator === ">=").map(([_, version]) => version);
-  const highestPossibleVersion = lessThanVersions.length > 0 ? Math.max(Math.min(...lessThanVersions) - 1, 18) : 100;
-  const lowestRequiredVersion = greaterThanVersions.length > 0 ? Math.max(...greaterThanVersions) : 18;
-  if (lowestRequiredVersion > highestPossibleVersion) {
-    throw new import_oauth215.Oauth2ServerErrorResponseError({
-      error: import_oauth215.Oauth2ErrorCodes.InvalidRequest,
-      error_description: `Could not infer openid4vp version from the openid4vp request payload. Based on specification requirements, lowest required version is ${lowestRequiredVersion} and highest possible version is ${highestPossibleVersion}`
-    });
-  }
-  return highestPossibleVersion;
-}
-
 // src/jar/jar-request-object/fetch-jar-request-object.ts
 var import_oauth216 = require("@openid4vc/oauth2");
-var import_utils13 = require("@openid4vc/utils");
+var import_utils14 = require("@openid4vc/utils");
 async function fetchJarRequestObject(options) {
   const { requestUri, clientIdentifierScheme, method, wallet, fetch } = options;
   let requestBody = wallet.metadata ? { wallet_metadata: wallet.metadata, wallet_nonce: wallet.nonce } : void 0;
@@ -1210,12 +1223,12 @@ async function fetchJarRequestObject(options) {
     const { request_object_signing_alg_values_supported, ...rest } = requestBody.wallet_metadata;
     requestBody = { ...requestBody, wallet_metadata: { ...rest } };
   }
-  const response = await (0, import_utils13.createFetcher)(fetch)(requestUri, {
+  const response = await (0, import_utils14.createFetcher)(fetch)(requestUri, {
     method,
-    body: method === "post" ? (0, import_utils13.objectToQueryParams)(wallet.metadata ?? {}) : void 0,
+    body: method === "post" ? (0, import_utils14.objectToQueryParams)(wallet.metadata ?? {}) : void 0,
     headers: {
-      Accept: `${import_utils13.ContentType.OAuthAuthorizationRequestJwt}, ${import_utils13.ContentType.Jwt};q=0.9, text/plain`,
-      "Content-Type": import_utils13.ContentType.XWwwFormUrlencoded
+      Accept: `${import_utils14.ContentType.OAuthAuthorizationRequestJwt}, ${import_utils14.ContentType.Jwt};q=0.9, text/plain`,
+      "Content-Type": import_utils14.ContentType.XWwwFormUrlencoded
     }
   }).catch(() => {
     throw new import_oauth216.Oauth2ServerErrorResponseError({
@@ -1381,7 +1394,7 @@ async function verifyJarRequestObject(options) {
 
 // src/transaction-data/parse-transaction-data.ts
 var import_oauth219 = require("@openid4vc/oauth2");
-var import_utils14 = require("@openid4vc/utils");
+var import_utils15 = require("@openid4vc/utils");
 
 // src/transaction-data/z-transaction-data.ts
 var import_zod14 = require("zod");
@@ -1395,7 +1408,7 @@ var zTransactionData = import_zod14.z.array(zTransactionEntry);
 // src/transaction-data/parse-transaction-data.ts
 function parseTransactionData(options) {
   const { transactionData } = options;
-  const decoded = transactionData.map((tdEntry) => (0, import_utils14.parseIfJson)((0, import_utils14.encodeToUtf8String)((0, import_utils14.decodeBase64)(tdEntry))));
+  const decoded = transactionData.map((tdEntry) => (0, import_utils15.parseIfJson)((0, import_utils15.encodeToUtf8String)((0, import_utils15.decodeBase64)(tdEntry))));
   const parsedResult = zTransactionData.safeParse(decoded);
   if (!parsedResult.success) {
     throw new import_oauth219.Oauth2ServerErrorResponseError({
@@ -1414,7 +1427,7 @@ function parseTransactionData(options) {
 async function resolveOpenid4vpAuthorizationRequest(options) {
   const { wallet, callbacks, origin, disableOriginValidation } = options;
   let authorizationRequestPayload;
-  const parsed = (0, import_utils15.parseWithErrorHandling)(
+  const parsed = (0, import_utils16.parseWithErrorHandling)(
     import_zod15.default.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest, zJarAuthorizationRequest]),
     options.authorizationRequestPayload,
     "Invalid authorization request. Could not parse openid4vp authorization request as openid4vp or jar auth request."
@@ -1422,7 +1435,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
   let jar;
   if (isJarAuthorizationRequest(parsed)) {
     jar = await verifyJarRequest({ jarRequestParams: parsed, callbacks, wallet });
-    const parsedJarAuthorizationRequestPayload = (0, import_utils15.parseWithErrorHandling)(
+    const parsedJarAuthorizationRequestPayload = (0, import_utils16.parseWithErrorHandling)(
       import_zod15.default.union([zOpenid4vpAuthorizationRequestDcApi, zOpenid4vpAuthorizationRequest]),
       jar.authorizationRequestPayload,
       "Invalid authorization request. Could not parse jar request payload as openid4vp auth request."
@@ -1504,7 +1517,7 @@ function validateOpenId4vpAuthorizationRequestPayload(options) {
 
 // src/authorization-response/create-authorization-response.ts
 var import_oauth223 = require("@openid4vc/oauth2");
-var import_utils16 = require("@openid4vc/utils");
+var import_utils17 = require("@openid4vc/utils");
 
 // ../utils/src/date.ts
 function addSecondsToDate2(date, seconds) {
@@ -1685,7 +1698,7 @@ async function createOpenid4vpAuthorizationResponse(options) {
     additionalJwtPayload = {
       iss: jarm.authorizationServer,
       aud: jarm.audience,
-      exp: jarm.expiresInSeconds ?? (0, import_utils16.dateToSeconds)(addSecondsToDate2(/* @__PURE__ */ new Date(), 60 * 10))
+      exp: jarm.expiresInSeconds ?? (0, import_utils17.dateToSeconds)(addSecondsToDate2(/* @__PURE__ */ new Date(), 60 * 10))
       // default: 10 minutes
     };
   }
@@ -1699,8 +1712,8 @@ async function createOpenid4vpAuthorizationResponse(options) {
     jweEncryptor: jarm?.encryption ? {
       method: "jwk",
       publicJwk: encJwk,
-      apu: jarm.encryption.nonce ? (0, import_utils16.encodeToBase64Url)(jarm.encryption.nonce) : void 0,
-      apv: (0, import_utils16.encodeToBase64Url)(authorizationRequestPayload.nonce),
+      apu: jarm.encryption.nonce ? (0, import_utils17.encodeToBase64Url)(jarm.encryption.nonce) : void 0,
+      apv: (0, import_utils17.encodeToBase64Url)(authorizationRequestPayload.nonce),
       alg,
       enc
     } : void 0,
@@ -1717,25 +1730,25 @@ async function createOpenid4vpAuthorizationResponse(options) {
 
 // src/authorization-response/submit-authorization-response.ts
 var import_oauth225 = require("@openid4vc/oauth2");
-var import_utils18 = require("@openid4vc/utils");
 var import_utils19 = require("@openid4vc/utils");
+var import_utils20 = require("@openid4vc/utils");
 
 // src/jarm/jarm-authorizatino-response-send.ts
 var import_oauth224 = require("@openid4vc/oauth2");
-var import_utils17 = require("@openid4vc/utils");
+var import_utils18 = require("@openid4vc/utils");
 var jarmAuthorizationResponseSend = (options) => {
   const { authorizationRequestPayload, jarmAuthorizationResponseJwt, callbacks } = options;
   const responseEndpoint = authorizationRequestPayload.response_uri ?? authorizationRequestPayload.redirect_uri;
   if (!responseEndpoint) {
     throw new import_oauth224.Oauth2Error(`Either 'response_uri' or 'redirect_uri' MUST  be present in the authorization request`);
   }
-  const responseEndpointUrl = new import_utils17.URL(responseEndpoint);
+  const responseEndpointUrl = new import_utils18.URL(responseEndpoint);
   return handleDirectPostJwt(responseEndpointUrl, jarmAuthorizationResponseJwt, callbacks);
 };
 async function handleDirectPostJwt(responseEndpoint, responseJwt, callbacks) {
-  const response = await (0, import_utils17.createFetcher)(callbacks.fetch)(responseEndpoint, {
+  const response = await (0, import_utils18.createFetcher)(callbacks.fetch)(responseEndpoint, {
     method: "POST",
-    headers: { "Content-Type": import_utils17.ContentType.XWwwFormUrlencoded },
+    headers: { "Content-Type": import_utils18.ContentType.XWwwFormUrlencoded },
     body: `response=${responseJwt}`
   });
   return {
@@ -1760,13 +1773,13 @@ async function submitOpenid4vpAuthorizationResponse(options) {
       "Failed to submit OpenId4Vp Authorization Response. No redirect_uri or response_uri provided."
     );
   }
-  const fetch = (0, import_utils18.createFetcher)(callbacks.fetch);
-  const encodedResponse = (0, import_utils19.objectToQueryParams)(authorizationResponsePayload);
+  const fetch = (0, import_utils19.createFetcher)(callbacks.fetch);
+  const encodedResponse = (0, import_utils20.objectToQueryParams)(authorizationResponsePayload);
   const submissionResponse = await fetch(url, {
     method: "POST",
     body: encodedResponse.toString(),
     headers: {
-      "Content-Type": import_utils18.ContentType.XWwwFormUrlencoded
+      "Content-Type": import_utils19.ContentType.XWwwFormUrlencoded
     }
   });
   return {
@@ -1779,7 +1792,7 @@ async function submitOpenid4vpAuthorizationResponse(options) {
 var import_oauth226 = require("@openid4vc/oauth2");
 
 // src/vp-token/parse-vp-token.ts
-var import_utils20 = require("@openid4vc/utils");
+var import_utils21 = require("@openid4vc/utils");
 
 // src/vp-token/z-vp-token.ts
 var import_zod17 = require("zod");
@@ -1805,17 +1818,17 @@ var zVpToken = zVpTokenDcql.or(zVpTokenPex);
 
 // src/vp-token/parse-vp-token.ts
 function parsePexVpToken(vpToken) {
-  const parsedVpToken = (0, import_utils20.parseWithErrorHandling)(
+  const parsedVpToken = (0, import_utils21.parseWithErrorHandling)(
     zVpTokenPex,
-    (0, import_utils20.parseIfJson)(vpToken),
+    (0, import_utils21.parseIfJson)(vpToken),
     "Could not parse presentation exchange vp_token. Expected a string or an array of strings"
   );
   return Array.isArray(parsedVpToken) ? parsedVpToken : [parsedVpToken];
 }
 function parseDcqlVpToken(vpToken) {
-  const parsedVpToken = (0, import_utils20.parseWithErrorHandling)(
+  const parsedVpToken = (0, import_utils21.parseWithErrorHandling)(
     zVpTokenDcql,
-    (0, import_utils20.parseIfJson)(vpToken),
+    (0, import_utils21.parseIfJson)(vpToken),
     "Could not parse dcql vp_token. Expected an object where the values are encoded presentations"
   );
   return Object.fromEntries(
@@ -1874,10 +1887,10 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
 var import_oauth228 = require("@openid4vc/oauth2");
 
 // src/authorization-response/parse-authorization-response-payload.ts
-var import_utils22 = require("@openid4vc/utils");
+var import_utils23 = require("@openid4vc/utils");
 
 // src/authorization-response/z-authorization-response.ts
-var import_utils21 = require("@openid4vc/utils");
+var import_utils22 = require("@openid4vc/utils");
 var import_zod19 = require("zod");
 
 // src/models/z-pex.ts
@@ -1890,7 +1903,7 @@ var zOpenid4vpAuthorizationResponse = import_zod19.z.object({
   state: import_zod19.z.string().optional(),
   id_token: import_zod19.z.string().optional(),
   vp_token: zVpToken,
-  presentation_submission: zPexPresentationSubmission.or(import_utils21.zStringToJson).optional(),
+  presentation_submission: zPexPresentationSubmission.or(import_utils22.zStringToJson).optional(),
   refresh_token: import_zod19.z.string().optional(),
   token_type: import_zod19.z.string().optional(),
   access_token: import_zod19.z.string().optional(),
@@ -1899,7 +1912,7 @@ var zOpenid4vpAuthorizationResponse = import_zod19.z.object({
 
 // src/authorization-response/parse-authorization-response-payload.ts
 function parseOpenid4VpAuthorizationResponsePayload(payload) {
-  return (0, import_utils22.parseWithErrorHandling)(
+  return (0, import_utils23.parseWithErrorHandling)(
     zOpenid4vpAuthorizationResponse,
     payload,
     "Failed to parse openid4vp authorization response."
@@ -1908,11 +1921,11 @@ function parseOpenid4VpAuthorizationResponsePayload(payload) {
 
 // src/authorization-response/parse-jarm-authorization-response.ts
 var import_oauth227 = require("@openid4vc/oauth2");
-var import_utils23 = require("@openid4vc/utils");
+var import_utils24 = require("@openid4vc/utils");
 var import_zod20 = __toESM(require("zod"));
 async function parseJarmAuthorizationResponse(options) {
   const { jarmResponseJwt, callbacks, authorizationRequestPayload, expectedClientId } = options;
-  const jarmAuthorizationResponseJwt = (0, import_utils23.parseWithErrorHandling)(
+  const jarmAuthorizationResponseJwt = (0, import_utils24.parseWithErrorHandling)(
     import_zod20.default.union([import_oauth227.zCompactJwt, import_oauth227.zCompactJwe]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
@@ -2009,7 +2022,7 @@ var Openid4vpClient = class {
 
 // src/transaction-data/verify-transaction-data.ts
 var import_oauth229 = require("@openid4vc/oauth2");
-var import_utils24 = require("@openid4vc/utils");
+var import_utils25 = require("@openid4vc/utils");
 async function verifyTransactionData(options) {
   const parsedTransactionData = parseTransactionData({
     transactionData: options.transactionData
@@ -2036,7 +2049,7 @@ async function verifyTransactionDataEntry({
   );
   const hashes = {};
   for (const alg of supportedAlgs) {
-    hashes[alg] = (0, import_utils24.encodeToBase64Url)(await callbacks.hash((0, import_utils24.decodeUtf8String)(entry.encoded), alg));
+    hashes[alg] = (0, import_utils25.encodeToBase64Url)(await callbacks.hash((0, import_utils25.decodeUtf8String)(entry.encoded), alg));
   }
   for (const credentialId of entry.transactionData.credential_ids) {
     const transactionDataHashesCredential = credentials[credentialId];
@@ -2139,6 +2152,7 @@ var zWalletMetadata = import_zod23.z.object({
   getOpenid4vpClientId,
   isJarmResponseMode,
   isOpenid4vpAuthorizationRequestDcApi,
+  parseAuthorizationRequestVersion,
   parseDcqlVpToken,
   parseJarmAuthorizationResponse,
   parseOpenid4VpAuthorizationResponsePayload,