@openid4vc/openid4vp 0.3.0-alpha-20250713104317 → 0.3.0-alpha-20250713113151

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import * as zod from 'zod';
 import zod__default, { z } from 'zod';
 import * as _openid4vc_oauth2 from '@openid4vc/oauth2';
-import { Jwk, JwtSignerWithJwk, decodeJwt, CallbackContext, JwtPayload, JwtSigner, JweEncryptor, HashAlgorithm } from '@openid4vc/oauth2';
+import { Jwk, JwtSignerWithJwk, decodeJwt, CallbackContext, JwtPayload, JwtSigner, JweEncryptor, HashAlgorithm, JwkSet } from '@openid4vc/oauth2';
 
 declare const zOpenid4vpAuthorizationRequest: z.ZodObject<{
     response_type: z.ZodLiteral<"vp_token">;
@@ -11687,6 +11687,14 @@ declare const zClientMetadata: z.ZodObject<{
 }, z.ZodTypeAny, "passthrough">>;
 type ClientMetadata = z.infer<typeof zClientMetadata>;
 
+/**
+ * The Openid4vpVersionNumber
+ *
+ * 100 means 1.0 final, all others are draft versions
+ */
+type Openid4vpVersionNumber = 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 100;
+declare function parseAuthorizationRequestVersion(request: Openid4vpAuthorizationRequest | Openid4vpAuthorizationRequestDcApi): Openid4vpVersionNumber;
+
 declare const zClientIdPrefix: z.ZodEnum<["pre-registered", "redirect_uri", "verifier_attestation", "https", "openid_federation", "did", "decentralized_identifier", "x509_san_uri", "x509_hash", "x509_san_dns", "origin", "web-origin"]>;
 declare const zUniformClientIdPrefix: z.ZodEnum<["pre-registered", "redirect_uri", "verifier_attestation", "openid_federation", "decentralized_identifier", "x509_san_uri", "x509_hash", "x509_san_dns", "origin"]>;
 type ClientIdPrefix = z.infer<typeof zClientIdPrefix>;
@@ -11753,6 +11761,15 @@ interface GetOpenid4vpClientIdOptions {
     legacyClientIdScheme?: unknown;
     responseMode: unknown;
     origin?: string;
+    /**
+     * The version of OpenID4VP used.
+     *
+     * Currently it is only used for:
+     * - determining whether effective client id is `origin:` or `web-origin:` when DC API is used.
+     *
+     * When no version is provided, it is assumed version 1.0 (100) is used.
+     */
+    version?: Openid4vpVersionNumber;
 }
 /**
  * Get the client id for an authorization request based on the response_mode, client_id, client_id_scheme and origin values.
@@ -12573,14 +12590,6 @@ declare const zJarmClientMetadata: z.ZodObject<{
 }>;
 type JarmClientMetadata = z.infer<typeof zJarmClientMetadata>;
 
-/**
- * The Openid4vpVersionNumber
- *
- * 100 means 1.0 final, all others are draft versions
- */
-type Openid4vpVersionNumber = 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 100;
-declare function parseAuthorizationRequestVersion(request: Openid4vpAuthorizationRequest | Openid4vpAuthorizationRequestDcApi): Openid4vpVersionNumber;
-
 interface CreateJarAuthorizationRequestOptions {
     authorizationRequestPayload: JwtPayload & {
         client_id?: string;
@@ -31236,6 +31245,47 @@ declare const jarmResponseMode: readonly ["jwt", "query.jwt", "fragment.jwt", "f
 type JarmResponseMode = (typeof jarmResponseMode)[number];
 declare const isJarmResponseMode: (responseMode: string) => responseMode is JarmResponseMode;
 
+declare function extractEncryptionJwkFromJwks(jwks: JwkSet, { kid, supportedAlgValues, }: {
+    kid?: string;
+    supportedAlgValues?: string[];
+}): zod.objectOutputType<{
+    kty: zod.ZodString;
+    crv: zod.ZodOptional<zod.ZodString>;
+    x: zod.ZodOptional<zod.ZodString>;
+    y: zod.ZodOptional<zod.ZodString>;
+    e: zod.ZodOptional<zod.ZodString>;
+    n: zod.ZodOptional<zod.ZodString>;
+    alg: zod.ZodOptional<zod.ZodString>;
+    d: zod.ZodOptional<zod.ZodString>;
+    dp: zod.ZodOptional<zod.ZodString>;
+    dq: zod.ZodOptional<zod.ZodString>;
+    ext: zod.ZodOptional<zod.ZodBoolean>;
+    k: zod.ZodOptional<zod.ZodString>;
+    key_ops: zod.ZodOptional<zod.ZodArray<zod.ZodString, "many">>;
+    kid: zod.ZodOptional<zod.ZodString>;
+    oth: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+        d: zod.ZodOptional<zod.ZodString>;
+        r: zod.ZodOptional<zod.ZodString>;
+        t: zod.ZodOptional<zod.ZodString>;
+    }, "passthrough", zod.ZodTypeAny, zod.objectOutputType<{
+        d: zod.ZodOptional<zod.ZodString>;
+        r: zod.ZodOptional<zod.ZodString>;
+        t: zod.ZodOptional<zod.ZodString>;
+    }, zod.ZodTypeAny, "passthrough">, zod.objectInputType<{
+        d: zod.ZodOptional<zod.ZodString>;
+        r: zod.ZodOptional<zod.ZodString>;
+        t: zod.ZodOptional<zod.ZodString>;
+    }, zod.ZodTypeAny, "passthrough">>, "many">>;
+    p: zod.ZodOptional<zod.ZodString>;
+    q: zod.ZodOptional<zod.ZodString>;
+    qi: zod.ZodOptional<zod.ZodString>;
+    use: zod.ZodOptional<zod.ZodString>;
+    x5c: zod.ZodOptional<zod.ZodArray<zod.ZodString, "many">>;
+    x5t: zod.ZodOptional<zod.ZodString>;
+    'x5t#S256': zod.ZodOptional<zod.ZodString>;
+    x5u: zod.ZodOptional<zod.ZodString>;
+}, zod.ZodTypeAny, "passthrough"> | undefined;
+
 declare const zCredentialFormat: z.ZodEnum<["jwt_vc_json", "ldp_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]>;
 type CredentialFormat = z.infer<typeof zCredentialFormat>;
 
@@ -31271,4 +31321,4 @@ declare const zVerifierAttestations: zod__default.ZodArray<zod__default.ZodObjec
 type VerifierAttestation = zod__default.infer<typeof zVerifierAttestation>;
 type VerifierAttestations = zod__default.infer<typeof zVerifierAttestations>;
 
-export { type ClientIdPrefix, type ClientMetadata, type CreateOpenid4vpAuthorizationRequestOptions, type CreateOpenid4vpAuthorizationResponseOptions, type CreateOpenid4vpAuthorizationResponseResult, type CredentialFormat, type GetOpenid4vpClientIdOptions, type JarmClientMetadata, JarmMode, type Openid4vpAuthorizationRequest, type Openid4vpAuthorizationRequestDcApi, type Openid4vpAuthorizationResponse, Openid4vpClient, Openid4vpVerifier, type Openid4vpVersionNumber, type ParseJarmAuthorizationResponseOptions, type ParseOpenid4vpAuthorizationRequestOptions, type ParseOpenid4vpAuthorizationResponseOptions, type ParseTransactionDataOptions, type ParsedOpenid4vpAuthorizationResponse, type ProofFormat, type ResolveOpenid4vpAuthorizationRequestOptions, type ResolvedOpenid4vpAuthorizationRequest, type SubmitOpenid4vpAuthorizationResponseOptions, type TransactionDataEntry, type TransactionDataHashesCredentials, type ValidateOpenid4VpAuthorizationResponseResult, type ValidateOpenid4VpDcqlAuthorizationResponseResult, type ValidateOpenid4VpPexAuthorizationResponseResult, type ValidateOpenid4vpAuthorizationRequestPayloadOptions, type ValidateOpenid4vpAuthorizationResponseOptions, type VerifiedTransactionDataEntry, type VerifierAttestation, type VerifierAttestations, type VerifyJarmAuthorizationResponseOptions, type VerifyTransactionDataOptions, type VpToken, type VpTokenDcql, type VpTokenPex, type VpTokenPresentationEntry, type WalletMetadata, type WalletVerificationOptions, createOpenid4vpAuthorizationRequest, createOpenid4vpAuthorizationResponse, getOpenid4vpClientId, isJarmResponseMode, isOpenid4vpAuthorizationRequestDcApi, parseAuthorizationRequestVersion, parseDcqlVpToken, parseJarmAuthorizationResponse, parseOpenid4VpAuthorizationResponsePayload, parseOpenid4vpAuthorizationRequest, parseOpenid4vpAuthorizationResponse, parsePexVpToken, parseTransactionData, resolveOpenid4vpAuthorizationRequest, submitOpenid4vpAuthorizationResponse, validateOpenid4vpAuthorizationRequestPayload, validateOpenid4vpAuthorizationResponsePayload, verifyJarmAuthorizationResponse, zClientIdPrefix, zClientMetadata, zCredentialFormat, zJarmClientMetadata, zOpenid4vpAuthorizationResponse, zProofFormat, zVerifierAttestations, zWalletMetadata };
+export { type ClientIdPrefix, type ClientMetadata, type CreateOpenid4vpAuthorizationRequestOptions, type CreateOpenid4vpAuthorizationResponseOptions, type CreateOpenid4vpAuthorizationResponseResult, type CredentialFormat, type GetOpenid4vpClientIdOptions, type JarmClientMetadata, JarmMode, type Openid4vpAuthorizationRequest, type Openid4vpAuthorizationRequestDcApi, type Openid4vpAuthorizationResponse, Openid4vpClient, Openid4vpVerifier, type Openid4vpVersionNumber, type ParseJarmAuthorizationResponseOptions, type ParseOpenid4vpAuthorizationRequestOptions, type ParseOpenid4vpAuthorizationResponseOptions, type ParseTransactionDataOptions, type ParsedOpenid4vpAuthorizationResponse, type ProofFormat, type ResolveOpenid4vpAuthorizationRequestOptions, type ResolvedOpenid4vpAuthorizationRequest, type SubmitOpenid4vpAuthorizationResponseOptions, type TransactionDataEntry, type TransactionDataHashesCredentials, type ValidateOpenid4VpAuthorizationResponseResult, type ValidateOpenid4VpDcqlAuthorizationResponseResult, type ValidateOpenid4VpPexAuthorizationResponseResult, type ValidateOpenid4vpAuthorizationRequestPayloadOptions, type ValidateOpenid4vpAuthorizationResponseOptions, type VerifiedTransactionDataEntry, type VerifierAttestation, type VerifierAttestations, type VerifyJarmAuthorizationResponseOptions, type VerifyTransactionDataOptions, type VpToken, type VpTokenDcql, type VpTokenPex, type VpTokenPresentationEntry, type WalletMetadata, type WalletVerificationOptions, createOpenid4vpAuthorizationRequest, createOpenid4vpAuthorizationResponse, extractEncryptionJwkFromJwks, getOpenid4vpClientId, isJarmResponseMode, isOpenid4vpAuthorizationRequestDcApi, parseAuthorizationRequestVersion, parseDcqlVpToken, parseJarmAuthorizationResponse, parseOpenid4VpAuthorizationResponsePayload, parseOpenid4vpAuthorizationRequest, parseOpenid4vpAuthorizationResponse, parsePexVpToken, parseTransactionData, resolveOpenid4vpAuthorizationRequest, submitOpenid4vpAuthorizationResponse, validateOpenid4vpAuthorizationRequestPayload, validateOpenid4vpAuthorizationResponsePayload, verifyJarmAuthorizationResponse, zClientIdPrefix, zClientMetadata, zCredentialFormat, zJarmClientMetadata, zOpenid4vpAuthorizationResponse, zProofFormat, zVerifierAttestations, zWalletMetadata };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as zod from 'zod';
 import zod__default, { z } from 'zod';
 import * as _openid4vc_oauth2 from '@openid4vc/oauth2';
-import { Jwk, JwtSignerWithJwk, decodeJwt, CallbackContext, JwtPayload, JwtSigner, JweEncryptor, HashAlgorithm } from '@openid4vc/oauth2';
+import { Jwk, JwtSignerWithJwk, decodeJwt, CallbackContext, JwtPayload, JwtSigner, JweEncryptor, HashAlgorithm, JwkSet } from '@openid4vc/oauth2';
 
 declare const zOpenid4vpAuthorizationRequest: z.ZodObject<{
     response_type: z.ZodLiteral<"vp_token">;
@@ -11687,6 +11687,14 @@ declare const zClientMetadata: z.ZodObject<{
 }, z.ZodTypeAny, "passthrough">>;
 type ClientMetadata = z.infer<typeof zClientMetadata>;
 
+/**
+ * The Openid4vpVersionNumber
+ *
+ * 100 means 1.0 final, all others are draft versions
+ */
+type Openid4vpVersionNumber = 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 100;
+declare function parseAuthorizationRequestVersion(request: Openid4vpAuthorizationRequest | Openid4vpAuthorizationRequestDcApi): Openid4vpVersionNumber;
+
 declare const zClientIdPrefix: z.ZodEnum<["pre-registered", "redirect_uri", "verifier_attestation", "https", "openid_federation", "did", "decentralized_identifier", "x509_san_uri", "x509_hash", "x509_san_dns", "origin", "web-origin"]>;
 declare const zUniformClientIdPrefix: z.ZodEnum<["pre-registered", "redirect_uri", "verifier_attestation", "openid_federation", "decentralized_identifier", "x509_san_uri", "x509_hash", "x509_san_dns", "origin"]>;
 type ClientIdPrefix = z.infer<typeof zClientIdPrefix>;
@@ -11753,6 +11761,15 @@ interface GetOpenid4vpClientIdOptions {
     legacyClientIdScheme?: unknown;
     responseMode: unknown;
     origin?: string;
+    /**
+     * The version of OpenID4VP used.
+     *
+     * Currently it is only used for:
+     * - determining whether effective client id is `origin:` or `web-origin:` when DC API is used.
+     *
+     * When no version is provided, it is assumed version 1.0 (100) is used.
+     */
+    version?: Openid4vpVersionNumber;
 }
 /**
  * Get the client id for an authorization request based on the response_mode, client_id, client_id_scheme and origin values.
@@ -12573,14 +12590,6 @@ declare const zJarmClientMetadata: z.ZodObject<{
 }>;
 type JarmClientMetadata = z.infer<typeof zJarmClientMetadata>;
 
-/**
- * The Openid4vpVersionNumber
- *
- * 100 means 1.0 final, all others are draft versions
- */
-type Openid4vpVersionNumber = 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 100;
-declare function parseAuthorizationRequestVersion(request: Openid4vpAuthorizationRequest | Openid4vpAuthorizationRequestDcApi): Openid4vpVersionNumber;
-
 interface CreateJarAuthorizationRequestOptions {
     authorizationRequestPayload: JwtPayload & {
         client_id?: string;
@@ -31236,6 +31245,47 @@ declare const jarmResponseMode: readonly ["jwt", "query.jwt", "fragment.jwt", "f
 type JarmResponseMode = (typeof jarmResponseMode)[number];
 declare const isJarmResponseMode: (responseMode: string) => responseMode is JarmResponseMode;
 
+declare function extractEncryptionJwkFromJwks(jwks: JwkSet, { kid, supportedAlgValues, }: {
+    kid?: string;
+    supportedAlgValues?: string[];
+}): zod.objectOutputType<{
+    kty: zod.ZodString;
+    crv: zod.ZodOptional<zod.ZodString>;
+    x: zod.ZodOptional<zod.ZodString>;
+    y: zod.ZodOptional<zod.ZodString>;
+    e: zod.ZodOptional<zod.ZodString>;
+    n: zod.ZodOptional<zod.ZodString>;
+    alg: zod.ZodOptional<zod.ZodString>;
+    d: zod.ZodOptional<zod.ZodString>;
+    dp: zod.ZodOptional<zod.ZodString>;
+    dq: zod.ZodOptional<zod.ZodString>;
+    ext: zod.ZodOptional<zod.ZodBoolean>;
+    k: zod.ZodOptional<zod.ZodString>;
+    key_ops: zod.ZodOptional<zod.ZodArray<zod.ZodString, "many">>;
+    kid: zod.ZodOptional<zod.ZodString>;
+    oth: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+        d: zod.ZodOptional<zod.ZodString>;
+        r: zod.ZodOptional<zod.ZodString>;
+        t: zod.ZodOptional<zod.ZodString>;
+    }, "passthrough", zod.ZodTypeAny, zod.objectOutputType<{
+        d: zod.ZodOptional<zod.ZodString>;
+        r: zod.ZodOptional<zod.ZodString>;
+        t: zod.ZodOptional<zod.ZodString>;
+    }, zod.ZodTypeAny, "passthrough">, zod.objectInputType<{
+        d: zod.ZodOptional<zod.ZodString>;
+        r: zod.ZodOptional<zod.ZodString>;
+        t: zod.ZodOptional<zod.ZodString>;
+    }, zod.ZodTypeAny, "passthrough">>, "many">>;
+    p: zod.ZodOptional<zod.ZodString>;
+    q: zod.ZodOptional<zod.ZodString>;
+    qi: zod.ZodOptional<zod.ZodString>;
+    use: zod.ZodOptional<zod.ZodString>;
+    x5c: zod.ZodOptional<zod.ZodArray<zod.ZodString, "many">>;
+    x5t: zod.ZodOptional<zod.ZodString>;
+    'x5t#S256': zod.ZodOptional<zod.ZodString>;
+    x5u: zod.ZodOptional<zod.ZodString>;
+}, zod.ZodTypeAny, "passthrough"> | undefined;
+
 declare const zCredentialFormat: z.ZodEnum<["jwt_vc_json", "ldp_vc", "mso_mdoc", "dc+sd-jwt", "vc+sd-jwt"]>;
 type CredentialFormat = z.infer<typeof zCredentialFormat>;
 
@@ -31271,4 +31321,4 @@ declare const zVerifierAttestations: zod__default.ZodArray<zod__default.ZodObjec
 type VerifierAttestation = zod__default.infer<typeof zVerifierAttestation>;
 type VerifierAttestations = zod__default.infer<typeof zVerifierAttestations>;
 
-export { type ClientIdPrefix, type ClientMetadata, type CreateOpenid4vpAuthorizationRequestOptions, type CreateOpenid4vpAuthorizationResponseOptions, type CreateOpenid4vpAuthorizationResponseResult, type CredentialFormat, type GetOpenid4vpClientIdOptions, type JarmClientMetadata, JarmMode, type Openid4vpAuthorizationRequest, type Openid4vpAuthorizationRequestDcApi, type Openid4vpAuthorizationResponse, Openid4vpClient, Openid4vpVerifier, type Openid4vpVersionNumber, type ParseJarmAuthorizationResponseOptions, type ParseOpenid4vpAuthorizationRequestOptions, type ParseOpenid4vpAuthorizationResponseOptions, type ParseTransactionDataOptions, type ParsedOpenid4vpAuthorizationResponse, type ProofFormat, type ResolveOpenid4vpAuthorizationRequestOptions, type ResolvedOpenid4vpAuthorizationRequest, type SubmitOpenid4vpAuthorizationResponseOptions, type TransactionDataEntry, type TransactionDataHashesCredentials, type ValidateOpenid4VpAuthorizationResponseResult, type ValidateOpenid4VpDcqlAuthorizationResponseResult, type ValidateOpenid4VpPexAuthorizationResponseResult, type ValidateOpenid4vpAuthorizationRequestPayloadOptions, type ValidateOpenid4vpAuthorizationResponseOptions, type VerifiedTransactionDataEntry, type VerifierAttestation, type VerifierAttestations, type VerifyJarmAuthorizationResponseOptions, type VerifyTransactionDataOptions, type VpToken, type VpTokenDcql, type VpTokenPex, type VpTokenPresentationEntry, type WalletMetadata, type WalletVerificationOptions, createOpenid4vpAuthorizationRequest, createOpenid4vpAuthorizationResponse, getOpenid4vpClientId, isJarmResponseMode, isOpenid4vpAuthorizationRequestDcApi, parseAuthorizationRequestVersion, parseDcqlVpToken, parseJarmAuthorizationResponse, parseOpenid4VpAuthorizationResponsePayload, parseOpenid4vpAuthorizationRequest, parseOpenid4vpAuthorizationResponse, parsePexVpToken, parseTransactionData, resolveOpenid4vpAuthorizationRequest, submitOpenid4vpAuthorizationResponse, validateOpenid4vpAuthorizationRequestPayload, validateOpenid4vpAuthorizationResponsePayload, verifyJarmAuthorizationResponse, zClientIdPrefix, zClientMetadata, zCredentialFormat, zJarmClientMetadata, zOpenid4vpAuthorizationResponse, zProofFormat, zVerifierAttestations, zWalletMetadata };
+export { type ClientIdPrefix, type ClientMetadata, type CreateOpenid4vpAuthorizationRequestOptions, type CreateOpenid4vpAuthorizationResponseOptions, type CreateOpenid4vpAuthorizationResponseResult, type CredentialFormat, type GetOpenid4vpClientIdOptions, type JarmClientMetadata, JarmMode, type Openid4vpAuthorizationRequest, type Openid4vpAuthorizationRequestDcApi, type Openid4vpAuthorizationResponse, Openid4vpClient, Openid4vpVerifier, type Openid4vpVersionNumber, type ParseJarmAuthorizationResponseOptions, type ParseOpenid4vpAuthorizationRequestOptions, type ParseOpenid4vpAuthorizationResponseOptions, type ParseTransactionDataOptions, type ParsedOpenid4vpAuthorizationResponse, type ProofFormat, type ResolveOpenid4vpAuthorizationRequestOptions, type ResolvedOpenid4vpAuthorizationRequest, type SubmitOpenid4vpAuthorizationResponseOptions, type TransactionDataEntry, type TransactionDataHashesCredentials, type ValidateOpenid4VpAuthorizationResponseResult, type ValidateOpenid4VpDcqlAuthorizationResponseResult, type ValidateOpenid4VpPexAuthorizationResponseResult, type ValidateOpenid4vpAuthorizationRequestPayloadOptions, type ValidateOpenid4vpAuthorizationResponseOptions, type VerifiedTransactionDataEntry, type VerifierAttestation, type VerifierAttestations, type VerifyJarmAuthorizationResponseOptions, type VerifyTransactionDataOptions, type VpToken, type VpTokenDcql, type VpTokenPex, type VpTokenPresentationEntry, type WalletMetadata, type WalletVerificationOptions, createOpenid4vpAuthorizationRequest, createOpenid4vpAuthorizationResponse, extractEncryptionJwkFromJwks, getOpenid4vpClientId, isJarmResponseMode, isOpenid4vpAuthorizationRequestDcApi, parseAuthorizationRequestVersion, parseDcqlVpToken, parseJarmAuthorizationResponse, parseOpenid4VpAuthorizationResponsePayload, parseOpenid4vpAuthorizationRequest, parseOpenid4vpAuthorizationResponse, parsePexVpToken, parseTransactionData, resolveOpenid4vpAuthorizationRequest, submitOpenid4vpAuthorizationResponse, validateOpenid4vpAuthorizationRequestPayload, validateOpenid4vpAuthorizationResponsePayload, verifyJarmAuthorizationResponse, zClientIdPrefix, zClientMetadata, zCredentialFormat, zJarmClientMetadata, zOpenid4vpAuthorizationResponse, zProofFormat, zVerifierAttestations, zWalletMetadata };

package/dist/index.js

@@ -35,6 +35,7 @@ __export(index_exports, {
   Openid4vpVerifier: () => Openid4vpVerifier,
   createOpenid4vpAuthorizationRequest: () => createOpenid4vpAuthorizationRequest,
   createOpenid4vpAuthorizationResponse: () => createOpenid4vpAuthorizationResponse,
+  extractEncryptionJwkFromJwks: () => extractEncryptionJwkFromJwks,
   getOpenid4vpClientId: () => getOpenid4vpClientId,
   isJarmResponseMode: () => isJarmResponseMode,
   isOpenid4vpAuthorizationRequestDcApi: () => isOpenid4vpAuthorizationRequestDcApi,
@@ -349,6 +350,7 @@ function getOpenid4vpClientId(options) {
   const original = {
     clientId: options.clientId
   };
+  const version = options.version ?? 100;
   if (isOpenid4vpResponseModeDcApi(options.responseMode)) {
     if (!options.clientId) {
       if (!options.origin) {
@@ -361,10 +363,7 @@ function getOpenid4vpClientId(options) {
         clientIdPrefix: "origin",
         effectiveClientIdPrefix: "origin",
         clientIdIdentifier: options.origin,
-        // FIXME: draft 24 uses web-origin, draft 25+ uses origin
-        // But it's not really possible to know which one to use as the
-        // 'effective' client id. Defaulting to origin: since that's newer
-        effectiveClientId: `origin:${options.origin}`,
+        effectiveClientId: version >= 25 ? `origin:${options.origin}` : `web-origin:${options.origin}`,
         original
       };
     }
@@ -1456,6 +1455,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
       disableOriginValidation
     });
   }
+  const version = parseAuthorizationRequestVersion(authorizationRequestPayload);
   let clientMetadata = authorizationRequestPayload.client_metadata;
   if (!isOpenid4vpAuthorizationRequestDcApi(authorizationRequestPayload) && !clientMetadata && authorizationRequestPayload.client_metadata_uri) {
     clientMetadata = await fetchClientMetadata({ clientMetadataUri: authorizationRequestPayload.client_metadata_uri });
@@ -1467,7 +1467,8 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
     },
     jar,
     callbacks,
-    origin
+    origin,
+    version
   });
   let pex;
   let dcql;
@@ -1494,7 +1495,7 @@ async function resolveOpenid4vpAuthorizationRequest(options) {
     client: clientMeta,
     pex,
     dcql,
-    version: parseAuthorizationRequestVersion(authorizationRequestPayload)
+    version
   };
 }
 function validateOpenId4vpAuthorizationRequestPayload(options) {
@@ -2152,6 +2153,7 @@ var zWalletMetadata = import_zod23.z.object({
   Openid4vpVerifier,
   createOpenid4vpAuthorizationRequest,
   createOpenid4vpAuthorizationResponse,
+  extractEncryptionJwkFromJwks,
   getOpenid4vpClientId,
   isJarmResponseMode,
   isOpenid4vpAuthorizationRequestDcApi,