@cloudflare/workers-oauth-provider 0.1.0 → 0.2.3

package/dist/oauth-provider.js

@@ -1,1697 +1,1809 @@
-var __typeError = (msg) => {
-  throw TypeError(msg);
-};
-var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
-var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
-var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
-
-// src/oauth-provider.ts
 import { WorkerEntrypoint } from "cloudflare:workers";
-var _impl;
+
+//#region src/oauth-provider.ts
+if (!(typeof Cloudflare !== "undefined" && Cloudflare.compatibilityFlags?.global_fetch_strictly_public === true)) console.warn("CIMD (Client ID Metadata Document) is disabled: add '\"compatibility_flags\": [\"global_fetch_strictly_public\"]' to your wrangler.jsonc to enable. See: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#global-fetch-strictly-public");
+/**
+* Enum representing the type of handler (ExportedHandler or WorkerEntrypoint)
+*/
+var HandlerType = /* @__PURE__ */ function(HandlerType$1) {
+	HandlerType$1[HandlerType$1["EXPORTED_HANDLER"] = 0] = "EXPORTED_HANDLER";
+	HandlerType$1[HandlerType$1["WORKER_ENTRYPOINT"] = 1] = "WORKER_ENTRYPOINT";
+	return HandlerType$1;
+}(HandlerType || {});
+/**
+* Enum representing OAuth grant types
+*/
+let GrantType = /* @__PURE__ */ function(GrantType$1) {
+	GrantType$1["AUTHORIZATION_CODE"] = "authorization_code";
+	GrantType$1["REFRESH_TOKEN"] = "refresh_token";
+	GrantType$1["TOKEN_EXCHANGE"] = "urn:ietf:params:oauth:grant-type:token-exchange";
+	return GrantType$1;
+}({});
+/**
+* OAuth 2.0 Provider implementation for Cloudflare Workers
+* Implements authorization code flow with support for refresh tokens
+* and dynamic client registration.
+*/
 var OAuthProvider = class {
-  /**
-   * Creates a new OAuth provider instance
-   * @param options - Configuration options for the provider
-   */
-  constructor(options) {
-    __privateAdd(this, _impl);
-    __privateSet(this, _impl, new OAuthProviderImpl(options));
-  }
-  /**
-   * Main fetch handler for the Worker
-   * Routes requests to the appropriate handler based on the URL
-   * @param request - The HTTP request
-   * @param env - Cloudflare Worker environment variables
-   * @param ctx - Cloudflare Worker execution context
-   * @returns A Promise resolving to an HTTP Response
-   */
-  fetch(request, env, ctx) {
-    return __privateGet(this, _impl).fetch(request, env, ctx);
-  }
+	#impl;
+	/**
+	* Creates a new OAuth provider instance
+	* @param options - Configuration options for the provider
+	*/
+	constructor(options) {
+		this.#impl = new OAuthProviderImpl(options);
+	}
+	/**
+	* Main fetch handler for the Worker
+	* Routes requests to the appropriate handler based on the URL
+	* @param request - The HTTP request
+	* @param env - Cloudflare Worker environment variables
+	* @param ctx - Cloudflare Worker execution context
+	* @returns A Promise resolving to an HTTP Response
+	*/
+	fetch(request, env, ctx) {
+		return this.#impl.fetch(request, env, ctx);
+	}
 };
-_impl = new WeakMap();
-var OAuthProviderImpl = class {
-  /**
-   * Creates a new OAuth provider instance
-   * @param options - Configuration options for the provider
-   */
-  constructor(options) {
-    this.typedApiHandlers = [];
-    const hasSingleHandlerConfig = !!(options.apiRoute && options.apiHandler);
-    const hasMultiHandlerConfig = !!options.apiHandlers;
-    if (hasSingleHandlerConfig && hasMultiHandlerConfig) {
-      throw new TypeError(
-        "Cannot use both apiRoute/apiHandler and apiHandlers. Use either apiRoute + apiHandler OR apiHandlers, not both."
-      );
-    }
-    if (!hasSingleHandlerConfig && !hasMultiHandlerConfig) {
-      throw new TypeError(
-        "Must provide either apiRoute + apiHandler OR apiHandlers. No API route configuration provided."
-      );
-    }
-    this.typedDefaultHandler = this.validateHandler(options.defaultHandler, "defaultHandler");
-    if (hasSingleHandlerConfig) {
-      const apiHandler = this.validateHandler(options.apiHandler, "apiHandler");
-      if (Array.isArray(options.apiRoute)) {
-        options.apiRoute.forEach((route, index) => {
-          this.validateEndpoint(route, `apiRoute[${index}]`);
-          this.typedApiHandlers.push([route, apiHandler]);
-        });
-      } else {
-        this.validateEndpoint(options.apiRoute, "apiRoute");
-        this.typedApiHandlers.push([options.apiRoute, apiHandler]);
-      }
-    } else {
-      for (const [route, handler] of Object.entries(options.apiHandlers)) {
-        this.validateEndpoint(route, `apiHandlers key: ${route}`);
-        this.typedApiHandlers.push([route, this.validateHandler(handler, `apiHandlers[${route}]`)]);
-      }
-    }
-    this.validateEndpoint(options.authorizeEndpoint, "authorizeEndpoint");
-    this.validateEndpoint(options.tokenEndpoint, "tokenEndpoint");
-    if (options.clientRegistrationEndpoint) {
-      this.validateEndpoint(options.clientRegistrationEndpoint, "clientRegistrationEndpoint");
-    }
-    this.options = {
-      accessTokenTTL: DEFAULT_ACCESS_TOKEN_TTL,
-      onError: ({ status, code, description }) => console.warn(`OAuth error response: ${status} ${code} - ${description}`),
-      ...options
-    };
-  }
-  /**
-   * Validates that an endpoint is either an absolute path or a full URL
-   * @param endpoint - The endpoint to validate
-   * @param name - The name of the endpoint property for error messages
-   * @throws TypeError if the endpoint is invalid
-   */
-  validateEndpoint(endpoint, name) {
-    if (this.isPath(endpoint)) {
-      if (!endpoint.startsWith("/")) {
-        throw new TypeError(`${name} path must be an absolute path starting with /`);
-      }
-    } else {
-      try {
-        new URL(endpoint);
-      } catch (e) {
-        throw new TypeError(`${name} must be either an absolute path starting with / or a valid URL`);
-      }
-    }
-  }
-  /**
-   * Validates that a handler is either an ExportedHandler or a class extending WorkerEntrypoint
-   * @param handler - The handler to validate
-   * @param name - The name of the handler property for error messages
-   * @returns The type of the handler (EXPORTED_HANDLER or WORKER_ENTRYPOINT)
-   * @throws TypeError if the handler is invalid
-   */
-  validateHandler(handler, name) {
-    if (typeof handler === "object" && handler !== null && typeof handler.fetch === "function") {
-      return { type: 0 /* EXPORTED_HANDLER */, handler };
-    }
-    if (typeof handler === "function" && handler.prototype instanceof WorkerEntrypoint) {
-      return { type: 1 /* WORKER_ENTRYPOINT */, handler };
-    }
-    throw new TypeError(
-      `${name} must be either an ExportedHandler object with a fetch method or a class extending WorkerEntrypoint`
-    );
-  }
-  /**
-   * Main fetch handler for the Worker
-   * Routes requests to the appropriate handler based on the URL
-   * @param request - The HTTP request
-   * @param env - Cloudflare Worker environment variables
-   * @param ctx - Cloudflare Worker execution context
-   * @returns A Promise resolving to an HTTP Response
-   */
-  async fetch(request, env, ctx) {
-    const url = new URL(request.url);
-    if (request.method === "OPTIONS") {
-      if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) {
-        return this.addCorsHeaders(
-          new Response(null, {
-            status: 204,
-            headers: { "Content-Length": "0" }
-          }),
-          request
-        );
-      }
-    }
-    if (url.pathname === "/.well-known/oauth-authorization-server") {
-      const response = await this.handleMetadataDiscovery(url);
-      return this.addCorsHeaders(response, request);
-    }
-    if (this.isTokenEndpoint(url)) {
-      const parsed = await this.parseTokenEndpointRequest(request, env);
-      if (parsed instanceof Response) {
-        return this.addCorsHeaders(parsed, request);
-      }
-      let response;
-      if (parsed.isRevocationRequest) {
-        response = await this.handleRevocationRequest(parsed.body, env);
-      } else {
-        response = await this.handleTokenRequest(parsed.body, parsed.clientInfo, env);
-      }
-      return this.addCorsHeaders(response, request);
-    }
-    if (this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) {
-      const response = await this.handleClientRegistration(request, env);
-      return this.addCorsHeaders(response, request);
-    }
-    if (this.isApiRequest(url)) {
-      const response = await this.handleApiRequest(request, env, ctx);
-      return this.addCorsHeaders(response, request);
-    }
-    if (!env.OAUTH_PROVIDER) {
-      env.OAUTH_PROVIDER = this.createOAuthHelpers(env);
-    }
-    if (this.typedDefaultHandler.type === 0 /* EXPORTED_HANDLER */) {
-      return this.typedDefaultHandler.handler.fetch(
-        request,
-        env,
-        ctx
-      );
-    } else {
-      const handler = new this.typedDefaultHandler.handler(ctx, env);
-      return handler.fetch(request);
-    }
-  }
-  /**
-   * Determines if an endpoint configuration is a path or a full URL
-   * @param endpoint - The endpoint configuration
-   * @returns True if the endpoint is a path (starts with /), false if it's a full URL
-   */
-  isPath(endpoint) {
-    return endpoint.startsWith("/");
-  }
-  /**
-   * Matches a URL against an endpoint pattern that can be a full URL or just a path
-   * @param url - The URL to check
-   * @param endpoint - The endpoint pattern (full URL or path)
-   * @returns True if the URL matches the endpoint pattern
-   */
-  matchEndpoint(url, endpoint) {
-    if (this.isPath(endpoint)) {
-      return url.pathname === endpoint;
-    } else {
-      const endpointUrl = new URL(endpoint);
-      return url.hostname === endpointUrl.hostname && url.pathname === endpointUrl.pathname;
-    }
-  }
-  /**
-   * Checks if a URL matches the configured token endpoint
-   * @param url - The URL to check
-   * @returns True if the URL matches the token endpoint
-   */
-  isTokenEndpoint(url) {
-    return this.matchEndpoint(url, this.options.tokenEndpoint);
-  }
-  /**
-   * Checks if a URL matches the configured client registration endpoint
-   * @param url - The URL to check
-   * @returns True if the URL matches the client registration endpoint
-   */
-  isClientRegistrationEndpoint(url) {
-    if (!this.options.clientRegistrationEndpoint) return false;
-    return this.matchEndpoint(url, this.options.clientRegistrationEndpoint);
-  }
-  /**
-   * Parses and validates a token endpoint request (used for both token exchange and revocation)
-   * @param request - The HTTP request to parse
-   * @returns Promise with parsed body and client info, or error response
-   */
-  async parseTokenEndpointRequest(request, env) {
-    if (request.method !== "POST") {
-      return this.createErrorResponse("invalid_request", "Method not allowed", 405);
-    }
-    let contentType = request.headers.get("Content-Type") || "";
-    let body = {};
-    if (!contentType.includes("application/x-www-form-urlencoded")) {
-      return this.createErrorResponse("invalid_request", "Content-Type must be application/x-www-form-urlencoded", 400);
-    }
-    const formData = await request.formData();
-    for (const [key, value] of formData.entries()) {
-      const allValues = formData.getAll(key);
-      body[key] = allValues.length > 1 ? allValues : value;
-    }
-    const authHeader = request.headers.get("Authorization");
-    let clientId = "";
-    let clientSecret = "";
-    if (authHeader && authHeader.startsWith("Basic ")) {
-      const credentials = atob(authHeader.substring(6));
-      const [id, secret] = credentials.split(":", 2);
-      clientId = decodeURIComponent(id);
-      clientSecret = decodeURIComponent(secret || "");
-    } else {
-      clientId = body.client_id;
-      clientSecret = body.client_secret || "";
-    }
-    if (!clientId) {
-      return this.createErrorResponse("invalid_client", "Client ID is required", 401);
-    }
-    const clientInfo = await this.getClient(env, clientId);
-    if (!clientInfo) {
-      return this.createErrorResponse("invalid_client", "Client not found", 401);
-    }
-    const isPublicClient = clientInfo.tokenEndpointAuthMethod === "none";
-    if (!isPublicClient) {
-      if (!clientSecret) {
-        return this.createErrorResponse("invalid_client", "Client authentication failed: missing client_secret", 401);
-      }
-      if (!clientInfo.clientSecret) {
-        return this.createErrorResponse(
-          "invalid_client",
-          "Client authentication failed: client has no registered secret",
-          401
-        );
-      }
-      const providedSecretHash = await hashSecret(clientSecret);
-      if (providedSecretHash !== clientInfo.clientSecret) {
-        return this.createErrorResponse("invalid_client", "Client authentication failed: invalid client_secret", 401);
-      }
-    }
-    const isRevocationRequest = !body.grant_type && !!body.token;
-    return {
-      body,
-      clientInfo,
-      isRevocationRequest
-    };
-  }
-  /**
-   * Checks if a URL matches a specific API route
-   * @param url - The URL to check
-   * @param route - The API route to check against
-   * @returns True if the URL matches the API route
-   */
-  matchApiRoute(url, route) {
-    if (this.isPath(route)) {
-      return url.pathname.startsWith(route);
-    } else {
-      const apiUrl = new URL(route);
-      return url.hostname === apiUrl.hostname && url.pathname.startsWith(apiUrl.pathname);
-    }
-  }
-  /**
-   * Checks if a URL is an API request based on the configured API route(s)
-   * @param url - The URL to check
-   * @returns True if the URL matches any of the API routes
-   */
-  isApiRequest(url) {
-    for (const [route, _] of this.typedApiHandlers) {
-      if (this.matchApiRoute(url, route)) {
-        return true;
-      }
-    }
-    return false;
-  }
-  /**
-   * Finds the appropriate API handler for a URL
-   * @param url - The URL to find a handler for
-   * @returns The TypedHandler for the URL, or undefined if no handler matches
-   */
-  findApiHandlerForUrl(url) {
-    for (const [route, handler] of this.typedApiHandlers) {
-      if (this.matchApiRoute(url, route)) {
-        return handler;
-      }
-    }
-    return void 0;
-  }
-  /**
-   * Gets the full URL for an endpoint, using the provided request URL's
-   * origin for endpoints specified as just paths
-   * @param endpoint - The endpoint configuration (path or full URL)
-   * @param requestUrl - The URL of the incoming request
-   * @returns The full URL for the endpoint
-   */
-  getFullEndpointUrl(endpoint, requestUrl) {
-    if (this.isPath(endpoint)) {
-      return `${requestUrl.origin}${endpoint}`;
-    } else {
-      return endpoint;
-    }
-  }
-  /**
-   * Adds CORS headers to a response
-   * @param response - The response to add CORS headers to
-   * @param request - The original request
-   * @returns A new Response with CORS headers added
-   */
-  addCorsHeaders(response, request) {
-    const origin = request.headers.get("Origin");
-    if (!origin) {
-      return response;
-    }
-    const newResponse = new Response(response.body, response);
-    newResponse.headers.set("Access-Control-Allow-Origin", origin);
-    newResponse.headers.set("Access-Control-Allow-Methods", "*");
-    newResponse.headers.set("Access-Control-Allow-Headers", "Authorization, *");
-    newResponse.headers.set("Access-Control-Max-Age", "86400");
-    return newResponse;
-  }
-  /**
-   * Handles the OAuth metadata discovery endpoint
-   * Implements RFC 8414 for OAuth Server Metadata
-   * @param requestUrl - The URL of the incoming request
-   * @returns Response with OAuth server metadata
-   */
-  async handleMetadataDiscovery(requestUrl) {
-    const tokenEndpoint = this.getFullEndpointUrl(this.options.tokenEndpoint, requestUrl);
-    const authorizeEndpoint = this.getFullEndpointUrl(this.options.authorizeEndpoint, requestUrl);
-    let registrationEndpoint = void 0;
-    if (this.options.clientRegistrationEndpoint) {
-      registrationEndpoint = this.getFullEndpointUrl(this.options.clientRegistrationEndpoint, requestUrl);
-    }
-    const responseTypesSupported = ["code"];
-    if (this.options.allowImplicitFlow) {
-      responseTypesSupported.push("token");
-    }
-    const metadata = {
-      issuer: new URL(tokenEndpoint).origin,
-      authorization_endpoint: authorizeEndpoint,
-      token_endpoint: tokenEndpoint,
-      // not implemented: jwks_uri
-      registration_endpoint: registrationEndpoint,
-      scopes_supported: this.options.scopesSupported,
-      response_types_supported: responseTypesSupported,
-      response_modes_supported: ["query"],
-      grant_types_supported: ["authorization_code", "refresh_token"],
-      // Support "none" auth method for public clients
-      token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "none"],
-      // not implemented: token_endpoint_auth_signing_alg_values_supported
-      // not implemented: service_documentation
-      // not implemented: ui_locales_supported
-      // not implemented: op_policy_uri
-      // not implemented: op_tos_uri
-      revocation_endpoint: tokenEndpoint,
-      // Reusing token endpoint for revocation
-      // not implemented: revocation_endpoint_auth_methods_supported
-      // not implemented: revocation_endpoint_auth_signing_alg_values_supported
-      // not implemented: introspection_endpoint
-      // not implemented: introspection_endpoint_auth_methods_supported
-      // not implemented: introspection_endpoint_auth_signing_alg_values_supported
-      code_challenge_methods_supported: ["plain", "S256"]
-      // PKCE support
-    };
-    return new Response(JSON.stringify(metadata), {
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-  /**
-   * Handles client authentication and token issuance via the token endpoint
-   * Supports authorization_code and refresh_token grant types
-   * @param body - The parsed request body
-   * @param clientInfo - The authenticated client information
-   * @param env - Cloudflare Worker environment variables
-   * @returns Response with token data or error
-   */
-  async handleTokenRequest(body, clientInfo, env) {
-    const grantType = body.grant_type;
-    if (grantType === "authorization_code") {
-      return this.handleAuthorizationCodeGrant(body, clientInfo, env);
-    } else if (grantType === "refresh_token") {
-      return this.handleRefreshTokenGrant(body, clientInfo, env);
-    } else {
-      return this.createErrorResponse("unsupported_grant_type", "Grant type not supported");
-    }
-  }
-  /**
-   * Handles the authorization code grant type
-   * Exchanges an authorization code for access and refresh tokens
-   * @param body - The parsed request body
-   * @param clientInfo - The authenticated client information
-   * @param env - Cloudflare Worker environment variables
-   * @returns Response with token data or error
-   */
-  async handleAuthorizationCodeGrant(body, clientInfo, env) {
-    const code = body.code;
-    const redirectUri = body.redirect_uri;
-    const codeVerifier = body.code_verifier;
-    if (!code) {
-      return this.createErrorResponse("invalid_request", "Authorization code is required");
-    }
-    const codeParts = code.split(":");
-    if (codeParts.length !== 3) {
-      return this.createErrorResponse("invalid_grant", "Invalid authorization code format");
-    }
-    const [userId, grantId, _] = codeParts;
-    const grantKey = `grant:${userId}:${grantId}`;
-    const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
-    if (!grantData) {
-      return this.createErrorResponse("invalid_grant", "Grant not found or authorization code expired");
-    }
-    if (!grantData.authCodeId) {
-      return this.createErrorResponse("invalid_grant", "Authorization code already used");
-    }
-    const codeHash = await hashSecret(code);
-    if (codeHash !== grantData.authCodeId) {
-      return this.createErrorResponse("invalid_grant", "Invalid authorization code");
-    }
-    if (grantData.clientId !== clientInfo.clientId) {
-      return this.createErrorResponse("invalid_grant", "Client ID mismatch");
-    }
-    const isPkceEnabled = !!grantData.codeChallenge;
-    if (!redirectUri && !isPkceEnabled) {
-      return this.createErrorResponse("invalid_request", "redirect_uri is required when not using PKCE");
-    }
-    if (redirectUri && !clientInfo.redirectUris.includes(redirectUri)) {
-      return this.createErrorResponse("invalid_grant", "Invalid redirect URI");
-    }
-    if (!isPkceEnabled && codeVerifier) {
-      return this.createErrorResponse("invalid_request", "code_verifier provided for a flow that did not use PKCE");
-    }
-    if (isPkceEnabled) {
-      if (!codeVerifier) {
-        return this.createErrorResponse("invalid_request", "code_verifier is required for PKCE");
-      }
-      let calculatedChallenge;
-      if (grantData.codeChallengeMethod === "S256") {
-        const encoder = new TextEncoder();
-        const data = encoder.encode(codeVerifier);
-        const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-        const hashArray = Array.from(new Uint8Array(hashBuffer));
-        calculatedChallenge = base64UrlEncode(String.fromCharCode(...hashArray));
-      } else {
-        calculatedChallenge = codeVerifier;
-      }
-      if (calculatedChallenge !== grantData.codeChallenge) {
-        return this.createErrorResponse("invalid_grant", "Invalid PKCE code_verifier");
-      }
-    }
-    const accessTokenSecret = generateRandomString(TOKEN_LENGTH);
-    const accessToken = `${userId}:${grantId}:${accessTokenSecret}`;
-    const accessTokenId = await generateTokenId(accessToken);
-    let accessTokenTTL = this.options.accessTokenTTL;
-    let refreshTokenTTL = this.options.refreshTokenTTL;
-    const encryptionKey = await unwrapKeyWithToken(code, grantData.authCodeWrappedKey);
-    let grantEncryptionKey = encryptionKey;
-    let accessTokenEncryptionKey = encryptionKey;
-    let encryptedAccessTokenProps = grantData.encryptedProps;
-    if (this.options.tokenExchangeCallback) {
-      const decryptedProps = await decryptProps(encryptionKey, grantData.encryptedProps);
-      let grantProps = decryptedProps;
-      let accessTokenProps = decryptedProps;
-      const callbackOptions = {
-        grantType: "authorization_code",
-        clientId: clientInfo.clientId,
-        userId,
-        scope: grantData.scope,
-        props: decryptedProps
-      };
-      const callbackResult = await Promise.resolve(this.options.tokenExchangeCallback(callbackOptions));
-      if (callbackResult) {
-        if (callbackResult.newProps) {
-          grantProps = callbackResult.newProps;
-          if (!callbackResult.accessTokenProps) {
-            accessTokenProps = callbackResult.newProps;
-          }
-        }
-        if (callbackResult.accessTokenProps) {
-          accessTokenProps = callbackResult.accessTokenProps;
-        }
-        if (callbackResult.accessTokenTTL !== void 0) {
-          accessTokenTTL = callbackResult.accessTokenTTL;
-        }
-        if ("refreshTokenTTL" in callbackResult) {
-          refreshTokenTTL = callbackResult.refreshTokenTTL;
-        }
-      }
-      const grantResult = await encryptProps(grantProps);
-      grantData.encryptedProps = grantResult.encryptedData;
-      grantEncryptionKey = grantResult.key;
-      if (accessTokenProps !== grantProps) {
-        const tokenResult = await encryptProps(accessTokenProps);
-        encryptedAccessTokenProps = tokenResult.encryptedData;
-        accessTokenEncryptionKey = tokenResult.key;
-      } else {
-        encryptedAccessTokenProps = grantData.encryptedProps;
-        accessTokenEncryptionKey = grantEncryptionKey;
-      }
-    }
-    const now = Math.floor(Date.now() / 1e3);
-    const accessTokenExpiresAt = now + accessTokenTTL;
-    const useRefreshToken = refreshTokenTTL !== 0;
-    const accessTokenWrappedKey = await wrapKeyWithToken(accessToken, accessTokenEncryptionKey);
-    delete grantData.authCodeId;
-    delete grantData.codeChallenge;
-    delete grantData.codeChallengeMethod;
-    delete grantData.authCodeWrappedKey;
-    let refreshToken;
-    if (useRefreshToken) {
-      const refreshTokenSecret = generateRandomString(TOKEN_LENGTH);
-      refreshToken = `${userId}:${grantId}:${refreshTokenSecret}`;
-      const refreshTokenId = await generateTokenId(refreshToken);
-      const refreshTokenWrappedKey = await wrapKeyWithToken(refreshToken, grantEncryptionKey);
-      const expiresAt = refreshTokenTTL !== void 0 ? now + refreshTokenTTL : void 0;
-      grantData.refreshTokenId = refreshTokenId;
-      grantData.refreshTokenWrappedKey = refreshTokenWrappedKey;
-      grantData.previousRefreshTokenId = void 0;
-      grantData.previousRefreshTokenWrappedKey = void 0;
-      grantData.expiresAt = expiresAt;
-    }
-    await this.saveGrantWithTTL(env, grantKey, grantData, now);
-    if (body.resource && grantData.resource) {
-      const requestedResources = Array.isArray(body.resource) ? body.resource : [body.resource];
-      const grantedResources = Array.isArray(grantData.resource) ? grantData.resource : [grantData.resource];
-      for (const requested of requestedResources) {
-        if (!grantedResources.includes(requested)) {
-          return this.createErrorResponse(
-            "invalid_target",
-            "Requested resource was not included in the authorization request"
-          );
-        }
-      }
-    }
-    const audience = parseResourceParameter(body.resource || grantData.resource);
-    if ((body.resource || grantData.resource) && !audience) {
-      return this.createErrorResponse(
-        "invalid_target",
-        "The resource parameter must be a valid absolute URI without a fragment"
-      );
-    }
-    const accessTokenData = {
-      id: accessTokenId,
-      grantId,
-      userId,
-      createdAt: now,
-      expiresAt: accessTokenExpiresAt,
-      audience,
-      wrappedEncryptionKey: accessTokenWrappedKey,
-      grant: {
-        clientId: grantData.clientId,
-        scope: grantData.scope,
-        encryptedProps: encryptedAccessTokenProps
-      }
-    };
-    await env.OAUTH_KV.put(`token:${userId}:${grantId}:${accessTokenId}`, JSON.stringify(accessTokenData), {
-      expirationTtl: accessTokenTTL
-    });
-    const tokenResponse = {
-      access_token: accessToken,
-      token_type: "bearer",
-      expires_in: accessTokenTTL,
-      scope: grantData.scope.join(" ")
-    };
-    if (refreshToken) {
-      tokenResponse.refresh_token = refreshToken;
-    }
-    if (audience) {
-      tokenResponse.resource = audience;
-    }
-    return new Response(JSON.stringify(tokenResponse), {
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-  /**
-   * Handles the refresh token grant type
-   * Issues a new access token using a refresh token
-   * @param body - The parsed request body
-   * @param clientInfo - The authenticated client information
-   * @param env - Cloudflare Worker environment variables
-   * @returns Response with token data or error
-   */
-  async handleRefreshTokenGrant(body, clientInfo, env) {
-    const refreshToken = body.refresh_token;
-    if (!refreshToken) {
-      return this.createErrorResponse("invalid_request", "Refresh token is required");
-    }
-    const tokenParts = refreshToken.split(":");
-    if (tokenParts.length !== 3) {
-      return this.createErrorResponse("invalid_grant", "Invalid token format");
-    }
-    const [userId, grantId, _] = tokenParts;
-    const providedTokenHash = await generateTokenId(refreshToken);
-    const grantKey = `grant:${userId}:${grantId}`;
-    const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
-    if (!grantData) {
-      return this.createErrorResponse("invalid_grant", "Grant not found");
-    }
-    const isCurrentToken = grantData.refreshTokenId === providedTokenHash;
-    const isPreviousToken = grantData.previousRefreshTokenId === providedTokenHash;
-    if (!isCurrentToken && !isPreviousToken) {
-      return this.createErrorResponse("invalid_grant", "Invalid refresh token");
-    }
-    if (grantData.clientId !== clientInfo.clientId) {
-      return this.createErrorResponse("invalid_grant", "Client ID mismatch");
-    }
-    if (grantData.expiresAt !== void 0) {
-      const now2 = Math.floor(Date.now() / 1e3);
-      if (now2 >= grantData.expiresAt) {
-        return this.createErrorResponse("invalid_grant", "Refresh token has expired");
-      }
-    }
-    const accessTokenSecret = generateRandomString(TOKEN_LENGTH);
-    const newAccessToken = `${userId}:${grantId}:${accessTokenSecret}`;
-    const accessTokenId = await generateTokenId(newAccessToken);
-    let accessTokenTTL = this.options.accessTokenTTL;
-    let wrappedKeyToUse;
-    if (isCurrentToken) {
-      wrappedKeyToUse = grantData.refreshTokenWrappedKey;
-    } else {
-      wrappedKeyToUse = grantData.previousRefreshTokenWrappedKey;
-    }
-    const encryptionKey = await unwrapKeyWithToken(refreshToken, wrappedKeyToUse);
-    let grantEncryptionKey = encryptionKey;
-    let accessTokenEncryptionKey = encryptionKey;
-    let encryptedAccessTokenProps = grantData.encryptedProps;
-    let grantPropsChanged = false;
-    if (this.options.tokenExchangeCallback) {
-      const decryptedProps = await decryptProps(encryptionKey, grantData.encryptedProps);
-      let grantProps = decryptedProps;
-      let accessTokenProps = decryptedProps;
-      const callbackOptions = {
-        grantType: "refresh_token",
-        clientId: clientInfo.clientId,
-        userId,
-        scope: grantData.scope,
-        props: decryptedProps
-      };
-      const callbackResult = await Promise.resolve(this.options.tokenExchangeCallback(callbackOptions));
-      if (callbackResult) {
-        if (callbackResult.newProps) {
-          grantProps = callbackResult.newProps;
-          grantPropsChanged = true;
-          if (!callbackResult.accessTokenProps) {
-            accessTokenProps = callbackResult.newProps;
-          }
-        }
-        if (callbackResult.accessTokenProps) {
-          accessTokenProps = callbackResult.accessTokenProps;
-        }
-        if (callbackResult.accessTokenTTL !== void 0) {
-          accessTokenTTL = callbackResult.accessTokenTTL;
-        }
-        if ("refreshTokenTTL" in callbackResult) {
-          return this.createErrorResponse(
-            "invalid_request",
-            "refreshTokenTTL cannot be changed during refresh token exchange"
-          );
-        }
-      }
-      if (grantPropsChanged) {
-        const grantResult = await encryptProps(grantProps);
-        grantData.encryptedProps = grantResult.encryptedData;
-        if (grantResult.key !== encryptionKey) {
-          grantEncryptionKey = grantResult.key;
-          wrappedKeyToUse = await wrapKeyWithToken(refreshToken, grantEncryptionKey);
-        } else {
-          grantEncryptionKey = grantResult.key;
-        }
-      }
-      if (accessTokenProps !== grantProps) {
-        const tokenResult = await encryptProps(accessTokenProps);
-        encryptedAccessTokenProps = tokenResult.encryptedData;
-        accessTokenEncryptionKey = tokenResult.key;
-      } else {
-        encryptedAccessTokenProps = grantData.encryptedProps;
-        accessTokenEncryptionKey = grantEncryptionKey;
-      }
-    }
-    const now = Math.floor(Date.now() / 1e3);
-    if (grantData.expiresAt !== void 0) {
-      const remainingRefreshTokenLifetime = grantData.expiresAt - now;
-      if (remainingRefreshTokenLifetime > 0) {
-        accessTokenTTL = Math.min(accessTokenTTL, remainingRefreshTokenLifetime);
-      }
-    }
-    const accessTokenExpiresAt = now + accessTokenTTL;
-    const accessTokenWrappedKey = await wrapKeyWithToken(newAccessToken, accessTokenEncryptionKey);
-    const refreshTokenSecret = generateRandomString(TOKEN_LENGTH);
-    const newRefreshToken = `${userId}:${grantId}:${refreshTokenSecret}`;
-    const newRefreshTokenId = await generateTokenId(newRefreshToken);
-    const newRefreshTokenWrappedKey = await wrapKeyWithToken(newRefreshToken, grantEncryptionKey);
-    grantData.previousRefreshTokenId = providedTokenHash;
-    grantData.previousRefreshTokenWrappedKey = wrappedKeyToUse;
-    grantData.refreshTokenId = newRefreshTokenId;
-    grantData.refreshTokenWrappedKey = newRefreshTokenWrappedKey;
-    await this.saveGrantWithTTL(env, grantKey, grantData, now);
-    if (body.resource && grantData.resource) {
-      const requestedResources = Array.isArray(body.resource) ? body.resource : [body.resource];
-      const grantedResources = Array.isArray(grantData.resource) ? grantData.resource : [grantData.resource];
-      for (const requested of requestedResources) {
-        if (!grantedResources.includes(requested)) {
-          return this.createErrorResponse(
-            "invalid_target",
-            "Requested resource was not included in the authorization request"
-          );
-        }
-      }
-    }
-    const audience = parseResourceParameter(body.resource || grantData.resource);
-    if ((body.resource || grantData.resource) && !audience) {
-      return this.createErrorResponse(
-        "invalid_target",
-        "The resource parameter must be a valid absolute URI without a fragment"
-      );
-    }
-    const accessTokenData = {
-      id: accessTokenId,
-      grantId,
-      userId,
-      createdAt: now,
-      expiresAt: accessTokenExpiresAt,
-      audience,
-      wrappedEncryptionKey: accessTokenWrappedKey,
-      grant: {
-        clientId: grantData.clientId,
-        scope: grantData.scope,
-        encryptedProps: encryptedAccessTokenProps
-      }
-    };
-    await env.OAUTH_KV.put(`token:${userId}:${grantId}:${accessTokenId}`, JSON.stringify(accessTokenData), {
-      expirationTtl: accessTokenTTL
-    });
-    const tokenResponse = {
-      access_token: newAccessToken,
-      token_type: "bearer",
-      expires_in: accessTokenTTL,
-      refresh_token: newRefreshToken,
-      scope: grantData.scope.join(" ")
-    };
-    if (audience) {
-      tokenResponse.resource = audience;
-    }
-    return new Response(JSON.stringify(tokenResponse), {
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-  /**
-   * Handles OAuth 2.0 token revocation requests (RFC 7009)
-   * @param body - The parsed request body containing revocation parameters
-   * @param env - Cloudflare Worker environment variables
-   * @returns Response confirming revocation or error
-   */
-  async handleRevocationRequest(body, env) {
-    return this.revokeToken(body, env);
-  }
-  /**
-   * - Access tokens: Revokes only the specific token
-   * - Refresh tokens: Revokes the entire grant (access + refresh tokens)
-   * @param body - The parsed request body containing token parameter
-   * @param env - Cloudflare Worker environment variables
-   * @returns Response confirming revocation or error
-   */
-  async revokeToken(body, env) {
-    const token = body.token;
-    if (!token) {
-      return this.createErrorResponse("invalid_request", "Token parameter is required");
-    }
-    const tokenParts = token.split(":");
-    if (tokenParts.length !== 3) {
-      return new Response("", { status: 200 });
-    }
-    const [userId, grantId, _] = tokenParts;
-    const tokenId = await generateTokenId(token);
-    const isAccessToken = await this.validateAccessToken(tokenId, userId, grantId, env);
-    const isRefreshToken = await this.validateRefreshToken(tokenId, userId, grantId, env);
-    if (isAccessToken) {
-      await this.revokeSpecificAccessToken(tokenId, userId, grantId, env);
-    } else if (isRefreshToken) {
-      await this.createOAuthHelpers(env).revokeGrant(grantId, userId);
-    }
-    return new Response("", { status: 200 });
-  }
-  /**
-   * Revokes a specific access token without affecting the refresh token
-   * @param tokenId - The hashed token ID
-   * @param userId - The user ID extracted from the token
-   * @param grantId - The grant ID extracted from the token
-   * @param env - Cloudflare Worker environment variables
-   */
-  async revokeSpecificAccessToken(tokenId, userId, grantId, env) {
-    const tokenKey = `token:${userId}:${grantId}:${tokenId}`;
-    await env.OAUTH_KV.delete(tokenKey);
-  }
-  /**
-   * Validates if a token is a valid access token
-   * @param tokenId - The hashed token ID
-   * @param userId - The user ID extracted from the token
-   * @param grantId - The grant ID extracted from the token
-   * @param env - Cloudflare Worker environment variables
-   * @returns Promise<boolean> indicating if the token is valid
-   */
-  async validateAccessToken(tokenId, userId, grantId, env) {
-    const tokenKey = `token:${userId}:${grantId}:${tokenId}`;
-    const tokenData = await env.OAUTH_KV.get(tokenKey, { type: "json" });
-    if (!tokenData) {
-      return false;
-    }
-    const now = Math.floor(Date.now() / 1e3);
-    return tokenData.expiresAt >= now;
-  }
-  /**
-   * Validates if a token is a valid refresh token
-   * @param tokenId - The hashed token ID
-   * @param userId - The user ID extracted from the token
-   * @param grantId - The grant ID extracted from the token
-   * @param env - Cloudflare Worker environment variables
-   * @returns Promise<boolean> indicating if the token is valid
-   */
-  async validateRefreshToken(tokenId, userId, grantId, env) {
-    const grantKey = `grant:${userId}:${grantId}`;
-    const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
-    if (!grantData) {
-      return false;
-    }
-    return grantData.refreshTokenId === tokenId || grantData.previousRefreshTokenId === tokenId;
-  }
-  /**
-   * Handles the dynamic client registration endpoint (RFC 7591)
-   * @param request - The HTTP request
-   * @param env - Cloudflare Worker environment variables
-   * @returns Response with client registration data or error
-   */
-  async handleClientRegistration(request, env) {
-    if (!this.options.clientRegistrationEndpoint) {
-      return this.createErrorResponse("not_implemented", "Client registration is not enabled", 501);
-    }
-    if (request.method !== "POST") {
-      return this.createErrorResponse("invalid_request", "Method not allowed", 405);
-    }
-    const contentLength = parseInt(request.headers.get("Content-Length") || "0", 10);
-    if (contentLength > 1048576) {
-      return this.createErrorResponse("invalid_request", "Request payload too large, must be under 1 MiB", 413);
-    }
-    let clientMetadata;
-    try {
-      const text = await request.text();
-      if (text.length > 1048576) {
-        return this.createErrorResponse("invalid_request", "Request payload too large, must be under 1 MiB", 413);
-      }
-      clientMetadata = JSON.parse(text);
-    } catch (error) {
-      return this.createErrorResponse("invalid_request", "Invalid JSON payload", 400);
-    }
-    const validateStringField = (field) => {
-      if (field === void 0) {
-        return void 0;
-      }
-      if (typeof field !== "string") {
-        throw new Error("Field must be a string");
-      }
-      return field;
-    };
-    const validateStringArray = (arr) => {
-      if (arr === void 0) {
-        return void 0;
-      }
-      if (!Array.isArray(arr)) {
-        throw new Error("Field must be an array");
-      }
-      for (const item of arr) {
-        if (typeof item !== "string") {
-          throw new Error("All array elements must be strings");
-        }
-      }
-      return arr;
-    };
-    const authMethod = validateStringField(clientMetadata.token_endpoint_auth_method) || "client_secret_basic";
-    const isPublicClient = authMethod === "none";
-    if (isPublicClient && this.options.disallowPublicClientRegistration) {
-      return this.createErrorResponse("invalid_client_metadata", "Public client registration is not allowed");
-    }
-    const clientId = generateRandomString(16);
-    let clientSecret;
-    let hashedSecret;
-    if (!isPublicClient) {
-      clientSecret = generateRandomString(32);
-      hashedSecret = await hashSecret(clientSecret);
-    }
-    let clientInfo;
-    try {
-      const redirectUris = validateStringArray(clientMetadata.redirect_uris);
-      if (!redirectUris || redirectUris.length === 0) {
-        throw new Error("At least one redirect URI is required");
-      }
-      for (const uri of redirectUris) {
-        validateRedirectUriScheme(uri);
-      }
-      clientInfo = {
-        clientId,
-        redirectUris,
-        clientName: validateStringField(clientMetadata.client_name),
-        logoUri: validateStringField(clientMetadata.logo_uri),
-        clientUri: validateStringField(clientMetadata.client_uri),
-        policyUri: validateStringField(clientMetadata.policy_uri),
-        tosUri: validateStringField(clientMetadata.tos_uri),
-        jwksUri: validateStringField(clientMetadata.jwks_uri),
-        contacts: validateStringArray(clientMetadata.contacts),
-        grantTypes: validateStringArray(clientMetadata.grant_types) || ["authorization_code", "refresh_token"],
-        responseTypes: validateStringArray(clientMetadata.response_types) || ["code"],
-        registrationDate: Math.floor(Date.now() / 1e3),
-        tokenEndpointAuthMethod: authMethod
-      };
-      if (!isPublicClient && hashedSecret) {
-        clientInfo.clientSecret = hashedSecret;
-      }
-    } catch (error) {
-      return this.createErrorResponse(
-        "invalid_client_metadata",
-        error instanceof Error ? error.message : "Invalid client metadata"
-      );
-    }
-    await env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(clientInfo));
-    const response = {
-      client_id: clientInfo.clientId,
-      redirect_uris: clientInfo.redirectUris,
-      client_name: clientInfo.clientName,
-      logo_uri: clientInfo.logoUri,
-      client_uri: clientInfo.clientUri,
-      policy_uri: clientInfo.policyUri,
-      tos_uri: clientInfo.tosUri,
-      jwks_uri: clientInfo.jwksUri,
-      contacts: clientInfo.contacts,
-      grant_types: clientInfo.grantTypes,
-      response_types: clientInfo.responseTypes,
-      token_endpoint_auth_method: clientInfo.tokenEndpointAuthMethod,
-      registration_client_uri: `${this.options.clientRegistrationEndpoint}/${clientId}`,
-      client_id_issued_at: clientInfo.registrationDate
-    };
-    if (clientSecret) {
-      response.client_secret = clientSecret;
-    }
-    return new Response(JSON.stringify(response), {
-      status: 201,
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-  /**
-   * Handles API requests by validating the access token and calling the API handler
-   * @param request - The HTTP request
-   * @param env - Cloudflare Worker environment variables
-   * @param ctx - Cloudflare Worker execution context
-   * @returns Response from the API handler or error
-   */
-  async handleApiRequest(request, env, ctx) {
-    const authHeader = request.headers.get("Authorization");
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-      return this.createErrorResponse("invalid_token", "Missing or invalid access token", 401, {
-        "WWW-Authenticate": 'Bearer realm="OAuth", error="invalid_token", error_description="Missing or invalid access token"'
-      });
-    }
-    const accessToken = authHeader.substring(7);
-    const parts = accessToken.split(":");
-    const isPossiblyInternalFormat = parts.length === 3;
-    let tokenData = null;
-    let userId = "";
-    let grantId = "";
-    if (isPossiblyInternalFormat) {
-      [userId, grantId] = parts;
-      const id = await generateTokenId(accessToken);
-      tokenData = await env.OAUTH_KV.get(`token:${userId}:${grantId}:${id}`, { type: "json" });
-    }
-    if (!tokenData && !this.options.resolveExternalToken) {
-      return this.createErrorResponse("invalid_token", "Invalid access token", 401, {
-        "WWW-Authenticate": 'Bearer realm="OAuth", error="invalid_token"'
-      });
-    }
-    if (tokenData) {
-      const now = Math.floor(Date.now() / 1e3);
-      if (tokenData.expiresAt < now) {
-        return this.createErrorResponse("invalid_token", "Access token expired", 401, {
-          "WWW-Authenticate": 'Bearer realm="OAuth", error="invalid_token"'
-        });
-      }
-      if (tokenData.audience) {
-        const requestUrl = new URL(request.url);
-        const resourceServer = `${requestUrl.protocol}//${requestUrl.host}`;
-        const audiences = Array.isArray(tokenData.audience) ? tokenData.audience : [tokenData.audience];
-        const matches = audiences.some((aud) => audienceMatches(resourceServer, aud));
-        if (!matches) {
-          return this.createErrorResponse("invalid_token", "Token audience does not match resource server", 401, {
-            "WWW-Authenticate": 'Bearer realm="OAuth", error="invalid_token", error_description="Invalid audience"'
-          });
-        }
-      }
-      const encryptionKey = await unwrapKeyWithToken(accessToken, tokenData.wrappedEncryptionKey);
-      const decryptedProps = await decryptProps(encryptionKey, tokenData.grant.encryptedProps);
-      ctx.props = decryptedProps;
-    } else if (this.options.resolveExternalToken) {
-      const ext = await this.options.resolveExternalToken({ token: accessToken, request, env });
-      if (!ext) {
-        return this.createErrorResponse("invalid_token", "Invalid access token", 401, {
-          "WWW-Authenticate": 'Bearer realm="OAuth", error="invalid_token"'
-        });
-      }
-      if (ext.audience) {
-        const requestUrl = new URL(request.url);
-        const resourceServer = `${requestUrl.protocol}//${requestUrl.host}`;
-        const audiences = Array.isArray(ext.audience) ? ext.audience : [ext.audience];
-        const matches = audiences.some((aud) => audienceMatches(resourceServer, aud));
-        if (!matches) {
-          return this.createErrorResponse("invalid_token", "Token audience does not match resource server", 401, {
-            "WWW-Authenticate": 'Bearer realm="OAuth", error="invalid_token", error_description="Invalid audience"'
-          });
-        }
-      }
-      ctx.props = ext.props;
-    }
-    if (!env.OAUTH_PROVIDER) {
-      env.OAUTH_PROVIDER = this.createOAuthHelpers(env);
-    }
-    const url = new URL(request.url);
-    const apiHandler = this.findApiHandlerForUrl(url);
-    if (!apiHandler) {
-      return this.createErrorResponse("invalid_request", "No handler found for API route", 404);
-    }
-    if (apiHandler.type === 0 /* EXPORTED_HANDLER */) {
-      return apiHandler.handler.fetch(request, env, ctx);
-    } else {
-      const handler = new apiHandler.handler(ctx, env);
-      return handler.fetch(request);
-    }
-  }
-  /**
-   * Creates the helper methods object for OAuth operations
-   * This is passed to the handler functions to allow them to interact with the OAuth system
-   * @param env - Cloudflare Worker environment variables
-   * @returns An instance of OAuthHelpers
-   */
-  createOAuthHelpers(env) {
-    return new OAuthHelpersImpl(env, this);
-  }
-  /**
-   * Saves a grant to KV with appropriate TTL based on expiration
-   * @param env - The environment bindings
-   * @param grantKey - The KV key for the grant
-   * @param grantData - The grant data to save
-   * @param now - Current timestamp in seconds
-   */
-  async saveGrantWithTTL(env, grantKey, grantData, now) {
-    const kvOptions = grantData.expiresAt !== void 0 ? { expiration: grantData.expiresAt } : {};
-    await env.OAUTH_KV.put(grantKey, JSON.stringify(grantData), kvOptions);
-  }
-  /**
-   * Fetches client information from KV storage
-   * This method is not private because `OAuthHelpers` needs to call it. Note that since
-   * `OAuthProviderImpl` is not exposed outside this module, this is still effectively
-   * module-private.
-   * @param env - Cloudflare Worker environment variables
-   * @param clientId - The client ID to look up
-   * @returns The client information, or null if not found
-   */
-  getClient(env, clientId) {
-    const clientKey = `client:${clientId}`;
-    return env.OAUTH_KV.get(clientKey, { type: "json" });
-  }
-  /**
-   * Helper function to create OAuth error responses
-   * @param code - OAuth error code (e.g., 'invalid_request', 'invalid_token')
-   * @param description - Human-readable error description
-   * @param status - HTTP status code (default: 400)
-   * @param headers - Additional headers to include
-   * @returns A Response object with the error
-   */
-  createErrorResponse(code, description, status = 400, headers = {}) {
-    const customErrorResponse = this.options.onError?.({ code, description, status, headers });
-    if (customErrorResponse) return customErrorResponse;
-    const body = JSON.stringify({
-      error: code,
-      error_description: description
-    });
-    return new Response(body, {
-      status,
-      headers: {
-        "Content-Type": "application/json",
-        ...headers
-      }
-    });
-  }
+/**
+* Gets OAuthHelpers for the given environment
+* @param options - Configuration options for the OAuth provider
+* @param env - Cloudflare Worker environment variables
+* @returns An instance of OAuthHelpers
+*/
+function getOAuthApi(options, env) {
+	return new OAuthProviderImpl(options).createOAuthHelpers(env);
+}
+/**
+* Implementation class backing OAuthProvider.
+*
+* We use a PImpl pattern in `OAuthProvider` to make sure we don't inadvertently export any private
+* methods over RPC. Unfortunately, declaring a method "private" in TypeScript is merely a type
+* annotation, and does not actually prevent the method from being called from outside the class,
+* including over RPC.
+*/
+var OAuthProviderImpl = class OAuthProviderImpl {
+	/**
+	* Creates a new OAuth provider instance
+	* @param options - Configuration options for the provider
+	*/
+	constructor(options) {
+		this.typedApiHandlers = [];
+		const hasSingleHandlerConfig = !!(options.apiRoute && options.apiHandler);
+		const hasMultiHandlerConfig = !!options.apiHandlers;
+		if (hasSingleHandlerConfig && hasMultiHandlerConfig) throw new TypeError("Cannot use both apiRoute/apiHandler and apiHandlers. Use either apiRoute + apiHandler OR apiHandlers, not both.");
+		if (!hasSingleHandlerConfig && !hasMultiHandlerConfig) throw new TypeError("Must provide either apiRoute + apiHandler OR apiHandlers. No API route configuration provided.");
+		this.typedDefaultHandler = this.validateHandler(options.defaultHandler, "defaultHandler");
+		if (hasSingleHandlerConfig) {
+			const apiHandler = this.validateHandler(options.apiHandler, "apiHandler");
+			if (Array.isArray(options.apiRoute)) options.apiRoute.forEach((route, index) => {
+				this.validateEndpoint(route, `apiRoute[${index}]`);
+				this.typedApiHandlers.push([route, apiHandler]);
+			});
+			else {
+				this.validateEndpoint(options.apiRoute, "apiRoute");
+				this.typedApiHandlers.push([options.apiRoute, apiHandler]);
+			}
+		} else for (const [route, handler] of Object.entries(options.apiHandlers)) {
+			this.validateEndpoint(route, `apiHandlers key: ${route}`);
+			this.typedApiHandlers.push([route, this.validateHandler(handler, `apiHandlers[${route}]`)]);
+		}
+		this.validateEndpoint(options.authorizeEndpoint, "authorizeEndpoint");
+		this.validateEndpoint(options.tokenEndpoint, "tokenEndpoint");
+		if (options.clientRegistrationEndpoint) this.validateEndpoint(options.clientRegistrationEndpoint, "clientRegistrationEndpoint");
+		this.options = {
+			accessTokenTTL: DEFAULT_ACCESS_TOKEN_TTL,
+			onError: ({ status, code, description }) => console.warn(`OAuth error response: ${status} ${code} - ${description}`),
+			...options
+		};
+	}
+	/**
+	* Validates that an endpoint is either an absolute path or a full URL
+	* @param endpoint - The endpoint to validate
+	* @param name - The name of the endpoint property for error messages
+	* @throws TypeError if the endpoint is invalid
+	*/
+	validateEndpoint(endpoint, name) {
+		if (this.isPath(endpoint)) {
+			if (!endpoint.startsWith("/")) throw new TypeError(`${name} path must be an absolute path starting with /`);
+		} else try {
+			new URL(endpoint);
+		} catch (e) {
+			throw new TypeError(`${name} must be either an absolute path starting with / or a valid URL`);
+		}
+	}
+	/**
+	* Validates that a handler is either an ExportedHandler or a class extending WorkerEntrypoint
+	* @param handler - The handler to validate
+	* @param name - The name of the handler property for error messages
+	* @returns The type of the handler (EXPORTED_HANDLER or WORKER_ENTRYPOINT)
+	* @throws TypeError if the handler is invalid
+	*/
+	validateHandler(handler, name) {
+		if (typeof handler === "object" && handler !== null && typeof handler.fetch === "function") return {
+			type: HandlerType.EXPORTED_HANDLER,
+			handler
+		};
+		if (typeof handler === "function" && handler.prototype instanceof WorkerEntrypoint) return {
+			type: HandlerType.WORKER_ENTRYPOINT,
+			handler
+		};
+		throw new TypeError(`${name} must be either an ExportedHandler object with a fetch method or a class extending WorkerEntrypoint`);
+	}
+	/**
+	* Main fetch handler for the Worker
+	* Routes requests to the appropriate handler based on the URL
+	* @param request - The HTTP request
+	* @param env - Cloudflare Worker environment variables
+	* @param ctx - Cloudflare Worker execution context
+	* @returns A Promise resolving to an HTTP Response
+	*/
+	async fetch(request, env, ctx) {
+		const url = new URL(request.url);
+		if (request.method === "OPTIONS") {
+			if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
+				status: 204,
+				headers: { "Content-Length": "0" }
+			}), request);
+		}
+		if (url.pathname === "/.well-known/oauth-authorization-server") {
+			const response = await this.handleMetadataDiscovery(url);
+			return this.addCorsHeaders(response, request);
+		}
+		if (this.isTokenEndpoint(url)) {
+			const parsed = await this.parseTokenEndpointRequest(request, env);
+			if (parsed instanceof Response) return this.addCorsHeaders(parsed, request);
+			let response;
+			if (parsed.isRevocationRequest) response = await this.handleRevocationRequest(parsed.body, env);
+			else response = await this.handleTokenRequest(parsed.body, parsed.clientInfo, env);
+			return this.addCorsHeaders(response, request);
+		}
+		if (this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) {
+			const response = await this.handleClientRegistration(request, env);
+			return this.addCorsHeaders(response, request);
+		}
+		if (this.isApiRequest(url)) {
+			const response = await this.handleApiRequest(request, env, ctx);
+			return this.addCorsHeaders(response, request);
+		}
+		if (!env.OAUTH_PROVIDER) env.OAUTH_PROVIDER = this.createOAuthHelpers(env);
+		if (this.typedDefaultHandler.type === HandlerType.EXPORTED_HANDLER) return this.typedDefaultHandler.handler.fetch(request, env, ctx);
+		else return new this.typedDefaultHandler.handler(ctx, env).fetch(request);
+	}
+	/**
+	* Decodes a token and returns token data with decrypted props
+	* @param token - The granted token
+	* @param env - Cloudflare Worker environment variables
+	* @returns Promise resolving to token data with decrypted props, or null if token is invalid
+	*/
+	async unwrapToken(token, env) {
+		const parts = token.split(":");
+		if (!(parts.length === 3)) return null;
+		const [userId, grantId] = parts;
+		const id = await generateTokenId(token);
+		const tokenData = await env.OAUTH_KV.get(`token:${userId}:${grantId}:${id}`, { type: "json" });
+		if (!tokenData) return null;
+		const now = Math.floor(Date.now() / 1e3);
+		if (tokenData.expiresAt < now) return null;
+		const decryptedProps = await decryptProps(await unwrapKeyWithToken(token, tokenData.wrappedEncryptionKey), tokenData.grant.encryptedProps);
+		const { grant } = tokenData;
+		return {
+			id: tokenData.id,
+			grantId: tokenData.grantId,
+			userId: tokenData.userId,
+			createdAt: tokenData.createdAt,
+			expiresAt: tokenData.expiresAt,
+			audience: tokenData.audience,
+			scope: tokenData.scope || grant.scope,
+			grant: {
+				clientId: grant.clientId,
+				scope: grant.scope,
+				props: decryptedProps
+			}
+		};
+	}
+	/**
+	* Determines if an endpoint configuration is a path or a full URL
+	* @param endpoint - The endpoint configuration
+	* @returns True if the endpoint is a path (starts with /), false if it's a full URL
+	*/
+	isPath(endpoint) {
+		return endpoint.startsWith("/");
+	}
+	/**
+	* Matches a URL against an endpoint pattern that can be a full URL or just a path
+	* @param url - The URL to check
+	* @param endpoint - The endpoint pattern (full URL or path)
+	* @returns True if the URL matches the endpoint pattern
+	*/
+	matchEndpoint(url, endpoint) {
+		if (this.isPath(endpoint)) return url.pathname === endpoint;
+		else {
+			const endpointUrl = new URL(endpoint);
+			return url.hostname === endpointUrl.hostname && url.pathname === endpointUrl.pathname;
+		}
+	}
+	/**
+	* Checks if a URL matches the configured token endpoint
+	* @param url - The URL to check
+	* @returns True if the URL matches the token endpoint
+	*/
+	isTokenEndpoint(url) {
+		return this.matchEndpoint(url, this.options.tokenEndpoint);
+	}
+	/**
+	* Checks if a URL matches the configured client registration endpoint
+	* @param url - The URL to check
+	* @returns True if the URL matches the client registration endpoint
+	*/
+	isClientRegistrationEndpoint(url) {
+		if (!this.options.clientRegistrationEndpoint) return false;
+		return this.matchEndpoint(url, this.options.clientRegistrationEndpoint);
+	}
+	/**
+	* Parses and validates a token endpoint request (used for both token exchange and revocation)
+	* @param request - The HTTP request to parse
+	* @returns Promise with parsed body and client info, or error response
+	*/
+	async parseTokenEndpointRequest(request, env) {
+		if (request.method !== "POST") return this.createErrorResponse("invalid_request", "Method not allowed", 405);
+		let contentType = request.headers.get("Content-Type") || "";
+		let body = {};
+		if (!contentType.includes("application/x-www-form-urlencoded")) return this.createErrorResponse("invalid_request", "Content-Type must be application/x-www-form-urlencoded", 400);
+		const formData = await request.formData();
+		for (const [key, value] of formData.entries()) {
+			const allValues = formData.getAll(key);
+			body[key] = allValues.length > 1 ? allValues : value;
+		}
+		const authHeader = request.headers.get("Authorization");
+		let clientId = "";
+		let clientSecret = "";
+		if (authHeader && authHeader.startsWith("Basic ")) {
+			const [id, secret] = atob(authHeader.substring(6)).split(":", 2);
+			clientId = decodeURIComponent(id);
+			clientSecret = decodeURIComponent(secret || "");
+		} else {
+			clientId = body.client_id;
+			clientSecret = body.client_secret || "";
+		}
+		if (!clientId) return this.createErrorResponse("invalid_client", "Client ID is required", 401);
+		const clientInfo = await this.getClient(env, clientId);
+		if (!clientInfo) return this.createErrorResponse("invalid_client", "Client not found", 401);
+		if (!(clientInfo.tokenEndpointAuthMethod === "none")) {
+			if (!clientSecret) return this.createErrorResponse("invalid_client", "Client authentication failed: missing client_secret", 401);
+			if (!clientInfo.clientSecret) return this.createErrorResponse("invalid_client", "Client authentication failed: client has no registered secret", 401);
+			if (await hashSecret(clientSecret) !== clientInfo.clientSecret) return this.createErrorResponse("invalid_client", "Client authentication failed: invalid client_secret", 401);
+		}
+		return {
+			body,
+			clientInfo,
+			isRevocationRequest: !body.grant_type && !!body.token
+		};
+	}
+	/**
+	* Checks if a URL matches a specific API route
+	* @param url - The URL to check
+	* @param route - The API route to check against
+	* @returns True if the URL matches the API route
+	*/
+	matchApiRoute(url, route) {
+		if (this.isPath(route)) return url.pathname.startsWith(route);
+		else {
+			const apiUrl = new URL(route);
+			return url.hostname === apiUrl.hostname && url.pathname.startsWith(apiUrl.pathname);
+		}
+	}
+	/**
+	* Checks if a URL is an API request based on the configured API route(s)
+	* @param url - The URL to check
+	* @returns True if the URL matches any of the API routes
+	*/
+	isApiRequest(url) {
+		for (const [route, _] of this.typedApiHandlers) if (this.matchApiRoute(url, route)) return true;
+		return false;
+	}
+	/**
+	* Finds the appropriate API handler for a URL
+	* @param url - The URL to find a handler for
+	* @returns The TypedHandler for the URL, or undefined if no handler matches
+	*/
+	findApiHandlerForUrl(url) {
+		for (const [route, handler] of this.typedApiHandlers) if (this.matchApiRoute(url, route)) return handler;
+	}
+	/**
+	* Gets the full URL for an endpoint, using the provided request URL's
+	* origin for endpoints specified as just paths
+	* @param endpoint - The endpoint configuration (path or full URL)
+	* @param requestUrl - The URL of the incoming request
+	* @returns The full URL for the endpoint
+	*/
+	getFullEndpointUrl(endpoint, requestUrl) {
+		if (this.isPath(endpoint)) return `${requestUrl.origin}${endpoint}`;
+		else return endpoint;
+	}
+	/**
+	* Adds CORS headers to a response
+	* @param response - The response to add CORS headers to
+	* @param request - The original request
+	* @returns A new Response with CORS headers added
+	*/
+	addCorsHeaders(response, request) {
+		const origin = request.headers.get("Origin");
+		if (!origin) return response;
+		const newResponse = new Response(response.body, response);
+		newResponse.headers.set("Access-Control-Allow-Origin", origin);
+		newResponse.headers.set("Access-Control-Allow-Methods", "*");
+		newResponse.headers.set("Access-Control-Allow-Headers", "Authorization, *");
+		newResponse.headers.set("Access-Control-Max-Age", "86400");
+		return newResponse;
+	}
+	/**
+	* Handles the OAuth metadata discovery endpoint
+	* Implements RFC 8414 for OAuth Server Metadata
+	* @param requestUrl - The URL of the incoming request
+	* @returns Response with OAuth server metadata
+	*/
+	async handleMetadataDiscovery(requestUrl) {
+		const tokenEndpoint = this.getFullEndpointUrl(this.options.tokenEndpoint, requestUrl);
+		const authorizeEndpoint = this.getFullEndpointUrl(this.options.authorizeEndpoint, requestUrl);
+		let registrationEndpoint = void 0;
+		if (this.options.clientRegistrationEndpoint) registrationEndpoint = this.getFullEndpointUrl(this.options.clientRegistrationEndpoint, requestUrl);
+		const responseTypesSupported = ["code"];
+		if (this.options.allowImplicitFlow) responseTypesSupported.push("token");
+		const grantTypesSupported = [GrantType.AUTHORIZATION_CODE, GrantType.REFRESH_TOKEN];
+		if (this.options.allowTokenExchangeGrant) grantTypesSupported.push(GrantType.TOKEN_EXCHANGE);
+		const metadata = {
+			issuer: new URL(tokenEndpoint).origin,
+			authorization_endpoint: authorizeEndpoint,
+			token_endpoint: tokenEndpoint,
+			registration_endpoint: registrationEndpoint,
+			scopes_supported: this.options.scopesSupported,
+			response_types_supported: responseTypesSupported,
+			response_modes_supported: ["query"],
+			grant_types_supported: grantTypesSupported,
+			token_endpoint_auth_methods_supported: [
+				"client_secret_basic",
+				"client_secret_post",
+				"none"
+			],
+			revocation_endpoint: tokenEndpoint,
+			code_challenge_methods_supported: ["plain", "S256"],
+			client_id_metadata_document_supported: this.hasGlobalFetchStrictlyPublic()
+		};
+		return new Response(JSON.stringify(metadata), { headers: { "Content-Type": "application/json" } });
+	}
+	/**
+	* Handles client authentication and token issuance via the token endpoint
+	* Supports authorization_code and refresh_token grant types
+	* @param body - The parsed request body
+	* @param clientInfo - The authenticated client information
+	* @param env - Cloudflare Worker environment variables
+	* @returns Response with token data or error
+	*/
+	async handleTokenRequest(body, clientInfo, env) {
+		const grantType = body.grant_type;
+		if (grantType === GrantType.AUTHORIZATION_CODE) return this.handleAuthorizationCodeGrant(body, clientInfo, env);
+		else if (grantType === GrantType.REFRESH_TOKEN) return this.handleRefreshTokenGrant(body, clientInfo, env);
+		else if (grantType === GrantType.TOKEN_EXCHANGE && this.options.allowTokenExchangeGrant) return this.handleTokenExchangeGrant(body, clientInfo, env);
+		else return this.createErrorResponse("unsupported_grant_type", "Grant type not supported");
+	}
+	/**
+	* Handles the authorization code grant type
+	* Exchanges an authorization code for access and refresh tokens
+	* @param body - The parsed request body
+	* @param clientInfo - The authenticated client information
+	* @param env - Cloudflare Worker environment variables
+	* @returns Response with token data or error
+	*/
+	async handleAuthorizationCodeGrant(body, clientInfo, env) {
+		const code = body.code;
+		const redirectUri = body.redirect_uri;
+		const codeVerifier = body.code_verifier;
+		if (!code) return this.createErrorResponse("invalid_request", "Authorization code is required");
+		const codeParts = code.split(":");
+		if (codeParts.length !== 3) return this.createErrorResponse("invalid_grant", "Invalid authorization code format");
+		const [userId, grantId, _] = codeParts;
+		const grantKey = `grant:${userId}:${grantId}`;
+		const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
+		if (!grantData) return this.createErrorResponse("invalid_grant", "Grant not found or authorization code expired");
+		if (!grantData.authCodeId) return this.createErrorResponse("invalid_grant", "Authorization code already used");
+		if (await hashSecret(code) !== grantData.authCodeId) return this.createErrorResponse("invalid_grant", "Invalid authorization code");
+		if (grantData.clientId !== clientInfo.clientId) return this.createErrorResponse("invalid_grant", "Client ID mismatch");
+		const isPkceEnabled = !!grantData.codeChallenge;
+		if (!redirectUri && !isPkceEnabled) return this.createErrorResponse("invalid_request", "redirect_uri is required when not using PKCE");
+		if (redirectUri && !clientInfo.redirectUris.includes(redirectUri)) return this.createErrorResponse("invalid_grant", "Invalid redirect URI");
+		if (!isPkceEnabled && codeVerifier) return this.createErrorResponse("invalid_request", "code_verifier provided for a flow that did not use PKCE");
+		if (isPkceEnabled) {
+			if (!codeVerifier) return this.createErrorResponse("invalid_request", "code_verifier is required for PKCE");
+			let calculatedChallenge;
+			if (grantData.codeChallengeMethod === "S256") {
+				const data = new TextEncoder().encode(codeVerifier);
+				const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+				const hashArray = Array.from(new Uint8Array(hashBuffer));
+				calculatedChallenge = base64UrlEncode(String.fromCharCode(...hashArray));
+			} else calculatedChallenge = codeVerifier;
+			if (calculatedChallenge !== grantData.codeChallenge) return this.createErrorResponse("invalid_grant", "Invalid PKCE code_verifier");
+		}
+		let accessTokenTTL = this.options.accessTokenTTL;
+		let refreshTokenTTL = this.options.refreshTokenTTL;
+		const encryptionKey = await unwrapKeyWithToken(code, grantData.authCodeWrappedKey);
+		let grantEncryptionKey = encryptionKey;
+		let accessTokenEncryptionKey = encryptionKey;
+		let encryptedAccessTokenProps = grantData.encryptedProps;
+		let tokenScopes = this.downscope(body.scope, grantData.scope);
+		if (this.options.tokenExchangeCallback) {
+			const decryptedProps = await decryptProps(encryptionKey, grantData.encryptedProps);
+			let grantProps = decryptedProps;
+			let accessTokenProps = decryptedProps;
+			const callbackOptions = {
+				grantType: GrantType.AUTHORIZATION_CODE,
+				clientId: clientInfo.clientId,
+				userId,
+				scope: grantData.scope,
+				requestedScope: tokenScopes,
+				props: decryptedProps
+			};
+			const callbackResult = await Promise.resolve(this.options.tokenExchangeCallback(callbackOptions));
+			if (callbackResult) {
+				if (callbackResult.newProps) {
+					grantProps = callbackResult.newProps;
+					if (!callbackResult.accessTokenProps) accessTokenProps = callbackResult.newProps;
+				}
+				if (callbackResult.accessTokenProps) accessTokenProps = callbackResult.accessTokenProps;
+				if (callbackResult.accessTokenTTL !== void 0) accessTokenTTL = callbackResult.accessTokenTTL;
+				if ("refreshTokenTTL" in callbackResult) refreshTokenTTL = callbackResult.refreshTokenTTL;
+				if (callbackResult.accessTokenScope) tokenScopes = this.downscope(callbackResult.accessTokenScope, grantData.scope);
+			}
+			const grantResult = await encryptProps(grantProps);
+			grantData.encryptedProps = grantResult.encryptedData;
+			grantEncryptionKey = grantResult.key;
+			if (accessTokenProps !== grantProps) {
+				const tokenResult = await encryptProps(accessTokenProps);
+				encryptedAccessTokenProps = tokenResult.encryptedData;
+				accessTokenEncryptionKey = tokenResult.key;
+			} else {
+				encryptedAccessTokenProps = grantData.encryptedProps;
+				accessTokenEncryptionKey = grantEncryptionKey;
+			}
+		}
+		const now = Math.floor(Date.now() / 1e3);
+		const useRefreshToken = refreshTokenTTL !== 0;
+		delete grantData.authCodeId;
+		delete grantData.codeChallenge;
+		delete grantData.codeChallengeMethod;
+		delete grantData.authCodeWrappedKey;
+		let refreshToken;
+		if (useRefreshToken) {
+			refreshToken = `${userId}:${grantId}:${generateRandomString(TOKEN_LENGTH)}`;
+			const refreshTokenId = await generateTokenId(refreshToken);
+			const refreshTokenWrappedKey = await wrapKeyWithToken(refreshToken, grantEncryptionKey);
+			const expiresAt = refreshTokenTTL !== void 0 ? now + refreshTokenTTL : void 0;
+			grantData.refreshTokenId = refreshTokenId;
+			grantData.refreshTokenWrappedKey = refreshTokenWrappedKey;
+			grantData.previousRefreshTokenId = void 0;
+			grantData.previousRefreshTokenWrappedKey = void 0;
+			grantData.expiresAt = expiresAt;
+		}
+		await this.saveGrantWithTTL(env, grantKey, grantData, now);
+		if (body.resource && grantData.resource) {
+			const requestedResources = Array.isArray(body.resource) ? body.resource : [body.resource];
+			const grantedResources = Array.isArray(grantData.resource) ? grantData.resource : [grantData.resource];
+			for (const requested of requestedResources) if (!grantedResources.includes(requested)) return this.createErrorResponse("invalid_target", "Requested resource was not included in the authorization request");
+		}
+		const audience = parseResourceParameter(body.resource || grantData.resource);
+		if ((body.resource || grantData.resource) && !audience) return this.createErrorResponse("invalid_target", "The resource parameter must be a valid absolute URI without a fragment");
+		const tokenResponse = {
+			access_token: await this.createAccessToken({
+				userId,
+				grantId,
+				clientId: grantData.clientId,
+				scope: tokenScopes,
+				encryptedProps: encryptedAccessTokenProps,
+				encryptionKey: accessTokenEncryptionKey,
+				expiresIn: accessTokenTTL,
+				audience,
+				env
+			}),
+			token_type: "bearer",
+			expires_in: accessTokenTTL,
+			scope: tokenScopes.join(" ")
+		};
+		if (refreshToken) tokenResponse.refresh_token = refreshToken;
+		if (audience) tokenResponse.resource = audience;
+		return new Response(JSON.stringify(tokenResponse), { headers: { "Content-Type": "application/json" } });
+	}
+	/**
+	* Handles the refresh token grant type
+	* Issues a new access token using a refresh token
+	* @param body - The parsed request body
+	* @param clientInfo - The authenticated client information
+	* @param env - Cloudflare Worker environment variables
+	* @returns Response with token data or error
+	*/
+	async handleRefreshTokenGrant(body, clientInfo, env) {
+		const refreshToken = body.refresh_token;
+		if (!refreshToken) return this.createErrorResponse("invalid_request", "Refresh token is required");
+		const tokenParts = refreshToken.split(":");
+		if (tokenParts.length !== 3) return this.createErrorResponse("invalid_grant", "Invalid token format");
+		const [userId, grantId, _] = tokenParts;
+		const providedTokenHash = await generateTokenId(refreshToken);
+		const grantKey = `grant:${userId}:${grantId}`;
+		const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
+		if (!grantData) return this.createErrorResponse("invalid_grant", "Grant not found");
+		const isCurrentToken = grantData.refreshTokenId === providedTokenHash;
+		const isPreviousToken = grantData.previousRefreshTokenId === providedTokenHash;
+		if (!isCurrentToken && !isPreviousToken) return this.createErrorResponse("invalid_grant", "Invalid refresh token");
+		if (grantData.clientId !== clientInfo.clientId) return this.createErrorResponse("invalid_grant", "Client ID mismatch");
+		if (grantData.expiresAt !== void 0) {
+			if (Math.floor(Date.now() / 1e3) >= grantData.expiresAt) return this.createErrorResponse("invalid_grant", "Refresh token has expired");
+		}
+		const newAccessToken = `${userId}:${grantId}:${generateRandomString(TOKEN_LENGTH)}`;
+		const accessTokenId = await generateTokenId(newAccessToken);
+		let accessTokenTTL = this.options.accessTokenTTL;
+		let wrappedKeyToUse;
+		if (isCurrentToken) wrappedKeyToUse = grantData.refreshTokenWrappedKey;
+		else wrappedKeyToUse = grantData.previousRefreshTokenWrappedKey;
+		const encryptionKey = await unwrapKeyWithToken(refreshToken, wrappedKeyToUse);
+		let grantEncryptionKey = encryptionKey;
+		let accessTokenEncryptionKey = encryptionKey;
+		let encryptedAccessTokenProps = grantData.encryptedProps;
+		let tokenScopes = this.downscope(body.scope, grantData.scope);
+		let grantPropsChanged = false;
+		if (this.options.tokenExchangeCallback) {
+			const decryptedProps = await decryptProps(encryptionKey, grantData.encryptedProps);
+			let grantProps = decryptedProps;
+			let accessTokenProps = decryptedProps;
+			const callbackOptions = {
+				grantType: GrantType.REFRESH_TOKEN,
+				clientId: clientInfo.clientId,
+				userId,
+				scope: grantData.scope,
+				requestedScope: tokenScopes,
+				props: decryptedProps
+			};
+			const callbackResult = await Promise.resolve(this.options.tokenExchangeCallback(callbackOptions));
+			if (callbackResult) {
+				if (callbackResult.newProps) {
+					grantProps = callbackResult.newProps;
+					grantPropsChanged = true;
+					if (!callbackResult.accessTokenProps) accessTokenProps = callbackResult.newProps;
+				}
+				if (callbackResult.accessTokenProps) accessTokenProps = callbackResult.accessTokenProps;
+				if (callbackResult.accessTokenTTL !== void 0) accessTokenTTL = callbackResult.accessTokenTTL;
+				if ("refreshTokenTTL" in callbackResult) return this.createErrorResponse("invalid_request", "refreshTokenTTL cannot be changed during refresh token exchange");
+				if (callbackResult.accessTokenScope) tokenScopes = this.downscope(callbackResult.accessTokenScope, grantData.scope);
+			}
+			if (grantPropsChanged) {
+				const grantResult = await encryptProps(grantProps);
+				grantData.encryptedProps = grantResult.encryptedData;
+				if (grantResult.key !== encryptionKey) {
+					grantEncryptionKey = grantResult.key;
+					wrappedKeyToUse = await wrapKeyWithToken(refreshToken, grantEncryptionKey);
+				} else grantEncryptionKey = grantResult.key;
+			}
+			if (accessTokenProps !== grantProps) {
+				const tokenResult = await encryptProps(accessTokenProps);
+				encryptedAccessTokenProps = tokenResult.encryptedData;
+				accessTokenEncryptionKey = tokenResult.key;
+			} else {
+				encryptedAccessTokenProps = grantData.encryptedProps;
+				accessTokenEncryptionKey = grantEncryptionKey;
+			}
+		}
+		const now = Math.floor(Date.now() / 1e3);
+		if (grantData.expiresAt !== void 0) {
+			const remainingRefreshTokenLifetime = grantData.expiresAt - now;
+			if (remainingRefreshTokenLifetime > 0) accessTokenTTL = Math.min(accessTokenTTL, remainingRefreshTokenLifetime);
+		}
+		const accessTokenExpiresAt = now + accessTokenTTL;
+		const accessTokenWrappedKey = await wrapKeyWithToken(newAccessToken, accessTokenEncryptionKey);
+		const newRefreshToken = `${userId}:${grantId}:${generateRandomString(TOKEN_LENGTH)}`;
+		const newRefreshTokenId = await generateTokenId(newRefreshToken);
+		const newRefreshTokenWrappedKey = await wrapKeyWithToken(newRefreshToken, grantEncryptionKey);
+		grantData.previousRefreshTokenId = providedTokenHash;
+		grantData.previousRefreshTokenWrappedKey = wrappedKeyToUse;
+		grantData.refreshTokenId = newRefreshTokenId;
+		grantData.refreshTokenWrappedKey = newRefreshTokenWrappedKey;
+		await this.saveGrantWithTTL(env, grantKey, grantData, now);
+		if (body.resource && grantData.resource) {
+			const requestedResources = Array.isArray(body.resource) ? body.resource : [body.resource];
+			const grantedResources = Array.isArray(grantData.resource) ? grantData.resource : [grantData.resource];
+			for (const requested of requestedResources) if (!grantedResources.includes(requested)) return this.createErrorResponse("invalid_target", "Requested resource was not included in the authorization request");
+		}
+		const audience = parseResourceParameter(body.resource || grantData.resource);
+		if ((body.resource || grantData.resource) && !audience) return this.createErrorResponse("invalid_target", "The resource parameter must be a valid absolute URI without a fragment");
+		const accessTokenData = {
+			id: accessTokenId,
+			grantId,
+			userId,
+			createdAt: now,
+			expiresAt: accessTokenExpiresAt,
+			audience,
+			scope: tokenScopes,
+			wrappedEncryptionKey: accessTokenWrappedKey,
+			grant: {
+				clientId: grantData.clientId,
+				scope: grantData.scope,
+				encryptedProps: encryptedAccessTokenProps
+			}
+		};
+		await env.OAUTH_KV.put(`token:${userId}:${grantId}:${accessTokenId}`, JSON.stringify(accessTokenData), { expirationTtl: accessTokenTTL });
+		const tokenResponse = {
+			access_token: newAccessToken,
+			token_type: "bearer",
+			expires_in: accessTokenTTL,
+			refresh_token: newRefreshToken,
+			scope: tokenScopes.join(" ")
+		};
+		if (audience) tokenResponse.resource = audience;
+		return new Response(JSON.stringify(tokenResponse), { headers: { "Content-Type": "application/json" } });
+	}
+	/**
+	* Core token exchange logic (RFC 8693)
+	* Performs the actual token exchange operation
+	* This method is not private because `OAuthHelpers` needs to call it. Note that since
+	* `OAuthProviderImpl` is not exposed outside this module, this is still effectively
+	* module-private.
+	* @param subjectToken - The subject token to exchange
+	* @param requestedScopes - Optional narrowed scopes (must be subset of original)
+	* @param requestedResource - Optional resource/audience (must be subset of original if original had resource)
+	* @param expiresIn - Optional TTL override in seconds
+	* @param clientInfo - The client making the exchange request
+	* @param env - Cloudflare Worker environment variables
+	* @returns Promise resolving to token response
+	* @throws OAuthError with OAuth error code and description
+	*/
+	async exchangeToken(subjectToken, requestedScopes, requestedResource, expiresIn, clientInfo, env) {
+		const tokenSummary = await this.unwrapToken(subjectToken, env);
+		if (!tokenSummary) throw new OAuthError("invalid_grant", "Invalid or expired subject token");
+		const grantKey = `grant:${tokenSummary.userId}:${tokenSummary.grantId}`;
+		const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
+		if (!grantData) throw new OAuthError("invalid_grant", "Grant not found");
+		let tokenScopes = this.downscope(requestedScopes, grantData.scope);
+		let newAudience = tokenSummary.audience;
+		if (requestedResource) {
+			if (grantData.resource) {
+				const requestedResources = Array.isArray(requestedResource) ? requestedResource : [requestedResource];
+				const grantedResources = Array.isArray(grantData.resource) ? grantData.resource : [grantData.resource];
+				for (const requested of requestedResources) if (!grantedResources.includes(requested)) throw new OAuthError("invalid_target", "Requested resource was not included in the authorization request");
+			}
+			const parsedResource = parseResourceParameter(requestedResource);
+			if (!parsedResource) throw new OAuthError("invalid_target", "The resource parameter must be a valid absolute URI without a fragment");
+			newAudience = parsedResource;
+		}
+		const now = Math.floor(Date.now() / 1e3);
+		const subjectTokenRemainingLifetime = tokenSummary.expiresAt - now;
+		let accessTokenTTL = this.options.accessTokenTTL ?? DEFAULT_ACCESS_TOKEN_TTL;
+		if (expiresIn !== void 0) {
+			if (expiresIn <= 0) throw new OAuthError("invalid_request", "Invalid expires_in parameter");
+			accessTokenTTL = Math.min(expiresIn, subjectTokenRemainingLifetime);
+		} else accessTokenTTL = Math.min(accessTokenTTL, subjectTokenRemainingLifetime);
+		const subjectTokenData = await env.OAUTH_KV.get(`token:${tokenSummary.userId}:${tokenSummary.grantId}:${tokenSummary.id}`, { type: "json" });
+		if (!subjectTokenData) throw new OAuthError("invalid_grant", "Subject token data not found");
+		const encryptionKey = await unwrapKeyWithToken(subjectToken, subjectTokenData.wrappedEncryptionKey);
+		let accessTokenEncryptionKey = encryptionKey;
+		let encryptedAccessTokenProps = subjectTokenData.grant.encryptedProps;
+		if (this.options.tokenExchangeCallback) {
+			const decryptedProps = await decryptProps(encryptionKey, subjectTokenData.grant.encryptedProps);
+			const callbackOptions = {
+				grantType: GrantType.TOKEN_EXCHANGE,
+				clientId: clientInfo.clientId,
+				userId: tokenSummary.userId,
+				scope: tokenSummary.grant.scope,
+				requestedScope: tokenScopes,
+				props: decryptedProps
+			};
+			const callbackResult = await Promise.resolve(this.options.tokenExchangeCallback(callbackOptions));
+			if (callbackResult) {
+				let accessTokenProps = decryptedProps;
+				if (callbackResult.newProps) {
+					if (!callbackResult.accessTokenProps) accessTokenProps = callbackResult.newProps;
+				}
+				if (callbackResult.accessTokenProps) accessTokenProps = callbackResult.accessTokenProps;
+				if (callbackResult.accessTokenTTL !== void 0) accessTokenTTL = Math.min(callbackResult.accessTokenTTL, subjectTokenRemainingLifetime);
+				if (accessTokenProps !== decryptedProps) {
+					const tokenResult = await encryptProps(accessTokenProps);
+					encryptedAccessTokenProps = tokenResult.encryptedData;
+					accessTokenEncryptionKey = tokenResult.key;
+				}
+				if (callbackResult.accessTokenScope) tokenScopes = this.downscope(callbackResult.accessTokenScope, grantData.scope);
+			}
+		}
+		const tokenResponse = {
+			access_token: await this.createAccessToken({
+				userId: tokenSummary.userId,
+				grantId: tokenSummary.grantId,
+				clientId: tokenSummary.grant.clientId,
+				scope: tokenScopes,
+				encryptedProps: encryptedAccessTokenProps,
+				encryptionKey: accessTokenEncryptionKey,
+				expiresIn: accessTokenTTL,
+				audience: newAudience,
+				env
+			}),
+			issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
+			token_type: "bearer",
+			expires_in: accessTokenTTL,
+			scope: tokenScopes.join(" ")
+		};
+		if (newAudience) tokenResponse.resource = newAudience;
+		return tokenResponse;
+	}
+	/**
+	* Handles OAuth 2.0 token exchange requests (RFC 8693)
+	* Exchanges an existing access token for a new one with modified characteristics
+	* @param body - The parsed request body
+	* @param clientInfo - The authenticated client information
+	* @param env - Cloudflare Worker environment variables
+	* @returns Response with new token data or error
+	*/
+	async handleTokenExchangeGrant(body, clientInfo, env) {
+		const subjectToken = body.subject_token;
+		const subjectTokenType = body.subject_token_type;
+		const requestedTokenType = body.requested_token_type || "urn:ietf:params:oauth:token-type:access_token";
+		const requestedScope = body.scope;
+		const requestedResource = body.resource;
+		if (!subjectToken) return this.createErrorResponse("invalid_request", "subject_token is required");
+		if (!subjectTokenType) return this.createErrorResponse("invalid_request", "subject_token_type is required");
+		if (subjectTokenType !== "urn:ietf:params:oauth:token-type:access_token") return this.createErrorResponse("invalid_request", "Only access_token subject_token_type is supported");
+		if (requestedTokenType !== "urn:ietf:params:oauth:token-type:access_token") return this.createErrorResponse("invalid_request", "Only access_token requested_token_type is supported");
+		let requestedScopes;
+		if (requestedScope) if (typeof requestedScope === "string") requestedScopes = requestedScope.split(" ").filter(Boolean);
+		else if (Array.isArray(requestedScope)) requestedScopes = requestedScope;
+		else return this.createErrorResponse("invalid_request", "Invalid scope parameter format");
+		let expiresIn;
+		if (body.expires_in !== void 0) {
+			const requestedTTL = parseInt(body.expires_in, 10);
+			if (isNaN(requestedTTL) || requestedTTL <= 0) return this.createErrorResponse("invalid_request", "Invalid expires_in parameter");
+			expiresIn = requestedTTL;
+		}
+		try {
+			const tokenResponse = await this.exchangeToken(subjectToken, requestedScopes, requestedResource, expiresIn, clientInfo, env);
+			return new Response(JSON.stringify(tokenResponse), { headers: { "Content-Type": "application/json" } });
+		} catch (error) {
+			if (error instanceof OAuthError) return this.createErrorResponse(error.code, error.message);
+			throw error;
+		}
+	}
+	/**
+	* Handles OAuth 2.0 token revocation requests (RFC 7009)
+	* @param body - The parsed request body containing revocation parameters
+	* @param env - Cloudflare Worker environment variables
+	* @returns Response confirming revocation or error
+	*/
+	async handleRevocationRequest(body, env) {
+		return this.revokeToken(body, env);
+	}
+	/**
+	* - Access tokens: Revokes only the specific token
+	* - Refresh tokens: Revokes the entire grant (access + refresh tokens)
+	* @param body - The parsed request body containing token parameter
+	* @param env - Cloudflare Worker environment variables
+	* @returns Response confirming revocation or error
+	*/
+	async revokeToken(body, env) {
+		const token = body.token;
+		if (!token) return this.createErrorResponse("invalid_request", "Token parameter is required");
+		const tokenParts = token.split(":");
+		if (tokenParts.length !== 3) return new Response("", { status: 200 });
+		const [userId, grantId, _] = tokenParts;
+		const tokenId = await generateTokenId(token);
+		const isAccessToken = await this.validateAccessToken(tokenId, userId, grantId, env);
+		const isRefreshToken = await this.validateRefreshToken(tokenId, userId, grantId, env);
+		if (isAccessToken) await this.revokeSpecificAccessToken(tokenId, userId, grantId, env);
+		else if (isRefreshToken) await this.createOAuthHelpers(env).revokeGrant(grantId, userId);
+		return new Response("", { status: 200 });
+	}
+	/**
+	* Revokes a specific access token without affecting the refresh token
+	* @param tokenId - The hashed token ID
+	* @param userId - The user ID extracted from the token
+	* @param grantId - The grant ID extracted from the token
+	* @param env - Cloudflare Worker environment variables
+	*/
+	async revokeSpecificAccessToken(tokenId, userId, grantId, env) {
+		const tokenKey = `token:${userId}:${grantId}:${tokenId}`;
+		await env.OAUTH_KV.delete(tokenKey);
+	}
+	/**
+	* Validates if a token is a valid access token
+	* @param tokenId - The hashed token ID
+	* @param userId - The user ID extracted from the token
+	* @param grantId - The grant ID extracted from the token
+	* @param env - Cloudflare Worker environment variables
+	* @returns Promise<boolean> indicating if the token is valid
+	*/
+	async validateAccessToken(tokenId, userId, grantId, env) {
+		const tokenKey = `token:${userId}:${grantId}:${tokenId}`;
+		const tokenData = await env.OAUTH_KV.get(tokenKey, { type: "json" });
+		if (!tokenData) return false;
+		const now = Math.floor(Date.now() / 1e3);
+		return tokenData.expiresAt >= now;
+	}
+	/**
+	* Validates if a token is a valid refresh token
+	* @param tokenId - The hashed token ID
+	* @param userId - The user ID extracted from the token
+	* @param grantId - The grant ID extracted from the token
+	* @param env - Cloudflare Worker environment variables
+	* @returns Promise<boolean> indicating if the token is valid
+	*/
+	async validateRefreshToken(tokenId, userId, grantId, env) {
+		const grantKey = `grant:${userId}:${grantId}`;
+		const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
+		if (!grantData) return false;
+		return grantData.refreshTokenId === tokenId || grantData.previousRefreshTokenId === tokenId;
+	}
+	/**
+	* Handles the dynamic client registration endpoint (RFC 7591)
+	* @param request - The HTTP request
+	* @param env - Cloudflare Worker environment variables
+	* @returns Response with client registration data or error
+	*/
+	async handleClientRegistration(request, env) {
+		if (!this.options.clientRegistrationEndpoint) return this.createErrorResponse("not_implemented", "Client registration is not enabled", 501);
+		if (request.method !== "POST") return this.createErrorResponse("invalid_request", "Method not allowed", 405);
+		if (parseInt(request.headers.get("Content-Length") || "0", 10) > 1048576) return this.createErrorResponse("invalid_request", "Request payload too large, must be under 1 MiB", 413);
+		let clientMetadata;
+		try {
+			const text = await request.text();
+			if (text.length > 1048576) return this.createErrorResponse("invalid_request", "Request payload too large, must be under 1 MiB", 413);
+			clientMetadata = JSON.parse(text);
+		} catch (error) {
+			return this.createErrorResponse("invalid_request", "Invalid JSON payload", 400);
+		}
+		const authMethod = OAuthProviderImpl.validateStringField(clientMetadata.token_endpoint_auth_method) || "client_secret_basic";
+		const isPublicClient = authMethod === "none";
+		if (isPublicClient && this.options.disallowPublicClientRegistration) return this.createErrorResponse("invalid_client_metadata", "Public client registration is not allowed");
+		const clientId = generateRandomString(16);
+		let clientSecret;
+		let hashedSecret;
+		if (!isPublicClient) {
+			clientSecret = generateRandomString(32);
+			hashedSecret = await hashSecret(clientSecret);
+		}
+		let clientInfo;
+		try {
+			const redirectUris = OAuthProviderImpl.validateStringArray(clientMetadata.redirect_uris);
+			if (!redirectUris || redirectUris.length === 0) throw new Error("At least one redirect URI is required");
+			for (const uri of redirectUris) validateRedirectUriScheme(uri);
+			clientInfo = {
+				clientId,
+				redirectUris,
+				clientName: OAuthProviderImpl.validateStringField(clientMetadata.client_name),
+				logoUri: OAuthProviderImpl.validateStringField(clientMetadata.logo_uri),
+				clientUri: OAuthProviderImpl.validateStringField(clientMetadata.client_uri),
+				policyUri: OAuthProviderImpl.validateStringField(clientMetadata.policy_uri),
+				tosUri: OAuthProviderImpl.validateStringField(clientMetadata.tos_uri),
+				jwksUri: OAuthProviderImpl.validateStringField(clientMetadata.jwks_uri),
+				contacts: OAuthProviderImpl.validateStringArray(clientMetadata.contacts),
+				grantTypes: OAuthProviderImpl.validateStringArray(clientMetadata.grant_types) || [
+					GrantType.AUTHORIZATION_CODE,
+					GrantType.REFRESH_TOKEN,
+					...this.options.allowTokenExchangeGrant ? [GrantType.TOKEN_EXCHANGE] : []
+				],
+				responseTypes: OAuthProviderImpl.validateStringArray(clientMetadata.response_types) || ["code"],
+				registrationDate: Math.floor(Date.now() / 1e3),
+				tokenEndpointAuthMethod: authMethod
+			};
+			if (!isPublicClient && hashedSecret) clientInfo.clientSecret = hashedSecret;
+		} catch (error) {
+			return this.createErrorResponse("invalid_client_metadata", error instanceof Error ? error.message : "Invalid client metadata");
+		}
+		await env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(clientInfo));
+		const response = {
+			client_id: clientInfo.clientId,
+			redirect_uris: clientInfo.redirectUris,
+			client_name: clientInfo.clientName,
+			logo_uri: clientInfo.logoUri,
+			client_uri: clientInfo.clientUri,
+			policy_uri: clientInfo.policyUri,
+			tos_uri: clientInfo.tosUri,
+			jwks_uri: clientInfo.jwksUri,
+			contacts: clientInfo.contacts,
+			grant_types: clientInfo.grantTypes,
+			response_types: clientInfo.responseTypes,
+			token_endpoint_auth_method: clientInfo.tokenEndpointAuthMethod,
+			registration_client_uri: `${this.options.clientRegistrationEndpoint}/${clientId}`,
+			client_id_issued_at: clientInfo.registrationDate
+		};
+		if (clientSecret) response.client_secret = clientSecret;
+		return new Response(JSON.stringify(response), {
+			status: 201,
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	/**
+	* Handles API requests by validating the access token and calling the API handler
+	* @param request - The HTTP request
+	* @param env - Cloudflare Worker environment variables
+	* @param ctx - Cloudflare Worker execution context
+	* @returns Response from the API handler or error
+	*/
+	async handleApiRequest(request, env, ctx) {
+		const authHeader = request.headers.get("Authorization");
+		if (!authHeader || !authHeader.startsWith("Bearer ")) return this.createErrorResponse("invalid_token", "Missing or invalid access token", 401, { "WWW-Authenticate": "Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"Missing or invalid access token\"" });
+		const accessToken = authHeader.substring(7);
+		const parts = accessToken.split(":");
+		const isPossiblyInternalFormat = parts.length === 3;
+		let tokenData = null;
+		let userId = "";
+		let grantId = "";
+		if (isPossiblyInternalFormat) {
+			[userId, grantId] = parts;
+			const id = await generateTokenId(accessToken);
+			tokenData = await env.OAUTH_KV.get(`token:${userId}:${grantId}:${id}`, { type: "json" });
+		}
+		if (!tokenData && !this.options.resolveExternalToken) return this.createErrorResponse("invalid_token", "Invalid access token", 401, { "WWW-Authenticate": "Bearer realm=\"OAuth\", error=\"invalid_token\"" });
+		if (tokenData) {
+			const now = Math.floor(Date.now() / 1e3);
+			if (tokenData.expiresAt < now) return this.createErrorResponse("invalid_token", "Access token expired", 401, { "WWW-Authenticate": "Bearer realm=\"OAuth\", error=\"invalid_token\"" });
+			if (tokenData.audience) {
+				const requestUrl = new URL(request.url);
+				const resourceServer = `${requestUrl.protocol}//${requestUrl.host}${requestUrl.pathname}`;
+				if (!(Array.isArray(tokenData.audience) ? tokenData.audience : [tokenData.audience]).some((aud) => audienceMatches(resourceServer, aud))) return this.createErrorResponse("invalid_token", "Token audience does not match resource server", 401, { "WWW-Authenticate": "Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"Invalid audience\"" });
+			}
+			ctx.props = await decryptProps(await unwrapKeyWithToken(accessToken, tokenData.wrappedEncryptionKey), tokenData.grant.encryptedProps);
+		} else if (this.options.resolveExternalToken) {
+			const ext = await this.options.resolveExternalToken({
+				token: accessToken,
+				request,
+				env
+			});
+			if (!ext) return this.createErrorResponse("invalid_token", "Invalid access token", 401, { "WWW-Authenticate": "Bearer realm=\"OAuth\", error=\"invalid_token\"" });
+			if (ext.audience) {
+				const requestUrl = new URL(request.url);
+				const resourceServer = `${requestUrl.protocol}//${requestUrl.host}${requestUrl.pathname}`;
+				if (!(Array.isArray(ext.audience) ? ext.audience : [ext.audience]).some((aud) => audienceMatches(resourceServer, aud))) return this.createErrorResponse("invalid_token", "Token audience does not match resource server", 401, { "WWW-Authenticate": "Bearer realm=\"OAuth\", error=\"invalid_token\", error_description=\"Invalid audience\"" });
+			}
+			ctx.props = ext.props;
+		}
+		if (!env.OAUTH_PROVIDER) env.OAUTH_PROVIDER = this.createOAuthHelpers(env);
+		const url = new URL(request.url);
+		const apiHandler = this.findApiHandlerForUrl(url);
+		if (!apiHandler) return this.createErrorResponse("invalid_request", "No handler found for API route", 404);
+		if (apiHandler.type === HandlerType.EXPORTED_HANDLER) return apiHandler.handler.fetch(request, env, ctx);
+		else return new apiHandler.handler(ctx, env).fetch(request);
+	}
+	/**
+	* Creates the helper methods object for OAuth operations
+	* This is passed to the handler functions to allow them to interact with the OAuth system
+	* @param env - Cloudflare Worker environment variables
+	* @returns An instance of OAuthHelpers
+	*/
+	createOAuthHelpers(env) {
+		return new OAuthHelpersImpl(env, this);
+	}
+	/**
+	* Saves a grant to KV with appropriate TTL based on expiration
+	* @param env - The environment bindings
+	* @param grantKey - The KV key for the grant
+	* @param grantData - The grant data to save
+	* @param now - Current timestamp in seconds
+	*/
+	async saveGrantWithTTL(env, grantKey, grantData, now) {
+		const kvOptions = grantData.expiresAt !== void 0 ? { expiration: grantData.expiresAt } : {};
+		await env.OAUTH_KV.put(grantKey, JSON.stringify(grantData), kvOptions);
+	}
+	/**
+	* Fetches client information from KV storage or via CIMD (Client ID Metadata Document)
+	* This method is not private because `OAuthHelpers` needs to call it. Note that since
+	* `OAuthProviderImpl` is not exposed outside this module, this is still effectively
+	* module-private.
+	*
+	* Supports CIMD: If clientId is an HTTPS URL with a non-root path, the metadata
+	* document will be fetched from that URL instead of looking up in KV storage.
+	*
+	* @param env - Cloudflare Worker environment variables
+	* @param clientId - The client ID to look up (can be a regular ID or an HTTPS URL for CIMD)
+	* @returns The client information, or null if not found
+	*/
+	async getClient(env, clientId) {
+		if (this.isClientMetadataUrl(clientId)) {
+			if (!this.hasGlobalFetchStrictlyPublic()) throw new Error(`Client ID "${clientId}" appears to be a CIMD URL, but the 'global_fetch_strictly_public' compatibility flag is not enabled. Add this flag to your wrangler.jsonc to enable CIMD support.`);
+			return this.fetchClientMetadataDocument(clientId);
+		}
+		const clientKey = `client:${clientId}`;
+		return env.OAUTH_KV.get(clientKey, { type: "json" });
+	}
+	/**
+	* Creates and stores an access token
+	* @param params - Options for creating the access token
+	* @returns The access token string
+	*/
+	async createAccessToken(params) {
+		const { userId, grantId, clientId, scope, encryptedProps, encryptionKey, expiresIn, audience, env } = params;
+		const accessToken = `${userId}:${grantId}:${generateRandomString(TOKEN_LENGTH)}`;
+		const now = Math.floor(Date.now() / 1e3);
+		const accessTokenId = await generateTokenId(accessToken);
+		const accessTokenData = {
+			id: accessTokenId,
+			grantId,
+			userId,
+			createdAt: now,
+			expiresAt: now + expiresIn,
+			audience,
+			scope,
+			wrappedEncryptionKey: await wrapKeyWithToken(accessToken, encryptionKey),
+			grant: {
+				clientId,
+				scope,
+				encryptedProps
+			}
+		};
+		await env.OAUTH_KV.put(`token:${userId}:${grantId}:${accessTokenId}`, JSON.stringify(accessTokenData), { expirationTtl: expiresIn });
+		return accessToken;
+	}
+	/**
+	* Downscopes requested scopes to only include those that are in the grant
+	* Filters out any requested scopes that are not in the granted scopes
+	* @param requestedScope - The scope parameter from the request (string or array)
+	* @param grantedScopes - The scopes that were granted in the authorization
+	* @returns The filtered scopes that are a subset of the granted scopes
+	*/
+	downscope(requestedScope, grantedScopes) {
+		if (!requestedScope) return grantedScopes;
+		return (typeof requestedScope === "string" ? requestedScope.split(" ").filter(Boolean) : requestedScope).filter((scope) => grantedScopes.includes(scope));
+	}
+	/**
+	* Checks if the global_fetch_strictly_public compatibility flag is enabled.
+	* This flag is required for CIMD to prevent SSRF attacks.
+	* See: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#global-fetch-strictly-public
+	*/
+	hasGlobalFetchStrictlyPublic() {
+		return !!(typeof Cloudflare !== "undefined" && Cloudflare.compatibilityFlags ? Cloudflare.compatibilityFlags : null)?.global_fetch_strictly_public;
+	}
+	/**
+	* Checks if a client_id is a CIMD URL (HTTPS with non-root path)
+	*/
+	isClientMetadataUrl(clientId) {
+		try {
+			const url = new URL(clientId);
+			return url.protocol === "https:" && url.pathname !== "/";
+		} catch {
+			return false;
+		}
+	}
+	static {
+		this.CIMD_MAX_SIZE_BYTES = 5 * 1024;
+	}
+	static {
+		this.CIMD_FETCH_TIMEOUT_MS = 1e4;
+	}
+	static {
+		this.CIMD_ALLOWED_AUTH_METHODS = ["none", "private_key_jwt"];
+	}
+	/**
+	* Validates that a field is a string or undefined
+	* @param field - The field value to validate
+	* @param fieldName - Name of the field for error messages
+	* @returns The validated string or undefined
+	* @throws Error if field is not a string or undefined
+	*/
+	static validateStringField(field, fieldName) {
+		if (field === void 0) return void 0;
+		if (typeof field !== "string") throw new Error(fieldName ? `Invalid ${fieldName}: expected string, got ${typeof field}` : "Field must be a string");
+		return field;
+	}
+	/**
+	* Validates that a field is a string array or undefined
+	* @param arr - The array to validate
+	* @param fieldName - Name of the field for error messages
+	* @returns The validated string array or undefined
+	* @throws Error if field is not a string array or undefined
+	*/
+	static validateStringArray(arr, fieldName) {
+		if (arr === void 0) return void 0;
+		if (!Array.isArray(arr)) throw new Error(fieldName ? `Invalid ${fieldName}: expected array, got ${typeof arr}` : "Field must be an array");
+		if (!arr.every((item) => typeof item === "string")) throw new Error(fieldName ? `Invalid ${fieldName}: array must contain only strings` : "All array elements must be strings");
+		return arr;
+	}
+	/**
+	* Fetches and validates a Client ID Metadata Document from the given URL
+	* Per the MCP spec, the client_id in the document must match the URL exactly
+	*
+	* Uses Cloudflare HTTP cache for caching (via cacheEverything option).
+	* Response size is limited to 5KB per IETF spec.
+	*
+	* @param metadataUrl - The HTTPS URL to fetch metadata from
+	* @returns The client information
+	* @throws Error if fetch fails or validation fails
+	*/
+	async fetchClientMetadataDocument(metadataUrl) {
+		const abortController = new AbortController();
+		const timeoutId = setTimeout(() => abortController.abort(), OAuthProviderImpl.CIMD_FETCH_TIMEOUT_MS);
+		try {
+			const response = await fetch(metadataUrl, {
+				headers: { Accept: "application/json" },
+				signal: abortController.signal,
+				cf: { cacheEverything: true }
+			});
+			clearTimeout(timeoutId);
+			if (!response.ok) throw new Error(`Failed to fetch client metadata: HTTP ${response.status}`);
+			const contentLength = response.headers.get("content-length");
+			if (contentLength && parseInt(contentLength, 10) > OAuthProviderImpl.CIMD_MAX_SIZE_BYTES) throw new Error(`Client metadata exceeds size limit: ${contentLength} bytes (max ${OAuthProviderImpl.CIMD_MAX_SIZE_BYTES})`);
+			const rawMetadata = await this.readJsonWithSizeLimit(response, OAuthProviderImpl.CIMD_MAX_SIZE_BYTES);
+			const clientId = OAuthProviderImpl.validateStringField(rawMetadata.client_id, "client_id");
+			const redirectUris = OAuthProviderImpl.validateStringArray(rawMetadata.redirect_uris, "redirect_uris");
+			const tokenEndpointAuthMethod = OAuthProviderImpl.validateStringField(rawMetadata.token_endpoint_auth_method, "token_endpoint_auth_method");
+			if (clientId !== metadataUrl) throw new Error(`client_id "${clientId}" does not match metadata URL "${metadataUrl}"`);
+			if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
+			if (tokenEndpointAuthMethod && !OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.includes(tokenEndpointAuthMethod)) throw new Error(`token_endpoint_auth_method "${tokenEndpointAuthMethod}" is not allowed for CIMD clients. Allowed methods: ${OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.join(", ")}`);
+			return {
+				clientId,
+				redirectUris,
+				clientName: OAuthProviderImpl.validateStringField(rawMetadata.client_name, "client_name"),
+				clientUri: OAuthProviderImpl.validateStringField(rawMetadata.client_uri, "client_uri"),
+				logoUri: OAuthProviderImpl.validateStringField(rawMetadata.logo_uri, "logo_uri"),
+				policyUri: OAuthProviderImpl.validateStringField(rawMetadata.policy_uri, "policy_uri"),
+				tosUri: OAuthProviderImpl.validateStringField(rawMetadata.tos_uri, "tos_uri"),
+				jwksUri: OAuthProviderImpl.validateStringField(rawMetadata.jwks_uri, "jwks_uri"),
+				contacts: OAuthProviderImpl.validateStringArray(rawMetadata.contacts, "contacts"),
+				grantTypes: OAuthProviderImpl.validateStringArray(rawMetadata.grant_types, "grant_types") || ["authorization_code"],
+				responseTypes: OAuthProviderImpl.validateStringArray(rawMetadata.response_types, "response_types") || ["code"],
+				tokenEndpointAuthMethod: tokenEndpointAuthMethod || "none"
+			};
+		} finally {
+			clearTimeout(timeoutId);
+		}
+	}
+	/**
+	* Reads JSON from a response with a size limit to prevent DoS attacks.
+	* Streams the response body and aborts if it exceeds the limit.
+	*
+	* @param response - The fetch response
+	* @param maxBytes - Maximum allowed size in bytes
+	* @returns Parsed JSON object
+	* @throws Error if response body is null, size exceeded, or JSON parse failed
+	*/
+	async readJsonWithSizeLimit(response, maxBytes) {
+		const reader = response.body?.getReader();
+		if (!reader) throw new Error("Response body is null");
+		const chunks = [];
+		let totalSize = 0;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (value) {
+				totalSize += value.length;
+				if (totalSize > maxBytes) {
+					await reader.cancel();
+					throw new Error(`Response exceeded size limit of ${maxBytes} bytes`);
+				}
+				chunks.push(value);
+			}
+		}
+		const allChunks = new Uint8Array(totalSize);
+		let position = 0;
+		for (const chunk of chunks) {
+			allChunks.set(chunk, position);
+			position += chunk.length;
+		}
+		const text = new TextDecoder().decode(allChunks);
+		return JSON.parse(text);
+	}
+	/**
+	* Helper function to create OAuth error responses
+	* @param code - OAuth error code (e.g., 'invalid_request', 'invalid_token')
+	* @param description - Human-readable error description
+	* @param status - HTTP status code (default: 400)
+	* @param headers - Additional headers to include
+	* @returns A Response object with the error
+	*/
+	createErrorResponse(code, description, status = 400, headers = {}) {
+		const customErrorResponse = this.options.onError?.({
+			code,
+			description,
+			status,
+			headers
+		});
+		if (customErrorResponse) return customErrorResponse;
+		const body = JSON.stringify({
+			error: code,
+			error_description: description
+		});
+		return new Response(body, {
+			status,
+			headers: {
+				"Content-Type": "application/json",
+				...headers
+			}
+		});
+	}
 };
-var DEFAULT_ACCESS_TOKEN_TTL = 60 * 60;
-var TOKEN_LENGTH = 32;
+/**
+* Error class for OAuth operations
+* Carries OAuth error code and description for proper error responses
+*/
+var OAuthError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "OAuthError";
+	}
+};
+/**
+* Default expiration time for access tokens (1 hour in seconds)
+*/
+const DEFAULT_ACCESS_TOKEN_TTL = 3600;
+/**
+* Length of generated token strings
+*/
+const TOKEN_LENGTH = 32;
+/**
+* Validates a resource URI per RFC 8707 Section 2
+* @param uri - The URI string to validate
+* @returns true if valid, false otherwise
+*/
 function validateResourceUri(uri) {
-  if (!uri || typeof uri !== "string") {
-    return false;
-  }
-  try {
-    const parsed = new URL(uri);
-    if (!parsed.protocol) {
-      return false;
-    }
-    if (parsed.hash) {
-      return false;
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      return false;
-    }
-    return true;
-  } catch {
-    return false;
-  }
+	if (!uri || typeof uri !== "string") return false;
+	try {
+		const parsed = new URL(uri);
+		if (!parsed.protocol) return false;
+		if (parsed.hash) return false;
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+		return true;
+	} catch {
+		return false;
+	}
 }
+/**
+* Checks if a resource server matches an audience claim.
+* Uses origin comparison (case-insensitive hostname via URL normalization)
+* and path-prefix matching on path boundaries for RFC 8707 resource indicators.
+* @param resourceServerUrl - The resource server URL (from request)
+* @param audienceValue - The audience value from token
+* @returns true if they match, false otherwise
+*/
 function audienceMatches(resourceServerUrl, audienceValue) {
-  return resourceServerUrl === audienceValue;
+	try {
+		const resource = new URL(resourceServerUrl);
+		const audience = new URL(audienceValue);
+		if (resource.origin !== audience.origin) return false;
+		if (audience.pathname === "/" || audience.pathname === "") return true;
+		return resource.pathname === audience.pathname || resource.pathname.startsWith(audience.pathname + "/");
+	} catch {
+		return false;
+	}
 }
+/**
+* Parses and validates the resource parameter from a token request (RFC 8707)
+* Handles single string or array of strings (from multiple form parameters)
+* @param value - The resource parameter value from the request body
+* @returns The validated value as string, string array, or undefined if validation fails
+*/
 function parseResourceParameter(value) {
-  if (!value) {
-    return void 0;
-  }
-  const uris = Array.isArray(value) ? value : [value];
-  for (const uri of uris) {
-    if (typeof uri !== "string" || !validateResourceUri(uri)) {
-      return void 0;
-    }
-  }
-  return value;
+	if (!value) return;
+	const uris = Array.isArray(value) ? value : [value];
+	for (const uri of uris) if (typeof uri !== "string" || !validateResourceUri(uri)) return;
+	return value;
 }
+/**
+* Hashes a secret value using SHA-256
+* @param secret - The secret value to hash
+* @returns A hex string representation of the hash
+*/
 async function hashSecret(secret) {
-  return generateTokenId(secret);
+	return generateTokenId(secret);
 }
+/**
+* Generates a cryptographically secure random string
+* @param length - The length of the string to generate
+* @returns A random string of the specified length
+*/
 function generateRandomString(length) {
-  const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  let result = "";
-  const values = new Uint8Array(length);
-  crypto.getRandomValues(values);
-  for (let i = 0; i < length; i++) {
-    result += characters.charAt(values[i] % characters.length);
-  }
-  return result;
+	const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+	let result = "";
+	const values = new Uint8Array(length);
+	crypto.getRandomValues(values);
+	for (let i = 0; i < length; i++) result += characters.charAt(values[i] % 64);
+	return result;
 }
+/**
+* Generates a token ID by hashing the token value using SHA-256
+* @param token - The token to hash
+* @returns A hex string representation of the hash
+*/
 async function generateTokenId(token) {
-  const encoder = new TextEncoder();
-  const data = encoder.encode(token);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-  const hashArray = Array.from(new Uint8Array(hashBuffer));
-  const hashHex = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
-  return hashHex;
+	const data = new TextEncoder().encode(token);
+	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+/**
+* Validates that a redirect URI does not use a dangerous pseudo-scheme.
+* Normalizes the URI by trimming whitespace and checking the scheme in a
+* case-insensitive manner to prevent bypass attacks.
+* Per RFC 3986, control characters are explicitly disallowed in URIs and
+* will cause rejection rather than silent removal.
+* @param redirectUri - The redirect URI to validate
+* @throws Error if the URI uses a blacklisted scheme or contains control characters
+*/
 function validateRedirectUriScheme(redirectUri) {
-  const dangerousSchemes = ["javascript:", "data:", "vbscript:", "file:", "mailto:", "blob:"];
-  const normalized = redirectUri.trim();
-  for (let i = 0; i < normalized.length; i++) {
-    const code = normalized.charCodeAt(i);
-    if (code >= 0 && code <= 31 || code >= 127 && code <= 159) {
-      throw new Error("Invalid redirect URI");
-    }
-  }
-  const colonIndex = normalized.indexOf(":");
-  if (colonIndex === -1) {
-    throw new Error("Invalid redirect URI");
-  }
-  const scheme = normalized.substring(0, colonIndex + 1).toLowerCase();
-  for (const dangerousScheme of dangerousSchemes) {
-    if (scheme === dangerousScheme) {
-      throw new Error("Invalid redirect URI");
-    }
-  }
+	const dangerousSchemes = [
+		"javascript:",
+		"data:",
+		"vbscript:",
+		"file:",
+		"mailto:",
+		"blob:"
+	];
+	const normalized = redirectUri.trim();
+	for (let i = 0; i < normalized.length; i++) {
+		const code = normalized.charCodeAt(i);
+		if (code >= 0 && code <= 31 || code >= 127 && code <= 159) throw new Error("Invalid redirect URI");
+	}
+	const colonIndex = normalized.indexOf(":");
+	if (colonIndex === -1) throw new Error("Invalid redirect URI");
+	const scheme = normalized.substring(0, colonIndex + 1).toLowerCase();
+	for (const dangerousScheme of dangerousSchemes) if (scheme === dangerousScheme) throw new Error("Invalid redirect URI");
 }
+/**
+* Encodes a string as base64url (URL-safe base64)
+* @param str - The string to encode
+* @returns The base64url encoded string
+*/
 function base64UrlEncode(str) {
-  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+	return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
+/**
+* Encodes an ArrayBuffer as base64 string
+* @param buffer - The ArrayBuffer to encode
+* @returns The base64 encoded string
+*/
 function arrayBufferToBase64(buffer) {
-  return btoa(String.fromCharCode(...new Uint8Array(buffer)));
+	return btoa(String.fromCharCode(...new Uint8Array(buffer)));
 }
+/**
+* Decodes a base64 string to an ArrayBuffer
+* @param base64 - The base64 string to decode
+* @returns The decoded ArrayBuffer
+*/
 function base64ToArrayBuffer(base64) {
-  const binaryString = atob(base64);
-  const bytes = new Uint8Array(binaryString.length);
-  for (let i = 0; i < binaryString.length; i++) {
-    bytes[i] = binaryString.charCodeAt(i);
-  }
-  return bytes.buffer;
+	const binaryString = atob(base64);
+	const bytes = new Uint8Array(binaryString.length);
+	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
+	return bytes.buffer;
 }
+/**
+* Encrypts props data with a newly generated key
+* @param data - The data to encrypt
+* @returns An object containing the encrypted data and the generated key
+*/
 async function encryptProps(data) {
-  const key = await crypto.subtle.generateKey(
-    {
-      name: "AES-GCM",
-      length: 256
-    },
-    true,
-    // extractable
-    ["encrypt", "decrypt"]
-  );
-  const iv = new Uint8Array(12);
-  const jsonData = JSON.stringify(data);
-  const encoder = new TextEncoder();
-  const encodedData = encoder.encode(jsonData);
-  const encryptedBuffer = await crypto.subtle.encrypt(
-    {
-      name: "AES-GCM",
-      iv
-    },
-    key,
-    encodedData
-  );
-  return {
-    encryptedData: arrayBufferToBase64(encryptedBuffer),
-    key
-  };
+	const key = await crypto.subtle.generateKey({
+		name: "AES-GCM",
+		length: 256
+	}, true, ["encrypt", "decrypt"]);
+	const iv = new Uint8Array(12);
+	const jsonData = JSON.stringify(data);
+	const encodedData = new TextEncoder().encode(jsonData);
+	return {
+		encryptedData: arrayBufferToBase64(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv
+		}, key, encodedData)),
+		key
+	};
 }
+/**
+* Decrypts encrypted props data using the provided key
+* @param key - The CryptoKey to use for decryption
+* @param encryptedData - The encrypted data as a base64 string
+* @returns The decrypted data object
+*/
 async function decryptProps(key, encryptedData) {
-  const encryptedBuffer = base64ToArrayBuffer(encryptedData);
-  const iv = new Uint8Array(12);
-  const decryptedBuffer = await crypto.subtle.decrypt(
-    {
-      name: "AES-GCM",
-      iv
-    },
-    key,
-    encryptedBuffer
-  );
-  const decoder = new TextDecoder();
-  const jsonData = decoder.decode(decryptedBuffer);
-  return JSON.parse(jsonData);
+	const encryptedBuffer = base64ToArrayBuffer(encryptedData);
+	const iv = new Uint8Array(12);
+	const decryptedBuffer = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv
+	}, key, encryptedBuffer);
+	const jsonData = new TextDecoder().decode(decryptedBuffer);
+	return JSON.parse(jsonData);
 }
-var WRAPPING_KEY_HMAC_KEY = new Uint8Array([
-  34,
-  126,
-  38,
-  134,
-  141,
-  241,
-  225,
-  109,
-  128,
-  112,
-  234,
-  23,
-  151,
-  91,
-  71,
-  166,
-  130,
-  24,
-  250,
-  135,
-  40,
-  174,
-  222,
-  133,
-  181,
-  29,
-  74,
-  217,
-  150,
-  202,
-  202,
-  67
+const WRAPPING_KEY_HMAC_KEY = new Uint8Array([
+	34,
+	126,
+	38,
+	134,
+	141,
+	241,
+	225,
+	109,
+	128,
+	112,
+	234,
+	23,
+	151,
+	91,
+	71,
+	166,
+	130,
+	24,
+	250,
+	135,
+	40,
+	174,
+	222,
+	133,
+	181,
+	29,
+	74,
+	217,
+	150,
+	202,
+	202,
+	67
 ]);
+/**
+* Derives a wrapping key from a token string
+* This intentionally uses a different method than token ID generation
+* to ensure the token ID cannot be used to derive the wrapping key
+* @param tokenStr - The token string to use as key material
+* @returns A Promise resolving to the derived CryptoKey
+*/
 async function deriveKeyFromToken(tokenStr) {
-  const encoder = new TextEncoder();
-  const hmacKey = await crypto.subtle.importKey(
-    "raw",
-    WRAPPING_KEY_HMAC_KEY,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const hmacResult = await crypto.subtle.sign("HMAC", hmacKey, encoder.encode(tokenStr));
-  return await crypto.subtle.importKey(
-    "raw",
-    hmacResult,
-    { name: "AES-KW" },
-    false,
-    // not extractable
-    ["wrapKey", "unwrapKey"]
-  );
+	const encoder = new TextEncoder();
+	const hmacKey = await crypto.subtle.importKey("raw", WRAPPING_KEY_HMAC_KEY, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const hmacResult = await crypto.subtle.sign("HMAC", hmacKey, encoder.encode(tokenStr));
+	return await crypto.subtle.importKey("raw", hmacResult, { name: "AES-KW" }, false, ["wrapKey", "unwrapKey"]);
 }
+/**
+* Wraps an encryption key using a token-derived key
+* @param tokenStr - The token string to use for key wrapping
+* @param keyToWrap - The encryption key to wrap
+* @returns A Promise resolving to the wrapped key as a base64 string
+*/
 async function wrapKeyWithToken(tokenStr, keyToWrap) {
-  const wrappingKey = await deriveKeyFromToken(tokenStr);
-  const wrappedKeyBuffer = await crypto.subtle.wrapKey("raw", keyToWrap, wrappingKey, { name: "AES-KW" });
-  return arrayBufferToBase64(wrappedKeyBuffer);
+	const wrappingKey = await deriveKeyFromToken(tokenStr);
+	return arrayBufferToBase64(await crypto.subtle.wrapKey("raw", keyToWrap, wrappingKey, { name: "AES-KW" }));
 }
+/**
+* Unwraps an encryption key using a token-derived key
+* @param tokenStr - The token string used for key wrapping
+* @param wrappedKeyBase64 - The wrapped key as a base64 string
+* @returns A Promise resolving to the unwrapped CryptoKey
+*/
 async function unwrapKeyWithToken(tokenStr, wrappedKeyBase64) {
-  const wrappingKey = await deriveKeyFromToken(tokenStr);
-  const wrappedKeyBuffer = base64ToArrayBuffer(wrappedKeyBase64);
-  return await crypto.subtle.unwrapKey(
-    "raw",
-    wrappedKeyBuffer,
-    wrappingKey,
-    { name: "AES-KW" },
-    { name: "AES-GCM" },
-    true,
-    // extractable
-    ["encrypt", "decrypt"]
-  );
+	const wrappingKey = await deriveKeyFromToken(tokenStr);
+	const wrappedKeyBuffer = base64ToArrayBuffer(wrappedKeyBase64);
+	return await crypto.subtle.unwrapKey("raw", wrappedKeyBuffer, wrappingKey, { name: "AES-KW" }, { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
 }
+/**
+* Class that implements the OAuth helper methods
+* Provides methods for OAuth operations needed by handlers
+*/
 var OAuthHelpersImpl = class {
-  /**
-   * Creates a new OAuthHelpers instance
-   * @param env - Cloudflare Worker environment variables
-   * @param provider - Reference to the parent provider instance
-   */
-  constructor(env, provider) {
-    this.env = env;
-    this.provider = provider;
-  }
-  /**
-   * Parses an OAuth authorization request from the HTTP request
-   * @param request - The HTTP request containing OAuth parameters
-   * @returns The parsed authorization request parameters
-   */
-  async parseAuthRequest(request) {
-    const url = new URL(request.url);
-    const responseType = url.searchParams.get("response_type") || "";
-    const clientId = url.searchParams.get("client_id") || "";
-    const redirectUri = url.searchParams.get("redirect_uri") || "";
-    const scope = (url.searchParams.get("scope") || "").split(" ").filter(Boolean);
-    const state = url.searchParams.get("state") || "";
-    const codeChallenge = url.searchParams.get("code_challenge") || void 0;
-    const codeChallengeMethod = url.searchParams.get("code_challenge_method") || "plain";
-    const resourceParams = url.searchParams.getAll("resource");
-    const resourceParam = resourceParams.length > 0 ? resourceParams.length === 1 ? resourceParams[0] : resourceParams : void 0;
-    validateRedirectUriScheme(redirectUri);
-    const resource = parseResourceParameter(resourceParam);
-    if (resourceParam && !resource) {
-      throw new Error("The resource parameter must be a valid absolute URI without a fragment");
-    }
-    if (responseType === "token" && !this.provider.options.allowImplicitFlow) {
-      throw new Error("The implicit grant flow is not enabled for this provider");
-    }
-    if (clientId) {
-      const clientInfo = await this.lookupClient(clientId);
-      if (!clientInfo) {
-        throw new Error(`Invalid client. The clientId provided does not match to this client.`);
-      }
-      if (clientInfo && redirectUri) {
-        if (!clientInfo.redirectUris.includes(redirectUri)) {
-          throw new Error(
-            `Invalid redirect URI. The redirect URI provided does not match any registered URI for this client.`
-          );
-        }
-      }
-    }
-    return {
-      responseType,
-      clientId,
-      redirectUri,
-      scope,
-      state,
-      codeChallenge,
-      codeChallengeMethod,
-      resource
-    };
-  }
-  /**
-   * Looks up a client by its client ID
-   * @param clientId - The client ID to look up
-   * @returns A Promise resolving to the client info, or null if not found
-   */
-  async lookupClient(clientId) {
-    return await this.provider.getClient(this.env, clientId);
-  }
-  /**
-   * Completes an authorization request by creating a grant and either:
-   * - For authorization code flow: generating an authorization code
-   * - For implicit flow: generating an access token directly
-   * @param options - Options specifying the grant details
-   * @returns A Promise resolving to an object containing the redirect URL
-   */
-  async completeAuthorization(options) {
-    const { clientId, redirectUri } = options.request;
-    if (!clientId || !redirectUri) {
-      throw new Error("Client ID and Redirect URI are required in the authorization request.");
-    }
-    const clientInfo = await this.lookupClient(clientId);
-    if (!clientInfo || !clientInfo.redirectUris.includes(redirectUri)) {
-      throw new Error(
-        "Invalid redirect URI. The redirect URI provided does not match any registered URI for this client."
-      );
-    }
-    const grantId = generateRandomString(16);
-    const { encryptedData, key: encryptionKey } = await encryptProps(options.props);
-    const now = Math.floor(Date.now() / 1e3);
-    if (options.request.responseType === "token") {
-      const accessTokenSecret = generateRandomString(TOKEN_LENGTH);
-      const accessToken = `${options.userId}:${grantId}:${accessTokenSecret}`;
-      const accessTokenId = await generateTokenId(accessToken);
-      const accessTokenTTL = this.provider.options.accessTokenTTL || DEFAULT_ACCESS_TOKEN_TTL;
-      const accessTokenExpiresAt = now + accessTokenTTL;
-      const accessTokenWrappedKey = await wrapKeyWithToken(accessToken, encryptionKey);
-      const audience = parseResourceParameter(options.request.resource);
-      if (options.request.resource && !audience) {
-        throw new Error("The resource parameter must be a valid absolute URI without a fragment");
-      }
-      const grant = {
-        id: grantId,
-        clientId: options.request.clientId,
-        userId: options.userId,
-        scope: options.scope,
-        metadata: options.metadata,
-        encryptedProps: encryptedData,
-        createdAt: now,
-        resource: options.request.resource
-      };
-      const grantKey = `grant:${options.userId}:${grantId}`;
-      await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant));
-      const accessTokenData = {
-        id: accessTokenId,
-        grantId,
-        userId: options.userId,
-        createdAt: now,
-        expiresAt: accessTokenExpiresAt,
-        audience,
-        wrappedEncryptionKey: accessTokenWrappedKey,
-        grant: {
-          clientId: options.request.clientId,
-          scope: options.scope,
-          encryptedProps: encryptedData
-        }
-      };
-      await this.env.OAUTH_KV.put(
-        `token:${options.userId}:${grantId}:${accessTokenId}`,
-        JSON.stringify(accessTokenData),
-        { expirationTtl: accessTokenTTL }
-      );
-      const redirectUrl = new URL(options.request.redirectUri);
-      const fragment = new URLSearchParams();
-      fragment.set("access_token", accessToken);
-      fragment.set("token_type", "bearer");
-      fragment.set("expires_in", accessTokenTTL.toString());
-      fragment.set("scope", options.scope.join(" "));
-      if (options.request.state) {
-        fragment.set("state", options.request.state);
-      }
-      redirectUrl.hash = fragment.toString();
-      return { redirectTo: redirectUrl.toString() };
-    } else {
-      const authCodeSecret = generateRandomString(32);
-      const authCode = `${options.userId}:${grantId}:${authCodeSecret}`;
-      const authCodeId = await hashSecret(authCode);
-      const authCodeWrappedKey = await wrapKeyWithToken(authCode, encryptionKey);
-      const grant = {
-        id: grantId,
-        clientId: options.request.clientId,
-        userId: options.userId,
-        scope: options.scope,
-        metadata: options.metadata,
-        encryptedProps: encryptedData,
-        createdAt: now,
-        authCodeId,
-        // Store the auth code hash in the grant
-        authCodeWrappedKey,
-        // Store the wrapped key
-        // Store PKCE parameters if provided
-        codeChallenge: options.request.codeChallenge,
-        codeChallengeMethod: options.request.codeChallengeMethod,
-        resource: options.request.resource
-      };
-      const grantKey = `grant:${options.userId}:${grantId}`;
-      const codeExpiresIn = 600;
-      await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant), { expirationTtl: codeExpiresIn });
-      const redirectUrl = new URL(options.request.redirectUri);
-      redirectUrl.searchParams.set("code", authCode);
-      if (options.request.state) {
-        redirectUrl.searchParams.set("state", options.request.state);
-      }
-      return { redirectTo: redirectUrl.toString() };
-    }
-  }
-  /**
-   * Creates a new OAuth client
-   * @param clientInfo - Partial client information to create the client with
-   * @returns A Promise resolving to the created client info
-   */
-  async createClient(clientInfo) {
-    const clientId = generateRandomString(16);
-    const tokenEndpointAuthMethod = clientInfo.tokenEndpointAuthMethod || "client_secret_basic";
-    const isPublicClient = tokenEndpointAuthMethod === "none";
-    const newClient = {
-      clientId,
-      redirectUris: clientInfo.redirectUris || [],
-      clientName: clientInfo.clientName,
-      logoUri: clientInfo.logoUri,
-      clientUri: clientInfo.clientUri,
-      policyUri: clientInfo.policyUri,
-      tosUri: clientInfo.tosUri,
-      jwksUri: clientInfo.jwksUri,
-      contacts: clientInfo.contacts,
-      grantTypes: clientInfo.grantTypes || ["authorization_code", "refresh_token"],
-      responseTypes: clientInfo.responseTypes || ["code"],
-      registrationDate: Math.floor(Date.now() / 1e3),
-      tokenEndpointAuthMethod
-    };
-    for (const uri of newClient.redirectUris) {
-      validateRedirectUriScheme(uri);
-    }
-    let clientSecret;
-    if (!isPublicClient) {
-      clientSecret = generateRandomString(32);
-      newClient.clientSecret = await hashSecret(clientSecret);
-    }
-    await this.env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(newClient));
-    const clientResponse = { ...newClient };
-    if (!isPublicClient && clientSecret) {
-      clientResponse.clientSecret = clientSecret;
-    }
-    return clientResponse;
-  }
-  /**
-   * Lists all registered OAuth clients with pagination support
-   * @param options - Optional pagination parameters (limit and cursor)
-   * @returns A Promise resolving to the list result with items and optional cursor
-   */
-  async listClients(options) {
-    const listOptions = {
-      prefix: "client:"
-    };
-    if (options?.limit !== void 0) {
-      listOptions.limit = options.limit;
-    }
-    if (options?.cursor !== void 0) {
-      listOptions.cursor = options.cursor;
-    }
-    const response = await this.env.OAUTH_KV.list(listOptions);
-    const clients = [];
-    const promises = response.keys.map(async (key) => {
-      const clientId = key.name.substring("client:".length);
-      const client = await this.provider.getClient(this.env, clientId);
-      if (client) {
-        clients.push(client);
-      }
-    });
-    await Promise.all(promises);
-    return {
-      items: clients,
-      cursor: response.list_complete ? void 0 : response.cursor
-    };
-  }
-  /**
-   * Updates an existing OAuth client
-   * @param clientId - The ID of the client to update
-   * @param updates - Partial client information with fields to update
-   * @returns A Promise resolving to the updated client info, or null if not found
-   */
-  async updateClient(clientId, updates) {
-    const client = await this.provider.getClient(this.env, clientId);
-    if (!client) {
-      return null;
-    }
-    let authMethod = updates.tokenEndpointAuthMethod || client.tokenEndpointAuthMethod || "client_secret_basic";
-    const isPublicClient = authMethod === "none";
-    let secretToStore = client.clientSecret;
-    let originalSecret = void 0;
-    if (isPublicClient) {
-      secretToStore = void 0;
-    } else if (updates.clientSecret) {
-      originalSecret = updates.clientSecret;
-      secretToStore = await hashSecret(updates.clientSecret);
-    }
-    const updatedClient = {
-      ...client,
-      ...updates,
-      clientId: client.clientId,
-      // Ensure clientId doesn't change
-      tokenEndpointAuthMethod: authMethod
-      // Use determined auth method
-    };
-    if (!isPublicClient && secretToStore) {
-      updatedClient.clientSecret = secretToStore;
-    } else {
-      delete updatedClient.clientSecret;
-    }
-    await this.env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(updatedClient));
-    const response = { ...updatedClient };
-    if (!isPublicClient && originalSecret) {
-      response.clientSecret = originalSecret;
-    }
-    return response;
-  }
-  /**
-   * Deletes an OAuth client
-   * @param clientId - The ID of the client to delete
-   * @returns A Promise resolving when the deletion is confirmed.
-   */
-  async deleteClient(clientId) {
-    await this.env.OAUTH_KV.delete(`client:${clientId}`);
-  }
-  /**
-   * Lists all authorization grants for a specific user with pagination support
-   * Returns a summary of each grant without sensitive information
-   * @param userId - The ID of the user whose grants to list
-   * @param options - Optional pagination parameters (limit and cursor)
-   * @returns A Promise resolving to the list result with grant summaries and optional cursor
-   */
-  async listUserGrants(userId, options) {
-    const listOptions = {
-      prefix: `grant:${userId}:`
-    };
-    if (options?.limit !== void 0) {
-      listOptions.limit = options.limit;
-    }
-    if (options?.cursor !== void 0) {
-      listOptions.cursor = options.cursor;
-    }
-    const response = await this.env.OAUTH_KV.list(listOptions);
-    const grantSummaries = [];
-    const promises = response.keys.map(async (key) => {
-      const grantData = await this.env.OAUTH_KV.get(key.name, { type: "json" });
-      if (grantData) {
-        const summary = {
-          id: grantData.id,
-          clientId: grantData.clientId,
-          userId: grantData.userId,
-          scope: grantData.scope,
-          metadata: grantData.metadata,
-          createdAt: grantData.createdAt,
-          expiresAt: grantData.expiresAt
-        };
-        grantSummaries.push(summary);
-      }
-    });
-    await Promise.all(promises);
-    return {
-      items: grantSummaries,
-      cursor: response.list_complete ? void 0 : response.cursor
-    };
-  }
-  /**
-   * Revokes an authorization grant and all its associated access tokens
-   * @param grantId - The ID of the grant to revoke
-   * @param userId - The ID of the user who owns the grant
-   * @returns A Promise resolving when the revocation is confirmed.
-   */
-  async revokeGrant(grantId, userId) {
-    const grantKey = `grant:${userId}:${grantId}`;
-    const tokenPrefix = `token:${userId}:${grantId}:`;
-    let cursor;
-    let allTokensDeleted = false;
-    while (!allTokensDeleted) {
-      const listOptions = {
-        prefix: tokenPrefix
-      };
-      if (cursor) {
-        listOptions.cursor = cursor;
-      }
-      const result = await this.env.OAUTH_KV.list(listOptions);
-      if (result.keys.length > 0) {
-        await Promise.all(
-          result.keys.map((key) => {
-            return this.env.OAUTH_KV.delete(key.name);
-          })
-        );
-      }
-      if (result.list_complete) {
-        allTokensDeleted = true;
-      } else {
-        cursor = result.cursor;
-      }
-    }
-    await this.env.OAUTH_KV.delete(grantKey);
-  }
+	/**
+	* Creates a new OAuthHelpers instance
+	* @param env - Cloudflare Worker environment variables
+	* @param provider - Reference to the parent provider instance
+	*/
+	constructor(env, provider) {
+		this.env = env;
+		this.provider = provider;
+	}
+	/**
+	* Parses an OAuth authorization request from the HTTP request
+	* @param request - The HTTP request containing OAuth parameters
+	* @returns The parsed authorization request parameters
+	*/
+	async parseAuthRequest(request) {
+		const url = new URL(request.url);
+		const responseType = url.searchParams.get("response_type") || "";
+		const clientId = url.searchParams.get("client_id") || "";
+		const redirectUri = url.searchParams.get("redirect_uri") || "";
+		const scope = (url.searchParams.get("scope") || "").split(" ").filter(Boolean);
+		const state = url.searchParams.get("state") || "";
+		const codeChallenge = url.searchParams.get("code_challenge") || void 0;
+		const codeChallengeMethod = url.searchParams.get("code_challenge_method") || "plain";
+		const resourceParams = url.searchParams.getAll("resource");
+		const resourceParam = resourceParams.length > 0 ? resourceParams.length === 1 ? resourceParams[0] : resourceParams : void 0;
+		validateRedirectUriScheme(redirectUri);
+		const resource = parseResourceParameter(resourceParam);
+		if (resourceParam && !resource) throw new Error("The resource parameter must be a valid absolute URI without a fragment");
+		if (responseType === "token" && !this.provider.options.allowImplicitFlow) throw new Error("The implicit grant flow is not enabled for this provider");
+		if (clientId) {
+			const clientInfo = await this.lookupClient(clientId);
+			if (!clientInfo) throw new Error(`Invalid client. The clientId provided does not match to this client.`);
+			if (clientInfo && redirectUri) {
+				if (!clientInfo.redirectUris.includes(redirectUri)) throw new Error(`Invalid redirect URI. The redirect URI provided does not match any registered URI for this client.`);
+			}
+		}
+		return {
+			responseType,
+			clientId,
+			redirectUri,
+			scope,
+			state,
+			codeChallenge,
+			codeChallengeMethod,
+			resource
+		};
+	}
+	/**
+	* Looks up a client by its client ID
+	* @param clientId - The client ID to look up
+	* @returns A Promise resolving to the client info, or null if not found
+	*/
+	async lookupClient(clientId) {
+		return await this.provider.getClient(this.env, clientId);
+	}
+	/**
+	* Completes an authorization request by creating a grant and either:
+	* - For authorization code flow: generating an authorization code
+	* - For implicit flow: generating an access token directly
+	* @param options - Options specifying the grant details
+	* @returns A Promise resolving to an object containing the redirect URL
+	*/
+	async completeAuthorization(options) {
+		const { clientId, redirectUri } = options.request;
+		if (!clientId || !redirectUri) throw new Error("Client ID and Redirect URI are required in the authorization request.");
+		const clientInfo = await this.lookupClient(clientId);
+		if (!clientInfo || !clientInfo.redirectUris.includes(redirectUri)) throw new Error("Invalid redirect URI. The redirect URI provided does not match any registered URI for this client.");
+		const grantId = generateRandomString(16);
+		const { encryptedData, key: encryptionKey } = await encryptProps(options.props);
+		const now = Math.floor(Date.now() / 1e3);
+		if (options.request.responseType === "token") {
+			const accessTokenSecret = generateRandomString(TOKEN_LENGTH);
+			const accessToken = `${options.userId}:${grantId}:${accessTokenSecret}`;
+			const accessTokenId = await generateTokenId(accessToken);
+			const accessTokenTTL = this.provider.options.accessTokenTTL || DEFAULT_ACCESS_TOKEN_TTL;
+			const accessTokenExpiresAt = now + accessTokenTTL;
+			const accessTokenWrappedKey = await wrapKeyWithToken(accessToken, encryptionKey);
+			const audience = parseResourceParameter(options.request.resource);
+			if (options.request.resource && !audience) throw new Error("The resource parameter must be a valid absolute URI without a fragment");
+			const grant = {
+				id: grantId,
+				clientId: options.request.clientId,
+				userId: options.userId,
+				scope: options.scope,
+				metadata: options.metadata,
+				encryptedProps: encryptedData,
+				createdAt: now,
+				resource: options.request.resource
+			};
+			const grantKey = `grant:${options.userId}:${grantId}`;
+			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant));
+			const accessTokenData = {
+				id: accessTokenId,
+				grantId,
+				userId: options.userId,
+				createdAt: now,
+				expiresAt: accessTokenExpiresAt,
+				audience,
+				scope: options.scope,
+				wrappedEncryptionKey: accessTokenWrappedKey,
+				grant: {
+					clientId: options.request.clientId,
+					scope: options.scope,
+					encryptedProps: encryptedData
+				}
+			};
+			await this.env.OAUTH_KV.put(`token:${options.userId}:${grantId}:${accessTokenId}`, JSON.stringify(accessTokenData), { expirationTtl: accessTokenTTL });
+			const redirectUrl = new URL(options.request.redirectUri);
+			const fragment = new URLSearchParams();
+			fragment.set("access_token", accessToken);
+			fragment.set("token_type", "bearer");
+			fragment.set("expires_in", accessTokenTTL.toString());
+			fragment.set("scope", options.scope.join(" "));
+			if (options.request.state) fragment.set("state", options.request.state);
+			redirectUrl.hash = fragment.toString();
+			return { redirectTo: redirectUrl.toString() };
+		} else {
+			const authCodeSecret = generateRandomString(32);
+			const authCode = `${options.userId}:${grantId}:${authCodeSecret}`;
+			const authCodeId = await hashSecret(authCode);
+			const authCodeWrappedKey = await wrapKeyWithToken(authCode, encryptionKey);
+			const grant = {
+				id: grantId,
+				clientId: options.request.clientId,
+				userId: options.userId,
+				scope: options.scope,
+				metadata: options.metadata,
+				encryptedProps: encryptedData,
+				createdAt: now,
+				authCodeId,
+				authCodeWrappedKey,
+				codeChallenge: options.request.codeChallenge,
+				codeChallengeMethod: options.request.codeChallengeMethod,
+				resource: options.request.resource
+			};
+			const grantKey = `grant:${options.userId}:${grantId}`;
+			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant), { expirationTtl: 600 });
+			const redirectUrl = new URL(options.request.redirectUri);
+			redirectUrl.searchParams.set("code", authCode);
+			if (options.request.state) redirectUrl.searchParams.set("state", options.request.state);
+			return { redirectTo: redirectUrl.toString() };
+		}
+	}
+	/**
+	* Creates a new OAuth client
+	* @param clientInfo - Partial client information to create the client with
+	* @returns A Promise resolving to the created client info
+	*/
+	async createClient(clientInfo) {
+		const clientId = generateRandomString(16);
+		const tokenEndpointAuthMethod = clientInfo.tokenEndpointAuthMethod || "client_secret_basic";
+		const isPublicClient = tokenEndpointAuthMethod === "none";
+		const newClient = {
+			clientId,
+			redirectUris: clientInfo.redirectUris || [],
+			clientName: clientInfo.clientName,
+			logoUri: clientInfo.logoUri,
+			clientUri: clientInfo.clientUri,
+			policyUri: clientInfo.policyUri,
+			tosUri: clientInfo.tosUri,
+			jwksUri: clientInfo.jwksUri,
+			contacts: clientInfo.contacts,
+			grantTypes: clientInfo.grantTypes || [
+				GrantType.AUTHORIZATION_CODE,
+				GrantType.REFRESH_TOKEN,
+				...this.provider.options.allowTokenExchangeGrant ? [GrantType.TOKEN_EXCHANGE] : []
+			],
+			responseTypes: clientInfo.responseTypes || ["code"],
+			registrationDate: Math.floor(Date.now() / 1e3),
+			tokenEndpointAuthMethod
+		};
+		for (const uri of newClient.redirectUris) validateRedirectUriScheme(uri);
+		let clientSecret;
+		if (!isPublicClient) {
+			clientSecret = generateRandomString(32);
+			newClient.clientSecret = await hashSecret(clientSecret);
+		}
+		await this.env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(newClient));
+		const clientResponse = { ...newClient };
+		if (!isPublicClient && clientSecret) clientResponse.clientSecret = clientSecret;
+		return clientResponse;
+	}
+	/**
+	* Lists all registered OAuth clients with pagination support
+	* @param options - Optional pagination parameters (limit and cursor)
+	* @returns A Promise resolving to the list result with items and optional cursor
+	*/
+	async listClients(options) {
+		const listOptions = { prefix: "client:" };
+		if (options?.limit !== void 0) listOptions.limit = options.limit;
+		if (options?.cursor !== void 0) listOptions.cursor = options.cursor;
+		const response = await this.env.OAUTH_KV.list(listOptions);
+		const clients = [];
+		const promises = response.keys.map(async (key) => {
+			const clientId = key.name.substring(7);
+			const client = await this.provider.getClient(this.env, clientId);
+			if (client) clients.push(client);
+		});
+		await Promise.all(promises);
+		return {
+			items: clients,
+			cursor: response.list_complete ? void 0 : response.cursor
+		};
+	}
+	/**
+	* Updates an existing OAuth client
+	* @param clientId - The ID of the client to update
+	* @param updates - Partial client information with fields to update
+	* @returns A Promise resolving to the updated client info, or null if not found
+	*/
+	async updateClient(clientId, updates) {
+		const client = await this.provider.getClient(this.env, clientId);
+		if (!client) return null;
+		let authMethod = updates.tokenEndpointAuthMethod || client.tokenEndpointAuthMethod || "client_secret_basic";
+		const isPublicClient = authMethod === "none";
+		let secretToStore = client.clientSecret;
+		let originalSecret = void 0;
+		if (isPublicClient) secretToStore = void 0;
+		else if (updates.clientSecret) {
+			originalSecret = updates.clientSecret;
+			secretToStore = await hashSecret(updates.clientSecret);
+		}
+		const updatedClient = {
+			...client,
+			...updates,
+			clientId: client.clientId,
+			tokenEndpointAuthMethod: authMethod
+		};
+		if (!isPublicClient && secretToStore) updatedClient.clientSecret = secretToStore;
+		else delete updatedClient.clientSecret;
+		await this.env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(updatedClient));
+		const response = { ...updatedClient };
+		if (!isPublicClient && originalSecret) response.clientSecret = originalSecret;
+		return response;
+	}
+	/**
+	* Deletes an OAuth client
+	* @param clientId - The ID of the client to delete
+	* @returns A Promise resolving when the deletion is confirmed.
+	*/
+	async deleteClient(clientId) {
+		await this.env.OAUTH_KV.delete(`client:${clientId}`);
+	}
+	/**
+	* Lists all authorization grants for a specific user with pagination support
+	* Returns a summary of each grant without sensitive information
+	* @param userId - The ID of the user whose grants to list
+	* @param options - Optional pagination parameters (limit and cursor)
+	* @returns A Promise resolving to the list result with grant summaries and optional cursor
+	*/
+	async listUserGrants(userId, options) {
+		const listOptions = { prefix: `grant:${userId}:` };
+		if (options?.limit !== void 0) listOptions.limit = options.limit;
+		if (options?.cursor !== void 0) listOptions.cursor = options.cursor;
+		const response = await this.env.OAUTH_KV.list(listOptions);
+		const grantSummaries = [];
+		const promises = response.keys.map(async (key) => {
+			const grantData = await this.env.OAUTH_KV.get(key.name, { type: "json" });
+			if (grantData) {
+				const summary = {
+					id: grantData.id,
+					clientId: grantData.clientId,
+					userId: grantData.userId,
+					scope: grantData.scope,
+					metadata: grantData.metadata,
+					createdAt: grantData.createdAt,
+					expiresAt: grantData.expiresAt
+				};
+				grantSummaries.push(summary);
+			}
+		});
+		await Promise.all(promises);
+		return {
+			items: grantSummaries,
+			cursor: response.list_complete ? void 0 : response.cursor
+		};
+	}
+	/**
+	* Revokes an authorization grant and all its associated access tokens
+	* @param grantId - The ID of the grant to revoke
+	* @param userId - The ID of the user who owns the grant
+	* @returns A Promise resolving when the revocation is confirmed.
+	*/
+	async revokeGrant(grantId, userId) {
+		const grantKey = `grant:${userId}:${grantId}`;
+		const tokenPrefix = `token:${userId}:${grantId}:`;
+		let cursor;
+		let allTokensDeleted = false;
+		while (!allTokensDeleted) {
+			const listOptions = { prefix: tokenPrefix };
+			if (cursor) listOptions.cursor = cursor;
+			const result = await this.env.OAUTH_KV.list(listOptions);
+			if (result.keys.length > 0) await Promise.all(result.keys.map((key) => {
+				return this.env.OAUTH_KV.delete(key.name);
+			}));
+			if (result.list_complete) allTokensDeleted = true;
+			else cursor = result.cursor;
+		}
+		await this.env.OAUTH_KV.delete(grantKey);
+	}
+	/**
+	* Decodes a token and returns token data with decrypted props
+	* @param token - The token
+	* @returns Promise resolving to token data with decrypted props, or null if token is invalid
+	*/
+	async unwrapToken(token) {
+		return await this.provider.unwrapToken(token, this.env);
+	}
+	/**
+	* Exchanges an existing access token for a new one with modified characteristics
+	* Implements OAuth 2.0 Token Exchange (RFC 8693)
+	* @param options - Options for token exchange including subject token and optional modifications
+	* @returns Promise resolving to token response with new access token
+	*/
+	async exchangeToken(options) {
+		const tokenSummary = await this.unwrapToken(options.subjectToken);
+		if (!tokenSummary) throw new Error("Invalid or expired subject token");
+		const clientInfo = await this.lookupClient(tokenSummary.grant.clientId);
+		if (!clientInfo) throw new Error("Client not found");
+		return await this.provider.exchangeToken(options.subjectToken, options.scope, options.aud, options.expiresIn, clientInfo, this.env);
+	}
 };
+/**
+* Default export of the OAuth provider
+* This allows users to import the library and use it directly as in the example
+*/
 var oauth_provider_default = OAuthProvider;
-export {
-  OAuthProvider,
-  oauth_provider_default as default
-};
+
+//#endregion
+export { GrantType, OAuthProvider, oauth_provider_default as default, getOAuthApi };