@cloudflare/workers-oauth-provider 0.10.0 → 0.10.2

package/README.md

@@ -294,18 +294,21 @@ new OAuthProvider({
 }
 ```
 
-The compatibility flag prevents outbound CIMD fetches from using legacy same-zone origin routing, which is necessary for SSRF protection. The provider advertises `client_id_metadata_document_supported: true` only when both settings are present.
+The compatibility flag prevents outbound CIMD fetches from using legacy same-zone origin routing, which is necessary for SSRF protection. The provider advertises `client_id_metadata_document_supported: true` only when both settings are present. CIMD fetches also use the `cache` option of `fetch`, which requires a compatibility date of `2024-11-11` or later (or the `cache_option_enabled` compatibility flag).
 
-CIMD validation includes:
+CIMD validation follows [draft-ietf-oauth-client-id-metadata-document-00](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00) — the revision pinned by the MCP 2026-07-28 authorization spec — and includes:
 
-- HTTPS URL with a non-root path.
+- An HTTPS Client Identifier URL with a path component and no userinfo, fragment, or dot path segments.
 - A document `client_id` exactly matching its URL.
-- Non-empty `client_name` and `redirect_uris` fields.
+- Non-empty `client_name` and `redirect_uris` fields, as MCP requires, with unsafe redirect schemes rejected at ingestion.
 - Exact authorization-request redirect URI validation, with RFC 8252 loopback port handling.
-- A 5 KB response size limit and 10 second fetch timeout.
-- Safe URI schemes for client metadata fields.
+- A 5 KB response size limit and a 10 second timeout covering both headers and body.
+- Valid UTF-8 JSON object syntax and safe URI schemes for client metadata fields.
+- No embedded client secrets or private JWK material.
 
-CIMD currently supports only `token_endpoint_auth_method: "none"`.
+Validated documents are cached according to their `Cache-Control` headers, capped at 7 days. Error responses and invalid documents are never cached, and a cached document that stops validating is evicted and re-resolved from origin within the same request.
+
+CIMD token endpoint authentication is negotiated from `token_endpoint_auth_method` and the OpenID RP Metadata Choices field `token_endpoint_auth_methods_supported`. The provider currently implements only `none`: a client may prefer `private_key_jwt` while also offering `none`, in which case the provider selects `none` and applies public-client PKCE requirements. A client that offers only `private_key_jwt` is rejected until assertion validation is implemented.
 
 When a CIMD document cannot be fetched or validated, the token endpoint returns a generic `invalid_client` response and reports diagnostics through `onError.internal`. `OAuthHelpers` methods that resolve a CIMD client throw the exported `CimdFetchError`, allowing applications to distinguish an upstream metadata failure from a client that does not exist. See [Advanced configuration](https://github.com/cloudflare/workers-oauth-provider/blob/main/docs/advanced-configuration.md#cimd-fetch-errors) for an example.
 
@@ -319,7 +322,11 @@ clientRegistrationEndpoint: '/oauth/register';
 
 MCP 2026-07-28 deprecates DCR for new implementations in favor of CIMD. The endpoint remains useful for compatibility with clients that do not support CIMD.
 
-Registration accepts only authentication methods, grants, and response types implemented by the configured provider, and rejects inconsistent grant/response combinations before storage. Omitted metadata uses the RFC 7591 defaults: `client_secret_basic`, `grant_types: ["authorization_code"]`, and `response_types: ["code"]`.
+Registration accepts only authentication methods, grants, and response types implemented by the configured provider, and rejects inconsistent grant/response combinations before storage. Choice-valued `token_endpoint_auth_methods_supported` input is negotiated to one effective `token_endpoint_auth_method`; grant and response registrations remain strict. Omitted metadata uses the RFC 7591 defaults: `client_secret_basic`, `grant_types: ["authorization_code"]`, and `response_types: ["code"]`.
+
+The effective `token_endpoint_auth_method` returned by registration is enforced exactly. When both authentication metadata fields are omitted, no explicit-method marker is stored and the client may use either `client_secret_basic` or `client_secret_post`, provided the same stored secret validates. Client records written by earlier releases have no marker and receive the same compatibility. This never crosses between `none` and a secret method and does not apply to CIMD clients.
+
+Calling `OAuthHelpers.updateClient()` with `tokenEndpointAuthMethod` adds the marker; unrelated updates leave it unchanged.
 
 Related options:
 
@@ -345,16 +352,11 @@ The provider owns `tokenEndpoint`. It exchanges authorization codes for tokens,
 
 ## Resources and token audiences
 
-MCP clients must send the canonical MCP server URI as `resource` in authorization and token requests. The provider parses RFC 8707 resource indicators, stores the authorized resource on the grant, uses it as the access-token audience, and rejects resource expansion or audience mismatch.
-
-Resource policy follows `resourceMetadata.resource`:
-
-- When configured, authorization requests, token requests, and externally resolved tokens must use that one exact resource. `resourceMatchOriginOnly` cannot weaken this policy.
-- When omitted, valid resources are accepted. Token requests may inherit the authorization resource. If the authorization request also omits it, the provider uses the request origin as the default and issues an origin-bound token.
+MCP clients are required to send the canonical MCP server URI as `resource` in authorization and token requests. The provider tolerates omission for compatibility: when `resourceMetadata.resource` is configured, it is used as the canonical default and inherited by later token requests; otherwise a token request inherits any resource already stored on the grant. An explicit resource that does not match a bound grant is rejected with `invalid_target`.
 
-Path-aware audiences use path-boundary prefix matching. A token for `https://example.com/mcp` can be used at `/mcp/tools`, but not at `/mcp-other`. Split deployments and deployments requiring path isolation should configure the canonical resource explicitly.
+Legacy grants may have no stored resource. With no configured canonical resource, omitting `resource` preserves that unbound state. If a client supplies a resource during code exchange or refresh, it applies to that issued token but is not persisted as a new grant binding. Path-aware audiences use path-boundary prefix matching, so a token for `https://example.com/mcp` can be used at `/mcp/tools`, but not at `/mcp-other`.
 
-`resourceMatchOriginOnly` remains a migration option for grants created before path-aware resources were introduced. Do not enable it for a new deployment.
+`resourceMatchOriginOnly` is deprecated; its existing behavior is unchanged. Prefer `resourceMetadata.resource` for new deployments.
 
 ## Scopes and step-up authorization
 
@@ -431,7 +433,7 @@ Deleting a client through `OAuthHelpers.deleteClient()` also revokes its grants
 | `allowTokenExchangeGrant`          | Enable RFC 8693                                          | `false`                                     |
 | `tokenExchangeCallback`            | Update props, scopes, or lifetimes during token exchange | None                                        |
 | `resolveExternalToken`             | Validate external bearer credentials (advanced)          | None                                        |
-| `resourceMatchOriginOnly`          | Migration mode for old origin-only resource grants       | `false`                                     |
+| `resourceMatchOriginOnly`          | Deprecated origin-only resource comparison               | `false`                                     |
 | `enterpriseManagedAuthorization`   | Enable experimental ID-JAG grant support                 | Disabled                                    |
 | `onError`                          | Observe or replace OAuth error responses                 | Logs a warning                              |
 
@@ -466,6 +468,7 @@ The package implements or supports the relevant portions of:
 - [OAuth 2.0 Authorization Server Issuer Identification, RFC 9207](https://datatracker.ietf.org/doc/html/rfc9207)
 - [OAuth 2.0 Protected Resource Metadata, RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728)
 - [OAuth Client ID Metadata Documents](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00)
+- [OpenID Connect RP Metadata Choices 1.0](https://openid.net/specs/openid-connect-rp-metadata-choices-1_0-final.html)
 - [MCP Enterprise-Managed Authorization](https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization), with experimental package support
 
 ## Development

package/dist/oauth-provider.d.ts

@@ -299,7 +299,7 @@ interface EmaOptions<Env = Cloudflare.Env> {
 }
 //#endregion
 //#region src/oauth-capabilities.d.ts
-type AuthorizationErrorCode = 'invalid_request' | 'unauthorized_client' | 'access_denied' | 'unsupported_response_type' | 'invalid_scope' | 'server_error' | 'temporarily_unavailable';
+type AuthorizationErrorCode = 'invalid_request' | 'invalid_target' | 'unauthorized_client' | 'access_denied' | 'unsupported_response_type' | 'invalid_scope' | 'server_error' | 'temporarily_unavailable';
 interface AuthorizationErrorOptions {
   /** Wire-safe OAuth authorization error description. */
   description: string;
@@ -685,14 +685,16 @@ interface OAuthProviderOptions<Env = Cloudflare.Env> {
    */
   clientIdMetadataDocumentEnabled?: boolean;
   /**
-   * When true, resource validation during token exchange compares origins only
-   * (scheme + host + port) instead of exact URI matching. This allows grants issued
-   * with an origin-only resource (e.g. `https://server.com`) to be used with
-   * path-aware resource requests (e.g. `https://server.com/mcp`), enabling seamless
-   * migration from pre-0.4.0 versions that stored origin-only resource URIs.
-   * Explicit `resourceMetadata.resource` configuration always uses exact matching.
+   * When true, requested-vs-granted resource validation compares origins only
+   * (scheme + host + port) instead of exact URIs. This allows an origin-only
+   * grant such as `https://server.com` to accept `https://server.com/mcp`, but
+   * also ignores path and query differences. Configured canonical resources
+   * always use exact matching.
    *
    * Defaults to false (strict exact matching per RFC 8707).
+   *
+   * @deprecated This comparison is unsafe for shared-origin multi-path or
+   * multi-tenant deployments. Prefer configuring `resourceMetadata.resource`.
    */
   resourceMatchOriginOnly?: boolean;
   /**
@@ -706,10 +708,11 @@ interface OAuthProviderOptions<Env = Cloudflare.Env> {
     /**
      * The protected resource identifier URL (RFC 9728 `resource` field).
      *
-     * Configuring this value pins authorization requests, token requests, and
-     * access-token audiences to this exact resource. If omitted, the provider
-     * accepts valid RFC 8707 resource indicators and uses the authorization
-     * request origin as the default when the client does not send one.
+     * Configuring this value pins grants and access-token audiences to this
+     * exact resource. An omitted authorization resource defaults to this value,
+     * and an omitted token-request resource inherits it from the grant. Without
+     * configuration, explicit RFC 8707 resource indicators are accepted and
+     * omission remains unbound for backwards compatibility.
      */
     resource?: string;
     /**

package/dist/oauth-provider.js

@@ -53,6 +53,68 @@ function validateClientCapabilities(server, client) {
 	if (client.grantTypes.includes("authorization_code") !== client.responseTypes.includes("code")) throw new Error("grant_types authorization_code and response_types code must be registered together");
 	if (client.grantTypes.includes("implicit") !== client.responseTypes.includes("token")) throw new Error("grant_types implicit and response_types token must be registered together");
 }
+const SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS = new Set([
+	"client_secret_basic",
+	"client_secret_post",
+	"client_secret_jwt"
+]);
+function negotiateTokenEndpointAuthMethod(options) {
+	const { acceptedMethods, defaultMethod, preferredMethod, supportedMethods, context } = options;
+	if (preferredMethod !== void 0 && supportedMethods !== void 0 && !supportedMethods.includes(preferredMethod)) throw new Error("token_endpoint_auth_method must be included in token_endpoint_auth_methods_supported");
+	const advertisedMethods = supportedMethods ?? [preferredMethod ?? defaultMethod];
+	const effectiveMethod = preferredMethod !== void 0 && acceptedMethods.includes(preferredMethod) ? preferredMethod : acceptedMethods.find((method) => advertisedMethods.includes(method));
+	if (effectiveMethod !== void 0) return effectiveMethod;
+	const advertised = [...new Set([...preferredMethod === void 0 ? [] : [preferredMethod], ...advertisedMethods])];
+	throw new Error(`${context} does not support an accepted token endpoint authentication method. Supported methods: ${acceptedMethods.join(", ")}. Client advertised: ${advertised.length > 0 ? advertised.join(", ") : "(none)"}`);
+}
+function negotiateCimdTokenEndpointAuthMethod(server, preferredMethod, supportedMethods) {
+	if (preferredMethod !== void 0 && SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS.has(preferredMethod)) throw new Error(`CIMD clients cannot use symmetric token endpoint authentication method: ${preferredMethod}`);
+	return negotiateTokenEndpointAuthMethod({
+		acceptedMethods: server.tokenEndpointAuthMethods.filter((method) => !SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS.has(method)),
+		defaultMethod: "none",
+		preferredMethod,
+		supportedMethods,
+		context: "CIMD client"
+	});
+}
+/**
+* Negotiates choice-valued authentication metadata while keeping DCR grant and
+* response registration strict.
+*/
+function negotiateDynamicClientRegistrationCapabilities(server, client) {
+	const effective = {
+		grantTypes: [...client.grantTypes],
+		responseTypes: [...client.responseTypes],
+		tokenEndpointAuthMethod: negotiateTokenEndpointAuthMethod({
+			acceptedMethods: server.tokenEndpointAuthMethods,
+			defaultMethod: "client_secret_basic",
+			preferredMethod: client.tokenEndpointAuthMethod,
+			supportedMethods: client.tokenEndpointAuthMethodsSupported,
+			context: "Client"
+		})
+	};
+	validateClientCapabilities(server, effective);
+	return effective;
+}
+/**
+* Selects the capabilities from a Client ID Metadata Document that this
+* authorization server supports. CIMD documents may advertise extension
+* capabilities alongside the flow used with this server, so unsupported grant
+* and response types are omitted from the effective client metadata instead of
+* invalidating an otherwise usable client.
+*
+* The effective subset is still checked for grant/response consistency, and
+* token endpoint authentication must have a mutually supported method.
+*/
+function negotiateCimdClientCapabilities(server, client) {
+	const effective = {
+		grantTypes: client.grantTypes.filter((grantType) => server.grantTypes.includes(grantType)),
+		responseTypes: client.responseTypes.filter((responseType) => server.responseTypes.includes(responseType)),
+		tokenEndpointAuthMethod: negotiateCimdTokenEndpointAuthMethod(server, client.tokenEndpointAuthMethod, client.tokenEndpointAuthMethodsSupported)
+	};
+	validateClientCapabilities(server, effective);
+	return effective;
+}
 function validateAuthorizationResponseType(server, responseType, clientResponseTypes) {
 	if (!responseType) throw new AuthorizationError("invalid_request", { description: "response_type is required" });
 	if (!server.responseTypes.includes(responseType)) throw new AuthorizationError("unsupported_response_type", { description: `The authorization server does not support response_type ${responseType}` });
@@ -88,6 +150,403 @@ function isValidOAuthScopeToken(scopeToken) {
 	return OAUTH_SCOPE_TOKEN_PATTERN.test(scopeToken);
 }
 
+//#endregion
+//#region src/oauth-client-metadata.ts
+const CIMD_MAX_SIZE_BYTES = 5 * 1024;
+const CIMD_FETCH_TIMEOUT_MS = 1e4;
+const CIMD_CACHE_NAME = "workers-oauth-provider:cimd:v1";
+const CIMD_CACHE_MAX_TTL_SECONDS = 10080 * 60;
+function requireJsonObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("Client metadata must be a JSON object");
+	return value;
+}
+function optionalString(value, fieldName) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string") throw new Error(`Invalid ${fieldName}: expected string, got ${typeof value}`);
+	return value;
+}
+function optionalStringArray(value, fieldName) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) throw new Error(`Invalid ${fieldName}: expected array, got ${typeof value}`);
+	if (!value.every((item) => typeof item === "string")) throw new Error(`Invalid ${fieldName}: array must contain only strings`);
+	return [...value];
+}
+function optionalHttpUri(value, fieldName) {
+	const uri = optionalString(value, fieldName);
+	if (uri === void 0) return void 0;
+	let parsed;
+	try {
+		parsed = new URL(uri);
+	} catch {
+		throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
+	return uri;
+}
+const I18N_FIELDS = {
+	client_name: "string",
+	client_uri: "uri",
+	logo_uri: "uri",
+	tos_uri: "uri",
+	policy_uri: "uri"
+};
+function extractI18nFields(raw) {
+	const result = {};
+	for (const key of Object.keys(raw)) {
+		const hashIndex = key.indexOf("#");
+		if (hashIndex <= 0 || hashIndex === key.length - 1) continue;
+		const kind = I18N_FIELDS[key.slice(0, hashIndex)];
+		if (!kind) continue;
+		const value = kind === "uri" ? optionalHttpUri(raw[key], key) : optionalString(raw[key], key);
+		if (value !== void 0) result[key] = value;
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function validateChoiceConsistency(preferredName, preferredValue, choicesName, choices) {
+	if (preferredValue !== void 0 && choices !== void 0 && !choices.includes(preferredValue)) throw new Error(`${preferredName} must be included in ${choicesName}`);
+}
+function parseOAuthClientMetadata(raw) {
+	const tokenEndpointAuthMethod = optionalString(raw.token_endpoint_auth_method, "token_endpoint_auth_method");
+	const tokenEndpointAuthMethodsSupported = optionalStringArray(raw.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported");
+	const tokenEndpointAuthSigningAlg = optionalString(raw.token_endpoint_auth_signing_alg, "token_endpoint_auth_signing_alg");
+	const tokenEndpointAuthSigningAlgValuesSupported = optionalStringArray(raw.token_endpoint_auth_signing_alg_values_supported, "token_endpoint_auth_signing_alg_values_supported");
+	validateChoiceConsistency("token_endpoint_auth_method", tokenEndpointAuthMethod, "token_endpoint_auth_methods_supported", tokenEndpointAuthMethodsSupported);
+	validateChoiceConsistency("token_endpoint_auth_signing_alg", tokenEndpointAuthSigningAlg, "token_endpoint_auth_signing_alg_values_supported", tokenEndpointAuthSigningAlgValuesSupported);
+	return {
+		clientId: optionalString(raw.client_id, "client_id"),
+		redirectUris: optionalStringArray(raw.redirect_uris, "redirect_uris"),
+		clientName: optionalString(raw.client_name, "client_name"),
+		clientUri: optionalHttpUri(raw.client_uri, "client_uri"),
+		logoUri: optionalHttpUri(raw.logo_uri, "logo_uri"),
+		policyUri: optionalHttpUri(raw.policy_uri, "policy_uri"),
+		tosUri: optionalHttpUri(raw.tos_uri, "tos_uri"),
+		jwksUri: optionalHttpUri(raw.jwks_uri, "jwks_uri"),
+		i18n: extractI18nFields(raw),
+		contacts: optionalStringArray(raw.contacts, "contacts"),
+		grantTypes: optionalStringArray(raw.grant_types, "grant_types"),
+		responseTypes: optionalStringArray(raw.response_types, "response_types"),
+		tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported,
+		tokenEndpointAuthSigningAlg,
+		tokenEndpointAuthSigningAlgValuesSupported
+	};
+}
+function pickDisplayMetadata(metadata) {
+	const { clientName, clientUri, logoUri, policyUri, tosUri, jwksUri, i18n, contacts } = metadata;
+	return {
+		clientName,
+		clientUri,
+		logoUri,
+		policyUri,
+		tosUri,
+		jwksUri,
+		i18n,
+		contacts
+	};
+}
+/**
+* Validates that a redirect URI has a scheme and does not use a dangerous
+* pseudo-scheme or contain control characters.
+*/
+function validateRedirectUriScheme(redirectUri) {
+	const dangerousSchemes = [
+		"javascript:",
+		"data:",
+		"vbscript:",
+		"file:",
+		"mailto:",
+		"blob:"
+	];
+	const normalized = redirectUri.trim();
+	for (let i = 0; i < normalized.length; i++) {
+		const code = normalized.charCodeAt(i);
+		if (code >= 0 && code <= 31 || code >= 127 && code <= 159) throw new Error("Invalid redirect URI");
+	}
+	const colonIndex = normalized.indexOf(":");
+	if (colonIndex === -1) throw new Error("Invalid redirect URI");
+	const scheme = normalized.slice(0, colonIndex + 1).toLowerCase();
+	if (dangerousSchemes.includes(scheme)) throw new Error("Invalid redirect URI");
+}
+function requireValidRedirectUris(redirectUris) {
+	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
+	for (const redirectUri of redirectUris) validateRedirectUriScheme(redirectUri);
+	return redirectUris;
+}
+/**
+* Resolves a Dynamic Client Registration request into the complete metadata
+* shape that can be stored, applying RFC 7591 defaults and server capability
+* validation exactly once.
+*/
+function resolveDynamicClientRegistrationMetadata(raw, server) {
+	const metadata = parseOAuthClientMetadata(raw);
+	const capabilities = negotiateDynamicClientRegistrationCapabilities(server, {
+		tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
+		grantTypes: metadata.grantTypes ?? ["authorization_code"],
+		responseTypes: metadata.responseTypes ?? ["code"]
+	});
+	return {
+		...pickDisplayMetadata(metadata),
+		redirectUris: requireValidRedirectUris(metadata.redirectUris),
+		...capabilities,
+		authMethodExplicit: metadata.tokenEndpointAuthMethod !== void 0 || metadata.tokenEndpointAuthMethodsSupported !== void 0
+	};
+}
+/**
+* Path component of the raw client ID string. Deliberately not
+* `new URL().pathname`: WHATWG parsing collapses the `.` and `..` segments
+* that CIMD §3 requires rejecting, and normalizes `\` and scheme-relative
+* forms this validation must see verbatim.
+*/
+function rawPath(clientId) {
+	const schemeEnd = clientId.indexOf("://");
+	if (schemeEnd === -1) return "";
+	const authorityStart = schemeEnd + 3;
+	const authorityEndOffset = clientId.slice(authorityStart).search(/[/?#]/);
+	if (authorityEndOffset === -1) return "";
+	const pathStart = authorityStart + authorityEndOffset;
+	if (clientId[pathStart] !== "/") return "";
+	const pathEndOffset = clientId.slice(pathStart).search(/[?#]/);
+	return pathEndOffset === -1 ? clientId.slice(pathStart) : clientId.slice(pathStart, pathStart + pathEndOffset);
+}
+function validateClientIdentifierUrl(clientId) {
+	if (clientId !== clientId.trim() || /[\x00-\x20\x7f-\x9f\\]/.test(clientId)) throw new Error("Client Identifier URL contains invalid whitespace or characters");
+	if (!/^https:\/\//i.test(clientId)) throw new Error("Client Identifier URL must use an absolute HTTPS URL");
+	let parsed;
+	try {
+		parsed = new URL(clientId);
+	} catch {
+		throw new Error("Client Identifier URL must be a valid HTTPS URL");
+	}
+	if (parsed.protocol !== "https:") throw new Error("Client Identifier URL must use HTTPS");
+	if (parsed.username || parsed.password) throw new Error("Client Identifier URL must not contain userinfo");
+	if (parsed.hash) throw new Error("Client Identifier URL must not contain a fragment");
+	const path = rawPath(clientId);
+	if (!path) throw new Error("Client Identifier URL must contain a path component");
+	for (const segment of path.split("/")) {
+		let decodedSegment;
+		try {
+			decodedSegment = decodeURIComponent(segment);
+		} catch {
+			throw new Error("Client Identifier URL contains invalid percent encoding");
+		}
+		if (decodedSegment === "." || decodedSegment === "..") throw new Error("Client Identifier URL must not contain dot path segments");
+	}
+}
+/** Returns whether a client ID has the URL shape this package resolves through CIMD. */
+function isClientIdMetadataDocumentUrl(clientId) {
+	try {
+		return new URL(clientId).protocol === "https:" && rawPath(clientId) !== "";
+	} catch {
+		return false;
+	}
+}
+function containsPrivateJwkMaterial(value) {
+	if (value === void 0) return false;
+	const jwks = requireJsonObject(value);
+	if (!Array.isArray(jwks.keys)) throw new Error("Invalid jwks: keys must be an array");
+	const privateMembers = new Set([
+		"d",
+		"p",
+		"q",
+		"dp",
+		"dq",
+		"qi",
+		"oth",
+		"k"
+	]);
+	for (const value$1 of jwks.keys) {
+		const key = requireJsonObject(value$1);
+		if (Object.keys(key).some((member) => privateMembers.has(member))) return true;
+	}
+	return false;
+}
+function resolveClientIdMetadataDocument(metadataUrl, value, server) {
+	const raw = requireJsonObject(value);
+	const metadata = parseOAuthClientMetadata(raw);
+	if (metadata.clientId !== metadataUrl) throw new Error(`client_id "${metadata.clientId}" does not match metadata URL "${metadataUrl}"`);
+	if (!metadata.clientName?.trim()) throw new Error("client_name is required and must not be empty");
+	const redirectUris = requireValidRedirectUris(metadata.redirectUris);
+	if ("client_secret" in raw || "client_secret_expires_at" in raw) throw new Error("CIMD documents must not contain client secrets");
+	if (containsPrivateJwkMaterial(raw.jwks)) throw new Error("CIMD documents must not contain private key material");
+	const capabilities = negotiateCimdClientCapabilities(server, {
+		tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
+		grantTypes: metadata.grantTypes ?? ["authorization_code"],
+		responseTypes: metadata.responseTypes ?? ["code"]
+	});
+	return {
+		...pickDisplayMetadata(metadata),
+		clientId: metadata.clientId,
+		clientName: metadata.clientName,
+		redirectUris,
+		...capabilities
+	};
+}
+function readStreamChunk(reader, signal) {
+	if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
+	return new Promise((resolve, reject) => {
+		const abort = () => {
+			reader.cancel().catch(() => void 0);
+			reject(new DOMException("Aborted", "AbortError"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		reader.read().then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+	});
+}
+async function readJsonWithSizeLimit$1(response, maxBytes, signal) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength !== null) {
+		const declaredSize = Number(contentLength);
+		if (Number.isFinite(declaredSize) && declaredSize > maxBytes) {
+			await response.body?.cancel().catch(() => void 0);
+			throw new Error(`Client metadata exceeds size limit: ${contentLength} bytes (max ${maxBytes})`);
+		}
+	}
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("Client metadata response body is empty");
+	const chunks = [];
+	let totalSize = 0;
+	while (true) {
+		const { done, value } = await readStreamChunk(reader, signal);
+		if (done) break;
+		if (!value) continue;
+		totalSize += value.length;
+		if (totalSize > maxBytes) {
+			await reader.cancel().catch(() => void 0);
+			throw new Error(`Response exceeded size limit of ${maxBytes} bytes`);
+		}
+		chunks.push(value);
+	}
+	if (signal.aborted) throw new DOMException("Aborted", "AbortError");
+	const bytes = new Uint8Array(totalSize);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.length;
+	}
+	let text;
+	try {
+		text = new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(bytes);
+	} catch {
+		throw new Error("Client metadata response is not valid UTF-8");
+	}
+	try {
+		return {
+			value: JSON.parse(text),
+			bytes
+		};
+	} catch {
+		throw new Error("Client metadata response is not valid JSON");
+	}
+}
+function fetchCimdOrigin(metadataUrl, signal) {
+	return fetch(metadataUrl, {
+		headers: {
+			Accept: "application/json",
+			"Cache-Control": "no-store"
+		},
+		signal,
+		cache: "no-store"
+	});
+}
+async function openCimdCache() {
+	if (typeof caches === "undefined") return void 0;
+	try {
+		return await caches.open(CIMD_CACHE_NAME);
+	} catch {
+		return;
+	}
+}
+/**
+* Shared-cache lifetime derived from the origin's Cache-Control directives,
+* bounded by the server-side cap the CIMD draft permits (§5.2 "MAY define its
+* own upper and/or lower bounds on an acceptable cache lifetime"). Returns
+* undefined when the response must not be stored.
+*/
+function cacheTtlSeconds(response) {
+	const cacheControl = response.headers.get("Cache-Control");
+	if (cacheControl === null || /(?:^|,)\s*(?:no-cache|no-store|private)\b/i.test(cacheControl)) return void 0;
+	const directive = /(?:^|,)\s*s-maxage\s*=\s*"?(\d+)/i.exec(cacheControl) ?? /(?:^|,)\s*max-age\s*=\s*"?(\d+)/i.exec(cacheControl);
+	if (!directive) return void 0;
+	const ttl = Math.min(Number(directive[1]), CIMD_CACHE_MAX_TTL_SECONDS);
+	return ttl > 0 ? ttl : void 0;
+}
+async function cacheValidatedDocument(cache, metadataUrl, response, bytes) {
+	if (!cache) return;
+	const ttl = cacheTtlSeconds(response);
+	if (ttl === void 0) return;
+	const headers = new Headers({ "Cache-Control": `public, max-age=${ttl}` });
+	for (const name of [
+		"Content-Type",
+		"ETag",
+		"Last-Modified"
+	]) {
+		const value = response.headers.get(name);
+		if (value !== null) headers.set(name, value);
+	}
+	try {
+		await cache.put(metadataUrl, new Response(bytes, {
+			status: 200,
+			headers
+		}));
+	} catch {}
+}
+/**
+* Resolves a previously validated cache entry. A stored document that stops
+* validating (changed server capabilities, stricter rules after an upgrade)
+* is evicted so the caller re-resolves from origin in the same request;
+* timeout aborts propagate instead.
+*/
+async function tryResolveFromCache(cache, metadataUrl, server, signal) {
+	let cached;
+	try {
+		cached = await cache?.match(metadataUrl);
+	} catch {
+		return;
+	}
+	if (!cached) return void 0;
+	try {
+		const { value } = await readJsonWithSizeLimit$1(cached, CIMD_MAX_SIZE_BYTES, signal);
+		return resolveClientIdMetadataDocument(metadataUrl, value, server);
+	} catch (error) {
+		if (signal.aborted) throw error;
+		try {
+			await cache?.delete(metadataUrl);
+		} catch {}
+		return;
+	}
+}
+/**
+* Fetches, bounds, parses, validates, and negotiates a Client ID Metadata
+* Document into the single effective client configuration used by OAuth flows.
+*/
+async function fetchClientIdMetadataDocument(metadataUrl, server) {
+	validateClientIdentifierUrl(metadataUrl);
+	const abortController = new AbortController();
+	const timeoutId = setTimeout(() => abortController.abort(), CIMD_FETCH_TIMEOUT_MS);
+	try {
+		const cache = await openCimdCache();
+		const cachedDocument = await tryResolveFromCache(cache, metadataUrl, server, abortController.signal);
+		if (cachedDocument) return cachedDocument;
+		const response = await fetchCimdOrigin(metadataUrl, abortController.signal);
+		if (!response.ok) throw new Error(`Failed to fetch client metadata: HTTP ${response.status}`);
+		const { value, bytes } = await readJsonWithSizeLimit$1(response, CIMD_MAX_SIZE_BYTES, abortController.signal);
+		const resolved = resolveClientIdMetadataDocument(metadataUrl, value, server);
+		clearTimeout(timeoutId);
+		await cacheValidatedDocument(cache, metadataUrl, response, bytes);
+		return resolved;
+	} catch (error) {
+		if (abortController.signal.aborted) throw new Error(`Client metadata fetch timed out after ${CIMD_FETCH_TIMEOUT_MS}ms`);
+		throw error;
+	} finally {
+		clearTimeout(timeoutId);
+	}
+}
+
 //#endregion
 //#region src/ema/constants.ts
 /**
@@ -794,6 +1253,15 @@ let GrantType = /* @__PURE__ */ function(GrantType$1) {
 	GrantType$1["JWT_BEARER"] = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 	return GrantType$1;
 }({});
+function toPublicClientInfo(client) {
+	const { authMethodExplicit: _explicit, ...publicClient } = client;
+	return publicClient;
+}
+function isClientAuthMethodAllowed(client, presentedMethod, isClientMetadataDocument) {
+	if (presentedMethod === client.tokenEndpointAuthMethod) return true;
+	const isSecretMethod = (method) => method === "client_secret_basic" || method === "client_secret_post";
+	return !isClientMetadataDocument && client.authMethodExplicit === void 0 && isSecretMethod(client.tokenEndpointAuthMethod) && isSecretMethod(presentedMethod);
+}
 /**
 * OAuth 2.0 Provider implementation for Cloudflare Workers
 * Implements authorization code flow with support for refresh tokens
@@ -848,7 +1316,7 @@ function getOAuthApi(options, env) {
 * annotation, and does not actually prevent the method from being called from outside the class,
 * including over RPC.
 */
-var OAuthProviderImpl = class OAuthProviderImpl {
+var OAuthProviderImpl = class {
 	/**
 	* Creates a new OAuth provider instance
 	* @param options - Configuration options for the provider
@@ -935,7 +1403,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	/** Validate configured RFC 9728 protected resource metadata. */
 	validateResourceMetadataOptions(options) {
 		if (!options) return;
-		if (options.resource && !validateResourceUri(options.resource)) throw new TypeError("resourceMetadata.resource must be an absolute HTTP(S) URI without a fragment");
+		if (options.resource !== void 0 && !validateResourceUri(options.resource)) throw new TypeError("resourceMetadata.resource must be an absolute HTTP(S) URI without a fragment");
 		if (options.authorization_servers !== void 0) {
 			if (options.authorization_servers.length === 0) throw new TypeError("resourceMetadata.authorization_servers must contain at least one issuer");
 			for (const issuer of options.authorization_servers) {
@@ -1179,7 +1647,16 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		}
 		if (!clientInfo) return this.createInvalidClientResponse("Client not found", basicAuthenticationAttempted);
 		const presentedAuthMethod = basicAuthenticationAttempted ? "client_secret_basic" : formData.has("client_secret") ? "client_secret_post" : "none";
-		if (presentedAuthMethod !== clientInfo.tokenEndpointAuthMethod) return this.createInvalidClientResponse("Client authentication failed", basicAuthenticationAttempted);
+		const registeredAuthMethod = clientInfo.tokenEndpointAuthMethod;
+		if (!isClientAuthMethodAllowed(clientInfo, presentedAuthMethod, !!this.options.clientIdMetadataDocumentEnabled && this.isClientMetadataUrl(clientInfo.clientId))) return this.createInvalidClientResponse("Client authentication failed", basicAuthenticationAttempted, {
+			category: "client-authentication",
+			reason: "token_endpoint_auth_method_mismatch",
+			detail: {
+				clientId: clientInfo.clientId,
+				registeredMethod: registeredAuthMethod,
+				presentedMethod: presentedAuthMethod
+			}
+		});
 		if (presentedAuthMethod !== "none") {
 			if (!clientSecret) return this.createInvalidClientResponse("Client authentication failed: missing client_secret", basicAuthenticationAttempted);
 			if (!clientInfo.clientSecret) return this.createInvalidClientResponse("Client authentication failed: client has no registered secret", basicAuthenticationAttempted);
@@ -1671,7 +2148,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		let tokenScopes = this.downscope(requestedScopes, tokenSummary.scope);
 		const configuredResource = this.options.resourceMetadata?.resource;
 		if (configuredResource && !isExactResource(tokenSummary.audience, configuredResource)) throw new OAuthError("invalid_target", { description: "Subject token is not bound to the configured resource" });
-		const newAudience = this.resolveTokenResource(requestedResource, grantData.resource);
+		const newAudience = requestedResource === void 0 ? tokenSummary.audience : this.resolveTokenResource(requestedResource, grantData.resource);
 		const now = Math.floor(Date.now() / 1e3);
 		const subjectTokenRemainingLifetime = tokenSummary.expiresAt - now;
 		if (subjectTokenRemainingLifetime < KV_MIN_EXPIRATION_TTL_SECONDS) throw new OAuthError("invalid_grant", { description: "Subject token is too close to expiry to exchange" });
@@ -2064,35 +2541,29 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			statusCode: 413
 		});
 		const callbackRequest = request.clone();
-		let clientMetadata;
+		let parsedJson;
 		try {
 			const text = await request.text();
 			if (text.length > 1048576) return this.createErrorResponse("invalid_request", {
 				description: "Request payload too large, must be under 1 MiB",
 				statusCode: 413
 			});
-			clientMetadata = JSON.parse(text);
-		} catch (error) {
+			parsedJson = JSON.parse(text);
+		} catch {
 			return this.createErrorResponse("invalid_request", {
 				description: "Invalid JSON payload",
 				statusCode: 400
 			});
 		}
-		let authMethod;
-		let grantTypes;
-		let responseTypes;
+		let clientMetadata;
+		let metadata;
 		try {
-			authMethod = OAuthProviderImpl.validateStringField(clientMetadata.token_endpoint_auth_method) || "client_secret_basic";
-			grantTypes = OAuthProviderImpl.validateStringArray(clientMetadata.grant_types, "grant_types") || [GrantType.AUTHORIZATION_CODE];
-			responseTypes = OAuthProviderImpl.validateStringArray(clientMetadata.response_types, "response_types") || ["code"];
-			validateClientCapabilities(this.serverCapabilities, {
-				tokenEndpointAuthMethod: authMethod,
-				grantTypes,
-				responseTypes
-			});
+			clientMetadata = requireJsonObject(parsedJson);
+			metadata = resolveDynamicClientRegistrationMetadata(clientMetadata, this.serverCapabilities);
 		} catch (error) {
 			return this.createErrorResponse("invalid_client_metadata", { description: error instanceof Error ? error.message : "Invalid client metadata" });
 		}
+		const authMethod = metadata.tokenEndpointAuthMethod;
 		const isPublicClient = authMethod === "none";
 		if (isPublicClient && this.options.disallowPublicClientRegistration) return this.createErrorResponse("invalid_client_metadata", { description: "Public client registration is not allowed" });
 		const clientId = generateRandomString(16);
@@ -2102,31 +2573,24 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			clientSecret = generateRandomString(32);
 			hashedSecret = await hashSecret(clientSecret);
 		}
-		let clientInfo;
-		try {
-			const redirectUris = OAuthProviderImpl.validateStringArray(clientMetadata.redirect_uris);
-			if (!redirectUris || redirectUris.length === 0) throw new Error("At least one redirect URI is required");
-			for (const uri of redirectUris) validateRedirectUriScheme(uri);
-			clientInfo = {
-				clientId,
-				redirectUris,
-				clientName: OAuthProviderImpl.validateStringField(clientMetadata.client_name, "client_name"),
-				logoUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.logo_uri, "logo_uri"),
-				clientUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.client_uri, "client_uri"),
-				policyUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.policy_uri, "policy_uri"),
-				tosUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.tos_uri, "tos_uri"),
-				jwksUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.jwks_uri, "jwks_uri"),
-				i18n: OAuthProviderImpl.extractI18nFields(clientMetadata),
-				contacts: OAuthProviderImpl.validateStringArray(clientMetadata.contacts),
-				grantTypes,
-				responseTypes,
-				registrationDate: Math.floor(Date.now() / 1e3),
-				tokenEndpointAuthMethod: authMethod
-			};
-			if (!isPublicClient && hashedSecret) clientInfo.clientSecret = hashedSecret;
-		} catch (error) {
-			return this.createErrorResponse("invalid_client_metadata", { description: error instanceof Error ? error.message : "Invalid client metadata" });
-		}
+		const clientInfo = {
+			clientId,
+			redirectUris: metadata.redirectUris,
+			clientName: metadata.clientName,
+			logoUri: metadata.logoUri,
+			clientUri: metadata.clientUri,
+			policyUri: metadata.policyUri,
+			tosUri: metadata.tosUri,
+			jwksUri: metadata.jwksUri,
+			i18n: metadata.i18n,
+			contacts: metadata.contacts,
+			grantTypes: metadata.grantTypes,
+			responseTypes: metadata.responseTypes,
+			registrationDate: Math.floor(Date.now() / 1e3),
+			tokenEndpointAuthMethod: authMethod,
+			...metadata.authMethodExplicit ? { authMethodExplicit: true } : {},
+			...!isPublicClient && hashedSecret ? { clientSecret: hashedSecret } : {}
+		};
 		if (this.options.clientRegistrationCallback) {
 			let callbackResult;
 			try {
@@ -2147,7 +2611,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		}
 		const clientKvOptions = {};
 		if (this.options.clientRegistrationTTL !== void 0) clientKvOptions.expirationTtl = this.options.clientRegistrationTTL;
-		await env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(clientInfo), clientKvOptions);
+		await env.OAUTH_KV.put(`client:${clientInfo.clientId}`, JSON.stringify(clientInfo), clientKvOptions);
 		const response = {
 			client_id: clientInfo.clientId,
 			redirect_uris: clientInfo.redirectUris,
@@ -2342,7 +2806,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			}
 			if (!this.hasGlobalFetchStrictlyPublic()) throw new Error(`CIMD is enabled but 'global_fetch_strictly_public' compatibility flag is not set.`);
 			try {
-				return await this.fetchClientMetadataDocument(clientId);
+				return await fetchClientIdMetadataDocument(clientId, this.serverCapabilities);
 			} catch (error) {
 				console.warn(`CIMD fetch failed for ${clientId}:`, error instanceof Error ? error.message : error);
 				throw new CimdFetchError(clientId, error);
@@ -2353,19 +2817,26 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	}
 	/**
 	* Resolves an access-token audience from a token request and its authorization grant.
-	* Explicit resource configuration requires one exact value in both places. Without
-	* configuration, RFC 8707 downscoping is allowed and omission inherits the grant.
+	* A configured canonical resource is inherited when omitted but cannot be overridden.
+	* Without configuration, RFC 8707 downscoping is allowed, omission inherits a
+	* bound grant, and a legacy unbound grant retains the v0.8.2 behavior.
 	*/
 	resolveTokenResource(requestedResource, grantedResource) {
+		const resourceWasProvided = requestedResource !== void 0;
 		const requestedAudience = parseResourceParameter(requestedResource);
-		if (requestedResource && !requestedAudience) throw new OAuthError("invalid_target", { description: "The resource parameter must be a valid absolute URI without a fragment" });
+		if (resourceWasProvided && !requestedAudience) throw new OAuthError("invalid_target", { description: "The resource parameter must be a valid absolute URI without a fragment" });
+		const grantResourceWasStored = grantedResource !== void 0;
 		const grantedAudience = parseResourceParameter(grantedResource);
-		if (grantedResource && !grantedAudience) throw new OAuthError("invalid_target", { description: "The authorization grant contains an invalid resource" });
+		if (grantResourceWasStored && !grantedAudience) throw new OAuthError("invalid_target", { description: "The authorization grant contains an invalid resource" });
 		const configuredResource = this.options.resourceMetadata?.resource;
-		if (configuredResource && (!isExactResource(grantedResource, configuredResource) || !isExactResource(requestedResource, configuredResource))) throw new OAuthError("invalid_target", { description: `The resource parameter must exactly match ${configuredResource}` });
-		if (!configuredResource && requestedResource && !grantedResource) throw new OAuthError("invalid_target", { description: "Requested resource was not included in the authorization request" });
-		const originOnly = configuredResource ? false : !!this.options.resourceMatchOriginOnly;
-		if (requestedResource && grantedResource) {
+		if (configuredResource) {
+			if (resourceWasProvided && !isExactResource(requestedResource, configuredResource)) throw new OAuthError("invalid_target", { description: `The resource parameter must exactly match ${configuredResource}` });
+			if (isExactResource(grantedResource, configuredResource)) return configuredResource;
+			if (!grantResourceWasStored) return configuredResource;
+			throw new OAuthError("invalid_target", { description: "The authorization grant is not bound to the configured resource" });
+		}
+		const originOnly = !!this.options.resourceMatchOriginOnly;
+		if (resourceWasProvided && grantResourceWasStored) {
 			const requestedResources = Array.isArray(requestedResource) ? requestedResource : [requestedResource];
 			const grantedResources = Array.isArray(grantedResource) ? grantedResource : [grantedResource];
 			for (const requested of requestedResources) if (!grantedResources.some((granted) => resourceMatches(requested, granted, originOnly))) throw new OAuthError("invalid_target", { description: "Requested resource was not included in the authorization request" });
@@ -2430,207 +2901,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	* Not private because OAuthHelpersImpl needs access for purgeExpiredData.
 	*/
 	isClientMetadataUrl(clientId) {
-		try {
-			const url = new URL(clientId);
-			return url.protocol === "https:" && url.pathname !== "/";
-		} catch {
-			return false;
-		}
-	}
-	static {
-		this.CIMD_MAX_SIZE_BYTES = 5 * 1024;
-	}
-	static {
-		this.CIMD_FETCH_TIMEOUT_MS = 1e4;
-	}
-	static {
-		this.CIMD_ALLOWED_AUTH_METHODS = ["none"];
-	}
-	/**
-	* Validates that a field is a string or undefined
-	* @param field - The field value to validate
-	* @param fieldName - Name of the field for error messages
-	* @returns The validated string or undefined
-	* @throws Error if field is not a string or undefined
-	*/
-	static validateStringField(field, fieldName) {
-		if (field === void 0) return void 0;
-		if (typeof field !== "string") throw new Error(fieldName ? `Invalid ${fieldName}: expected string, got ${typeof field}` : "Field must be a string");
-		return field;
-	}
-	/**
-	* Validates that a field is an optional URI string using a safe scheme.
-	*
-	* Client metadata URI fields (e.g. logo_uri, client_uri, policy_uri, tos_uri,
-	* jwks_uri) are frequently rendered into HTML attributes such as `<a href>` or
-	* `<img src>` on consent screens. Permitting non-http(s) schemes such as
-	* `javascript:` or `data:` would allow script execution in that context, so we
-	* require an absolute http: or https: URL here, matching how redirect URIs are
-	* already restricted.
-	*
-	* @param field - The field to validate
-	* @param fieldName - Name of the field for error messages
-	* @returns The validated URI string or undefined
-	* @throws Error if the field is not a string or is not an absolute http(s) URL
-	*/
-	static validateOptionalUriField(field, fieldName) {
-		const value = OAuthProviderImpl.validateStringField(field, fieldName);
-		if (value === void 0) return void 0;
-		let parsed;
-		try {
-			parsed = new URL(value);
-		} catch {
-			throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
-		return value;
-	}
-	static {
-		this.I18N_FIELDS = {
-			client_name: "string",
-			client_uri: "uri",
-			logo_uri: "uri",
-			tos_uri: "uri",
-			policy_uri: "uri"
-		};
-	}
-	/**
-	* Extracts RFC 7591 §2.2 internationalized metadata variants from a raw
-	* registration payload.
-	*
-	* Localized variants are expressed by appending a `#<BCP 47 language tag>`
-	* suffix to a metadata member name (e.g. `client_name#ja`, `tos_uri#fr`).
-	* Only the human-readable fields the RFC names are considered; each value is
-	* validated with the same rules as its canonical field (URI fields must be
-	* absolute http(s) URLs). The raw `field#tag` keys are preserved verbatim so
-	* that consumers can do their own locale matching.
-	*
-	* @param raw - The parsed client metadata object
-	* @returns A map of `field#tag` to validated value, or undefined if none present
-	* @throws Error if a localized value fails its field's validation
-	*/
-	static extractI18nFields(raw) {
-		const result = {};
-		for (const key of Object.keys(raw)) {
-			const hashIndex = key.indexOf("#");
-			if (hashIndex <= 0 || hashIndex === key.length - 1) continue;
-			const baseField = key.slice(0, hashIndex);
-			const kind = OAuthProviderImpl.I18N_FIELDS[baseField];
-			if (!kind) continue;
-			const validated = kind === "uri" ? OAuthProviderImpl.validateOptionalUriField(raw[key], key) : OAuthProviderImpl.validateStringField(raw[key], key);
-			if (validated !== void 0) result[key] = validated;
-		}
-		return Object.keys(result).length > 0 ? result : void 0;
-	}
-	/**
-	* Validates that a field is a string array or undefined
-	* @param arr - The array to validate
-	* @param fieldName - Name of the field for error messages
-	* @returns The validated string array or undefined
-	* @throws Error if field is not a string array or undefined
-	*/
-	static validateStringArray(arr, fieldName) {
-		if (arr === void 0) return void 0;
-		if (!Array.isArray(arr)) throw new Error(fieldName ? `Invalid ${fieldName}: expected array, got ${typeof arr}` : "Field must be an array");
-		if (!arr.every((item) => typeof item === "string")) throw new Error(fieldName ? `Invalid ${fieldName}: array must contain only strings` : "All array elements must be strings");
-		return arr;
-	}
-	/**
-	* Fetches and validates a Client ID Metadata Document from the given URL
-	* Per the MCP spec, the client_id in the document must match the URL exactly
-	*
-	* Uses Cloudflare HTTP cache for caching (via cacheEverything option).
-	* Response size is limited to 5KB per IETF spec.
-	*
-	* @param metadataUrl - The HTTPS URL to fetch metadata from
-	* @returns The client information
-	* @throws Error if fetch fails or validation fails
-	*/
-	async fetchClientMetadataDocument(metadataUrl) {
-		const abortController = new AbortController();
-		const timeoutId = setTimeout(() => abortController.abort(), OAuthProviderImpl.CIMD_FETCH_TIMEOUT_MS);
-		try {
-			const response = await fetch(metadataUrl, {
-				headers: { Accept: "application/json" },
-				signal: abortController.signal,
-				cf: { cacheEverything: true }
-			});
-			clearTimeout(timeoutId);
-			if (!response.ok) throw new Error(`Failed to fetch client metadata: HTTP ${response.status}`);
-			const contentLength = response.headers.get("content-length");
-			if (contentLength && parseInt(contentLength, 10) > OAuthProviderImpl.CIMD_MAX_SIZE_BYTES) throw new Error(`Client metadata exceeds size limit: ${contentLength} bytes (max ${OAuthProviderImpl.CIMD_MAX_SIZE_BYTES})`);
-			const rawMetadata = await this.readJsonWithSizeLimit(response, OAuthProviderImpl.CIMD_MAX_SIZE_BYTES);
-			const clientId = OAuthProviderImpl.validateStringField(rawMetadata.client_id, "client_id");
-			const clientName = OAuthProviderImpl.validateStringField(rawMetadata.client_name, "client_name");
-			const redirectUris = OAuthProviderImpl.validateStringArray(rawMetadata.redirect_uris, "redirect_uris");
-			const declaredAuthMethod = OAuthProviderImpl.validateStringField(rawMetadata.token_endpoint_auth_method, "token_endpoint_auth_method");
-			const authMethodChoices = OAuthProviderImpl.validateStringArray(rawMetadata.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported");
-			const tokenEndpointAuthMethod = declaredAuthMethod ?? (authMethodChoices?.includes("none") ? "none" : void 0);
-			if (clientId !== metadataUrl) throw new Error(`client_id "${clientId}" does not match metadata URL "${metadataUrl}"`);
-			if (!clientName?.trim()) throw new Error("client_name is required and must not be empty");
-			if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
-			if (declaredAuthMethod && !OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.includes(declaredAuthMethod) || authMethodChoices && !authMethodChoices.some((method) => OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.includes(method))) throw new Error(`CIMD client does not support an accepted token endpoint authentication method. Supported methods: ${OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.join(", ")}`);
-			const grantTypes = OAuthProviderImpl.validateStringArray(rawMetadata.grant_types, "grant_types") || [GrantType.AUTHORIZATION_CODE];
-			const responseTypes = OAuthProviderImpl.validateStringArray(rawMetadata.response_types, "response_types") || ["code"];
-			const effectiveAuthMethod = tokenEndpointAuthMethod || "none";
-			validateClientCapabilities(this.serverCapabilities, {
-				tokenEndpointAuthMethod: effectiveAuthMethod,
-				grantTypes,
-				responseTypes
-			});
-			return {
-				clientId,
-				redirectUris,
-				clientName,
-				clientUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.client_uri, "client_uri"),
-				logoUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.logo_uri, "logo_uri"),
-				policyUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.policy_uri, "policy_uri"),
-				tosUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.tos_uri, "tos_uri"),
-				jwksUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.jwks_uri, "jwks_uri"),
-				i18n: OAuthProviderImpl.extractI18nFields(rawMetadata),
-				contacts: OAuthProviderImpl.validateStringArray(rawMetadata.contacts, "contacts"),
-				grantTypes,
-				responseTypes,
-				tokenEndpointAuthMethod: effectiveAuthMethod
-			};
-		} finally {
-			clearTimeout(timeoutId);
-		}
-	}
-	/**
-	* Reads JSON from a response with a size limit to prevent DoS attacks.
-	* Streams the response body and aborts if it exceeds the limit.
-	*
-	* @param response - The fetch response
-	* @param maxBytes - Maximum allowed size in bytes
-	* @returns Parsed JSON object
-	* @throws Error if response body is null, size exceeded, or JSON parse failed
-	*/
-	async readJsonWithSizeLimit(response, maxBytes) {
-		const reader = response.body?.getReader();
-		if (!reader) throw new Error("Response body is null");
-		const chunks = [];
-		let totalSize = 0;
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (value) {
-				totalSize += value.length;
-				if (totalSize > maxBytes) {
-					await reader.cancel();
-					throw new Error(`Response exceeded size limit of ${maxBytes} bytes`);
-				}
-				chunks.push(value);
-			}
-		}
-		const allChunks = new Uint8Array(totalSize);
-		let position = 0;
-		for (const chunk of chunks) {
-			allChunks.set(chunk, position);
-			position += chunk.length;
-		}
-		const text = new TextDecoder().decode(allChunks);
-		return JSON.parse(text);
+		return isClientIdMetadataDocumentUrl(clientId);
 	}
 	/**
 	* Builds a WWW-Authenticate header value with resource_metadata per RFC 9728 §5.1
@@ -2885,6 +3156,7 @@ function audienceMatches(resourceServerUrl, audienceValue) {
 function parseResourceParameter(value) {
 	if (!value) return;
 	const uris = Array.isArray(value) ? value : [value];
+	if (uris.length === 0) return;
 	for (const uri of uris) if (typeof uri !== "string" || !validateResourceUri(uri)) return;
 	return value;
 }
@@ -2968,34 +3240,6 @@ async function generateTokenId(token) {
 	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 /**
-* Validates that a redirect URI does not use a dangerous pseudo-scheme.
-* Normalizes the URI by trimming whitespace and checking the scheme in a
-* case-insensitive manner to prevent bypass attacks.
-* Per RFC 3986, control characters are explicitly disallowed in URIs and
-* will cause rejection rather than silent removal.
-* @param redirectUri - The redirect URI to validate
-* @throws Error if the URI uses a blacklisted scheme or contains control characters
-*/
-function validateRedirectUriScheme(redirectUri) {
-	const dangerousSchemes = [
-		"javascript:",
-		"data:",
-		"vbscript:",
-		"file:",
-		"mailto:",
-		"blob:"
-	];
-	const normalized = redirectUri.trim();
-	for (let i = 0; i < normalized.length; i++) {
-		const code = normalized.charCodeAt(i);
-		if (code >= 0 && code <= 31 || code >= 127 && code <= 159) throw new Error("Invalid redirect URI");
-	}
-	const colonIndex = normalized.indexOf(":");
-	if (colonIndex === -1) throw new Error("Invalid redirect URI");
-	const scheme = normalized.substring(0, colonIndex + 1).toLowerCase();
-	for (const dangerousScheme of dangerousSchemes) if (scheme === dangerousScheme) throw new Error("Invalid redirect URI");
-}
-/**
 * Checks if a URI is a loopback redirect URI (127.0.0.0/8, ::1, or localhost).
 * Per RFC 8252 Section 7.3, loopback IPs get special port handling. This library
 * applies the same port flexibility to localhost for native apps (e.g., Claude Code).
@@ -3258,11 +3502,14 @@ var OAuthHelpersImpl = class {
 		const withRedirect = (error) => {
 			throw withAuthorizationRedirect(error, redirectUri, state || void 0, issuer);
 		};
+		const resourceWasProvided = resourceParam !== void 0;
 		let resource = parseResourceParameter(resourceParam);
-		if (resourceParam && !resource) withRedirect(new AuthorizationError("invalid_request", { description: "The resource parameter must be a valid absolute URI without a fragment" }));
+		if (resourceWasProvided && !resource) withRedirect(new AuthorizationError("invalid_target", { description: "The resource parameter must be a valid absolute URI without a fragment" }));
 		const configuredResource = this.provider.options.resourceMetadata?.resource;
-		if (configuredResource && !isExactResource(resource, configuredResource)) withRedirect(new AuthorizationError("invalid_request", { description: `The resource parameter must exactly match ${configuredResource}` }));
-		resource ??= url.origin;
+		if (configuredResource) {
+			if (resourceWasProvided && !isExactResource(resource, configuredResource)) withRedirect(new AuthorizationError("invalid_target", { description: `The resource parameter must exactly match ${configuredResource}` }));
+			resource = configuredResource;
+		}
 		try {
 			validateAuthorizationResponseType(this.provider.serverCapabilities, responseType, clientInfo.responseTypes);
 			validateAuthorizationPkce(this.provider.serverCapabilities, {
@@ -3298,7 +3545,8 @@ var OAuthHelpersImpl = class {
 	* validating the metadata document fails.
 	*/
 	async lookupClient(clientId) {
-		return await this.provider.getClient(this.env, clientId);
+		const client = await this.provider.getClient(this.env, clientId);
+		return client ? toPublicClientInfo(client) : null;
 	}
 	/**
 	* Completes an authorization request by creating a grant and either:
@@ -3316,8 +3564,11 @@ var OAuthHelpersImpl = class {
 		if (!clientInfo || !isValidRedirectUri(redirectUri, clientInfo.redirectUris)) throw new Error("Invalid redirect URI. The redirect URI provided does not match any registered URI for this client.");
 		validateAuthorizationResponseType(this.provider.serverCapabilities, options.request.responseType, clientInfo.responseTypes);
 		const configuredResource = this.provider.options.resourceMetadata?.resource;
-		if (configuredResource && !isExactResource(options.request.resource, configuredResource)) throw new Error(`The resource parameter must exactly match ${configuredResource}`);
-		const effectiveResource = options.request.resource ?? options.request.issuer;
+		const resourceWasProvided = options.request.resource !== void 0;
+		const parsedResource = parseResourceParameter(options.request.resource);
+		if (resourceWasProvided && !parsedResource) throw new AuthorizationError("invalid_target", { description: "The resource parameter must be a valid absolute URI without a fragment" });
+		if (configuredResource && resourceWasProvided && !isExactResource(parsedResource, configuredResource)) throw new AuthorizationError("invalid_target", { description: `The resource parameter must exactly match ${configuredResource}` });
+		const effectiveResource = configuredResource ?? parsedResource;
 		validateAuthorizationPkce(this.provider.serverCapabilities, options.request, clientInfo);
 		let grantsToRevoke = [];
 		if (options.revokeExistingGrants !== false) {
@@ -3423,6 +3674,7 @@ var OAuthHelpersImpl = class {
 	*/
 	async createClient(clientInfo) {
 		const clientId = generateRandomString(16);
+		const authMethodWasExplicit = clientInfo.tokenEndpointAuthMethod !== void 0;
 		const tokenEndpointAuthMethod = clientInfo.tokenEndpointAuthMethod || "client_secret_basic";
 		const isPublicClient = tokenEndpointAuthMethod === "none";
 		const newClient = {
@@ -3443,7 +3695,8 @@ var OAuthHelpersImpl = class {
 			],
 			responseTypes: clientInfo.responseTypes || ["code"],
 			registrationDate: Math.floor(Date.now() / 1e3),
-			tokenEndpointAuthMethod
+			tokenEndpointAuthMethod,
+			...authMethodWasExplicit ? { authMethodExplicit: true } : {}
 		};
 		for (const uri of newClient.redirectUris) validateRedirectUriScheme(uri);
 		let clientSecret;
@@ -3452,7 +3705,7 @@ var OAuthHelpersImpl = class {
 			newClient.clientSecret = await hashSecret(clientSecret);
 		}
 		await this.env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(newClient));
-		const clientResponse = { ...newClient };
+		const clientResponse = toPublicClientInfo(newClient);
 		if (!isPublicClient && clientSecret) clientResponse.clientSecret = clientSecret;
 		return clientResponse;
 	}
@@ -3470,7 +3723,7 @@ var OAuthHelpersImpl = class {
 		const promises = response.keys.map(async (key) => {
 			const clientId = key.name.substring(7);
 			const client = await this.provider.getClient(this.env, clientId);
-			if (client) clients.push(client);
+			if (client) clients.push(toPublicClientInfo(client));
 		});
 		await Promise.all(promises);
 		return {
@@ -3487,7 +3740,8 @@ var OAuthHelpersImpl = class {
 	async updateClient(clientId, updates) {
 		const client = await this.provider.getClient(this.env, clientId);
 		if (!client) return null;
-		let authMethod = updates.tokenEndpointAuthMethod || client.tokenEndpointAuthMethod || "client_secret_basic";
+		const authMethodWasExplicit = updates.tokenEndpointAuthMethod !== void 0;
+		const authMethod = updates.tokenEndpointAuthMethod || client.tokenEndpointAuthMethod || "client_secret_basic";
 		const isPublicClient = authMethod === "none";
 		let secretToStore = client.clientSecret;
 		let originalSecret = void 0;
@@ -3500,14 +3754,15 @@ var OAuthHelpersImpl = class {
 			...client,
 			...updates,
 			clientId: client.clientId,
-			tokenEndpointAuthMethod: authMethod
+			tokenEndpointAuthMethod: authMethod,
+			authMethodExplicit: authMethodWasExplicit ? true : client.authMethodExplicit
 		};
 		if (!isPublicClient && secretToStore) updatedClient.clientSecret = secretToStore;
 		else delete updatedClient.clientSecret;
 		const clientKvOptions = {};
 		if (this.provider.options.clientRegistrationTTL !== void 0) clientKvOptions.expirationTtl = this.provider.options.clientRegistrationTTL;
 		await this.env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(updatedClient), clientKvOptions);
-		const response = { ...updatedClient };
+		const response = toPublicClientInfo(updatedClient);
 		if (!isPublicClient && originalSecret) response.clientSecret = originalSecret;
 		return response;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",