@cloudflare/workers-oauth-provider 0.10.1 → 0.10.3

package/README.md

@@ -248,6 +248,8 @@ A typical flow has three steps:
 
 `completeAuthorization()` stores a new grant and, by default, revokes existing grants for the same user and client after the new grant is safely stored. Set `revokeExistingGrants: false` only when the application intentionally allows concurrent grants for the same user and client.
 
+For Client ID Metadata Document clients, whose client_id is the metadata URL shared by every installation, default revocation is additionally scoped to grants created from the same redirect URI, so one installation's re-authorization does not revoke another's. Grants created before the redirect URI was recorded are never auto-revoked by CIMD clients.
+
 For users with many grants, `revokeExistingGrantsBatchSize` controls the KV page size used during that scan. It defaults to `50` and is capped at KV's maximum page size of `1000`.
 
 ### Authorization response issuer
@@ -294,18 +296,21 @@ new OAuthProvider({
 }
 ```
 
-The compatibility flag prevents outbound CIMD fetches from using legacy same-zone origin routing, which is necessary for SSRF protection. The provider advertises `client_id_metadata_document_supported: true` only when both settings are present.
+The compatibility flag prevents outbound CIMD fetches from using legacy same-zone origin routing, which is necessary for SSRF protection. The provider advertises `client_id_metadata_document_supported: true` only when both settings are present. CIMD fetches also use the `cache` option of `fetch`, which requires a compatibility date of `2024-11-11` or later (or the `cache_option_enabled` compatibility flag).
 
-CIMD validation includes:
+CIMD validation follows [draft-ietf-oauth-client-id-metadata-document-00](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00) — the revision pinned by the MCP 2026-07-28 authorization spec — and includes:
 
-- HTTPS URL with a non-root path.
+- An HTTPS Client Identifier URL with a path component and no userinfo, fragment, or dot path segments.
 - A document `client_id` exactly matching its URL.
-- Non-empty `client_name` and `redirect_uris` fields.
+- Non-empty `client_name` and `redirect_uris` fields, as MCP requires, with unsafe redirect schemes rejected at ingestion.
 - Exact authorization-request redirect URI validation, with RFC 8252 loopback port handling.
-- A 5 KB response size limit and 10 second fetch timeout.
-- Safe URI schemes for client metadata fields.
+- A 5 KB response size limit and a 10 second timeout covering both headers and body.
+- Valid UTF-8 JSON object syntax and safe URI schemes for client metadata fields.
+- No embedded client secrets or private JWK material.
+
+Validated documents are cached according to their `Cache-Control` headers, capped at 7 days. Error responses and invalid documents are never cached, and a cached document that stops validating is evicted and re-resolved from origin within the same request.
 
-CIMD currently supports only `token_endpoint_auth_method: "none"`.
+CIMD token endpoint authentication is negotiated from `token_endpoint_auth_method` and the OpenID RP Metadata Choices field `token_endpoint_auth_methods_supported`. The provider currently implements only `none`: a client may prefer `private_key_jwt` while also offering `none`, in which case the provider selects `none` and applies public-client PKCE requirements. A client that offers only `private_key_jwt` is rejected until assertion validation is implemented.
 
 When a CIMD document cannot be fetched or validated, the token endpoint returns a generic `invalid_client` response and reports diagnostics through `onError.internal`. `OAuthHelpers` methods that resolve a CIMD client throw the exported `CimdFetchError`, allowing applications to distinguish an upstream metadata failure from a client that does not exist. See [Advanced configuration](https://github.com/cloudflare/workers-oauth-provider/blob/main/docs/advanced-configuration.md#cimd-fetch-errors) for an example.
 
@@ -319,9 +324,9 @@ clientRegistrationEndpoint: '/oauth/register';
 
 MCP 2026-07-28 deprecates DCR for new implementations in favor of CIMD. The endpoint remains useful for compatibility with clients that do not support CIMD.
 
-Registration accepts only authentication methods, grants, and response types implemented by the configured provider, and rejects inconsistent grant/response combinations before storage. Omitted metadata uses the RFC 7591 defaults: `client_secret_basic`, `grant_types: ["authorization_code"]`, and `response_types: ["code"]`.
+Registration accepts only authentication methods, grants, and response types implemented by the configured provider, and rejects inconsistent grant/response combinations before storage. Choice-valued `token_endpoint_auth_methods_supported` input is negotiated to one effective `token_endpoint_auth_method`; grant and response registrations remain strict. Omitted metadata uses the RFC 7591 defaults: `client_secret_basic`, `grant_types: ["authorization_code"]`, and `response_types: ["code"]`.
 
-An explicitly supplied `token_endpoint_auth_method` is enforced exactly. When it is omitted, no explicit-method marker is stored and the client may use either `client_secret_basic` or `client_secret_post`, provided the same stored secret validates. Client records written by earlier releases have no marker and receive the same compatibility. This never crosses between `none` and a secret method and does not apply to CIMD clients.
+The effective `token_endpoint_auth_method` returned by registration is enforced exactly. When both authentication metadata fields are omitted, no explicit-method marker is stored and the client may use either `client_secret_basic` or `client_secret_post`, provided the same stored secret validates. Client records written by earlier releases have no marker and receive the same compatibility. This never crosses between `none` and a secret method and does not apply to CIMD clients.
 
 Calling `OAuthHelpers.updateClient()` with `tokenEndpointAuthMethod` adds the marker; unrelated updates leave it unchanged.
 
@@ -465,6 +470,7 @@ The package implements or supports the relevant portions of:
 - [OAuth 2.0 Authorization Server Issuer Identification, RFC 9207](https://datatracker.ietf.org/doc/html/rfc9207)
 - [OAuth 2.0 Protected Resource Metadata, RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728)
 - [OAuth Client ID Metadata Documents](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00)
+- [OpenID Connect RP Metadata Choices 1.0](https://openid.net/specs/openid-connect-rp-metadata-choices-1_0-final.html)
 - [MCP Enterprise-Managed Authorization](https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization), with experimental package support
 
 ## Development

package/dist/oauth-provider.d.ts

@@ -1103,6 +1103,13 @@ interface Grant {
    * Indicates the protected resource(s) for which access is requested
    */
   resource?: string | string[];
+  /**
+   * The exact redirect URI used in the authorization request that created this grant
+   * Recorded so that default grant revocation can be scoped to a single installation
+   * of a CIMD client (whose client_id is shared across all installations). Absent on
+   * grants created before this field was introduced.
+   */
+  redirectUri?: string;
 }
 /**
  * OAuth 2.0 Token Response
@@ -1314,6 +1321,13 @@ interface GrantSummary {
    * Unix timestamp when the grant expires (if TTL is configured)
    */
   expiresAt?: number;
+  /**
+   * The exact redirect URI used in the authorization request that created this grant
+   * Recorded so that default grant revocation can be scoped to a single installation
+   * of a CIMD client (whose client_id is shared across all installations). Absent on
+   * grants created before this field was introduced.
+   */
+  redirectUri?: string;
 }
 /**
  * OAuth 2.0 Provider implementation for Cloudflare Workers

package/dist/oauth-provider.js

@@ -53,6 +53,49 @@ function validateClientCapabilities(server, client) {
 	if (client.grantTypes.includes("authorization_code") !== client.responseTypes.includes("code")) throw new Error("grant_types authorization_code and response_types code must be registered together");
 	if (client.grantTypes.includes("implicit") !== client.responseTypes.includes("token")) throw new Error("grant_types implicit and response_types token must be registered together");
 }
+const SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS = new Set([
+	"client_secret_basic",
+	"client_secret_post",
+	"client_secret_jwt"
+]);
+function negotiateTokenEndpointAuthMethod(options) {
+	const { acceptedMethods, defaultMethod, preferredMethod, supportedMethods, context } = options;
+	if (preferredMethod !== void 0 && supportedMethods !== void 0 && !supportedMethods.includes(preferredMethod)) throw new Error("token_endpoint_auth_method must be included in token_endpoint_auth_methods_supported");
+	const advertisedMethods = supportedMethods ?? [preferredMethod ?? defaultMethod];
+	const effectiveMethod = preferredMethod !== void 0 && acceptedMethods.includes(preferredMethod) ? preferredMethod : acceptedMethods.find((method) => advertisedMethods.includes(method));
+	if (effectiveMethod !== void 0) return effectiveMethod;
+	const advertised = [...new Set([...preferredMethod === void 0 ? [] : [preferredMethod], ...advertisedMethods])];
+	throw new Error(`${context} does not support an accepted token endpoint authentication method. Supported methods: ${acceptedMethods.join(", ")}. Client advertised: ${advertised.length > 0 ? advertised.join(", ") : "(none)"}`);
+}
+function negotiateCimdTokenEndpointAuthMethod(server, preferredMethod, supportedMethods) {
+	if (preferredMethod !== void 0 && SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS.has(preferredMethod)) throw new Error(`CIMD clients cannot use symmetric token endpoint authentication method: ${preferredMethod}`);
+	return negotiateTokenEndpointAuthMethod({
+		acceptedMethods: server.tokenEndpointAuthMethods.filter((method) => !SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS.has(method)),
+		defaultMethod: "none",
+		preferredMethod,
+		supportedMethods,
+		context: "CIMD client"
+	});
+}
+/**
+* Negotiates choice-valued authentication metadata while keeping DCR grant and
+* response registration strict.
+*/
+function negotiateDynamicClientRegistrationCapabilities(server, client) {
+	const effective = {
+		grantTypes: [...client.grantTypes],
+		responseTypes: [...client.responseTypes],
+		tokenEndpointAuthMethod: negotiateTokenEndpointAuthMethod({
+			acceptedMethods: server.tokenEndpointAuthMethods,
+			defaultMethod: "client_secret_basic",
+			preferredMethod: client.tokenEndpointAuthMethod,
+			supportedMethods: client.tokenEndpointAuthMethodsSupported,
+			context: "Client"
+		})
+	};
+	validateClientCapabilities(server, effective);
+	return effective;
+}
 /**
 * Selects the capabilities from a Client ID Metadata Document that this
 * authorization server supports. CIMD documents may advertise extension
@@ -67,7 +110,7 @@ function negotiateCimdClientCapabilities(server, client) {
 	const effective = {
 		grantTypes: client.grantTypes.filter((grantType) => server.grantTypes.includes(grantType)),
 		responseTypes: client.responseTypes.filter((responseType) => server.responseTypes.includes(responseType)),
-		tokenEndpointAuthMethod: client.tokenEndpointAuthMethod
+		tokenEndpointAuthMethod: negotiateCimdTokenEndpointAuthMethod(server, client.tokenEndpointAuthMethod, client.tokenEndpointAuthMethodsSupported)
 	};
 	validateClientCapabilities(server, effective);
 	return effective;
@@ -107,6 +150,403 @@ function isValidOAuthScopeToken(scopeToken) {
 	return OAUTH_SCOPE_TOKEN_PATTERN.test(scopeToken);
 }
 
+//#endregion
+//#region src/oauth-client-metadata.ts
+const CIMD_MAX_SIZE_BYTES = 5 * 1024;
+const CIMD_FETCH_TIMEOUT_MS = 1e4;
+const CIMD_CACHE_NAME = "workers-oauth-provider:cimd:v1";
+const CIMD_CACHE_MAX_TTL_SECONDS = 10080 * 60;
+function requireJsonObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("Client metadata must be a JSON object");
+	return value;
+}
+function optionalString(value, fieldName) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string") throw new Error(`Invalid ${fieldName}: expected string, got ${typeof value}`);
+	return value;
+}
+function optionalStringArray(value, fieldName) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) throw new Error(`Invalid ${fieldName}: expected array, got ${typeof value}`);
+	if (!value.every((item) => typeof item === "string")) throw new Error(`Invalid ${fieldName}: array must contain only strings`);
+	return [...value];
+}
+function optionalHttpUri(value, fieldName) {
+	const uri = optionalString(value, fieldName);
+	if (uri === void 0) return void 0;
+	let parsed;
+	try {
+		parsed = new URL(uri);
+	} catch {
+		throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
+	return uri;
+}
+const I18N_FIELDS = {
+	client_name: "string",
+	client_uri: "uri",
+	logo_uri: "uri",
+	tos_uri: "uri",
+	policy_uri: "uri"
+};
+function extractI18nFields(raw) {
+	const result = {};
+	for (const key of Object.keys(raw)) {
+		const hashIndex = key.indexOf("#");
+		if (hashIndex <= 0 || hashIndex === key.length - 1) continue;
+		const kind = I18N_FIELDS[key.slice(0, hashIndex)];
+		if (!kind) continue;
+		const value = kind === "uri" ? optionalHttpUri(raw[key], key) : optionalString(raw[key], key);
+		if (value !== void 0) result[key] = value;
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function validateChoiceConsistency(preferredName, preferredValue, choicesName, choices) {
+	if (preferredValue !== void 0 && choices !== void 0 && !choices.includes(preferredValue)) throw new Error(`${preferredName} must be included in ${choicesName}`);
+}
+function parseOAuthClientMetadata(raw) {
+	const tokenEndpointAuthMethod = optionalString(raw.token_endpoint_auth_method, "token_endpoint_auth_method");
+	const tokenEndpointAuthMethodsSupported = optionalStringArray(raw.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported");
+	const tokenEndpointAuthSigningAlg = optionalString(raw.token_endpoint_auth_signing_alg, "token_endpoint_auth_signing_alg");
+	const tokenEndpointAuthSigningAlgValuesSupported = optionalStringArray(raw.token_endpoint_auth_signing_alg_values_supported, "token_endpoint_auth_signing_alg_values_supported");
+	validateChoiceConsistency("token_endpoint_auth_method", tokenEndpointAuthMethod, "token_endpoint_auth_methods_supported", tokenEndpointAuthMethodsSupported);
+	validateChoiceConsistency("token_endpoint_auth_signing_alg", tokenEndpointAuthSigningAlg, "token_endpoint_auth_signing_alg_values_supported", tokenEndpointAuthSigningAlgValuesSupported);
+	return {
+		clientId: optionalString(raw.client_id, "client_id"),
+		redirectUris: optionalStringArray(raw.redirect_uris, "redirect_uris"),
+		clientName: optionalString(raw.client_name, "client_name"),
+		clientUri: optionalHttpUri(raw.client_uri, "client_uri"),
+		logoUri: optionalHttpUri(raw.logo_uri, "logo_uri"),
+		policyUri: optionalHttpUri(raw.policy_uri, "policy_uri"),
+		tosUri: optionalHttpUri(raw.tos_uri, "tos_uri"),
+		jwksUri: optionalHttpUri(raw.jwks_uri, "jwks_uri"),
+		i18n: extractI18nFields(raw),
+		contacts: optionalStringArray(raw.contacts, "contacts"),
+		grantTypes: optionalStringArray(raw.grant_types, "grant_types"),
+		responseTypes: optionalStringArray(raw.response_types, "response_types"),
+		tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported,
+		tokenEndpointAuthSigningAlg,
+		tokenEndpointAuthSigningAlgValuesSupported
+	};
+}
+function pickDisplayMetadata(metadata) {
+	const { clientName, clientUri, logoUri, policyUri, tosUri, jwksUri, i18n, contacts } = metadata;
+	return {
+		clientName,
+		clientUri,
+		logoUri,
+		policyUri,
+		tosUri,
+		jwksUri,
+		i18n,
+		contacts
+	};
+}
+/**
+* Validates that a redirect URI has a scheme and does not use a dangerous
+* pseudo-scheme or contain control characters.
+*/
+function validateRedirectUriScheme(redirectUri) {
+	const dangerousSchemes = [
+		"javascript:",
+		"data:",
+		"vbscript:",
+		"file:",
+		"mailto:",
+		"blob:"
+	];
+	const normalized = redirectUri.trim();
+	for (let i = 0; i < normalized.length; i++) {
+		const code = normalized.charCodeAt(i);
+		if (code >= 0 && code <= 31 || code >= 127 && code <= 159) throw new Error("Invalid redirect URI");
+	}
+	const colonIndex = normalized.indexOf(":");
+	if (colonIndex === -1) throw new Error("Invalid redirect URI");
+	const scheme = normalized.slice(0, colonIndex + 1).toLowerCase();
+	if (dangerousSchemes.includes(scheme)) throw new Error("Invalid redirect URI");
+}
+function requireValidRedirectUris(redirectUris) {
+	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
+	for (const redirectUri of redirectUris) validateRedirectUriScheme(redirectUri);
+	return redirectUris;
+}
+/**
+* Resolves a Dynamic Client Registration request into the complete metadata
+* shape that can be stored, applying RFC 7591 defaults and server capability
+* validation exactly once.
+*/
+function resolveDynamicClientRegistrationMetadata(raw, server) {
+	const metadata = parseOAuthClientMetadata(raw);
+	const capabilities = negotiateDynamicClientRegistrationCapabilities(server, {
+		tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
+		grantTypes: metadata.grantTypes ?? ["authorization_code"],
+		responseTypes: metadata.responseTypes ?? ["code"]
+	});
+	return {
+		...pickDisplayMetadata(metadata),
+		redirectUris: requireValidRedirectUris(metadata.redirectUris),
+		...capabilities,
+		authMethodExplicit: metadata.tokenEndpointAuthMethod !== void 0 || metadata.tokenEndpointAuthMethodsSupported !== void 0
+	};
+}
+/**
+* Path component of the raw client ID string. Deliberately not
+* `new URL().pathname`: WHATWG parsing collapses the `.` and `..` segments
+* that CIMD §3 requires rejecting, and normalizes `\` and scheme-relative
+* forms this validation must see verbatim.
+*/
+function rawPath(clientId) {
+	const schemeEnd = clientId.indexOf("://");
+	if (schemeEnd === -1) return "";
+	const authorityStart = schemeEnd + 3;
+	const authorityEndOffset = clientId.slice(authorityStart).search(/[/?#]/);
+	if (authorityEndOffset === -1) return "";
+	const pathStart = authorityStart + authorityEndOffset;
+	if (clientId[pathStart] !== "/") return "";
+	const pathEndOffset = clientId.slice(pathStart).search(/[?#]/);
+	return pathEndOffset === -1 ? clientId.slice(pathStart) : clientId.slice(pathStart, pathStart + pathEndOffset);
+}
+function validateClientIdentifierUrl(clientId) {
+	if (clientId !== clientId.trim() || /[\x00-\x20\x7f-\x9f\\]/.test(clientId)) throw new Error("Client Identifier URL contains invalid whitespace or characters");
+	if (!/^https:\/\//i.test(clientId)) throw new Error("Client Identifier URL must use an absolute HTTPS URL");
+	let parsed;
+	try {
+		parsed = new URL(clientId);
+	} catch {
+		throw new Error("Client Identifier URL must be a valid HTTPS URL");
+	}
+	if (parsed.protocol !== "https:") throw new Error("Client Identifier URL must use HTTPS");
+	if (parsed.username || parsed.password) throw new Error("Client Identifier URL must not contain userinfo");
+	if (parsed.hash) throw new Error("Client Identifier URL must not contain a fragment");
+	const path = rawPath(clientId);
+	if (!path) throw new Error("Client Identifier URL must contain a path component");
+	for (const segment of path.split("/")) {
+		let decodedSegment;
+		try {
+			decodedSegment = decodeURIComponent(segment);
+		} catch {
+			throw new Error("Client Identifier URL contains invalid percent encoding");
+		}
+		if (decodedSegment === "." || decodedSegment === "..") throw new Error("Client Identifier URL must not contain dot path segments");
+	}
+}
+/** Returns whether a client ID has the URL shape this package resolves through CIMD. */
+function isClientIdMetadataDocumentUrl(clientId) {
+	try {
+		return new URL(clientId).protocol === "https:" && rawPath(clientId) !== "";
+	} catch {
+		return false;
+	}
+}
+function containsPrivateJwkMaterial(value) {
+	if (value === void 0) return false;
+	const jwks = requireJsonObject(value);
+	if (!Array.isArray(jwks.keys)) throw new Error("Invalid jwks: keys must be an array");
+	const privateMembers = new Set([
+		"d",
+		"p",
+		"q",
+		"dp",
+		"dq",
+		"qi",
+		"oth",
+		"k"
+	]);
+	for (const value$1 of jwks.keys) {
+		const key = requireJsonObject(value$1);
+		if (Object.keys(key).some((member) => privateMembers.has(member))) return true;
+	}
+	return false;
+}
+function resolveClientIdMetadataDocument(metadataUrl, value, server) {
+	const raw = requireJsonObject(value);
+	const metadata = parseOAuthClientMetadata(raw);
+	if (metadata.clientId !== metadataUrl) throw new Error(`client_id "${metadata.clientId}" does not match metadata URL "${metadataUrl}"`);
+	if (!metadata.clientName?.trim()) throw new Error("client_name is required and must not be empty");
+	const redirectUris = requireValidRedirectUris(metadata.redirectUris);
+	if ("client_secret" in raw || "client_secret_expires_at" in raw) throw new Error("CIMD documents must not contain client secrets");
+	if (containsPrivateJwkMaterial(raw.jwks)) throw new Error("CIMD documents must not contain private key material");
+	const capabilities = negotiateCimdClientCapabilities(server, {
+		tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+		tokenEndpointAuthMethodsSupported: metadata.tokenEndpointAuthMethodsSupported,
+		grantTypes: metadata.grantTypes ?? ["authorization_code"],
+		responseTypes: metadata.responseTypes ?? ["code"]
+	});
+	return {
+		...pickDisplayMetadata(metadata),
+		clientId: metadata.clientId,
+		clientName: metadata.clientName,
+		redirectUris,
+		...capabilities
+	};
+}
+function readStreamChunk(reader, signal) {
+	if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
+	return new Promise((resolve, reject) => {
+		const abort = () => {
+			reader.cancel().catch(() => void 0);
+			reject(new DOMException("Aborted", "AbortError"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		reader.read().then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+	});
+}
+async function readJsonWithSizeLimit$1(response, maxBytes, signal) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength !== null) {
+		const declaredSize = Number(contentLength);
+		if (Number.isFinite(declaredSize) && declaredSize > maxBytes) {
+			await response.body?.cancel().catch(() => void 0);
+			throw new Error(`Client metadata exceeds size limit: ${contentLength} bytes (max ${maxBytes})`);
+		}
+	}
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("Client metadata response body is empty");
+	const chunks = [];
+	let totalSize = 0;
+	while (true) {
+		const { done, value } = await readStreamChunk(reader, signal);
+		if (done) break;
+		if (!value) continue;
+		totalSize += value.length;
+		if (totalSize > maxBytes) {
+			await reader.cancel().catch(() => void 0);
+			throw new Error(`Response exceeded size limit of ${maxBytes} bytes`);
+		}
+		chunks.push(value);
+	}
+	if (signal.aborted) throw new DOMException("Aborted", "AbortError");
+	const bytes = new Uint8Array(totalSize);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.length;
+	}
+	let text;
+	try {
+		text = new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(bytes);
+	} catch {
+		throw new Error("Client metadata response is not valid UTF-8");
+	}
+	try {
+		return {
+			value: JSON.parse(text),
+			bytes
+		};
+	} catch {
+		throw new Error("Client metadata response is not valid JSON");
+	}
+}
+function fetchCimdOrigin(metadataUrl, signal) {
+	return fetch(metadataUrl, {
+		headers: {
+			Accept: "application/json",
+			"Cache-Control": "no-store"
+		},
+		signal,
+		cache: "no-store"
+	});
+}
+async function openCimdCache() {
+	if (typeof caches === "undefined") return void 0;
+	try {
+		return await caches.open(CIMD_CACHE_NAME);
+	} catch {
+		return;
+	}
+}
+/**
+* Shared-cache lifetime derived from the origin's Cache-Control directives,
+* bounded by the server-side cap the CIMD draft permits (§5.2 "MAY define its
+* own upper and/or lower bounds on an acceptable cache lifetime"). Returns
+* undefined when the response must not be stored.
+*/
+function cacheTtlSeconds(response) {
+	const cacheControl = response.headers.get("Cache-Control");
+	if (cacheControl === null || /(?:^|,)\s*(?:no-cache|no-store|private)\b/i.test(cacheControl)) return void 0;
+	const directive = /(?:^|,)\s*s-maxage\s*=\s*"?(\d+)/i.exec(cacheControl) ?? /(?:^|,)\s*max-age\s*=\s*"?(\d+)/i.exec(cacheControl);
+	if (!directive) return void 0;
+	const ttl = Math.min(Number(directive[1]), CIMD_CACHE_MAX_TTL_SECONDS);
+	return ttl > 0 ? ttl : void 0;
+}
+async function cacheValidatedDocument(cache, metadataUrl, response, bytes) {
+	if (!cache) return;
+	const ttl = cacheTtlSeconds(response);
+	if (ttl === void 0) return;
+	const headers = new Headers({ "Cache-Control": `public, max-age=${ttl}` });
+	for (const name of [
+		"Content-Type",
+		"ETag",
+		"Last-Modified"
+	]) {
+		const value = response.headers.get(name);
+		if (value !== null) headers.set(name, value);
+	}
+	try {
+		await cache.put(metadataUrl, new Response(bytes, {
+			status: 200,
+			headers
+		}));
+	} catch {}
+}
+/**
+* Resolves a previously validated cache entry. A stored document that stops
+* validating (changed server capabilities, stricter rules after an upgrade)
+* is evicted so the caller re-resolves from origin in the same request;
+* timeout aborts propagate instead.
+*/
+async function tryResolveFromCache(cache, metadataUrl, server, signal) {
+	let cached;
+	try {
+		cached = await cache?.match(metadataUrl);
+	} catch {
+		return;
+	}
+	if (!cached) return void 0;
+	try {
+		const { value } = await readJsonWithSizeLimit$1(cached, CIMD_MAX_SIZE_BYTES, signal);
+		return resolveClientIdMetadataDocument(metadataUrl, value, server);
+	} catch (error) {
+		if (signal.aborted) throw error;
+		try {
+			await cache?.delete(metadataUrl);
+		} catch {}
+		return;
+	}
+}
+/**
+* Fetches, bounds, parses, validates, and negotiates a Client ID Metadata
+* Document into the single effective client configuration used by OAuth flows.
+*/
+async function fetchClientIdMetadataDocument(metadataUrl, server) {
+	validateClientIdentifierUrl(metadataUrl);
+	const abortController = new AbortController();
+	const timeoutId = setTimeout(() => abortController.abort(), CIMD_FETCH_TIMEOUT_MS);
+	try {
+		const cache = await openCimdCache();
+		const cachedDocument = await tryResolveFromCache(cache, metadataUrl, server, abortController.signal);
+		if (cachedDocument) return cachedDocument;
+		const response = await fetchCimdOrigin(metadataUrl, abortController.signal);
+		if (!response.ok) throw new Error(`Failed to fetch client metadata: HTTP ${response.status}`);
+		const { value, bytes } = await readJsonWithSizeLimit$1(response, CIMD_MAX_SIZE_BYTES, abortController.signal);
+		const resolved = resolveClientIdMetadataDocument(metadataUrl, value, server);
+		clearTimeout(timeoutId);
+		await cacheValidatedDocument(cache, metadataUrl, response, bytes);
+		return resolved;
+	} catch (error) {
+		if (abortController.signal.aborted) throw new Error(`Client metadata fetch timed out after ${CIMD_FETCH_TIMEOUT_MS}ms`);
+		throw error;
+	} finally {
+		clearTimeout(timeoutId);
+	}
+}
+
 //#endregion
 //#region src/ema/constants.ts
 /**
@@ -876,7 +1316,7 @@ function getOAuthApi(options, env) {
 * annotation, and does not actually prevent the method from being called from outside the class,
 * including over RPC.
 */
-var OAuthProviderImpl = class OAuthProviderImpl {
+var OAuthProviderImpl = class {
 	/**
 	* Creates a new OAuth provider instance
 	* @param options - Configuration options for the provider
@@ -2101,37 +2541,29 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			statusCode: 413
 		});
 		const callbackRequest = request.clone();
-		let clientMetadata;
+		let parsedJson;
 		try {
 			const text = await request.text();
 			if (text.length > 1048576) return this.createErrorResponse("invalid_request", {
 				description: "Request payload too large, must be under 1 MiB",
 				statusCode: 413
 			});
-			clientMetadata = JSON.parse(text);
-		} catch (error) {
+			parsedJson = JSON.parse(text);
+		} catch {
 			return this.createErrorResponse("invalid_request", {
 				description: "Invalid JSON payload",
 				statusCode: 400
 			});
 		}
-		let authMethodWasExplicit;
-		let authMethod;
-		let grantTypes;
-		let responseTypes;
+		let clientMetadata;
+		let metadata;
 		try {
-			authMethodWasExplicit = clientMetadata.token_endpoint_auth_method !== void 0;
-			authMethod = OAuthProviderImpl.validateStringField(clientMetadata.token_endpoint_auth_method) || "client_secret_basic";
-			grantTypes = OAuthProviderImpl.validateStringArray(clientMetadata.grant_types, "grant_types") || [GrantType.AUTHORIZATION_CODE];
-			responseTypes = OAuthProviderImpl.validateStringArray(clientMetadata.response_types, "response_types") || ["code"];
-			validateClientCapabilities(this.serverCapabilities, {
-				tokenEndpointAuthMethod: authMethod,
-				grantTypes,
-				responseTypes
-			});
+			clientMetadata = requireJsonObject(parsedJson);
+			metadata = resolveDynamicClientRegistrationMetadata(clientMetadata, this.serverCapabilities);
 		} catch (error) {
 			return this.createErrorResponse("invalid_client_metadata", { description: error instanceof Error ? error.message : "Invalid client metadata" });
 		}
+		const authMethod = metadata.tokenEndpointAuthMethod;
 		const isPublicClient = authMethod === "none";
 		if (isPublicClient && this.options.disallowPublicClientRegistration) return this.createErrorResponse("invalid_client_metadata", { description: "Public client registration is not allowed" });
 		const clientId = generateRandomString(16);
@@ -2141,32 +2573,24 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			clientSecret = generateRandomString(32);
 			hashedSecret = await hashSecret(clientSecret);
 		}
-		let clientInfo;
-		try {
-			const redirectUris = OAuthProviderImpl.validateStringArray(clientMetadata.redirect_uris);
-			if (!redirectUris || redirectUris.length === 0) throw new Error("At least one redirect URI is required");
-			for (const uri of redirectUris) validateRedirectUriScheme(uri);
-			clientInfo = {
-				clientId,
-				redirectUris,
-				clientName: OAuthProviderImpl.validateStringField(clientMetadata.client_name, "client_name"),
-				logoUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.logo_uri, "logo_uri"),
-				clientUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.client_uri, "client_uri"),
-				policyUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.policy_uri, "policy_uri"),
-				tosUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.tos_uri, "tos_uri"),
-				jwksUri: OAuthProviderImpl.validateOptionalUriField(clientMetadata.jwks_uri, "jwks_uri"),
-				i18n: OAuthProviderImpl.extractI18nFields(clientMetadata),
-				contacts: OAuthProviderImpl.validateStringArray(clientMetadata.contacts),
-				grantTypes,
-				responseTypes,
-				registrationDate: Math.floor(Date.now() / 1e3),
-				tokenEndpointAuthMethod: authMethod,
-				...authMethodWasExplicit ? { authMethodExplicit: true } : {}
-			};
-			if (!isPublicClient && hashedSecret) clientInfo.clientSecret = hashedSecret;
-		} catch (error) {
-			return this.createErrorResponse("invalid_client_metadata", { description: error instanceof Error ? error.message : "Invalid client metadata" });
-		}
+		const clientInfo = {
+			clientId,
+			redirectUris: metadata.redirectUris,
+			clientName: metadata.clientName,
+			logoUri: metadata.logoUri,
+			clientUri: metadata.clientUri,
+			policyUri: metadata.policyUri,
+			tosUri: metadata.tosUri,
+			jwksUri: metadata.jwksUri,
+			i18n: metadata.i18n,
+			contacts: metadata.contacts,
+			grantTypes: metadata.grantTypes,
+			responseTypes: metadata.responseTypes,
+			registrationDate: Math.floor(Date.now() / 1e3),
+			tokenEndpointAuthMethod: authMethod,
+			...metadata.authMethodExplicit ? { authMethodExplicit: true } : {},
+			...!isPublicClient && hashedSecret ? { clientSecret: hashedSecret } : {}
+		};
 		if (this.options.clientRegistrationCallback) {
 			let callbackResult;
 			try {
@@ -2187,7 +2611,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		}
 		const clientKvOptions = {};
 		if (this.options.clientRegistrationTTL !== void 0) clientKvOptions.expirationTtl = this.options.clientRegistrationTTL;
-		await env.OAUTH_KV.put(`client:${clientId}`, JSON.stringify(clientInfo), clientKvOptions);
+		await env.OAUTH_KV.put(`client:${clientInfo.clientId}`, JSON.stringify(clientInfo), clientKvOptions);
 		const response = {
 			client_id: clientInfo.clientId,
 			redirect_uris: clientInfo.redirectUris,
@@ -2382,7 +2806,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			}
 			if (!this.hasGlobalFetchStrictlyPublic()) throw new Error(`CIMD is enabled but 'global_fetch_strictly_public' compatibility flag is not set.`);
 			try {
-				return await this.fetchClientMetadataDocument(clientId);
+				return await fetchClientIdMetadataDocument(clientId, this.serverCapabilities);
 			} catch (error) {
 				console.warn(`CIMD fetch failed for ${clientId}:`, error instanceof Error ? error.message : error);
 				throw new CimdFetchError(clientId, error);
@@ -2477,207 +2901,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	* Not private because OAuthHelpersImpl needs access for purgeExpiredData.
 	*/
 	isClientMetadataUrl(clientId) {
-		try {
-			const url = new URL(clientId);
-			return url.protocol === "https:" && url.pathname !== "/";
-		} catch {
-			return false;
-		}
-	}
-	static {
-		this.CIMD_MAX_SIZE_BYTES = 5 * 1024;
-	}
-	static {
-		this.CIMD_FETCH_TIMEOUT_MS = 1e4;
-	}
-	static {
-		this.CIMD_ALLOWED_AUTH_METHODS = ["none"];
-	}
-	/**
-	* Validates that a field is a string or undefined
-	* @param field - The field value to validate
-	* @param fieldName - Name of the field for error messages
-	* @returns The validated string or undefined
-	* @throws Error if field is not a string or undefined
-	*/
-	static validateStringField(field, fieldName) {
-		if (field === void 0) return void 0;
-		if (typeof field !== "string") throw new Error(fieldName ? `Invalid ${fieldName}: expected string, got ${typeof field}` : "Field must be a string");
-		return field;
-	}
-	/**
-	* Validates that a field is an optional URI string using a safe scheme.
-	*
-	* Client metadata URI fields (e.g. logo_uri, client_uri, policy_uri, tos_uri,
-	* jwks_uri) are frequently rendered into HTML attributes such as `<a href>` or
-	* `<img src>` on consent screens. Permitting non-http(s) schemes such as
-	* `javascript:` or `data:` would allow script execution in that context, so we
-	* require an absolute http: or https: URL here, matching how redirect URIs are
-	* already restricted.
-	*
-	* @param field - The field to validate
-	* @param fieldName - Name of the field for error messages
-	* @returns The validated URI string or undefined
-	* @throws Error if the field is not a string or is not an absolute http(s) URL
-	*/
-	static validateOptionalUriField(field, fieldName) {
-		const value = OAuthProviderImpl.validateStringField(field, fieldName);
-		if (value === void 0) return void 0;
-		let parsed;
-		try {
-			parsed = new URL(value);
-		} catch {
-			throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid ${fieldName}: must be an absolute http: or https: URL`);
-		return value;
-	}
-	static {
-		this.I18N_FIELDS = {
-			client_name: "string",
-			client_uri: "uri",
-			logo_uri: "uri",
-			tos_uri: "uri",
-			policy_uri: "uri"
-		};
-	}
-	/**
-	* Extracts RFC 7591 §2.2 internationalized metadata variants from a raw
-	* registration payload.
-	*
-	* Localized variants are expressed by appending a `#<BCP 47 language tag>`
-	* suffix to a metadata member name (e.g. `client_name#ja`, `tos_uri#fr`).
-	* Only the human-readable fields the RFC names are considered; each value is
-	* validated with the same rules as its canonical field (URI fields must be
-	* absolute http(s) URLs). The raw `field#tag` keys are preserved verbatim so
-	* that consumers can do their own locale matching.
-	*
-	* @param raw - The parsed client metadata object
-	* @returns A map of `field#tag` to validated value, or undefined if none present
-	* @throws Error if a localized value fails its field's validation
-	*/
-	static extractI18nFields(raw) {
-		const result = {};
-		for (const key of Object.keys(raw)) {
-			const hashIndex = key.indexOf("#");
-			if (hashIndex <= 0 || hashIndex === key.length - 1) continue;
-			const baseField = key.slice(0, hashIndex);
-			const kind = OAuthProviderImpl.I18N_FIELDS[baseField];
-			if (!kind) continue;
-			const validated = kind === "uri" ? OAuthProviderImpl.validateOptionalUriField(raw[key], key) : OAuthProviderImpl.validateStringField(raw[key], key);
-			if (validated !== void 0) result[key] = validated;
-		}
-		return Object.keys(result).length > 0 ? result : void 0;
-	}
-	/**
-	* Validates that a field is a string array or undefined
-	* @param arr - The array to validate
-	* @param fieldName - Name of the field for error messages
-	* @returns The validated string array or undefined
-	* @throws Error if field is not a string array or undefined
-	*/
-	static validateStringArray(arr, fieldName) {
-		if (arr === void 0) return void 0;
-		if (!Array.isArray(arr)) throw new Error(fieldName ? `Invalid ${fieldName}: expected array, got ${typeof arr}` : "Field must be an array");
-		if (!arr.every((item) => typeof item === "string")) throw new Error(fieldName ? `Invalid ${fieldName}: array must contain only strings` : "All array elements must be strings");
-		return arr;
-	}
-	/**
-	* Fetches and validates a Client ID Metadata Document from the given URL
-	* Per the MCP spec, the client_id in the document must match the URL exactly
-	*
-	* Uses Cloudflare HTTP cache for caching (via cacheEverything option).
-	* Response size is limited to 5KB per IETF spec.
-	*
-	* @param metadataUrl - The HTTPS URL to fetch metadata from
-	* @returns The client information
-	* @throws Error if fetch fails or validation fails
-	*/
-	async fetchClientMetadataDocument(metadataUrl) {
-		const abortController = new AbortController();
-		const timeoutId = setTimeout(() => abortController.abort(), OAuthProviderImpl.CIMD_FETCH_TIMEOUT_MS);
-		try {
-			const response = await fetch(metadataUrl, {
-				headers: { Accept: "application/json" },
-				signal: abortController.signal,
-				cf: { cacheEverything: true }
-			});
-			clearTimeout(timeoutId);
-			if (!response.ok) throw new Error(`Failed to fetch client metadata: HTTP ${response.status}`);
-			const contentLength = response.headers.get("content-length");
-			if (contentLength && parseInt(contentLength, 10) > OAuthProviderImpl.CIMD_MAX_SIZE_BYTES) throw new Error(`Client metadata exceeds size limit: ${contentLength} bytes (max ${OAuthProviderImpl.CIMD_MAX_SIZE_BYTES})`);
-			const rawMetadata = await this.readJsonWithSizeLimit(response, OAuthProviderImpl.CIMD_MAX_SIZE_BYTES);
-			const clientId = OAuthProviderImpl.validateStringField(rawMetadata.client_id, "client_id");
-			const clientName = OAuthProviderImpl.validateStringField(rawMetadata.client_name, "client_name");
-			const redirectUris = OAuthProviderImpl.validateStringArray(rawMetadata.redirect_uris, "redirect_uris");
-			const declaredAuthMethod = OAuthProviderImpl.validateStringField(rawMetadata.token_endpoint_auth_method, "token_endpoint_auth_method");
-			const authMethodChoices = OAuthProviderImpl.validateStringArray(rawMetadata.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported");
-			const tokenEndpointAuthMethod = declaredAuthMethod ?? (authMethodChoices?.includes("none") ? "none" : void 0);
-			if (clientId !== metadataUrl) throw new Error(`client_id "${clientId}" does not match metadata URL "${metadataUrl}"`);
-			if (!clientName?.trim()) throw new Error("client_name is required and must not be empty");
-			if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
-			if (declaredAuthMethod && !OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.includes(declaredAuthMethod) || authMethodChoices && !authMethodChoices.some((method) => OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.includes(method))) throw new Error(`CIMD client does not support an accepted token endpoint authentication method. Supported methods: ${OAuthProviderImpl.CIMD_ALLOWED_AUTH_METHODS.join(", ")}`);
-			const advertisedGrantTypes = OAuthProviderImpl.validateStringArray(rawMetadata.grant_types, "grant_types") || [GrantType.AUTHORIZATION_CODE];
-			const advertisedResponseTypes = OAuthProviderImpl.validateStringArray(rawMetadata.response_types, "response_types") || ["code"];
-			const effectiveAuthMethod = tokenEndpointAuthMethod || "none";
-			const { grantTypes, responseTypes } = negotiateCimdClientCapabilities(this.serverCapabilities, {
-				tokenEndpointAuthMethod: effectiveAuthMethod,
-				grantTypes: advertisedGrantTypes,
-				responseTypes: advertisedResponseTypes
-			});
-			return {
-				clientId,
-				redirectUris,
-				clientName,
-				clientUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.client_uri, "client_uri"),
-				logoUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.logo_uri, "logo_uri"),
-				policyUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.policy_uri, "policy_uri"),
-				tosUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.tos_uri, "tos_uri"),
-				jwksUri: OAuthProviderImpl.validateOptionalUriField(rawMetadata.jwks_uri, "jwks_uri"),
-				i18n: OAuthProviderImpl.extractI18nFields(rawMetadata),
-				contacts: OAuthProviderImpl.validateStringArray(rawMetadata.contacts, "contacts"),
-				grantTypes,
-				responseTypes,
-				tokenEndpointAuthMethod: effectiveAuthMethod
-			};
-		} finally {
-			clearTimeout(timeoutId);
-		}
-	}
-	/**
-	* Reads JSON from a response with a size limit to prevent DoS attacks.
-	* Streams the response body and aborts if it exceeds the limit.
-	*
-	* @param response - The fetch response
-	* @param maxBytes - Maximum allowed size in bytes
-	* @returns Parsed JSON object
-	* @throws Error if response body is null, size exceeded, or JSON parse failed
-	*/
-	async readJsonWithSizeLimit(response, maxBytes) {
-		const reader = response.body?.getReader();
-		if (!reader) throw new Error("Response body is null");
-		const chunks = [];
-		let totalSize = 0;
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (value) {
-				totalSize += value.length;
-				if (totalSize > maxBytes) {
-					await reader.cancel();
-					throw new Error(`Response exceeded size limit of ${maxBytes} bytes`);
-				}
-				chunks.push(value);
-			}
-		}
-		const allChunks = new Uint8Array(totalSize);
-		let position = 0;
-		for (const chunk of chunks) {
-			allChunks.set(chunk, position);
-			position += chunk.length;
-		}
-		const text = new TextDecoder().decode(allChunks);
-		return JSON.parse(text);
+		return isClientIdMetadataDocumentUrl(clientId);
 	}
 	/**
 	* Builds a WWW-Authenticate header value with resource_metadata per RFC 9728 §5.1
@@ -3016,34 +3240,6 @@ async function generateTokenId(token) {
 	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 /**
-* Validates that a redirect URI does not use a dangerous pseudo-scheme.
-* Normalizes the URI by trimming whitespace and checking the scheme in a
-* case-insensitive manner to prevent bypass attacks.
-* Per RFC 3986, control characters are explicitly disallowed in URIs and
-* will cause rejection rather than silent removal.
-* @param redirectUri - The redirect URI to validate
-* @throws Error if the URI uses a blacklisted scheme or contains control characters
-*/
-function validateRedirectUriScheme(redirectUri) {
-	const dangerousSchemes = [
-		"javascript:",
-		"data:",
-		"vbscript:",
-		"file:",
-		"mailto:",
-		"blob:"
-	];
-	const normalized = redirectUri.trim();
-	for (let i = 0; i < normalized.length; i++) {
-		const code = normalized.charCodeAt(i);
-		if (code >= 0 && code <= 31 || code >= 127 && code <= 159) throw new Error("Invalid redirect URI");
-	}
-	const colonIndex = normalized.indexOf(":");
-	if (colonIndex === -1) throw new Error("Invalid redirect URI");
-	const scheme = normalized.substring(0, colonIndex + 1).toLowerCase();
-	for (const dangerousScheme of dangerousSchemes) if (scheme === dangerousScheme) throw new Error("Invalid redirect URI");
-}
-/**
 * Checks if a URI is a loopback redirect URI (127.0.0.0/8, ::1, or localhost).
 * Per RFC 8252 Section 7.3, loopback IPs get special port handling. This library
 * applies the same port flexibility to localhost for native apps (e.g., Claude Code).
@@ -3376,6 +3572,7 @@ var OAuthHelpersImpl = class {
 		validateAuthorizationPkce(this.provider.serverCapabilities, options.request, clientInfo);
 		let grantsToRevoke = [];
 		if (options.revokeExistingGrants !== false) {
+			const isCimdClient = this.provider.isClientMetadataUrl(clientId);
 			const batchSize = getRevokeExistingGrantsBatchSize(options.revokeExistingGrantsBatchSize);
 			let cursor;
 			do {
@@ -3383,7 +3580,7 @@ var OAuthHelpersImpl = class {
 					cursor,
 					limit: batchSize
 				});
-				for (const grant of page.items) if (grant.clientId === clientId) grantsToRevoke.push(grant.id);
+				for (const grant of page.items) if (grant.clientId === clientId && (!isCimdClient || grant.redirectUri === options.request.redirectUri)) grantsToRevoke.push(grant.id);
 				cursor = page.cursor;
 			} while (cursor);
 		}
@@ -3407,7 +3604,8 @@ var OAuthHelpersImpl = class {
 				metadata: options.metadata,
 				encryptedProps: encryptedData,
 				createdAt: now,
-				resource: effectiveResource
+				resource: effectiveResource,
+				redirectUri: options.request.redirectUri
 			};
 			const grantKey = `grant:${options.userId}:${grantId}`;
 			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant));
@@ -3457,7 +3655,8 @@ var OAuthHelpersImpl = class {
 				authCodeWrappedKey,
 				codeChallenge: options.request.codeChallenge,
 				codeChallengeMethod: options.request.codeChallengeMethod,
-				resource: effectiveResource
+				resource: effectiveResource,
+				redirectUri: options.request.redirectUri
 			};
 			const grantKey = `grant:${options.userId}:${grantId}`;
 			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant), { expirationTtl: 600 });
@@ -3614,7 +3813,8 @@ var OAuthHelpersImpl = class {
 					scope: grantData.scope,
 					metadata: grantData.metadata,
 					createdAt: grantData.createdAt,
-					expiresAt: grantData.expiresAt
+					expiresAt: grantData.expiresAt,
+					redirectUri: grantData.redirectUri
 				};
 				grantSummaries.push(summary);
 			}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",