@cloudflare/workers-oauth-provider 1.1.0 → 1.2.0

package/dist/oauth-provider.js

@@ -3,6 +3,34 @@ import { WorkerEntrypoint } from "cloudflare:workers";
 //#region src/oauth-capabilities.ts
 const OAUTH_SCOPE_TOKEN_PATTERN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
 /**
+* The OAuth error redirect back to a client (RFC 6749 §4.1.2.1): `error`, an optional
+* `error_description`, the client's `state`, and `iss` (RFC 9207). Pass only a request the
+* library validated, from `parseAuthRequest()`, `finishUpstream()` or `approveConsent()`,
+* never one rebuilt from user input.
+*
+* ```ts
+* if (new URL(req.url).searchParams.get('error')) {
+*   return Response.redirect(authorizationErrorRedirect(original, 'access_denied'), 302);
+* }
+* ```
+*/
+function authorizationErrorRedirect(request, code, description) {
+	const redirect = new URL(request.redirectUri);
+	for (const key of ERROR_RESPONSE_PARAMETERS) redirect.searchParams.delete(key);
+	redirect.searchParams.set("error", code);
+	if (description) redirect.searchParams.set("error_description", description);
+	if (request.state) redirect.searchParams.set("state", request.state);
+	if (request.issuer) redirect.searchParams.set("iss", request.issuer);
+	return redirect.href;
+}
+const ERROR_RESPONSE_PARAMETERS = [
+	"error",
+	"error_description",
+	"error_uri",
+	"state",
+	"iss"
+];
+/**
 * Expected authorization-request validation failure. Absence of `redirectUri`
 * means a caller MUST render locally and MUST NOT redirect.
 */
@@ -15,8 +43,21 @@ var AuthorizationError = class extends Error {
 		this.redirectUri = options.redirectUri;
 		this.state = options.state;
 		this.issuer = options.issuer;
+		this.redirectTo = options.redirectUri ? safeErrorRedirect(code, options) : void 0;
 	}
 };
+/** The error redirect, or undefined when the registered URI can't be parsed: render locally then. */
+function safeErrorRedirect(code, options) {
+	try {
+		return authorizationErrorRedirect({
+			redirectUri: options.redirectUri,
+			state: options.state,
+			issuer: options.issuer
+		}, code, options.description);
+	} catch {
+		return;
+	}
+}
 /** @internal Attach context after exact client redirect validation succeeds. */
 function withAuthorizationRedirect(error, redirectUri, state, issuer) {
 	return new AuthorizationError(error.code, {
@@ -31,17 +72,17 @@ function buildOAuthServerCapabilities(options) {
 		grantTypes: [
 			"authorization_code",
 			"refresh_token",
-			...options.allowImplicitFlow ? ["implicit"] : [],
 			...options.allowTokenExchangeGrant ? ["urn:ietf:params:oauth:grant-type:token-exchange"] : [],
 			...options.enterpriseManagedAuthorization ? ["urn:ietf:params:oauth:grant-type:jwt-bearer"] : []
 		],
-		responseTypes: options.allowImplicitFlow ? ["code", "token"] : ["code"],
+		responseTypes: ["code"],
 		tokenEndpointAuthMethods: [
 			"client_secret_basic",
 			"client_secret_post",
 			"none"
 		],
-		codeChallengeMethods: options.allowPlainPKCE ? ["plain", "S256"] : ["S256"]
+		codeChallengeMethods: ["S256"],
+		allowPrivateUseRedirectUris: options.allowPrivateUseRedirectUris
 	};
 }
 function validateClientCapabilities(server, client) {
@@ -51,7 +92,6 @@ function validateClientCapabilities(server, client) {
 	const unsupportedResponse = client.responseTypes.find((responseType) => !server.responseTypes.includes(responseType));
 	if (unsupportedResponse) throw new Error(`Unsupported response_type: ${unsupportedResponse}`);
 	if (client.grantTypes.includes("authorization_code") !== client.responseTypes.includes("code")) throw new Error("grant_types authorization_code and response_types code must be registered together");
-	if (client.grantTypes.includes("implicit") !== client.responseTypes.includes("token")) throw new Error("grant_types implicit and response_types token must be registered together");
 }
 const SHARED_SECRET_TOKEN_ENDPOINT_AUTH_METHODS = new Set([
 	"client_secret_basic",
@@ -150,6 +190,212 @@ function isValidOAuthScopeToken(scopeToken) {
 	return OAUTH_SCOPE_TOKEN_PATTERN.test(scopeToken);
 }
 
+//#endregion
+//#region src/oauth-http.ts
+/**
+* HTTP details shared by the authorization-server host (`OAuthProvider`, `OAuthAuthorizationServer`)
+* and the resource-server host (`OAuthResourceServer`), so the two can't drift apart.
+*/
+/**
+* Adds CORS headers for a browser client. The request's `Origin` is reflected: bearer tokens are
+* not ambient credentials, so any origin may present one it holds. Browser OAuth and MCP clients
+* need `WWW-Authenticate` (discovery, step-up) and `Retry-After` (backoff) exposed. Headers the
+* response already carries are kept, so an API handler can narrow who may read its responses.
+* Preflights (`OPTIONS`) are answered by the hosts before any handler runs and stay permissive, so
+* an MCP client's preflight always succeeds; the browser enforces the handler's policy on the actual
+* response, and sending the request carries no ambient credential to abuse.
+*/
+function withCorsHeaders(response, request) {
+	const origin = request.headers.get("Origin");
+	if (!origin) return response;
+	const cors = new Response(response.body, response);
+	const setUnlessPresent = (name, value) => {
+		if (!cors.headers.has(name)) cors.headers.set(name, value);
+	};
+	setUnlessPresent("Access-Control-Allow-Origin", origin);
+	setUnlessPresent("Access-Control-Allow-Methods", "*");
+	setUnlessPresent("Access-Control-Allow-Headers", "Authorization, *");
+	setUnlessPresent("Access-Control-Max-Age", "86400");
+	appendHeaderValue(cors.headers, "Vary", "Origin");
+	appendHeaderValue(cors.headers, "Access-Control-Expose-Headers", "WWW-Authenticate");
+	appendHeaderValue(cors.headers, "Access-Control-Expose-Headers", "Retry-After");
+	return cors;
+}
+/** Adds `value` to a comma-separated header unless it's already there (case-insensitively). */
+function appendHeaderValue(headers, name, value) {
+	const values = (headers.get(name) ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+	if (!values.some((item) => item.toLowerCase() === value.toLowerCase())) values.push(value);
+	headers.set(name, values.join(", "));
+}
+/**
+* A resource's required scopes: `requiredScopes`, or the deprecated `resourceMetadata.scopes_supported`
+* it replaces. Both at once is ambiguous and refused.
+*/
+function resolveRequiredScopes(requiredScopes, deprecatedScopesSupported) {
+	if (requiredScopes !== void 0 && deprecatedScopesSupported !== void 0) throw new TypeError("Set requiredScopes only: resourceMetadata.scopes_supported is deprecated in its favour");
+	const scopes = requiredScopes ?? deprecatedScopesSupported;
+	return scopes === void 0 ? void 0 : [...scopes];
+}
+/**
+* The scopes a protected resource advertises and challenges with: deduplicated, and without
+* `offline_access`, which is an authorization-server capability rather than a resource requirement.
+*/
+function baselineResourceScopes(scopes) {
+	return [...new Set(scopes)].filter((scope) => scope !== "offline_access");
+}
+
+//#endregion
+//#region src/oauth-error.ts
+/**
+* The OAuth error your code throws to the library, to answer with a standard OAuth error instead
+* of a generic failure. It is honoured in two places:
+*
+* - **`tokenExchangeCallback`** (token endpoint): the response is `{ error, error_description }`
+*   with `statusCode` (default `400`) and `headers`. `invalid_grant` also revokes the grant.
+*   Anything else thrown is a `500`.
+* - **`OAuthResourceServer`'s `validateToken`**: `invalid_token` is a `401` and
+*   `insufficient_scope` a `403`, each with a Bearer challenge (the latter naming
+*   `requiredScopes`); any other code keeps `statusCode` and `headers`, such as `429` with
+*   `Retry-After`. Anything else thrown is a `503`.
+*
+* Unexpected failures stay visible that way: the library doesn't catch everything and return 400.
+* (`OAuthProvider`'s `resolveExternalToken` uses `ExternalTokenError` instead.)
+*
+* @example
+* ```ts
+* import { OAuthError } from '@cloudflare/workers-oauth-provider';
+*
+* tokenExchangeCallback: async (options) => {
+*   if (options.grantType === 'refresh_token') {
+*     // refreshUpstream() may throw OAuthError from any depth
+*     return { newProps: await refreshUpstream(options.props) };
+*   }
+* }
+*
+* async function refreshUpstream(props) {
+*   const res = await fetch(...);
+*   if (res.status === 401) {
+*     // invalid_grant can never recover: the provider also revokes this grant and its tokens.
+*     throw new OAuthError('invalid_grant', { description: 'upstream refresh token is invalid' });
+*   }
+*   if (res.status === 429) {
+*     // Mirror upstream's Retry-After if present, otherwise pick a default.
+*     throw new OAuthError('temporarily_unavailable', {
+*       description: 'upstream rate limited',
+*       statusCode: 429,
+*       headers: { 'Retry-After': res.headers.get('retry-after') ?? '60' },
+*     });
+*   }
+*   return await res.json();
+* }
+* ```
+*/
+var OAuthError = class extends Error {
+	constructor(code, options) {
+		super(options.description);
+		this.name = "OAuthError";
+		this.code = code;
+		this.options = {
+			...options,
+			statusCode: options.statusCode ?? 400
+		};
+		this.description = this.options.description;
+		this.statusCode = this.options.statusCode;
+		this.headers = this.options.headers;
+		this.requiredScopes = this.options.requiredScopes;
+	}
+};
+
+//#endregion
+//#region src/oauth-resource.ts
+/**
+* Loopback hosts where a plain `http` scheme is accepted for local development.
+* Matches RFC 8252 §7.3 loopback handling: 127.0.0.0/8, ::1, and `localhost`.
+*/
+function isLoopbackHostname(hostname) {
+	const host = hostname.toLowerCase();
+	if (host === "localhost" || host === "::1" || host === "[::1]") return true;
+	const ipv4 = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	return ipv4 !== null && ipv4.slice(1).every((octet) => Number(octet) <= 255);
+}
+/**
+* Whether a canonical resource, issuer, or endpoint URL uses an accepted
+* scheme: `https`, or `http` on a loopback host so `wrangler dev` works on
+* http://localhost. Workers are always served over `https`, so there is no
+* deployment in which cleartext OAuth traffic to a remote host is correct,
+* and no option exists to allow it.
+*/
+function hasAcceptedCanonicalScheme(url) {
+	return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
+}
+/** Validate an RFC 3986-safe HTTP(S) resource identifier for RFC 8707. */
+function validateResourceUri(uri) {
+	if (!uri || typeof uri !== "string") return false;
+	if (!/^[\x21-\x7e]+$/.test(uri) || /["\\#]/.test(uri) || !/^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]+(?:\/[^?#]*)?(?:\?[^#]*)?$/.test(uri) || /%(?![0-9A-Fa-f]{2})/.test(uri) || !/^[A-Za-z0-9:/?@!$&'()*+,;=._~%\[\]-]+$/.test(uri)) return false;
+	try {
+		const parsed = new URL(uri);
+		return parsed.protocol === "http:" || parsed.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether a requested resource identifies a granted or configured resource.
+* Only ASCII case in the URI scheme and host is ignored, and an empty path is
+* equivalent to `/` (RFC 3986 §6.2.3), so a client that round-trips
+* `https://example.com` through a URL parser as `https://example.com/` still
+* names it. Port, path, query, a trailing slash after a path segment, user
+* information, and every other byte remain significant.
+*/
+function resourceMatches(requested, granted) {
+	const foldedRequested = foldResourceSchemeAndHost(requested);
+	const foldedGranted = foldResourceSchemeAndHost(granted);
+	if (foldedRequested === void 0 || foldedGranted === void 0) return false;
+	return normalizeEmptyPath(foldedRequested) === normalizeEmptyPath(foldedGranted);
+}
+/**
+* Fold only the URI components whose comparison is ASCII case-insensitive: the
+* scheme and the host. A configured identifier is canonical when folding it is
+* the identity.
+*/
+function foldResourceSchemeAndHost(resource) {
+	const schemeSeparator = resource.indexOf("://");
+	if (schemeSeparator <= 0) return void 0;
+	const authorityStart = schemeSeparator + 3;
+	const authorityEndOffset = resource.slice(authorityStart).search(/[/?#]/);
+	const authorityEnd = authorityEndOffset === -1 ? resource.length : authorityStart + authorityEndOffset;
+	const authority = resource.slice(authorityStart, authorityEnd);
+	const hostStart = authority.lastIndexOf("@") + 1;
+	let hostEnd;
+	if (authority[hostStart] === "[") {
+		const closingBracket = authority.indexOf("]", hostStart + 1);
+		if (closingBracket === -1) return void 0;
+		hostEnd = closingBracket + 1;
+	} else {
+		const portSeparator = authority.indexOf(":", hostStart);
+		hostEnd = portSeparator === -1 ? authority.length : portSeparator;
+	}
+	const asciiLower = (value) => value.replace(/[A-Z]/g, (character) => character.toLowerCase());
+	return asciiLower(resource.slice(0, schemeSeparator)) + "://" + authority.slice(0, hostStart) + asciiLower(authority.slice(hostStart, hostEnd)) + authority.slice(hostEnd) + resource.slice(authorityEnd);
+}
+/** RFC 3986 §6.2.3: for http and https an empty path is equivalent to "/". */
+function normalizeEmptyPath(resource) {
+	const authorityStart = resource.indexOf("://") + 3;
+	const pathOffset = resource.slice(authorityStart).search(/[/?#]/);
+	if (pathOffset === -1) return `${resource}/`;
+	const pathStart = authorityStart + pathOffset;
+	return resource[pathStart] === "/" ? resource : `${resource.slice(0, pathStart)}/${resource.slice(pathStart)}`;
+}
+/**
+* Whether a request carries every query parameter of a canonical resource. A
+* query-bearing resource identifier names a more specific resource: a request
+* may add parameters of its own but must preserve the resource's.
+*/
+function requestCarriesResourceQuery(requestUrl, resourceUrl) {
+	for (const [name, value] of resourceUrl.searchParams) if (!requestUrl.searchParams.getAll(name).includes(value)) return false;
+	return true;
+}
+
 //#endregion
 //#region src/oauth-client-metadata.ts
 const CIMD_MAX_SIZE_BYTES = 5 * 1024;
@@ -245,10 +491,12 @@ function pickDisplayMetadata(metadata) {
 	};
 }
 /**
-* Validates that a redirect URI has a scheme and does not use a dangerous
-* pseudo-scheme or contain control characters.
+* The checks every listed redirect URI passes, whatever the policy: no control characters, a
+* scheme, and not a dangerous one (`javascript:`, `data:` and the like). A Client ID Metadata
+* Document is held to these alone; the URI a request uses is then held to {@link validateRedirectUri}.
+* @throws Error when the redirect URI is not safe to store
 */
-function validateRedirectUriScheme(redirectUri) {
+function validateRedirectUriSafety(redirectUri) {
 	const dangerousSchemes = [
 		"javascript:",
 		"data:",
@@ -267,9 +515,34 @@ function validateRedirectUriScheme(redirectUri) {
 	const scheme = normalized.slice(0, colonIndex + 1).toLowerCase();
 	if (dangerousSchemes.includes(scheme)) throw new Error("Invalid redirect URI");
 }
-function requireValidRedirectUris(redirectUris) {
+/**
+* Validates a redirect URI against the MCP / OAuth 2.1 redirect policy: `https`, or `http` on a
+* loopback host (`localhost`, `127.0.0.0/8`, `::1`), with no userinfo and no fragment (not even an
+* empty `#`). RFC 8252 private-use schemes are accepted only when the server enables
+* `allowPrivateUseRedirectUris`; remote `http` never is. The {@link validateRedirectUriSafety}
+* checks always apply.
+* @throws Error describing why the redirect URI is not acceptable
+*/
+function validateRedirectUri(redirectUri, server) {
+	validateRedirectUriSafety(redirectUri);
+	const normalized = redirectUri.trim();
+	let url;
+	try {
+		url = new URL(normalized);
+	} catch {
+		throw new Error("Invalid redirect URI");
+	}
+	if (normalized.includes("#") || url.username || url.password) throw new Error("Invalid redirect URI");
+	if (url.protocol === "https:") return;
+	if (url.protocol === "http:") {
+		if (isLoopbackHostname(url.hostname)) return;
+		throw new Error("Redirect URI must use https, or http on a loopback host");
+	}
+	if (!server.allowPrivateUseRedirectUris) throw new Error("Redirect URI must use https, or http on a loopback host");
+}
+function requireValidRedirectUris(redirectUris, validate) {
 	if (!redirectUris || redirectUris.length === 0) throw new Error("redirect_uris is required and must not be empty");
-	for (const redirectUri of redirectUris) validateRedirectUriScheme(redirectUri);
+	for (const redirectUri of redirectUris) validate(redirectUri);
 	return redirectUris;
 }
 /**
@@ -287,7 +560,7 @@ function resolveDynamicClientRegistrationMetadata(raw, server) {
 	});
 	return {
 		...pickDisplayMetadata(metadata),
-		redirectUris: requireValidRedirectUris(metadata.redirectUris),
+		redirectUris: requireValidRedirectUris(metadata.redirectUris, (uri) => validateRedirectUri(uri, server)),
 		...capabilities,
 		authMethodExplicit: metadata.tokenEndpointAuthMethod !== void 0 || metadata.tokenEndpointAuthMethodsSupported !== void 0
 	};
@@ -366,7 +639,7 @@ function resolveClientIdMetadataDocument(metadataUrl, value, server) {
 	const metadata = parseOAuthClientMetadata(raw);
 	if (metadata.clientId !== metadataUrl) throw new Error(`client_id "${metadata.clientId}" does not match metadata URL "${metadataUrl}"`);
 	if (!metadata.clientName?.trim()) throw new Error("client_name is required and must not be empty");
-	const redirectUris = requireValidRedirectUris(metadata.redirectUris);
+	const redirectUris = requireValidRedirectUris(metadata.redirectUris, validateRedirectUriSafety);
 	if ("client_secret" in raw || "client_secret_expires_at" in raw) throw new Error("CIMD documents must not contain client secrets");
 	if (containsPrivateJwkMaterial(raw.jwks)) throw new Error("CIMD documents must not contain private key material");
 	const capabilities = negotiateCimdClientCapabilities(server, {
@@ -850,16 +1123,34 @@ function parseIdJag(assertion, maxBytes) {
 		signature
 	});
 }
+/**
+* Decodes a base64url-encoded string to bytes.
+*/
+function base64UrlToBytes(base64Url) {
+	const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+	const binaryString = atob(padded);
+	const bytes = new Uint8Array(binaryString.length);
+	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
+	return bytes;
+}
+/**
+* Parses a base64url-encoded JWT JSON part into an object.
+*/
+function parseJwtJsonPart(encoded) {
+	try {
+		const json = new TextDecoder().decode(base64UrlToBytes(encoded));
+		const parsed = JSON.parse(json);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("JWT part must be an object");
+		return parsed;
+	} catch {
+		throw new Error("Malformed JWT part");
+	}
+}
 
 //#endregion
 //#region src/ema/signature.ts
 /**
-* JWK selection and ID-JAG signature verification.
-*
-* `selectJwk` is a pure picker; `verifyIdJagSignature` is the I/O-bearing
-* WebCrypto call. Both operate over an already-fetched JWKS.
-*/
-/**
 * Pick a signing key from a JWKS that matches the assertion header.
 *
 * Filters by:
@@ -910,95 +1201,31 @@ async function verifyIdJagSignature(input) {
 		return false;
 	}
 }
-
-//#endregion
-//#region src/oauth-resource.ts
-/**
-* Loopback hosts where a plain `http` scheme is accepted for local development.
-* Matches RFC 8252 §7.3 loopback handling: 127.0.0.0/8, ::1, and `localhost`.
-*/
-function isLoopbackHostname(hostname) {
-	const host = hostname.toLowerCase();
-	if (host === "localhost" || host === "::1" || host === "[::1]") return true;
-	const ipv4 = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
-	return ipv4 !== null && ipv4.slice(1).every((octet) => Number(octet) <= 255);
-}
-/**
-* Whether a canonical resource, issuer, or endpoint URL uses an accepted
-* scheme: `https`, or `http` on a loopback host so `wrangler dev` works on
-* http://localhost. Workers are always served over `https`, so there is no
-* deployment in which cleartext OAuth traffic to a remote host is correct,
-* and no option exists to allow it.
-*/
-function hasAcceptedCanonicalScheme(url) {
-	return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
-}
-/** Validate an RFC 3986-safe HTTP(S) resource identifier for RFC 8707. */
-function validateResourceUri(uri) {
-	if (!uri || typeof uri !== "string") return false;
-	if (!/^[\x21-\x7e]+$/.test(uri) || /["\\#]/.test(uri) || !/^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]+(?:\/[^?#]*)?(?:\?[^#]*)?$/.test(uri) || /%(?![0-9A-Fa-f]{2})/.test(uri) || !/^[A-Za-z0-9:/?@!$&'()*+,;=._~%\[\]-]+$/.test(uri)) return false;
-	try {
-		const parsed = new URL(uri);
-		return parsed.protocol === "http:" || parsed.protocol === "https:";
-	} catch {
-		return false;
-	}
-}
 /**
-* Whether a requested resource identifies a granted or configured resource.
-* Only ASCII case in the URI scheme and host is ignored, and an empty path is
-* equivalent to `/` (RFC 3986 §6.2.3), so a client that round-trips
-* `https://example.com` through a URL parser as `https://example.com/` still
-* names it. Port, path, query, a trailing slash after a path segment, user
-* information, and every other byte remain significant.
-*/
-function resourceMatches(requested, granted) {
-	const foldedRequested = foldResourceSchemeAndHost(requested);
-	const foldedGranted = foldResourceSchemeAndHost(granted);
-	if (foldedRequested === void 0 || foldedGranted === void 0) return false;
-	return normalizeEmptyPath(foldedRequested) === normalizeEmptyPath(foldedGranted);
-}
-/**
-* Fold only the URI components whose comparison is ASCII case-insensitive: the
-* scheme and the host. A configured identifier is canonical when folding it is
-* the identity.
+* Gets WebCrypto import and verify parameters for supported JOSE algorithms.
 */
-function foldResourceSchemeAndHost(resource) {
-	const schemeSeparator = resource.indexOf("://");
-	if (schemeSeparator <= 0) return void 0;
-	const authorityStart = schemeSeparator + 3;
-	const authorityEndOffset = resource.slice(authorityStart).search(/[/?#]/);
-	const authorityEnd = authorityEndOffset === -1 ? resource.length : authorityStart + authorityEndOffset;
-	const authority = resource.slice(authorityStart, authorityEnd);
-	const hostStart = authority.lastIndexOf("@") + 1;
-	let hostEnd;
-	if (authority[hostStart] === "[") {
-		const closingBracket = authority.indexOf("]", hostStart + 1);
-		if (closingBracket === -1) return void 0;
-		hostEnd = closingBracket + 1;
-	} else {
-		const portSeparator = authority.indexOf(":", hostStart);
-		hostEnd = portSeparator === -1 ? authority.length : portSeparator;
+function getJwtCryptoAlgorithms(alg) {
+	if (alg === "RS256") {
+		const algorithm = {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: "SHA-256"
+		};
+		return {
+			importAlgorithm: algorithm,
+			verifyAlgorithm: algorithm
+		};
 	}
-	const asciiLower = (value) => value.replace(/[A-Z]/g, (character) => character.toLowerCase());
-	return asciiLower(resource.slice(0, schemeSeparator)) + "://" + authority.slice(0, hostStart) + asciiLower(authority.slice(hostStart, hostEnd)) + authority.slice(hostEnd) + resource.slice(authorityEnd);
-}
-/** RFC 3986 §6.2.3: for http and https an empty path is equivalent to "/". */
-function normalizeEmptyPath(resource) {
-	const authorityStart = resource.indexOf("://") + 3;
-	const pathOffset = resource.slice(authorityStart).search(/[/?#]/);
-	if (pathOffset === -1) return `${resource}/`;
-	const pathStart = authorityStart + pathOffset;
-	return resource[pathStart] === "/" ? resource : `${resource.slice(0, pathStart)}/${resource.slice(pathStart)}`;
-}
-/**
-* Whether a request carries every query parameter of a canonical resource. A
-* query-bearing resource identifier names a more specific resource: a request
-* may add parameters of its own but must preserve the resource's.
-*/
-function requestCarriesResourceQuery(requestUrl, resourceUrl) {
-	for (const [name, value] of resourceUrl.searchParams) if (!requestUrl.searchParams.getAll(name).includes(value)) return false;
-	return true;
+	if (alg === "ES256") return {
+		importAlgorithm: {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		},
+		verifyAlgorithm: {
+			name: "ECDSA",
+			hash: "SHA-256"
+		}
+	};
+	throw new Error(`Unsupported JWT alg: ${alg}`);
 }
 
 //#endregion
@@ -1336,7 +1563,7 @@ const NO_CACHE_HEADERS$1 = {
 * ```
 */
 function insufficientScope(auth, scope, description) {
-	if (!Array.isArray(scope) || scope.length === 0 || scope.some((value) => !isValidScopeToken(value))) throw new TypeError("insufficientScope requires at least one valid OAuth scope token");
+	if (!Array.isArray(scope) || scope.length === 0 || scope.some((value) => typeof value !== "string" || !isValidOAuthScopeToken(value))) throw new TypeError("insufficientScope requires at least one valid OAuth scope token");
 	let challenge = `Bearer realm="OAuth", error="insufficient_scope", scope="${[...new Set(scope)].join(" ")}"`;
 	challenge += `, resource_metadata="${getResourceMetadataUrl(auth.audience)}"`;
 	if (description !== void 0) {
@@ -1376,35 +1603,36 @@ var OAuthResourceServer = class {
 		const validated = this.#validated;
 		const url = new URL(request.url);
 		if (isProtectedResourceMetadataPath(url)) {
-			if (request.method === "OPTIONS") return addCorsHeaders(new Response(null, {
+			if (request.method === "OPTIONS") return withCorsHeaders(new Response(null, {
 				status: 204,
 				headers: { "Content-Length": "0" }
 			}), request);
-			if (!isMetadataUrlRequest(url, validated.metadataUrl)) return addCorsHeaders(new Response(null, { status: 404 }), request);
-			if (request.method !== "GET" && request.method !== "HEAD") return addCorsHeaders(new Response(null, {
+			if (!isMetadataUrlRequest(url, validated.metadataUrl)) return withCorsHeaders(new Response(null, { status: 404 }), request);
+			if (request.method !== "GET" && request.method !== "HEAD") return withCorsHeaders(new Response(null, {
 				status: 405,
 				headers: { Allow: "GET, HEAD, OPTIONS" }
 			}), request);
 			const metadata = Response.json(validated.metadata, { headers: NO_CACHE_HEADERS$1 });
-			return addCorsHeaders(request.method === "HEAD" ? new Response(null, {
+			return withCorsHeaders(request.method === "HEAD" ? new Response(null, {
 				status: 200,
 				headers: metadata.headers
 			}) : metadata, request);
 		}
 		if (!isCanonicalResourceRequest(url, validated.resourceUrl)) return new Response(null, { status: 404 });
-		if (request.method === "OPTIONS") return addCorsHeaders(new Response(null, {
+		if (request.method === "OPTIONS") return withCorsHeaders(new Response(null, {
 			status: 204,
 			headers: { "Content-Length": "0" }
 		}), request);
 		const token = parseBearerToken(request.headers.get("Authorization"));
-		if (!token) return addCorsHeaders(createBearerChallenge(url, validated, false), request);
+		if (!token) return withCorsHeaders(createBearerChallenge(url, validated, false), request);
 		let validation;
 		try {
 			validation = await options.validateToken(env, request)(validated.resource, token);
-		} catch {
-			return addCorsHeaders(createValidationUnavailableResponse(), request);
+		} catch (error) {
+			if (error instanceof OAuthError) return withCorsHeaders(createOAuthErrorResponse(error, url, validated), request);
+			return withCorsHeaders(createValidationUnavailableResponse(), request);
 		}
-		if (!isValidTokenValidation(validation, validated.resource)) return addCorsHeaders(createBearerChallenge(url, validated, true), request);
+		if (!isValidTokenValidation(validation, validated.resource)) return withCorsHeaders(createBearerChallenge(url, validated, true), request);
 		const context = ctx;
 		context.props = validation.props;
 		context.auth = {
@@ -1416,7 +1644,7 @@ var OAuthResourceServer = class {
 			...validation.clientId !== void 0 ? { clientId: validation.clientId } : {}
 		};
 		const handler = options.handler;
-		return addCorsHeaders(isEntrypointClass(handler) ? await new handler(context, env).fetch(request) : await handler.fetch(request, env, context), request);
+		return withCorsHeaders(isEntrypointClass(handler) ? await new handler(context, env).fetch(request) : await handler.fetch(request, env, context), request);
 	}
 };
 function validateOptions(options) {
@@ -1435,9 +1663,9 @@ function validateOptions(options) {
 	}
 	const bearerMethods = options.resourceMetadata.bearer_methods_supported;
 	if (bearerMethods !== void 0 && (bearerMethods.length !== 1 || bearerMethods[0] !== "header")) throw new TypeError("resourceMetadata.bearer_methods_supported only supports 'header'");
-	const configuredScopes = options.resourceMetadata.scopes_supported ?? [];
-	if (configuredScopes.some((scope) => !isValidScopeToken(scope))) throw new TypeError("resourceMetadata.scopes_supported must contain valid OAuth scope tokens");
-	const resourceScopes = [...new Set(configuredScopes)].filter((scope) => scope !== "offline_access");
+	const configuredScopes = resolveRequiredScopes(options.requiredScopes, options.resourceMetadata.scopes_supported) ?? [];
+	if (configuredScopes.some((scope) => typeof scope !== "string" || !isValidOAuthScopeToken(scope))) throw new TypeError("requiredScopes (or the deprecated resourceMetadata.scopes_supported) must contain valid OAuth scope tokens");
+	const resourceScopes = baselineResourceScopes(configuredScopes);
 	return {
 		resource,
 		resourceUrl,
@@ -1463,9 +1691,6 @@ function parseCanonicalUrl(value) {
 	if (parsed.href !== value && parsed.origin !== value) return null;
 	return parsed;
 }
-function isValidScopeToken(scope) {
-	return typeof scope === "string" && scope.length > 0 && /^[\x21\x23-\x5b\x5d-\x7e]+$/.test(scope);
-}
 function getResourceMetadataUrl(resource) {
 	const parsed = new URL(resource);
 	const suffix = parsed.pathname === "/" ? "" : parsed.pathname;
@@ -1504,7 +1729,7 @@ function isValidTokenValidation(validation, canonicalResource) {
 	}
 	if (validation.scope !== void 0) {
 		if (!Array.isArray(validation.scope)) return false;
-		if (validation.scope.some((scope) => typeof scope !== "string" || !isValidScopeToken(scope))) return false;
+		if (validation.scope.some((scope) => typeof scope !== "string" || !isValidOAuthScopeToken(scope))) return false;
 	}
 	if (validation.userId !== void 0 && typeof validation.userId !== "string") return false;
 	if (validation.clientId !== void 0 && typeof validation.clientId !== "string") return false;
@@ -1524,30 +1749,44 @@ function createBearerChallenge(requestUrl, validated, invalidToken) {
 		}
 	});
 }
+/**
+* A validator's `OAuthError` as the response. RFC 6750 fixes `invalid_token` at `401` and
+* `insufficient_scope` at `403`, each with a Bearer challenge (unless the error brings its own);
+* any other code keeps the error's status and headers, such as a `429` with `Retry-After`.
+*/
+function createOAuthErrorResponse(error, requestUrl, validated) {
+	const headers = {
+		...NO_CACHE_HEADERS$1,
+		"Content-Type": "application/json",
+		...error.headers
+	};
+	const hasChallenge = Object.keys(headers).some((name) => name.toLowerCase() === "www-authenticate");
+	let status = error.statusCode;
+	if (error.code === "invalid_token") {
+		status = 401;
+		if (!hasChallenge) headers["WWW-Authenticate"] = createBearerChallenge(requestUrl, validated, true).headers.get("WWW-Authenticate");
+	} else if (error.code === "insufficient_scope") {
+		status = 403;
+		if (!hasChallenge) {
+			const scopes = [...new Set(error.requiredScopes ?? validated.metadata.scopes_supported ?? [])];
+			if (scopes.some((scope) => typeof scope !== "string" || !isValidOAuthScopeToken(scope))) return createValidationUnavailableResponse();
+			headers["WWW-Authenticate"] = "Bearer realm=\"OAuth\", error=\"insufficient_scope\"" + (scopes.length > 0 ? `, scope="${scopes.join(" ")}"` : "") + `, resource_metadata="${validated.metadataUrl.href}"`;
+		}
+	}
+	return new Response(JSON.stringify({
+		error: error.code,
+		error_description: error.description
+	}), {
+		status,
+		headers
+	});
+}
 function createValidationUnavailableResponse() {
 	return new Response(null, {
 		status: 503,
 		headers: NO_CACHE_HEADERS$1
 	});
 }
-function addCorsHeaders(response, request) {
-	const origin = request.headers.get("Origin");
-	if (!origin) return response;
-	const withCors = new Response(response.body, response);
-	withCors.headers.set("Access-Control-Allow-Origin", origin);
-	withCors.headers.set("Access-Control-Allow-Methods", "*");
-	withCors.headers.set("Access-Control-Allow-Headers", "Authorization, *");
-	appendHeaderValue$1(withCors.headers, "Vary", "Origin");
-	appendHeaderValue$1(withCors.headers, "Access-Control-Expose-Headers", "WWW-Authenticate");
-	appendHeaderValue$1(withCors.headers, "Access-Control-Expose-Headers", "Retry-After");
-	withCors.headers.set("Access-Control-Max-Age", "86400");
-	return withCors;
-}
-function appendHeaderValue$1(headers, name, value) {
-	const values = (headers.get(name) ?? "").split(",").map((item) => item.trim()).filter(Boolean);
-	if (!values.some((item) => item.toLowerCase() === value.toLowerCase())) values.push(value);
-	headers.set(name, values.join(", "));
-}
 
 //#endregion
 //#region src/oauth-consent.ts
@@ -1595,6 +1834,21 @@ function validateRememberConsentOptions(options) {
 	if (maxAge !== void 0 && (!Number.isInteger(maxAge) || maxAge <= 0)) throw new TypeError("remember.maxAgeSeconds must be a positive integer");
 	if (options.subject !== void 0 && (typeof options.subject !== "string" || options.subject.length === 0)) throw new TypeError("remember.subject must be a non-empty string");
 }
+/** The facts a consent page must show for a request, given the client `lookupClient()` resolved. */
+function describeConsent(client, request, isClientIdMetadataDocument) {
+	const redirectHost = new URL(request.redirectUri).hostname || request.redirectUri;
+	return {
+		clientId: request.clientId,
+		clientName: client?.clientName?.trim() ? client.clientName : request.clientId,
+		...isClientIdMetadataDocument ? { clientDomain: new URL(request.clientId).hostname } : {},
+		...client?.clientUri ? { clientUri: client.clientUri } : {},
+		...client?.logoUri ? { logoUri: client.logoUri } : {},
+		redirectUri: request.redirectUri,
+		redirectHost,
+		redirectIsLoopback: isLoopbackHostname(redirectHost),
+		scope: [...request.scope]
+	};
+}
 /** Start a consent transaction for an authorization request that must be shown to the user. */
 async function beginConsent(kv, cookies, request) {
 	const { handle, hash } = await createTransaction(kv, {
@@ -1647,19 +1901,15 @@ async function denyConsent(kv, cookies, request, handle, options = {}) {
 	const transaction = await openTransaction(kv, request, cookies.consent, handle, "consent");
 	await transaction.consume();
 	const record = transaction.record;
-	const redirect = new URL(record.request.redirectUri);
-	redirect.searchParams.set("error", "access_denied");
-	if (options.description) redirect.searchParams.set("error_description", options.description);
-	if (record.request.state) redirect.searchParams.set("state", record.request.state);
-	if (record.request.issuer) redirect.searchParams.set("iss", record.request.issuer);
+	const redirectTo = authorizationErrorRedirect(record.request, "access_denied", options.description);
 	const headers = new Headers({
 		"Cache-Control": "no-store",
-		Location: redirect.href
+		Location: redirectTo
 	});
 	headers.append("Set-Cookie", clearCookie(transaction.cookieName));
 	return {
 		request: record.request,
-		redirectTo: redirect.href,
+		redirectTo,
 		headers
 	};
 }
@@ -1887,6 +2137,9 @@ let GrantType = /* @__PURE__ */ function(GrantType$1) {
 	GrantType$1["JWT_BEARER"] = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 	return GrantType$1;
 }({});
+/** Where the split server's endpoints are unless configured otherwise, under the issuer. */
+const DEFAULT_AUTHORIZE_PATH = "/authorize";
+const DEFAULT_TOKEN_PATH = "/oauth/token";
 function toPublicClientInfo(client) {
 	const { authMethodExplicit: _explicit, registrationExpiresAt: _expiry, ...publicClient } = client;
 	return publicClient;
@@ -1946,7 +2199,6 @@ var OAuthAuthorizationServer = class {
 		const { issuer, resources, defaultResource, legacyGrantResource, authorizeEndpoint, tokenEndpoint, clientRegistrationEndpoint, ...commonOptions } = options;
 		this.#impl = new OAuthProviderImpl({
 			...commonOptions,
-			defaultHandler: { fetch: () => new Response(null, { status: 404 }) },
 			authorizationServer: {
 				issuer,
 				resources,
@@ -2018,7 +2270,7 @@ var OAuthProviderImpl = class {
 	constructor(options) {
 		this.errorResponses = /* @__PURE__ */ new WeakSet();
 		this.typedApiHandlers = [];
-		this.typedDefaultHandler = this.validateHandler(options.defaultHandler, "defaultHandler");
+		this.typedDefaultHandler = "authorizationServer" in options ? void 0 : this.validateHandler(options.defaultHandler, "defaultHandler");
 		const roleBased = "authorizationServer" in options;
 		if (!roleBased && "resourceMatchOriginOnly" in options) throw new TypeError("resourceMatchOriginOnly was removed in 1.0. Configure resourceMetadata.resource; audiences are compared exactly against that canonical resource. See the migration guide.");
 		let normalizedOptions;
@@ -2027,10 +2279,11 @@ var OAuthProviderImpl = class {
 			const { authorizationServer: authorizationServer$1, ...commonOptions } = options;
 			this.validateAuthorizationServerIssuer(authorizationServer$1.issuer);
 			this.explicitIssuer = authorizationServer$1.issuer;
+			const issuerBase = authorizationServer$1.issuer.replace(/\/+$/, "");
 			normalizedOptions = {
 				...commonOptions,
-				authorizeEndpoint: authorizationServer$1.authorizeEndpoint,
-				tokenEndpoint: authorizationServer$1.tokenEndpoint,
+				authorizeEndpoint: authorizationServer$1.authorizeEndpoint ?? `${issuerBase}${DEFAULT_AUTHORIZE_PATH}`,
+				tokenEndpoint: authorizationServer$1.tokenEndpoint ?? `${issuerBase}${DEFAULT_TOKEN_PATH}`,
 				clientRegistrationEndpoint: authorizationServer$1.clientRegistrationEndpoint
 			};
 			const declared = authorizationServer$1.resources;
@@ -2042,7 +2295,7 @@ var OAuthProviderImpl = class {
 			this.explicitIssuer = void 0;
 			normalizedOptions = options;
 			configuredResourceServers = [{
-				resourceMetadata: options.resourceMetadata,
+				resourceMetadata: withRequiredScopes(options.resourceMetadata, options.requiredScopes),
 				resolveExternalToken: options.resolveExternalToken
 			}];
 		}
@@ -2106,11 +2359,14 @@ var OAuthProviderImpl = class {
 		}
 		if (!isValidAccessTokenTTL(this.options.accessTokenTTL)) throw new TypeError(`accessTokenTTL must be an integer of at least ${KV_MIN_EXPIRATION_TTL_SECONDS} seconds (Cloudflare KV's minimum expiration window).`);
 		if (this.options.refreshTokenIdleTTL !== void 0 && !isValidAccessTokenTTL(this.options.refreshTokenIdleTTL)) throw new TypeError(`refreshTokenIdleTTL must be an integer of at least ${KV_MIN_EXPIRATION_TTL_SECONDS} seconds (Cloudflare KV's minimum expiration window).`);
+		if (this.options.allowPlainPKCE) throw new TypeError("allowPlainPKCE has been removed: MCP and OAuth 2.1 clients use S256 PKCE.");
+		if (this.options.allowImplicitFlow) throw new TypeError("allowImplicitFlow has been removed: OAuth 2.1 and MCP use the authorization code flow with PKCE.");
+		if (this.options.refreshTokenTTL !== void 0 && !isValidRefreshTokenTTL(this.options.refreshTokenTTL)) throw new TypeError(`refreshTokenTTL must be 0 (no refresh tokens), undefined (no expiry), or an integer of at least ${KV_MIN_EXPIRATION_TTL_SECONDS} seconds (Cloudflare KV's minimum expiration window).`);
+		if (this.options.clientRegistrationTTL !== void 0 && !isValidAccessTokenTTL(this.options.clientRegistrationTTL)) throw new TypeError(`clientRegistrationTTL must be undefined (no expiry) or an integer of at least ${KV_MIN_EXPIRATION_TTL_SECONDS} seconds (Cloudflare KV's minimum expiration window).`);
 		this.serverCapabilities = buildOAuthServerCapabilities({
-			allowImplicitFlow: !!this.options.allowImplicitFlow,
-			allowPlainPKCE: this.options.allowPlainPKCE === true,
 			allowTokenExchangeGrant: !!this.options.allowTokenExchangeGrant,
-			enterpriseManagedAuthorization: !!this.options.enterpriseManagedAuthorization
+			enterpriseManagedAuthorization: !!this.options.enterpriseManagedAuthorization,
+			allowPrivateUseRedirectUris: this.options.allowPrivateUseRedirectUris === true
 		});
 		validateAuthorizationServerScopes(this.options.scopesSupported);
 		this.validateEmaOptions(this.options.enterpriseManagedAuthorization);
@@ -2149,16 +2405,24 @@ var OAuthProviderImpl = class {
 		}
 		if (!validateResourceUri(issuer) || !hasAcceptedCanonicalScheme(parsed) || parsed.username || parsed.password || parsed.search || parsed.hash || foldResourceSchemeAndHost(issuer) !== issuer || parsed.href !== issuer && parsed.origin !== issuer) throw new TypeError("authorizationServer.issuer must be a canonical absolute HTTPS URL (http is accepted only on a loopback host)");
 	}
-	/** Reject exact collisions between protocol endpoints owned by the AS fetch surface. */
+	/**
+	* Reject an endpoint another would claim, so it could never be reached. fetch() tries metadata,
+	* then token, then registration; the application routes the authorization endpoint. Each check
+	* asks the predicate fetch() dispatches on, so it agrees with routing (metadata ignores the
+	* query, for one).
+	*/
 	validateAuthorizationServerRouteIsolation() {
 		const issuerUrl = new URL(this.explicitIssuer);
-		const discoveryEndpoint = this.getAuthorizationServerMetadataUrl(issuerUrl);
 		const tokenUrl = new URL(this.getFullEndpointUrl(this.options.tokenEndpoint, issuerUrl));
-		if (this.matchEndpoint(tokenUrl, discoveryEndpoint)) throw new TypeError("tokenEndpoint must not collide with the authorization server metadata endpoint");
+		if (this.isAuthorizationServerMetadataRequest(tokenUrl)) throw new TypeError("tokenEndpoint must not collide with the authorization server metadata endpoint");
+		const authorizeUrl = new URL(this.getFullEndpointUrl(this.options.authorizeEndpoint, issuerUrl));
+		if (this.isAuthorizationServerMetadataRequest(authorizeUrl)) throw new TypeError("authorizeEndpoint must not collide with the authorization server metadata endpoint");
+		if (this.isTokenEndpoint(authorizeUrl)) throw new TypeError("authorizeEndpoint must not collide with tokenEndpoint");
 		if (!this.options.clientRegistrationEndpoint) return;
+		if (this.isClientRegistrationEndpoint(authorizeUrl)) throw new TypeError("authorizeEndpoint must not collide with clientRegistrationEndpoint");
 		const registrationUrl = new URL(this.getFullEndpointUrl(this.options.clientRegistrationEndpoint, issuerUrl));
-		if (this.matchEndpoint(registrationUrl, this.options.tokenEndpoint)) throw new TypeError("clientRegistrationEndpoint must not collide with tokenEndpoint");
-		if (this.matchEndpoint(registrationUrl, discoveryEndpoint)) throw new TypeError("clientRegistrationEndpoint must not collide with the authorization server metadata endpoint");
+		if (this.isTokenEndpoint(registrationUrl)) throw new TypeError("clientRegistrationEndpoint must not collide with tokenEndpoint");
+		if (this.isAuthorizationServerMetadataRequest(registrationUrl)) throw new TypeError("clientRegistrationEndpoint must not collide with the authorization server metadata endpoint");
 	}
 	/**
 	* A protected route must be the canonical resource path or a path-boundary descendant of
@@ -2259,7 +2523,7 @@ var OAuthProviderImpl = class {
 				if (!validateResourceUri(issuer) || !hasAcceptedCanonicalScheme(parsed) || parsed.username || parsed.password || foldResourceSchemeAndHost(issuer) !== issuer || parsed.href !== issuer && parsed.origin !== issuer || issuer.includes("?") || issuer.includes("#")) throw new TypeError("resourceMetadata.authorization_servers must contain valid HTTPS issuer URLs (http is accepted only on a loopback host)");
 			}
 		}
-		if (options.scopes_supported?.some((scope) => !isValidOAuthScopeToken(scope))) throw new TypeError("resourceMetadata.scopes_supported must contain valid OAuth scope tokens");
+		if (options.scopes_supported?.some((scope) => !isValidOAuthScopeToken(scope))) throw new TypeError("requiredScopes (or the deprecated resourceMetadata.scopes_supported) must contain valid OAuth scope tokens");
 		if (options.bearer_methods_supported?.some((method) => method !== "header")) throw new TypeError("resourceMetadata.bearer_methods_supported only supports 'header'");
 	}
 	/**
@@ -2298,49 +2562,42 @@ var OAuthProviderImpl = class {
 		const metadataResourceServer = servesProtectedResources ? this.findResourceServerForMetadataUrl(url) : void 0;
 		const apiRoute = servesProtectedResources ? this.findApiRouteForUrl(url) : void 0;
 		if (request.method === "OPTIONS") {
-			if (apiRoute !== void 0 || this.isAuthorizationServerMetadataRequest(url) || servesProtectedResources && this.isProtectedResourceMetadataPath(url) || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
+			if (apiRoute !== void 0 || this.isAuthorizationServerMetadataRequest(url) || servesProtectedResources && this.isProtectedResourceMetadataPath(url) || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return withCorsHeaders(new Response(null, {
 				status: 204,
 				headers: { "Content-Length": "0" }
 			}), request);
 		}
 		if (this.isAuthorizationServerMetadataRequest(url)) {
-			if (request.method !== "GET" && request.method !== "HEAD") return this.addCorsHeaders(new Response(null, {
+			if (request.method !== "GET" && request.method !== "HEAD") return withCorsHeaders(new Response(null, {
 				status: 405,
 				headers: { Allow: "GET, HEAD, OPTIONS" }
 			}), request);
-			const response = await this.handleMetadataDiscovery(url);
-			return this.addCorsHeaders(withoutBodyForHead(request, response), request);
+			return withCorsHeaders(withoutBodyForHead(request, await this.handleMetadataDiscovery(url)), request);
 		}
 		if (servesProtectedResources && this.isProtectedResourceMetadataPath(url)) {
-			if (!metadataResourceServer) return this.addCorsHeaders(new Response(null, { status: 404 }), request);
-			if (request.method !== "GET" && request.method !== "HEAD") return this.addCorsHeaders(new Response(null, {
+			if (!metadataResourceServer) return withCorsHeaders(new Response(null, { status: 404 }), request);
+			if (request.method !== "GET" && request.method !== "HEAD") return withCorsHeaders(new Response(null, {
 				status: 405,
 				headers: { Allow: "GET, HEAD, OPTIONS" }
 			}), request);
-			const response = this.handleProtectedResourceMetadata(url, metadataResourceServer);
-			return this.addCorsHeaders(withoutBodyForHead(request, response), request);
+			return withCorsHeaders(withoutBodyForHead(request, this.handleProtectedResourceMetadata(url, metadataResourceServer)), request);
 		}
 		if (this.isTokenEndpoint(url)) {
 			const parsed = await this.parseTokenEndpointRequest(request, env);
-			if (parsed instanceof Response) return this.addCorsHeaders(parsed, request);
+			if (parsed instanceof Response) return withCorsHeaders(parsed, request);
 			let response;
-			if (parsed.isRevocationRequest) response = await this.handleRevocationRequest(parsed.body, parsed.clientInfo, env);
+			if (parsed.isRevocationRequest) response = await this.revokeToken(parsed.body, parsed.clientInfo, env);
 			else response = await this.handleTokenRequest(parsed.body, parsed.clientInfo, env, url, request);
 			if (response.ok && !this.errorResponses.has(response)) await this.renewClientRegistrationIfDue(env, parsed.clientInfo, Math.floor(Date.now() / 1e3));
-			return this.addCorsHeaders(response, request);
-		}
-		if (this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) {
-			const response = await this.handleClientRegistration(request, env);
-			return this.addCorsHeaders(response, request);
+			return withCorsHeaders(response, request);
 		}
-		if (apiRoute) {
-			const response = await this.handleApiRequest(request, env, ctx, apiRoute);
-			return this.addCorsHeaders(response, request);
-		}
-		if (typeof role === "object") return new Response(null, { status: 404 });
+		if (this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return withCorsHeaders(await this.handleClientRegistration(request, env), request);
+		if (apiRoute) return withCorsHeaders(await this.handleApiRequest(request, env, ctx, apiRoute), request);
+		const defaultHandler = this.typedDefaultHandler;
+		if (!defaultHandler) return new Response(null, { status: 404 });
 		if (!env.OAUTH_PROVIDER) env.OAUTH_PROVIDER = this.createOAuthHelpers(env);
-		if (this.typedDefaultHandler.type === HandlerType.EXPORTED_HANDLER) return this.typedDefaultHandler.handler.fetch(request, env, ctx);
-		return new this.typedDefaultHandler.handler(ctx, env).fetch(request);
+		if (defaultHandler.type === HandlerType.EXPORTED_HANDLER) return defaultHandler.handler.fetch(request, env, ctx);
+		return new defaultHandler.handler(ctx, env).fetch(request);
 	}
 	/**
 	* Decodes a token and returns token data with decrypted props
@@ -2576,7 +2833,7 @@ var OAuthProviderImpl = class {
 		});
 		const presentedAuthMethod = basicAuthenticationAttempted ? "client_secret_basic" : formData.has("client_secret") ? "client_secret_post" : "none";
 		const registeredAuthMethod = clientInfo.tokenEndpointAuthMethod;
-		if (!isClientAuthMethodAllowed(clientInfo, presentedAuthMethod, !!this.options.clientIdMetadataDocumentEnabled && this.isClientMetadataUrl(clientInfo.clientId))) return this.createInvalidClientResponse("Client authentication failed", basicAuthenticationAttempted, {
+		if (!isClientAuthMethodAllowed(clientInfo, presentedAuthMethod, !!this.options.clientIdMetadataDocumentEnabled && isClientIdMetadataDocumentUrl(clientInfo.clientId))) return this.createInvalidClientResponse("Client authentication failed", basicAuthenticationAttempted, {
 			category: "client-authentication",
 			reason: "token_endpoint_auth_method_mismatch",
 			detail: {
@@ -2652,26 +2909,6 @@ var OAuthProviderImpl = class {
 		return new URL(tokenEndpoint).origin;
 	}
 	/**
-	* Adds CORS headers to a response
-	* @param response - The response to add CORS headers to
-	* @param request - The original request
-	* @returns A new Response with CORS headers added
-	*/
-	addCorsHeaders(response, request) {
-		const origin = request.headers.get("Origin");
-		if (!origin) return response;
-		const newResponse = new Response(response.body, response);
-		newResponse.headers.set("Access-Control-Allow-Origin", origin);
-		newResponse.headers.set("Access-Control-Allow-Methods", "*");
-		newResponse.headers.set("Access-Control-Allow-Headers", "Authorization, *");
-		appendHeaderValue(newResponse.headers, "Vary", "Origin");
-		const exposedHeaders = (newResponse.headers.get("Access-Control-Expose-Headers") ?? "").split(",").map((name) => name.trim()).filter(Boolean);
-		for (const requiredHeader of ["WWW-Authenticate", "Retry-After"]) if (!exposedHeaders.some((name) => name.toLowerCase() === requiredHeader.toLowerCase())) exposedHeaders.push(requiredHeader);
-		newResponse.headers.set("Access-Control-Expose-Headers", exposedHeaders.join(", "));
-		newResponse.headers.set("Access-Control-Max-Age", "86400");
-		return newResponse;
-	}
-	/**
 	* Handles the OAuth metadata discovery endpoint
 	* Implements RFC 8414 for OAuth Server Metadata
 	* @param requestUrl - The URL of the incoming request
@@ -2693,7 +2930,7 @@ var OAuthProviderImpl = class {
 			registration_endpoint: registrationEndpoint,
 			scopes_supported: this.options.scopesSupported,
 			response_types_supported: responseTypesSupported,
-			response_modes_supported: this.options.allowImplicitFlow ? ["query", "fragment"] : ["query"],
+			response_modes_supported: ["query"],
 			grant_types_supported: grantTypesSupported,
 			...authorizationGrantProfilesSupported.length > 0 ? { authorization_grant_profiles_supported: authorizationGrantProfilesSupported } : {},
 			token_endpoint_auth_methods_supported: this.serverCapabilities.tokenEndpointAuthMethods,
@@ -2710,7 +2947,7 @@ var OAuthProviderImpl = class {
 	}
 	/** Deduplicate resource-facing scopes and remove authorization-server-only capabilities. */
 	normalizeProtectedResourceScopes(scopes) {
-		return [...new Set(scopes)].filter((scope) => scope !== "offline_access");
+		return baselineResourceScopes(scopes);
 	}
 	/**
 	* Handles the OAuth Protected Resource Metadata endpoint
@@ -2780,7 +3017,10 @@ var OAuthProviderImpl = class {
 	*/
 	async callTokenExchangeCallback(options, env) {
 		try {
-			return await Promise.resolve(this.options.tokenExchangeCallback(options));
+			return await Promise.resolve(this.options.tokenExchangeCallback({
+				...options,
+				env
+			}));
 		} catch (error) {
 			if (error instanceof OAuthError && error.code === "invalid_grant") try {
 				await this.createOAuthHelpers(env).revokeGrant(options.grantId, options.userId);
@@ -2875,9 +3115,9 @@ var OAuthProviderImpl = class {
 				reason: "code_replayed"
 			});
 		}
-		let codeChallengeMethod;
 		try {
-			codeChallengeMethod = grantData.codeChallenge ? validatePkceCodeChallengeMethod(this.serverCapabilities, grantData.codeChallengeMethod) : normalizePkceCodeChallengeMethod(grantData.codeChallengeMethod);
+			if (grantData.codeChallenge) validatePkceCodeChallengeMethod(this.serverCapabilities, grantData.codeChallengeMethod);
+			else normalizePkceCodeChallengeMethod(grantData.codeChallengeMethod);
 		} catch (error) {
 			return this.createErrorResponse("invalid_grant", { description: error instanceof Error ? error.message : "Invalid PKCE code_challenge_method" }, {
 				category: "authorization-code-grant",
@@ -2907,14 +3147,8 @@ var OAuthProviderImpl = class {
 				category: "authorization-code-grant",
 				reason: "code_verifier_missing"
 			});
-			let calculatedChallenge;
-			if (codeChallengeMethod === "S256") {
-				const data = new TextEncoder().encode(codeVerifier);
-				const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-				const hashArray = Array.from(new Uint8Array(hashBuffer));
-				calculatedChallenge = base64UrlEncode(String.fromCharCode(...hashArray));
-			} else calculatedChallenge = codeVerifier;
-			if (calculatedChallenge !== grantData.codeChallenge) return this.createErrorResponse("invalid_grant", { description: "Invalid PKCE code_verifier" }, {
+			const hashBuffer = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+			if (base64UrlEncode(String.fromCharCode(...new Uint8Array(hashBuffer))) !== grantData.codeChallenge) return this.createErrorResponse("invalid_grant", { description: "Invalid PKCE code_verifier" }, {
 				category: "authorization-code-grant",
 				reason: "code_verifier_mismatch"
 			});
@@ -2928,6 +3162,10 @@ var OAuthProviderImpl = class {
 		let accessTokenEncryptionKey = encryptionKey;
 		let encryptedAccessTokenProps = grantData.encryptedProps;
 		let tokenScopes = this.downscope(body.scope, grantData.scope);
+		if (grantsNoneOfTheRequestedScopes(body.scope, tokenScopes)) return this.createErrorResponse("invalid_scope", { description: "None of the requested scopes were granted" }, {
+			category: "authorization-code-grant",
+			reason: "scope_not_granted"
+		});
 		if (this.options.tokenExchangeCallback) {
 			const decryptedProps = await decryptProps(encryptionKey, grantData.encryptedProps);
 			let grantProps = decryptedProps;
@@ -2951,11 +3189,13 @@ var OAuthProviderImpl = class {
 				}
 				if (callbackResult.accessTokenProps) accessTokenProps = callbackResult.accessTokenProps;
 				if (callbackResult.accessTokenTTL !== void 0) accessTokenTTL = callbackResult.accessTokenTTL;
-				if ("refreshTokenTTL" in callbackResult) refreshTokenTTL = callbackResult.refreshTokenTTL;
-				if (callbackResult.refreshTokenIdleTTL !== void 0) return this.createErrorResponse("invalid_request", { description: "refreshTokenIdleTTL is only honored during refresh token exchange" }, {
-					category: "authorization-code-grant",
-					reason: "refresh_token_idle_ttl_wrong_grant"
-				});
+				if (callbackResult.refreshTokenTTL !== void 0) {
+					if (!isValidRefreshTokenTTL(callbackResult.refreshTokenTTL)) return this.createErrorResponse("invalid_request", { description: `refreshTokenTTL must be 0 (no refresh token) or an integer of at least ${KV_MIN_EXPIRATION_TTL_SECONDS} seconds` }, {
+						category: "authorization-code-grant",
+						reason: "refresh_token_ttl_invalid"
+					});
+					refreshTokenTTL = callbackResult.refreshTokenTTL;
+				}
 				if (callbackResult.accessTokenScope) tokenScopes = this.downscope(callbackResult.accessTokenScope, grantData.scope);
 			}
 			const grantResult = await encryptProps(grantProps);
@@ -2990,7 +3230,7 @@ var OAuthProviderImpl = class {
 			grantData.previousRefreshTokenId = void 0;
 			grantData.previousRefreshTokenWrappedKey = void 0;
 			grantData.expiresAt = expiresAt;
-		}
+		} else grantData.expiresAt = now + accessTokenTTL;
 		if (resourceResolution.grantResourceBackfill) grantData.resource = resourceResolution.grantResourceBackfill;
 		await this.saveGrantWithTTL(env, grantKey, grantData, now);
 		const tokenResponse = {
@@ -3074,6 +3314,10 @@ var OAuthProviderImpl = class {
 		let accessTokenEncryptionKey = encryptionKey;
 		let encryptedAccessTokenProps = grantData.encryptedProps;
 		let tokenScopes = this.downscope(body.scope, grantData.scope);
+		if (grantsNoneOfTheRequestedScopes(body.scope, tokenScopes)) return this.createErrorResponse("invalid_scope", { description: "None of the requested scopes were granted" }, {
+			category: "refresh-token-grant",
+			reason: "scope_not_granted"
+		});
 		let grantPropsChanged = false;
 		if (this.options.tokenExchangeCallback) {
 			const decryptedProps = await decryptProps(encryptionKey, grantData.encryptedProps);
@@ -3099,10 +3343,6 @@ var OAuthProviderImpl = class {
 				}
 				if (callbackResult.accessTokenProps) accessTokenProps = callbackResult.accessTokenProps;
 				if (callbackResult.accessTokenTTL !== void 0) accessTokenTTL = callbackResult.accessTokenTTL;
-				if ("refreshTokenTTL" in callbackResult) return this.createErrorResponse("invalid_request", { description: "refreshTokenTTL cannot be changed during refresh token exchange" }, {
-					category: "refresh-token-grant",
-					reason: "refresh_token_ttl_immutable"
-				});
 				if (callbackResult.refreshTokenIdleTTL !== void 0) {
 					if (!isValidAccessTokenTTL(callbackResult.refreshTokenIdleTTL)) return this.createErrorResponse("invalid_request", { description: `refreshTokenIdleTTL must be an integer of at least ${KV_MIN_EXPIRATION_TTL_SECONDS} seconds` }, {
 						category: "refresh-token-grant",
@@ -3231,6 +3471,13 @@ var OAuthProviderImpl = class {
 		});
 		if (crossClientExchange && !this.options.tokenExchangeCallback) throw crossClientRejection();
 		let tokenScopes = this.downscope(requestedScopes, tokenSummary.scope);
+		if (grantsNoneOfTheRequestedScopes(requestedScopes, tokenScopes)) throw new OAuthError("invalid_scope", {
+			description: "None of the requested scopes were granted",
+			internal: {
+				category: "token-exchange-grant",
+				reason: "scope_not_granted"
+			}
+		});
 		const newAudience = this.resolveTokenExchangeResource(requestedResource, tokenSummary.audience);
 		const now = Math.floor(Date.now() / 1e3);
 		const subjectTokenRemainingLifetime = tokenSummary.expiresAt - now;
@@ -3285,13 +3532,6 @@ var OAuthProviderImpl = class {
 				}
 				if (callbackResult.accessTokenProps) accessTokenProps = callbackResult.accessTokenProps;
 				if (callbackResult.accessTokenTTL !== void 0) accessTokenTTL = Math.min(callbackResult.accessTokenTTL, subjectTokenRemainingLifetime);
-				if (callbackResult.refreshTokenIdleTTL !== void 0) throw new OAuthError("invalid_request", {
-					description: "refreshTokenIdleTTL is only honored during refresh token exchange",
-					internal: {
-						category: "token-exchange-grant",
-						reason: "refresh_token_idle_ttl_wrong_grant"
-					}
-				});
 				if (accessTokenProps !== decryptedProps) {
 					const tokenResult = await encryptProps(accessTokenProps);
 					encryptedAccessTokenProps = tokenResult.encryptedData;
@@ -3311,7 +3551,7 @@ var OAuthProviderImpl = class {
 			access_token: await this.createAccessToken({
 				userId: tokenSummary.userId,
 				grantId: tokenSummary.grantId,
-				clientId: tokenSummary.grant.clientId,
+				clientId: clientInfo.clientId,
 				scope: tokenScopes,
 				encryptedProps: encryptedAccessTokenProps,
 				encryptionKey: accessTokenEncryptionKey,
@@ -3595,15 +3835,7 @@ var OAuthProviderImpl = class {
 		};
 	}
 	/**
-	* Handles OAuth 2.0 token revocation requests (RFC 7009)
-	* @param body - The parsed request body containing revocation parameters
-	* @param env - Cloudflare Worker environment variables
-	* @returns Response confirming revocation or error
-	*/
-	async handleRevocationRequest(body, clientInfo, env) {
-		return this.revokeToken(body, clientInfo, env);
-	}
-	/**
+	* Handles an RFC 7009 revocation request from an authenticated client.
 	* - Access tokens: Revokes only the specific token
 	* - Refresh tokens: Revokes the entire grant (access + refresh tokens)
 	* Per RFC 7009 §2.1, the server MUST verify the token was issued to the client making the request.
@@ -3695,14 +3927,17 @@ var OAuthProviderImpl = class {
 		const callbackRequest = request.clone();
 		let parsedJson;
 		try {
-			const text = await request.text();
-			if (text.length > 1048576) return this.createErrorResponse("invalid_request", {
-				description: "Request payload too large, must be under 1 MiB",
-				statusCode: 413
-			}, {
-				category: "client-registration",
-				reason: "payload_too_large"
-			});
+			const text = await readTextWithLimit(request, 1048576);
+			if (text === void 0) {
+				callbackRequest.body?.cancel().catch(() => void 0);
+				return this.createErrorResponse("invalid_request", {
+					description: "Request payload too large, must be under 1 MiB",
+					statusCode: 413
+				}, {
+					category: "client-registration",
+					reason: "payload_too_large"
+				});
+			}
 			parsedJson = JSON.parse(text);
 		} catch {
 			return this.createErrorResponse("invalid_request", {
@@ -3717,8 +3952,16 @@ var OAuthProviderImpl = class {
 		let metadata;
 		try {
 			clientMetadata = requireJsonObject(parsedJson);
-			metadata = resolveDynamicClientRegistrationMetadata(clientMetadata, this.serverCapabilities);
+			const capabilities = this.options.disallowPublicClientRegistration ? {
+				...this.serverCapabilities,
+				tokenEndpointAuthMethods: this.serverCapabilities.tokenEndpointAuthMethods.filter((method) => method !== "none")
+			} : this.serverCapabilities;
+			metadata = resolveDynamicClientRegistrationMetadata(clientMetadata, capabilities);
 		} catch (error) {
+			if (this.options.disallowPublicClientRegistration && wouldRegisterPublicClient(clientMetadata, this.serverCapabilities)) return this.createErrorResponse("invalid_client_metadata", { description: "Public client registration is not allowed" }, {
+				category: "client-registration",
+				reason: "public_client_forbidden"
+			});
 			return this.createErrorResponse("invalid_client_metadata", { description: error instanceof Error ? error.message : "Invalid client metadata" }, {
 				category: "client-registration",
 				reason: "metadata_invalid",
@@ -3727,10 +3970,6 @@ var OAuthProviderImpl = class {
 		}
 		const authMethod = metadata.tokenEndpointAuthMethod;
 		const isPublicClient = authMethod === "none";
-		if (isPublicClient && this.options.disallowPublicClientRegistration) return this.createErrorResponse("invalid_client_metadata", { description: "Public client registration is not allowed" }, {
-			category: "client-registration",
-			reason: "public_client_forbidden"
-		});
 		const clientId = generateRandomString(16);
 		let clientSecret;
 		let hashedSecret;
@@ -3765,7 +4004,7 @@ var OAuthProviderImpl = class {
 				}));
 			} catch (error) {
 				return this.createErrorResponse("server_error", {
-					description: error instanceof Error ? error.message : "Client registration callback failed",
+					description: "Client registration callback failed",
 					statusCode: 500
 				}, {
 					category: "client-registration",
@@ -3803,7 +4042,7 @@ var OAuthProviderImpl = class {
 		}
 		if (clientSecret) {
 			response.client_secret = clientSecret;
-			response.client_secret_expires_at = this.options.clientRegistrationTTL && clientInfo.registrationDate ? clientInfo.registrationDate + this.options.clientRegistrationTTL : 0;
+			response.client_secret_expires_at = this.options.clientRegistrationTTL !== void 0 && clientInfo.registrationDate ? clientInfo.registrationDate + this.options.clientRegistrationTTL : 0;
 			response.client_secret_issued_at = clientInfo.registrationDate;
 		}
 		return new Response(JSON.stringify(response), {
@@ -3848,7 +4087,7 @@ var OAuthProviderImpl = class {
 			const id = await generateTokenId(accessToken);
 			tokenData = await env.OAUTH_KV.get(`token:${userId}:${grantId}:${id}`, { type: "json" });
 		}
-		if (!tokenData && !externalTokenResolver) return this.createErrorResponse("invalid_token", {
+		if (!tokenData && (!externalTokenResolver || isIssuedTokenFormat(accessToken))) return this.createErrorResponse("invalid_token", {
 			description: "Invalid access token",
 			statusCode: 401,
 			headers: { "WWW-Authenticate": challenge("invalid_token") }
@@ -4054,7 +4293,7 @@ var OAuthProviderImpl = class {
 		}
 	}
 	async getClient(env, clientId) {
-		if (this.isClientMetadataUrl(clientId)) {
+		if (isClientIdMetadataDocumentUrl(clientId)) {
 			if (!this.options.clientIdMetadataDocumentEnabled) {
 				const clientKey$1 = `client:${clientId}`;
 				return env.OAUTH_KV.get(clientKey$1, { type: "json" });
@@ -4265,13 +4504,6 @@ var OAuthProviderImpl = class {
 		return !!(typeof Cloudflare !== "undefined" && Cloudflare.compatibilityFlags ? Cloudflare.compatibilityFlags : null)?.global_fetch_strictly_public;
 	}
 	/**
-	* Checks if a client_id is a CIMD URL (HTTPS with non-root path).
-	* Not private because OAuthHelpersImpl needs access for purgeExpiredData.
-	*/
-	isClientMetadataUrl(clientId) {
-		return isClientIdMetadataDocumentUrl(clientId);
-	}
-	/**
 	* Builds a WWW-Authenticate header value with resource_metadata per RFC 9728 §5.1
 	*/
 	buildWwwAuthenticateHeader(resourceMetadataUrl, error, errorDescription, requiredScopes = [], resourceServer = this.resourceServers[0]) {
@@ -4343,60 +4575,6 @@ var OAuthProviderImpl = class {
 	}
 };
 /**
-* Structured OAuth 2.0 token-endpoint error.
-*
-* Throw from a `tokenExchangeCallback` or any code it calls to surface a
-* standard OAuth token response (`{ error, error_description }`) instead of a
-* generic `500 Internal Server Error`.
-*
-* Anything thrown that is **not** an `OAuthError` continues to surface as
-* a 500 so unexpected failures remain visible — the provider does not
-* catch-everything-and-return-400.
-*
-* @example
-* ```ts
-* import { OAuthError } from '@cloudflare/workers-oauth-provider';
-*
-* tokenExchangeCallback: async (options) => {
-*   if (options.grantType === 'refresh_token') {
-*     // refreshUpstream() may throw OAuthError from any depth
-*     return { newProps: await refreshUpstream(options.props) };
-*   }
-* }
-*
-* async function refreshUpstream(props) {
-*   const res = await fetch(...);
-*   if (res.status === 401) {
-*     // invalid_grant can never recover: the provider also revokes this grant and its tokens.
-*     throw new OAuthError('invalid_grant', { description: 'upstream refresh token is invalid' });
-*   }
-*   if (res.status === 429) {
-*     // Mirror upstream's Retry-After if present, otherwise pick a default.
-*     throw new OAuthError('temporarily_unavailable', {
-*       description: 'upstream rate limited',
-*       statusCode: 429,
-*       headers: { 'Retry-After': res.headers.get('retry-after') ?? '60' },
-*     });
-*   }
-*   return await res.json();
-* }
-* ```
-*/
-var OAuthError = class extends Error {
-	constructor(code, options) {
-		super(options.description);
-		this.name = "OAuthError";
-		this.code = code;
-		this.options = {
-			...options,
-			statusCode: options.statusCode ?? 400
-		};
-		this.description = this.options.description;
-		this.statusCode = this.options.statusCode;
-		this.headers = this.options.headers;
-	}
-};
-/**
 * Intentional public error from an external bearer-token validator.
 *
 * Throw only from `resolveExternalToken` when an expected validation outcome
@@ -4471,6 +4649,75 @@ const DEFAULT_CLIENT_REGISTRATION_TTL = 2160 * 60 * 60;
 * to clamp absolute expirations when writing grants back to KV.
 */
 const KV_MIN_EXPIRATION_TTL_SECONDS = 60;
+/** Whether a registration refused without `none` on offer would otherwise have been a public client. */
+function wouldRegisterPublicClient(clientMetadata, server) {
+	if (!clientMetadata) return false;
+	try {
+		return resolveDynamicClientRegistrationMetadata(clientMetadata, server).tokenEndpointAuthMethod === "none";
+	} catch {
+		return false;
+	}
+}
+/** The combined provider's resource metadata with its required scopes resolved into `scopes_supported`. */
+function withRequiredScopes(metadata, requiredScopes) {
+	if (!metadata || typeof metadata !== "object") return metadata;
+	const { scopes_supported: deprecated, ...rest } = metadata;
+	const scopes = resolveRequiredScopes(requiredScopes, deprecated);
+	return scopes === void 0 ? rest : {
+		...rest,
+		scopes_supported: scopes
+	};
+}
+/** A refresh-token lifetime: 0 for "issue no refresh token", else a lifetime KV can store. */
+function isValidRefreshTokenTTL(ttl) {
+	return ttl === 0 || isValidAccessTokenTTL(ttl);
+}
+/**
+* Reads a `purgeExpiredData` cursor: the phase to resume and KV's opaque cursor within it
+* (empty for the start of that phase). No cursor starts a new sweep with the grants.
+*/
+function parsePurgeCursor(cursor) {
+	if (cursor === void 0) return { phase: "grants" };
+	const separator = cursor.indexOf(":");
+	const phase = cursor.slice(0, separator);
+	if (separator < 0 || phase !== "grants" && phase !== "tokens") throw new TypeError("Invalid purgeExpiredData cursor");
+	const kvCursor = cursor.slice(separator + 1);
+	return kvCursor ? {
+		phase,
+		kvCursor
+	} : { phase };
+}
+/**
+* RFC 6749 §6: a token request may narrow the grant's scopes. One that names scopes but none the
+* grant holds would otherwise get a token with no scope at all; it is `invalid_scope` instead.
+*/
+function grantsNoneOfTheRequestedScopes(requested, granted) {
+	return (typeof requested === "string" ? requested.split(" ").filter(Boolean) : requested ?? []).length > 0 && granted.length === 0;
+}
+/** Reads a request body as text, or returns undefined once it passes `maxBytes`. */
+async function readTextWithLimit(request, maxBytes) {
+	const reader = request.body?.getReader();
+	if (!reader) return "";
+	const chunks = [];
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			reader.cancel().catch(() => void 0);
+			return;
+		}
+		chunks.push(value);
+	}
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(bytes);
+}
 function isValidAccessTokenTTL(value) {
 	return Number.isInteger(value) && value >= KV_MIN_EXPIRATION_TTL_SECONDS;
 }
@@ -4497,11 +4744,6 @@ const MAX_KV_LIST_LIMIT = 1e3;
 * matched from `list()` alone and never read.
 */
 const DEFAULT_REVOKE_EXISTING_GRANTS_BATCH_SIZE = 50;
-function getRevokeExistingGrantsBatchSize(batchSize) {
-	if (batchSize === void 0) return DEFAULT_REVOKE_EXISTING_GRANTS_BATCH_SIZE;
-	if (!Number.isFinite(batchSize) || !Number.isInteger(batchSize) || batchSize < 1) throw new Error("revokeExistingGrantsBatchSize must be a positive integer.");
-	return Math.min(batchSize, MAX_KV_LIST_LIMIT);
-}
 /** KV serialises key metadata as JSON and rejects a write carrying more than this. */
 const MAX_KV_METADATA_BYTES = 1024;
 /**
@@ -4524,6 +4766,16 @@ function grantPutOptions(grant, expiry = {}) {
 		metadata
 	} : expiry;
 }
+/** Splits `grant:{userId}:{grantId}`. Grant IDs never contain `:`, so the last one separates them. */
+function parseGrantKey(name) {
+	const rest = name.slice(6);
+	const separator = rest.lastIndexOf(":");
+	if (!name.startsWith("grant:") || separator <= 0 || separator === rest.length - 1) return void 0;
+	return {
+		userId: rest.slice(0, separator),
+		grantId: rest.slice(separator + 1)
+	};
+}
 /** Whether a listed key carries metadata this version can match a grant on. */
 function isGrantKeyMetadata(value) {
 	if (typeof value !== "object" || value === null) return false;
@@ -4534,6 +4786,8 @@ function isGrantKeyMetadata(value) {
 * Length of generated token strings
 */
 const TOKEN_LENGTH = 32;
+const ISSUED_GRANT_ID_PATTERN = /^[A-Za-z0-9_-]{16}$/;
+const ISSUED_TOKEN_SECRET_PATTERN = /* @__PURE__ */ new RegExp(`^[A-Za-z0-9_-]{${TOKEN_LENGTH}}$`);
 /**
 * Checks if a resource server matches an audience claim.
 * Uses origin comparison (case-insensitive hostname via URL normalization)
@@ -4555,11 +4809,6 @@ function audienceMatches(resourceServerUrl, audienceValue) {
 		return false;
 	}
 }
-function appendHeaderValue(headers, name, value) {
-	const values = (headers.get(name) ?? "").split(",").map((item) => item.trim()).filter(Boolean);
-	if (!values.some((item) => item.toLowerCase() === value.toLowerCase())) values.push(value);
-	headers.set(name, values.join(", "));
-}
 /** Whether a request or audience names one canonical configured resource. */
 function isExactResource(value, configuredResource) {
 	if (Array.isArray(value)) return value.some((entry) => typeof entry === "string" && resourceMatches(entry, configuredResource));
@@ -4619,6 +4868,20 @@ function decodeFormUrlEncodedComponent(value) {
 	return decodeURIComponent(value.replace(/\+/g, " "));
 }
 /**
+* Whether a bearer credential has the exact shape of a token this provider issues:
+* `{userId}:{grantId}:{secret}`, with a 16-character grant ID and a TOKEN_LENGTH secret from
+* generateRandomString's alphabet. Parsed from the right, because a deployer's user ID may itself
+* contain `:`. An external credential with exactly this shape would be treated as ours; opaque API
+* keys, PATs and JWTs don't have it.
+*/
+function isIssuedTokenFormat(token) {
+	const parts = token.split(":");
+	if (parts.length < 3) return false;
+	const secret = parts[parts.length - 1];
+	const grantId = parts[parts.length - 2];
+	return parts.slice(0, -2).join(":").length > 0 && ISSUED_GRANT_ID_PATTERN.test(grantId) && ISSUED_TOKEN_SECRET_PATTERN.test(secret);
+}
+/**
 * Generates a cryptographically secure random string
 * @param length - The length of the string to generate
 * @returns A random string of the specified length
@@ -4679,56 +4942,6 @@ function base64UrlEncode(str) {
 	return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 /**
-* Decodes a base64url-encoded string to bytes.
-*/
-function base64UrlToBytes(base64Url) {
-	const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-	const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
-	const binaryString = atob(padded);
-	const bytes = new Uint8Array(binaryString.length);
-	for (let i = 0; i < binaryString.length; i++) bytes[i] = binaryString.charCodeAt(i);
-	return bytes;
-}
-/**
-* Parses a base64url-encoded JWT JSON part into an object.
-*/
-function parseJwtJsonPart(encoded) {
-	try {
-		const json = new TextDecoder().decode(base64UrlToBytes(encoded));
-		const parsed = JSON.parse(json);
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("JWT part must be an object");
-		return parsed;
-	} catch {
-		throw new Error("Malformed JWT part");
-	}
-}
-/**
-* Gets WebCrypto import and verify parameters for supported JOSE algorithms.
-*/
-function getJwtCryptoAlgorithms(alg) {
-	if (alg === "RS256") {
-		const algorithm = {
-			name: "RSASSA-PKCS1-v1_5",
-			hash: "SHA-256"
-		};
-		return {
-			importAlgorithm: algorithm,
-			verifyAlgorithm: algorithm
-		};
-	}
-	if (alg === "ES256") return {
-		importAlgorithm: {
-			name: "ECDSA",
-			namedCurve: "P-256"
-		},
-		verifyAlgorithm: {
-			name: "ECDSA",
-			hash: "SHA-256"
-		}
-	};
-	throw new Error(`Unsupported JWT alg: ${alg}`);
-}
-/**
 * Encodes an ArrayBuffer as base64 string
 * @param buffer - The ArrayBuffer to encode
 * @returns The base64 encoded string
@@ -4893,7 +5106,7 @@ var OAuthHelpersImpl = class {
 		const clientInfo = await this.lookupClient(clientId);
 		if (!clientInfo) throw new AuthorizationError("invalid_request", { description: "Invalid client_id" });
 		try {
-			validateRedirectUriScheme(redirectUri);
+			validateRedirectUri(redirectUri, this.provider.serverCapabilities);
 		} catch {
 			throw new AuthorizationError("invalid_request", { description: "Invalid redirect URI" });
 		}
@@ -4947,9 +5160,7 @@ var OAuthHelpersImpl = class {
 		return client ? toPublicClientInfo(client) : null;
 	}
 	/**
-	* Completes an authorization request by creating a grant and either:
-	* - For authorization code flow: generating an authorization code
-	* - For implicit flow: generating an access token directly
+	* Completes an authorization request by creating a grant and an authorization code.
 	* @param options - Options specifying the grant details
 	* @returns A Promise resolving to an object containing the redirect URL
 	* @throws Error when the request's response type is not permitted
@@ -4958,102 +5169,55 @@ var OAuthHelpersImpl = class {
 	async completeAuthorization(options) {
 		const { clientId, redirectUri } = options.request;
 		if (!clientId || !redirectUri) throw new Error("Client ID and Redirect URI are required in the authorization request.");
+		if (typeof options.userId !== "string" || options.userId.length === 0 || options.userId.includes(":")) throw new TypeError("userId must be a non-empty string without \":\"");
 		const clientInfo = await this.lookupClient(clientId);
 		if (!clientInfo || !isValidRedirectUri(redirectUri, clientInfo.redirectUris)) throw new Error("Invalid redirect URI. The redirect URI provided does not match any registered URI for this client.");
+		try {
+			validateRedirectUri(redirectUri, this.provider.serverCapabilities);
+		} catch {
+			throw new AuthorizationError("invalid_request", { description: "Invalid redirect URI" });
+		}
 		validateAuthorizationResponseType(this.provider.serverCapabilities, options.request.responseType, clientInfo.responseTypes);
 		const effectiveResource = this.provider.resolveAuthorizationRequestResource(options.request.resource);
 		validateAuthorizationPkce(this.provider.serverCapabilities, options.request, clientInfo);
 		let grantsToRevoke = [];
 		if (options.revokeExistingGrants !== false) {
-			const isCimdClient = this.provider.isClientMetadataUrl(clientId);
-			const readConcurrency = getRevokeExistingGrantsBatchSize(options.revokeExistingGrantsBatchSize);
-			grantsToRevoke = await this.findGrantIds(options.userId, (grant) => grant.clientId === clientId && (!isCimdClient || grant.redirectUri === options.request.redirectUri) && this.provider.shouldReplaceGrantForResource(grant.resource, effectiveResource), readConcurrency);
+			const isCimdClient = isClientIdMetadataDocumentUrl(clientId);
+			const readConcurrency = DEFAULT_REVOKE_EXISTING_GRANTS_BATCH_SIZE;
+			grantsToRevoke = await this.findGrantIds(options.userId, (grant$1) => grant$1.clientId === clientId && (!isCimdClient || grant$1.redirectUri === options.request.redirectUri) && this.provider.shouldReplaceGrantForResource(grant$1.resource, effectiveResource), readConcurrency);
 		}
 		const grantId = generateRandomString(16);
 		const { encryptedData, key: encryptionKey } = await encryptProps(options.props);
 		const now = Math.floor(Date.now() / 1e3);
-		if (options.request.responseType === "token") {
-			const accessTokenSecret = generateRandomString(TOKEN_LENGTH);
-			const accessToken = `${options.userId}:${grantId}:${accessTokenSecret}`;
-			const accessTokenId = await generateTokenId(accessToken);
-			const accessTokenTTL = this.provider.options.accessTokenTTL || DEFAULT_ACCESS_TOKEN_TTL;
-			const accessTokenExpiresAt = now + accessTokenTTL;
-			const accessTokenWrappedKey = await wrapKeyWithToken(accessToken, encryptionKey);
-			const audience = effectiveResource;
-			const grant = {
-				id: grantId,
-				clientId: options.request.clientId,
-				userId: options.userId,
-				scope: options.scope,
-				metadata: options.metadata,
-				encryptedProps: encryptedData,
-				createdAt: now,
-				resource: effectiveResource,
-				redirectUri: options.request.redirectUri
-			};
-			const grantKey = `grant:${options.userId}:${grantId}`;
-			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant), grantPutOptions(grant));
-			const accessTokenData = {
-				id: accessTokenId,
-				grantId,
-				userId: options.userId,
-				createdAt: now,
-				expiresAt: accessTokenExpiresAt,
-				audience,
-				scope: options.scope,
-				wrappedEncryptionKey: accessTokenWrappedKey,
-				grant: {
-					clientId: options.request.clientId,
-					scope: options.scope,
-					encryptedProps: encryptedData
-				}
-			};
-			await this.env.OAUTH_KV.put(`token:${options.userId}:${grantId}:${accessTokenId}`, JSON.stringify(accessTokenData), { expirationTtl: accessTokenTTL });
-			const redirectUrl = new URL(options.request.redirectUri);
-			const fragment = new URLSearchParams();
-			fragment.set("access_token", accessToken);
-			fragment.set("token_type", "bearer");
-			fragment.set("expires_in", accessTokenTTL.toString());
-			fragment.set("scope", options.scope.join(" "));
-			fragment.set("resource", effectiveResource);
-			if (options.request.state) fragment.set("state", options.request.state);
-			if (options.request.issuer) fragment.set("iss", options.request.issuer);
-			redirectUrl.hash = fragment.toString();
-			try {
-				await Promise.allSettled(grantsToRevoke.map((oldGrantId) => this.revokeGrant(oldGrantId, options.userId)));
-			} catch {}
-			return { redirectTo: redirectUrl.toString() };
-		} else {
-			const authCodeSecret = generateRandomString(32);
-			const authCode = `${options.userId}:${grantId}:${authCodeSecret}`;
-			const authCodeId = await hashSecret(authCode);
-			const authCodeWrappedKey = await wrapKeyWithToken(authCode, encryptionKey);
-			const grant = {
-				id: grantId,
-				clientId: options.request.clientId,
-				userId: options.userId,
-				scope: options.scope,
-				metadata: options.metadata,
-				encryptedProps: encryptedData,
-				createdAt: now,
-				authCodeId,
-				authCodeWrappedKey,
-				codeChallenge: options.request.codeChallenge,
-				codeChallengeMethod: options.request.codeChallengeMethod,
-				resource: effectiveResource,
-				redirectUri: options.request.redirectUri
-			};
-			const grantKey = `grant:${options.userId}:${grantId}`;
-			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant), grantPutOptions(grant, { expirationTtl: 600 }));
-			const redirectUrl = new URL(options.request.redirectUri);
-			redirectUrl.searchParams.set("code", authCode);
-			if (options.request.state) redirectUrl.searchParams.set("state", options.request.state);
-			if (options.request.issuer) redirectUrl.searchParams.set("iss", options.request.issuer);
-			try {
-				await Promise.allSettled(grantsToRevoke.map((oldGrantId) => this.revokeGrant(oldGrantId, options.userId)));
-			} catch {}
-			return { redirectTo: redirectUrl.toString() };
-		}
+		const authCodeSecret = generateRandomString(32);
+		const authCode = `${options.userId}:${grantId}:${authCodeSecret}`;
+		const authCodeId = await hashSecret(authCode);
+		const authCodeWrappedKey = await wrapKeyWithToken(authCode, encryptionKey);
+		const grant = {
+			id: grantId,
+			clientId: options.request.clientId,
+			userId: options.userId,
+			scope: options.scope,
+			metadata: options.metadata,
+			encryptedProps: encryptedData,
+			createdAt: now,
+			authCodeId,
+			authCodeWrappedKey,
+			codeChallenge: options.request.codeChallenge,
+			codeChallengeMethod: options.request.codeChallengeMethod,
+			resource: effectiveResource,
+			redirectUri: options.request.redirectUri
+		};
+		const grantKey = `grant:${options.userId}:${grantId}`;
+		await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant), grantPutOptions(grant, { expirationTtl: 600 }));
+		const redirectUrl = new URL(options.request.redirectUri);
+		redirectUrl.searchParams.set("code", authCode);
+		if (options.request.state) redirectUrl.searchParams.set("state", options.request.state);
+		if (options.request.issuer) redirectUrl.searchParams.set("iss", options.request.issuer);
+		try {
+			await Promise.allSettled(grantsToRevoke.map((oldGrantId) => this.revokeGrant(oldGrantId, options.userId)));
+		} catch {}
+		return { redirectTo: redirectUrl.toString() };
 	}
 	/**
 	* IDs of the user's grants that satisfy `matches`, judged from KV key metadata
@@ -5067,8 +5231,18 @@ var OAuthHelpersImpl = class {
 	* share shrinks on its own.
 	*/
 	async findGrantIds(userId, matches, readConcurrency) {
-		const prefix = `grant:${userId}:`;
-		const found = [];
+		const grantIds = [];
+		for await (const grants of this.findGrants(userId, matches, readConcurrency)) grantIds.push(...grants.map((grant) => grant.grantId));
+		return grantIds;
+	}
+	/**
+	* Finds grants matching `matches`, for one user or, with `userId` undefined, for every user.
+	* Metadata-carrying keys are matched without a read; legacy grants are read,
+	* `readConcurrency` at a time. Matches are yielded as they are found (each page's metadata
+	* matches, then each batch of reads), so a caller can act on them before the scan goes on.
+	*/
+	async *findGrants(userId, matches, readConcurrency) {
+		const prefix = userId === void 0 ? "grant:" : `grant:${userId}:`;
 		let cursor;
 		do {
 			const page = await this.env.OAUTH_KV.list({
@@ -5077,16 +5251,32 @@ var OAuthHelpersImpl = class {
 				cursor
 			});
 			const toRead = [];
-			for (const key of page.keys) if (isGrantKeyMetadata(key.metadata)) {
-				if (matches(key.metadata)) found.push(key.name.slice(prefix.length));
-			} else toRead.push(key.name);
+			const found = [];
+			for (const key of page.keys) {
+				const owner = parseGrantKey(key.name);
+				if (!owner || userId !== void 0 && owner.userId !== userId) continue;
+				if (isGrantKeyMetadata(key.metadata)) {
+					if (matches(key.metadata)) found.push(owner);
+				} else toRead.push({
+					name: key.name,
+					...owner
+				});
+			}
+			if (found.length > 0) yield found;
 			for (let start = 0; start < toRead.length; start += readConcurrency) {
-				const grants = await Promise.all(toRead.slice(start, start + readConcurrency).map((name) => this.env.OAUTH_KV.get(name, { type: "json" })));
-				for (const grant of grants) if (grant && matches(grant)) found.push(grant.id);
+				const batch = toRead.slice(start, start + readConcurrency);
+				const grants = await Promise.all(batch.map(({ name }) => this.env.OAUTH_KV.get(name, { type: "json" })));
+				const read = batch.filter((_, index) => {
+					const grant = grants[index];
+					return grant !== null && matches(grant);
+				});
+				if (read.length > 0) yield read.map(({ userId: userId$1, grantId }) => ({
+					userId: userId$1,
+					grantId
+				}));
 			}
 			cursor = page.list_complete ? void 0 : page.cursor;
 		} while (cursor);
-		return found;
 	}
 	/**
 	* Creates a new OAuth client
@@ -5119,7 +5309,12 @@ var OAuthHelpersImpl = class {
 			tokenEndpointAuthMethod,
 			...authMethodWasExplicit ? { authMethodExplicit: true } : {}
 		};
-		for (const uri of newClient.redirectUris) validateRedirectUriScheme(uri);
+		for (const uri of newClient.redirectUris) validateRedirectUri(uri, this.provider.serverCapabilities);
+		validateClientCapabilities(this.provider.serverCapabilities, {
+			grantTypes: newClient.grantTypes,
+			responseTypes: newClient.responseTypes,
+			tokenEndpointAuthMethod
+		});
 		let clientSecret;
 		if (!isPublicClient) {
 			clientSecret = generateRandomString(32);
@@ -5159,8 +5354,13 @@ var OAuthHelpersImpl = class {
 	* @returns A Promise resolving to the updated client info, or null if not found
 	*/
 	async updateClient(clientId, updates) {
+		if (this.provider.options.clientIdMetadataDocumentEnabled && isClientIdMetadataDocumentUrl(clientId)) throw new TypeError("Client ID Metadata Document clients are updated by changing their document");
 		const client = await this.provider.getClient(this.env, clientId);
 		if (!client) return null;
+		if (updates.redirectUris !== void 0) {
+			if (!Array.isArray(updates.redirectUris) || updates.redirectUris.length === 0) throw new Error("redirectUris must not be empty");
+			for (const uri of updates.redirectUris) validateRedirectUri(uri, this.provider.serverCapabilities);
+		}
 		const authMethodWasExplicit = updates.tokenEndpointAuthMethod !== void 0;
 		const authMethod = updates.tokenEndpointAuthMethod || client.tokenEndpointAuthMethod || "client_secret_basic";
 		const isPublicClient = authMethod === "none";
@@ -5178,6 +5378,11 @@ var OAuthHelpersImpl = class {
 			tokenEndpointAuthMethod: authMethod,
 			authMethodExplicit: authMethodWasExplicit ? true : client.authMethodExplicit
 		};
+		if (updates.grantTypes !== void 0 || updates.responseTypes !== void 0 || updates.tokenEndpointAuthMethod !== void 0) validateClientCapabilities(this.provider.serverCapabilities, {
+			grantTypes: updatedClient.grantTypes ?? [GrantType.AUTHORIZATION_CODE, GrantType.REFRESH_TOKEN],
+			responseTypes: updatedClient.responseTypes ?? ["code"],
+			tokenEndpointAuthMethod: authMethod
+		});
 		if (!isPublicClient && secretToStore) updatedClient.clientSecret = secretToStore;
 		else delete updatedClient.clientSecret;
 		if (client.registrationExpiresAt === void 0) await this.env.OAUTH_KV.put(`client:${updatedClient.clientId}`, JSON.stringify(updatedClient));
@@ -5192,20 +5397,9 @@ var OAuthHelpersImpl = class {
 	* @returns A Promise resolving when the deletion is confirmed.
 	*/
 	async deleteClient(clientId) {
-		let cursor;
-		let allProcessed = false;
-		while (!allProcessed) {
-			const listOptions = { prefix: "grant:" };
-			if (cursor) listOptions.cursor = cursor;
-			const result = await this.env.OAUTH_KV.list(listOptions);
-			for (const key of result.keys) {
-				const grantData = await this.env.OAUTH_KV.get(key.name, { type: "json" });
-				if (grantData && grantData.clientId === clientId) await this.revokeGrant(grantData.id, grantData.userId);
-			}
-			if (result.list_complete) allProcessed = true;
-			else cursor = result.cursor;
-		}
 		await this.env.OAUTH_KV.delete(`client:${clientId}`);
+		const grants = this.findGrants(void 0, (grant) => grant.clientId === clientId, DEFAULT_REVOKE_EXISTING_GRANTS_BATCH_SIZE);
+		for await (const found of grants) for (const { userId, grantId } of found) await this.revokeGrant(grantId, userId);
 	}
 	/**
 	* Lists all authorization grants for a specific user with pagination support
@@ -5218,9 +5412,18 @@ var OAuthHelpersImpl = class {
 		const listOptions = { prefix: `grant:${userId}:` };
 		if (options?.limit !== void 0) listOptions.limit = options.limit;
 		if (options?.cursor !== void 0) listOptions.cursor = options.cursor;
-		const response = await this.env.OAUTH_KV.list(listOptions);
+		const isOwn = (key) => !key.name.slice(listOptions.prefix.length).includes(":");
+		let response = await this.env.OAUTH_KV.list(listOptions);
+		let ownKeys = response.keys.filter(isOwn);
+		while (ownKeys.length === 0 && !response.list_complete) {
+			response = await this.env.OAUTH_KV.list({
+				...listOptions,
+				cursor: response.cursor
+			});
+			ownKeys = response.keys.filter(isOwn);
+		}
 		const grantSummaries = [];
-		const promises = response.keys.map(async (key) => {
+		const promises = ownKeys.map(async (key) => {
 			const grantData = await this.env.OAUTH_KV.get(key.name, { type: "json" });
 			if (grantData) {
 				const summary = {
@@ -5249,6 +5452,12 @@ var OAuthHelpersImpl = class {
 	* @param userId - The ID of the user who owns the grant
 	* @returns A Promise resolving when the revocation is confirmed.
 	*/
+	/** {@inheritDoc OAuthHelpers.describeConsent} */
+	async describeConsent(authRequest) {
+		const client = await this.lookupClient(authRequest.clientId);
+		const isCimd = !!this.provider.options.clientIdMetadataDocumentEnabled && isClientIdMetadataDocumentUrl(authRequest.clientId);
+		return describeConsent(client, authRequest, isCimd);
+	}
 	/** {@inheritDoc OAuthHelpers.isConsentRemembered} */
 	isConsentRemembered(request, authRequest, remember) {
 		return isConsentRemembered(this.provider.consentCookies, request, authRequest, remember);
@@ -5317,6 +5526,7 @@ var OAuthHelpersImpl = class {
 		const purgeOrphanedGrants = options?.purgeOrphanedGrants !== false;
 		const purgeExpiredGrants = options?.purgeExpiredGrants !== false;
 		const purgeOrphanedTokens = options?.purgeOrphanedTokens !== false;
+		const start = parsePurgeCursor(options?.cursor);
 		const now = Math.floor(Date.now() / 1e3);
 		const result = {
 			grantsChecked: 0,
@@ -5325,10 +5535,10 @@ var OAuthHelpersImpl = class {
 			tokensPurged: 0,
 			done: false
 		};
-		if (purgeOrphanedGrants || purgeExpiredGrants) {
+		if (start.phase === "grants" && (purgeOrphanedGrants || purgeExpiredGrants)) {
 			const knownGoodClients = /* @__PURE__ */ new Set();
 			const knownMissingClients = /* @__PURE__ */ new Set();
-			let grantCursor;
+			let grantCursor = start.kvCursor;
 			let grantsDone = false;
 			while (!grantsDone && result.grantsChecked < batchSize) {
 				const listOptions = {
@@ -5344,7 +5554,7 @@ var OAuthHelpersImpl = class {
 					if (!grantData) continue;
 					let shouldPurge = false;
 					if (purgeExpiredGrants && grantData.expiresAt !== void 0 && now >= grantData.expiresAt) shouldPurge = true;
-					if (!shouldPurge && purgeOrphanedGrants && !this.provider.isClientMetadataUrl(grantData.clientId)) {
+					if (!shouldPurge && purgeOrphanedGrants && !isClientIdMetadataDocumentUrl(grantData.clientId)) {
 						if (knownMissingClients.has(grantData.clientId)) shouldPurge = true;
 						else if (!knownGoodClients.has(grantData.clientId)) if (await this.env.OAUTH_KV.get(`client:${grantData.clientId}`, { type: "json" })) knownGoodClients.add(grantData.clientId);
 						else {
@@ -5360,12 +5570,15 @@ var OAuthHelpersImpl = class {
 				if (page.list_complete) grantsDone = true;
 				else grantCursor = page.cursor;
 			}
-			if (!grantsDone) return result;
+			if (!grantsDone) return {
+				...result,
+				cursor: `grants:${grantCursor ?? ""}`
+			};
 		}
 		if (purgeOrphanedTokens) {
 			const knownGoodGrants = /* @__PURE__ */ new Set();
 			const knownMissingGrants = /* @__PURE__ */ new Set();
-			let tokenCursor;
+			let tokenCursor = start.phase === "tokens" ? start.kvCursor : void 0;
 			let tokensDone = false;
 			while (!tokensDone && result.tokensChecked < batchSize) {
 				const listOptions = {
@@ -5393,7 +5606,10 @@ var OAuthHelpersImpl = class {
 				if (page.list_complete) tokensDone = true;
 				else tokenCursor = page.cursor;
 			}
-			if (!tokensDone) return result;
+			if (!tokensDone) return {
+				...result,
+				cursor: `tokens:${tokenCursor ?? ""}`
+			};
 		}
 		result.done = true;
 		return result;
@@ -5406,4 +5622,4 @@ var OAuthHelpersImpl = class {
 var oauth_provider_default = OAuthProvider;
 
 //#endregion
-export { AuthorizationError, CimdFetchError, ExternalTokenError, GrantType, OAuthAuthorizationServer, OAuthError, OAuthProvider, OAuthResourceServer, base64UrlToBytes, oauth_provider_default as default, getJwtCryptoAlgorithms, getOAuthApi, insufficientScope, isValidOAuthScopeToken, parseJwtJsonPart, resourceMatches, validateResourceUri };
+export { AuthorizationError, CimdFetchError, ExternalTokenError, GrantType, OAuthAuthorizationServer, OAuthError, OAuthProvider, OAuthResourceServer, authorizationErrorRedirect, oauth_provider_default as default, getOAuthApi, insufficientScope };